diff --git a/.codex/environments/environment.toml b/.codex/environments/environment.toml deleted file mode 100644 index 81c79e6..0000000 --- a/.codex/environments/environment.toml +++ /dev/null @@ -1,11 +0,0 @@ -# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY -version = 1 -name = "Codebase Combiner" - -[setup] -script = "" - -[[actions]] -name = "Run" -icon = "run" -command = "./script/build_and_run.sh --verify" diff --git a/.gitignore b/.gitignore index 17c3a6b..252e3d2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,8 @@ .DS_Store .vscode/ +.cursor/ +.codex/ +.agents/ node_modules/ SwiftExplorerApp/.build/ *.vsix @@ -12,6 +15,8 @@ AGENTS.md PLAN.md TODO.md MEMORY.md +SOUL.md +USER.md .worktrees/ .superpowers/ diff --git a/.mailmap b/.mailmap new file mode 100644 index 0000000..7ef0af1 --- /dev/null +++ b/.mailmap @@ -0,0 +1,2 @@ +Rafal Sikora <24563931+s1korrrr@users.noreply.github.com> Rafał Sikora +Rafal Sikora <24563931+s1korrrr@users.noreply.github.com> Rafal Sikora diff --git a/.vscodeignore b/.vscodeignore index 4d9d588..8acc5a8 100644 --- a/.vscodeignore +++ b/.vscodeignore @@ -1,6 +1,8 @@ .github/** .vscode/** +.cursor/** .codex/** +.agents/** .superpowers/** .worktrees/** Packaging/** diff --git a/CHANGELOG.md b/CHANGELOG.md index bcd1bd8..24f5684 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,6 @@ All notable changes to this project will be documented in this file. - Structured scan outcomes and skipped-file summaries. - Typed scan and persistence retry state with visible recovery controls. - An isolated sandboxed E2E host with synthetic fixtures, exact-PID ownership, deterministic window sizing, and scoped cleanup. -- A single current interaction, performance, security, packaging, and release audit under `docs/audit/`. ### Changed diff --git a/docs/audit/codebase-combiner-full-audit-2026-07-17.md b/docs/audit/codebase-combiner-full-audit-2026-07-17.md deleted file mode 100644 index 6a018fa..0000000 --- a/docs/audit/codebase-combiner-full-audit-2026-07-17.md +++ /dev/null @@ -1,91 +0,0 @@ -# Codebase Combiner Full Audit — 2026-07-17 - -## Decision - -- Repository implementation: **PASS**, subject to the PR review and hosted CI gates recorded on the resulting commit. -- Local native package: **package-ready for ad-hoc validation**. -- Developer ID distribution: **blocked:external** on a production signing identity, Apple notarization, and publication approval. -- App Store Connect upload: **blocked:external** on the matching provisioning profile, signed installer, app record, metadata, screenshots, upload, and Apple review. - -## Scope And Standards - -The review covered the VS Code extension, native SwiftUI app, filesystem boundaries, output generation, persistence, telemetry, sandbox packaging, Developer ID scripts, App Store scripts, CI workflows, documentation, and the sandboxed E2E harness. - -Primary references used during the audit: - -- [VS Code Workspace Trust extension guide](https://code.visualstudio.com/api/extension-guides/workspace-trust) -- [VS Code virtual workspaces extension guide](https://code.visualstudio.com/api/extension-guides/virtual-workspaces) -- [Node.js file system API](https://nodejs.org/api/fs.html) -- [Apple privacy manifest files](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files) -- [Apple describing required-reason API use](https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api) -- [Apple App Sandbox](https://developer.apple.com/documentation/security/app-sandbox) -- [GitHub Actions secure use reference](https://docs.github.com/en/actions/reference/security/secure-use) - -Repository standards came from `AGENTS.md`, CI, release contracts, and the existing architecture documents. - -## Findings Resolved - -| Area | Defect | Resolution | -| -------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| VSIX traversal | A context-selected symbolic-link directory could become the traversal root. | Root selection and collection now use `lstat` and fail closed on symbolic-link roots. | -| VSIX reporting | Binary, oversized, unreadable, symbolic-link, and workspace-limit skips were partially silent. | Collection publishes a path-free structured skip summary and the completion notice reports nonzero reasons. | -| VSIX filters | Submitting an empty one-run filter restored configured restrictions instead of preserving the explicit empty input. | Run filter parsing now preserves submitted empties and validates the input kind. | -| VSIX trust | The manifest claimed full untrusted-workspace support while workspace-scoped configuration affected collection. | Support is now `limited` with all