diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml index dedea74..791958c 100644 --- a/.github/workflows/publish-server-image.yml +++ b/.github/workflows/publish-server-image.yml @@ -256,9 +256,23 @@ jobs: grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; } done echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT" - # GitHub artifact attestations are unavailable for private repos on personal accounts. + # Owner type is not exposed on the github context; resolve it from the repository metadata API. + - name: Resolve registry attestation eligibility + id: attestation + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -euo pipefail + owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.owner.type')" + private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.private')" + if [[ "$owner_type" == "User" && "$private" == "true" ]]; then + echo "enabled=false" >> "$GITHUB_OUTPUT" + echo "Skipping registry attestation: unavailable for private repositories on personal accounts." + else + echo "enabled=true" >> "$GITHUB_OUTPUT" + fi - name: Attest the published image - if: github.event.repository.private != true || github.repository_owner_type != 'User' + if: steps.attestation.outputs.enabled == 'true' uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }} diff --git a/AGENTS.md b/AGENTS.md index 86604d5..58df55b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -10,6 +10,7 @@ - Keep code simple: reuse existing primitives and one source of truth, remove duplication and unused flexibility, and avoid speculative abstractions. Add an interface when it protects a real external or platform boundary, not for its own sake. - Treat auth, secret handling, sandbox boundaries, host commands, and integrations as security-sensitive. Keep tests deterministic and offline by default. - The desktop Playwright suite (`pnpm --filter @rakazo/desktop test:e2e`) opens real Electron windows and steals focus on macOS. Do not run it on a maintainer's machine as routine verification; run the unit tests locally and let CI's virtual-display job run the e2e on push. +- Work autonomously. Make routine calls yourself, such as opening or reopening a pull request, linking CI screenshots, or fixing gaps you found that belong to the task, then verify and report the outcome. Ask the maintainer only before irreversible actions or for product decisions without a sensible default. - After creating a pull request, stay with it until CI and automated review bots have finished; passing checks alone do not mean the review is complete. Follow `.agents/skills/pr-watch/SKILL.md`: run its `pr-digest --watch` helper as a single backgrounded call that blocks until the checks on the current head commit are terminal, then act on the verdict it prints. Do not poll in the foreground on a timer, which mostly buys repeated snapshots of an unchanged PR and dies at the tool timeout. Address every actionable issue, push the fixes, and repeat until no actionable feedback remains. Do not merge while review bots are still pending or review issues remain unresolved. - PR descriptions say why the change exists, what changed, and how it was tested. Write Why as the product reason (what was wrong and what this changes); never "Elie wants" or a third-person briefing of a named person; the maintainer is the author. - Commit messages, PR descriptions, issues, and review replies are public too. Describe test results in words instead of pasting tool output, and never include anything that identifies a person, machine, or account: local paths, usernames, hostnames, signing identities, legal entity names, Apple Team IDs, API key IDs, issuer or tenant IDs, account emails, or the accounts, machines, and files that secret values came from. Naming the secrets a workflow reads is fine; use placeholders when a value must be shown. diff --git a/apps/api/src/router.ts b/apps/api/src/router.ts index 2fa49c5..859725b 100644 --- a/apps/api/src/router.ts +++ b/apps/api/src/router.ts @@ -645,6 +645,10 @@ export function createRouter(deps: RouterDeps) { spaceNavigationDto(deps, context.actor, repos, groupRepos), ), create: authed.spaces.create.handler(async ({ context, input }) => { + // A linked folder lives on the host, and the host is the deployment owner's machine. + if (input.workspacePath && !context.actor.isDeploymentOwner) { + throw new ORPCError("FORBIDDEN"); + } let space: { id: string; name: string }; try { space = await createSpaceForMember(deps.prisma, { @@ -2306,10 +2310,7 @@ export function createRouter(deps: RouterDeps) { } } if (isProjectWorkspacePath(storedPath)) { - const workspaceRoot = await requireProjectWorkspaceRoot( - deps.prisma, - context.actor.spaceId, - ); + const workspaceRoot = await requireProjectWorkspaceRoot(deps.prisma, context.actor); const entries = await listProjectWorkspaceFiles(workspaceRoot, storedPath); return entries.map((entry) => ({ ...entry, @@ -2357,10 +2358,7 @@ export function createRouter(deps: RouterDeps) { } } if (isProjectWorkspacePath(storedPath)) { - const workspaceRoot = await requireProjectWorkspaceRoot( - deps.prisma, - context.actor.spaceId, - ); + const workspaceRoot = await requireProjectWorkspaceRoot(deps.prisma, context.actor); const bytes = await readProjectWorkspaceFile(workspaceRoot, storedPath, { maxBytes: MAX_COMPUTER_TEXT_FILE_BYTES, }); @@ -5033,10 +5031,13 @@ function mapUpdaterError(error: unknown): never { async function requireProjectWorkspaceRoot( prisma: Pick, - spaceId: string, + actor: Actor, ): Promise { + // Only