relevant settings declared as restricted configurations. | -| Output integrity | Plain-text path headers accepted line separators that could forge additional headers. | Display paths strip CR, LF, U+2028, and U+2029 before rendering. | -| Native filesystem | Opening a file replaced by a FIFO could block indefinitely before `fstat`. | Secure opens include `O_NONBLOCK` and reject every non-regular descriptor. | -| Native traversal | Directory enumeration errors could silently return partial success. | Immediate-child enumeration now throws; unreadable subdirectories are reported explicitly. | -| Native preferences | Malformed persisted `NaN`, infinity, or extreme size values could reach integer conversion. | Persisted values are normalized before publication and validation requires a finite value in range. | -| Native root semantics | “Skip hidden” rejected an explicitly selected dot-prefixed workspace root. | Hidden filtering applies only below the selected root. | -| Determinism | Localized sorting could change the bounded accepted subset by locale or OS. | Traversal and flattened output use locale-independent UTF-8 lexical ordering. | -| E2E lifecycle | A stale host or concurrent reset/build could share the bundle ID and race app-owned cleanup. | Exact executable discovery plus an atomic session lock serialize reset, build, runtime, and cleanup across worktrees. | -| Release evidence isolation | E2E packaging shared the production App Store output directory and could overwrite its manifest and checksums. | E2E now owns `dist/app-store-e2e`; cleanup removes that output and legacy E2E residue while production evidence remains unchanged. | -| Apple privacy | Distribution manifests omitted the File Timestamp required-reason API category used by `fstat` and file metadata access. | Both manifests declare `3B52.1` for user-granted files and `C617.1` for app-container metadata. | -| App Store evidence | The package lacked a bundled license, operation lock, and source-bound checksums. | At the time of this audit the bundle included the then-current MIT `LICENSE`; the project switched to Apache-2.0 with `NOTICE` on 2026-07-20. Packaging emits `release-manifest.json` and verified `SHA256SUMS` under a fail-closed lock. | -| Notarization | Final checksums selected lexicographic artifacts, and generated resume commands lost a custom app name. | The script binds exact manifest assets and preserves the effective `--app-name` in resumable commands. | -| CI signing | The decoded Developer ID PKCS#12 file did not explicitly establish owner-only permissions. | The import step uses `umask 077` and `chmod 600`. | -| Documentation | Test-runner, privacy, TestFlight, and license statements had drifted. | Current docs now match the implementation and distinguish repo proof from external release gates. | - -No unresolved Critical or Important code finding remained before the final review gate. - -## Verification Evidence - -| Gate | Result | -| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | -| Node tests | **29/29 passed** with `node --test`. | -| Swift tests | **125/125 passed** with XCTest. | -| JavaScript lint/format | ESLint and Prettier passed. | -| Swift format | Exact CI SwiftFormat `0.61.1` reported `0/47` files requiring formatting. | -| Release compile | `swift build -c release -Xswiftc -warnings-as-errors` passed. | -| Dependency audit | Runtime and full `npm audit` reported zero vulnerabilities; 379 registry signatures and 25 attestations verified. | -| VSIX | Version `0.0.2`; `vsce package` produced 41 files, 92.33 KB, and the inventory contract passed. | -| Shell/release contracts | Shell syntax, provisioning profile, Developer ID build/notarization, open-source, process lifecycle, and VSIX inventory contracts passed. | -| App Store package | Ad-hoc sandboxed bundle passed plist, strict codesign, entitlement, architecture, dSYM UUID, privacy, license, manifest, and checksum checks. | -| Production launch | Exact packaged PID launched, remained alive for verification, terminated, and reaped; stdout and stderr were empty. | -| App-owned errors | Unified logging returned no error or fault entry for subsystem `com.s1korrrr.codebasecombiner` during the final runtime window. | - -The final local environment was macOS 27.0, Xcode 26.6, macOS SDK 26.5, Apple Swift 6.3.3, with a packaged deployment target of macOS 13.0. - -## Native E2E Matrix - -The rebuilt sandboxed host ran at 960×640 against `/private/tmp/CodebaseCombinerE2EFixture`: - -- selected folder access succeeded under App Sandbox with user-selected read/write entitlement; -- scan accepted 2 UTF-8 files, 571 bytes, and 142 file tokens; -- hidden, excluded, not-included, and binary skip presentations were exercised without revealing skipped paths; -- tree expansion, one-file deselection, Select All, prompt-token updates, Markdown/plain-text switching, and preview rebuilding passed; -- current-output copy passed; -- native save produced a 633-byte exact fixture export with both expected file headers; -- a no-reset relaunch recovered 2-file metadata while keeping content concealed; -- Copy Last succeeded without revealing the recovered content; -- both E2E and production stdout/stderr logs were empty; -- the exact host was reaped and all E2E runtime, fixture, export, and app-owned container data were removed. - -## Remaining External Gates - -- No production Developer ID identity was used, no request was sent to Apple notarization, and no GitHub release was published. -- No matching Mac App Store provisioning profile or distribution-signed installer was available for this audit. -- No App Store Connect record, privacy answers, metadata, screenshots, TestFlight build, upload, or review state was changed. -- A macOS 13 machine or VM was not available; the binary and plist declare 13.0, but runtime compatibility at the floor remains an external test-lab gate. -- Destructive recovered-output clearing is covered by focused store/UI-policy tests; the final native sweep did not permanently delete it through the UI. - -These limitations do not block the repository PR, but they prevent any claim of notarized-distributable or App Store-upload readiness. diff --git a/docs/audit/codebase-combiner-oss-release-readiness-2026-07-20.md b/docs/audit/codebase-combiner-oss-release-readiness-2026-07-20.md deleted file mode 100644 index ed57a19..0000000 --- a/docs/audit/codebase-combiner-oss-release-readiness-2026-07-20.md +++ /dev/null @@ -1,122 +0,0 @@ -# Codebase Combiner open-source release-readiness audit — 2026-07-20 - -## Executive outcome - -**NOT READY FOR PUBLICATION** - -The repository-side remediation in the original audit is complete and its full local quality, packaging, and release-contract matrix was green. Publication remains a no-go until the expanded identity/license/history work is reviewed, the installed Developer ID identity produces a signed and notarized artifact, and the declared macOS 13 runtime floor is exercised or explicitly retained as an unverified compatibility claim. The dedicated security scan remains intentionally omitted by owner instruction and must not be represented as completed. - -This verdict does not block merging the repository hardening. It blocks representing the project as fully publication-ready or issuing an official release. - -## Scope and authority - -- Audited baseline: `main` at `7f278ffc20bb21d40a5d3f0fae262ad8863d39da`. -- Surfaces: VS Code extension, macOS SwiftUI app, release scripts/workflows, public documentation, licensing notices, and live GitHub repository settings. -- Authorized external write: push the completed hardening to `main`. -- Explicit exclusion: no dedicated security scan was run. -- Not authorized or not possible in the original audit pass: GitHub settings changes, Apple signing/notarization, release/tag publication, App Store submission, or transfer to another owner/publisher. A later owner-authorized follow-up transferred the repository to `rsitech-ai`; that result is recorded in the post-audit addendum below. - -## Repository assessment - -| Area | Result | Evidence | -| ------------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Node extension behavior | PASS | 30 tests passed; lint and formatting passed. | -| Swift app behavior | PASS | 126 tests passed; production build passed with warnings treated as errors. | -| Dependency integrity | PASS | 379 registry signatures and 25 attestations verified; npm reported 0 vulnerabilities. This is dependency-audit evidence, not a substitute for the omitted security scan. | -| VSIX packaging | PASS | Exact expected artifact and embedded name/version/publisher verified; stale root artifacts are rejected. | -| Developer ID contracts | PASS | Build, verification, resume, and mocked notarization contracts passed. No production Apple credentials or notarization were used. | -| App Store packaging contracts | PASS | Provisioning-profile and signed-package contract harnesses passed. No App Store upload was performed. | -| Public docs and privacy claims | PASS | Unsupported release, runtime, deletion, layout, and control-label claims were corrected. | -| Dedicated security scan | NOT PERFORMED | Explicitly excluded by request. | -| Official release evidence | BLOCKED | A local Developer ID identity is available, but there is no tag/release, notarized artifact, hosted release environment, or macOS 13 runtime proof. | - -## Changes made - -- The VS Code extension now suggests `combined_code.md` when Markdown is selected and the untouched default filename is still configured, while preserving custom filenames. -- Swift directory traversal now enumerates immediate children incrementally and stops at the traversal boundary instead of materializing an unbounded directory listing first. -- Developer ID source tags are bound to the manifest marketing version in both build and verification paths, with a behavioral contract for mismatched tags. -- The macOS release workflow no longer relies on Bash 4 uppercase expansion on the macOS runner. -- The VSIX inventory contract selects one exact package identity, inspects embedded manifest identity, and rejects stale/ambiguous root artifacts. -- SwiftFormat is pinned consistently to CI version 0.61.1, including the repository's intentional `redundantSendable` rule exception. -- README, installation, release, privacy, review, issue-template, changelog, and layout documentation now match verified behavior and current release state. -- `assets/icon.png` now contains PNG data instead of JPEG data with a `.png` extension; the visual design was preserved. -- Security guidance no longer points contributors to a disabled private advisory endpoint and instead provides the confidential project contact `info@rsitech.ai`. - -## Validation evidence - -The following gates passed in the release-readiness worktree: - -```text -npm run format:check -npm run lint -npm test # 30/30 passed -npm audit signatures # 379 signatures, 25 attestations -npm audit --omit=dev # 0 vulnerabilities -npm audit # 0 vulnerabilities -npm run package -/bin/bash script/tests/vsix_inventory_test.sh - -SwiftFormat 0.61.1 --lint . # 0/46 require formatting -cd SwiftExplorerApp && swift test # 126/126 passed -cd SwiftExplorerApp && swift build -c release -Xswiftc -warnings-as-errors -./script/build_and_run.sh --verify # exact production PID launched, verified, terminated, and reaped - -/bin/bash script/tests/build_and_run_contract_test.sh -/bin/bash script/tests/open_source_release_contract_test.sh -/bin/bash Packaging/DeveloperID/tests/run_tests.sh -/bin/bash Packaging/AppStore/tests/validate_provisioning_profile_test.sh -find . -type f -name '*.sh' ... | xargs -0 -n1 /bin/bash -n -``` - -YAML parsing, plist/privacy-manifest linting performed by the contracts, `git diff --check`, DMG mounting, code-signature structure, checksums, SBOM/symbol inventory, and mocked notarization evidence also passed. - -## Security and privacy findings - -- **BLOCKER — security assurance:** the dedicated security scan requested by the original release brief was not run, by explicit instruction. No statement in this audit should be interpreted as a completed source-security assessment. -- **PASS — confidential intake:** GitHub private vulnerability reporting remains disabled, but RSI Tech now provides the functioning confidential contact `info@rsitech.ai`; public issue disclosure remains forbidden. -- **HIGH — branch integrity:** the live repository has neither `main` branch protection nor a ruleset. Required checks and review protections are therefore not enforced by GitHub. -- **PARTIAL — release credentials:** the live repository has zero release environments. Locally, a direct Hardened Runtime signing probe succeeded with the private-key-backed `Developer ID Application: Rafal Sikora (2NY8A789TN)` identity and Apple timestamp, and the notarization profile authenticates. Final tagged-artifact signing/notarization remains pending; hosted signing remains unprovisioned. -- **PASS — privacy claims:** documentation now covers both the sandboxed macOS app and the local VS Code extension, and no longer promises that uninstalling the app deletes saved output or application data. -- **PASS — dependency audit:** npm vulnerability and signature checks are green. They cover known dependency advisories and registry provenance only. - -## Licensing and provenance - -- Repository license: Apache-2.0; copyright owner: Rafal Sikora; public maintainer: RSI Tech. -- The packaged VSIX and macOS release contracts include the license and third-party notices. -- Shipped Node runtime dependencies are represented in `THIRD_PARTY_NOTICES.md` and the package lock. -- **Owner confirmation required:** retain evidence that the icon and all public artwork are original or licensed for redistribution. -- **Owner/legal setup supplied:** the copyright owner is Rafal Sikora; the public brand/maintainer is RSI Tech; public and confidential project contact is `info@rsitech.ai`. -- **Repository transfer complete:** the GitHub repository is owned by `rsitech-ai`. The VS Code Marketplace publisher remains `s1korrrr` because Marketplace publisher identity is a separate release/account boundary. - -## Live GitHub state (post-audit transfer addendum) - -Verified on 2026-07-20 for `rsitech-ai/codebase-combiner` after preserving `main` at `c999df9e39633c8f18e7ec328e0412b6842a82aa` through the transfer: - -- Public repository; default branch `main`; Issues enabled. -- No branch protection and no repository rulesets. -- Private vulnerability reporting disabled. -- No release environments. -- No tags and no GitHub Releases. -- Existing repository description and topics are present and aligned with the product. - -In the later owner-authorized follow-up, repository ownership moved from `s1korrrr` to `rsitech-ai` and the public website was set to `https://rsitech.ai`; other listed GitHub settings were not changed. - -## GO / NO-GO matrix - -| Gate | Decision | Required next action | -| ------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Merge repository hardening to `main` | GO | Push the verified commit and require hosted CI/CodeQL to pass. | -| Publish source as an official release | NO-GO | Complete identity/license/history review and publish only with the exact signed, notarized, stapled, Gatekeeper-verified artifact and applicable runtime evidence. | -| Publish a VSIX | NO-GO | Confirm publisher ownership, provenance, version/tag plan, and hosted checks for the exact commit. | -| Publish a Developer ID DMG | NO-GO | Build locally with the installed Developer ID identity from a signed `macos-v0.1.0` tag, notarize, staple, and verify the exact artifact. | -| Submit to App Store Connect | NO-GO | Provide signing/provisioning/App Store Connect evidence and complete runtime/review validation. | - -## Exact next actions - -1. Keep `info@rsitech.ai` functioning as the public/confidential project contact; GitHub private vulnerability reporting is optional while that channel remains monitored. -2. Add a `main` ruleset requiring pull requests and the repository's CI/CodeQL checks; retain an owner recovery path. -3. Do not claim a dedicated security scan was performed; it remains intentionally omitted by owner instruction. -4. Confirm icon/artwork provenance, license attribution identity, and the separate VS Code Marketplace publisher strategy. GitHub repository ownership is resolved as `rsitech-ai`. -5. Validate the macOS app on macOS 13 and record launch, scan, save, recovery, sandbox, and accessibility evidence. -6. Verify the local notarization profile and installed Developer ID identity; provision a protected hosted `release` environment only if hosted release automation will be used. Keep certificate material out of repository logs and artifacts. -7. Create and sign the release tag only after all blockers close, then verify the produced checksums, SBOM, symbols, signatures, notarization ticket, and hosted workflow provenance before publication. diff --git a/docs/production-plan.md b/docs/production-plan.md deleted file mode 100644 index bdbf168..0000000 --- a/docs/production-plan.md +++ /dev/null @@ -1,80 +0,0 @@ -# Production Plan: Codebase Combiner - -## Product Brief - -- Target user: developers who need to package selected code files into one prompt-ready payload. -- Primary job: choose a workspace, filter/select files, add optional instructions, copy or save the combined output. -- Core workflow: pick folder -> scan -> refine selection/filters -> copy or save combined payload -> recover last ready payload later if needed. -- Business model: free developer tool with optional support link. -- Deployment target: macOS 13; runtime verification at that floor remains pending. -- Offline behavior: fully local; no network is required for scanning, combining, copying, saving, or restoring the last payload. -- Data handled: user-selected local source files, prompt prefix text, preferences, and the last generated combined payload. -- Privacy posture: local-first, no tracking, no analytics, no collected data; saved payload is user content stored locally in Application Support. -- V1 scope: SwiftPM macOS app, adaptive native workspace, canonical Settings, local recovery, tests, isolated E2E, and ad-hoc App Store-style bundle validation. -- Explicitly out of scope: cloud sync, account system, AI model calls, paid unlocks, automatic upload to App Store Connect. - -## Architecture - -- Scene model: one `WindowGroup` for the workspace plus one canonical `Settings` scene. -- Window roles: primary workspace window and standard Settings window. -- Layout model: adaptive workspace sidebar, preparation surface, and output inspector. The two outer pane hosts stay structurally mounted and use transform/opacity for visibility because changing AppKit-backed split/toolbar structure crashed the audited macOS 27 beta host. Pure pane geometry reserves a non-overlapping preparation region for every visible combination. -- State ownership: `AppController` coordinates `AppPreferences`, `WorkspaceStore`, `OutputStore`, and shared sidebar/inspector visibility; views retain only local presentation details. -- Persistence: preferences in UserDefaults; the last ready combined payload is an atomic binary property-list draft under Application Support, with bounded legacy JSON read compatibility. -- Services: `TreeLoader`, `TokenEstimator`, shared prompt/preview policies, `CombinedOutputBuilder`, `ClipboardDraftStore`, injected clipboard/save boundaries, and typed metadata-only telemetry. `TreeLoader` rejects symbolic links and verifies the opened file descriptor's resolved path before reading content. -- App Intents / Foundation Models / advanced capabilities: not used in v1. -- Folder/module structure: `App/`, `Models/`, `Stores/`, `Services/`, `Support/`, `Views/`, and focused XCTest targets. - -## Build And Run - -- Project type: SwiftPM executable plus VS Code extension package. -- Build command: `cd SwiftExplorerApp && swift build`. -- Run command: `cd SwiftExplorerApp && swift run`. -- `script/build_and_run.sh` status: available; `--verify` owns and reaps one exact production PID, `--e2e` runs a separate sandboxed fixture host, and `--clean-e2e-state` removes app-owned E2E state and temporary artifacts. -- Codex Run action status: `.codex/environments/environment.toml` points Run to `./script/build_and_run.sh --verify`. - -## Design System - -- Native structures: workspace hierarchy, forms, segmented output picker, standard menus/toolbars/buttons, standard Settings, and semantic macOS materials. -- Adaptive states: 864×520 compact minimum, 960×640 and 1180×760 regular, 1440×900 wide, independent sidebar/inspector visibility, empty, scanning, partial scan, no selection, current output, concealed recovery, and settings. -- Visual style: semantic macOS 13 baseline; one bounded `FunctionalChrome` modifier uses macOS 26 glass only when available and falls back to opaque/regular materials for reduced transparency or increased contrast. -- Motion rules: repeated workflow actions remain immediate; pane transitions are non-structural and Reduce Motion-safe. -- Accessibility requirements: named controls, prerequisite help for disabled actions, keyboard/menu parity, safe Cancel focus for destructive recovery clear, and accessibility-hidden collapsed panes. -- Empty/loading/error/offline/permission states: empty, loading, invalid settings, partial scan, typed scan failure with Retry/Choose Another Folder, persistence failure with same-draft retry, copy/save failure, and recovery failure are explicit; offline is normal operation. - -## Test Strategy - -- Unit tests: preference validation, adaptive/pane policies, token estimation, command state, async workspace/output ordering, recovery privacy, telemetry shape, tree loading, output formatting, and dependency selection. -- Integration tests or mocks: temporary-directory loader/draft tests plus injected filesystem, clipboard, save, output-build, and telemetry boundaries. -- UI/manual smoke: exact-PID `./script/build_and_run.sh --verify` plus the real sandboxed interaction matrix documented in `docs/audit/codebase-combiner-full-audit-2026-07-17.md`. -- Release smoke: `Packaging/AppStore/build_app_store_package.sh --skip-signing`, strict signature/plist/privacy/entitlement/minimum-OS inspection, and bounded 1,500-file Release performance. -- Commands: `swiftformat --lint .`, `swift test`, `swift build -c release -Xswiftc -warnings-as-errors`, `npm test`, `npm run lint`, `npm run format:check`, `npm run package`, shell contract/syntax checks, package assembly, and exact-PID launch verification. - -## Observability - -- Logger subsystem: `com.s1korrrr.codebasecombiner`. -- Categories: lifecycle, scan, export, persistence. -- Key lifecycle/action events: app launch/window setup, typed scan outcome, recovery load/save/clear outcome, and copy/save outcome with counts only. -- Sensitive logging exclusions: no raw file content, prompt text, combined/recovered payload, clipboard content, root/destination path, secret, or credential. - -## App Store Readiness - -- Bundle ID: `com.s1korrrr.codebasecombiner`. -- Signing team: valid distribution and installer identities were detected locally on 2026-07-14, but the owner team/account path and matching Mac App Store provisioning profile were not verified together. -- Sandbox/entitlements: strict ad-hoc signature verifies with App Sandbox and user-selected read/write only; no profile is embedded. -- Privacy manifest: parses; declares UserDefaults reason `CA92.1` and file-timestamp reasons `3B52.1`/`C617.1`, with no tracking or collected data. -- Privacy labels: must be entered and owner-confirmed in App Store Connect; they should remain no tracking/no collected data unless the product changes. -- Assets: the bundle contains a generated `.icns`; current interaction evidence is consolidated in `docs/audit/codebase-combiner-full-audit-2026-07-17.md`, but final App Store screenshots at accepted sizes/localizations are not prepared. -- Metadata: README/INSTALL are current; App Store Connect name/subtitle/description/keywords, support/privacy URLs, age rating, screenshots, and legal declarations remain owner work. -- Review notes: app is local-first and needs no demo account. -- Known blockers: matching provisioning profile, signed installer package, App Store Connect app record, final metadata/screenshots/privacy/legal declarations, upload, and Apple review. Xcode 27 is separately required before adding or proving macOS 27 SDK-only features. - -## Iteration Log - -| Date | Gate | Change | Verification | Next blocker | -| ---------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------ | -| 2026-06-29 | Production quality | Added file-backed last-ready-payload persistence and restore/copy UI. | `swift test` passed 8 tests; `npm test`; `npm run lint`; `npm run format:check`. | App Store signing assets. | -| 2026-06-29 | Build/run | Added `script/build_and_run.sh --verify` and Codex Run action. | `./script/build_and_run.sh --verify` launched packaged app. | None for local smoke. | -| 2026-07-14 | Native architecture | Extracted focused stores/controller and rebuilt the adaptive workspace with concealed recovery. | Historical sandbox matrix plus 100 current XCTest cases; changed pane runtime proof remains pending. | Holistic re-review and signed pane stress. | -| 2026-07-14 | Package evidence | Validated macOS 13.0 minimum, SDK 26.5, privacy manifest, strict ad-hoc signature, and minimal entitlements. | `build_app_store_package.sh --skip-signing`, `plutil`, `codesign`, and `vtool`. | Matching profile and signed installer package. | -| 2026-07-14 | Extension package | Corrected the VS Code publisher identifier and excluded non-extension artifacts. | `npm run package`: 72 files, 153.15 KB. | Marketplace ownership/publish remains external. | -| 2026-07-16 | Repository cleanup | Consolidated current audit/release evidence, rejected pathological nested globstars, and excluded local worktrees from VSIX packaging. | 24 Node tests, 119 Swift tests, release contracts, and a 41-file 91.62 KB VSIX passed. | Apple notarization/publication remains external. | diff --git a/script/tests/open_source_release_contract_test.sh b/script/tests/open_source_release_contract_test.sh index d8c4803..c8372e0 100755 --- a/script/tests/open_source_release_contract_test.sh +++ b/script/tests/open_source_release_contract_test.sh @@ -159,6 +159,9 @@ grep -F 'node_modules/**/.github/**' .vscodeignore >/dev/null grep -F 'node_modules/**/*.map' .vscodeignore >/dev/null grep -F 'node_modules/**/*.d.ts' .vscodeignore >/dev/null grep -F '.worktrees/**' .vscodeignore >/dev/null +grep -F '.cursor/**' .vscodeignore >/dev/null +grep -F '.codex/**' .vscodeignore >/dev/null +grep -F '.agents/**' .vscodeignore >/dev/null expected_vsix="$ROOT_DIR/codebase-combiner-$(node -p 'require("./package.json").version').vsix" test -f "$expected_vsix" diff --git a/script/tests/vsix_inventory_test.sh b/script/tests/vsix_inventory_test.sh index 26c43ce..ae15001 100755 --- a/script/tests/vsix_inventory_test.sh +++ b/script/tests/vsix_inventory_test.sh @@ -35,7 +35,7 @@ for required in \ grep -Fx "$required" <<< "$listing" >/dev/null || { echo "VSIX is missing required file: $required" >&2; exit 1; } done -if grep -E '(^|/)(\.git|\.github|\.worktrees|\.tap|test|tests|coverage)(/|$)|(^|/)eslint[.]config[.]cjs$|\.(p12|p8|key|pem|dmg|pkg|map|d\.ts)$' <<< "$listing"; then +if grep -E '(^|/)(\.git|\.github|\.cursor|\.codex|\.agents|\.worktrees|\.tap|test|tests|coverage)(/|$)|(^|/)eslint[.]config[.]cjs$|\.(p12|p8|key|pem|dmg|pkg|map|d\.ts)$' <<< "$listing"; then echo "VSIX contains repository, test, secret, release, source-map, or declaration files." >&2 exit 1 fi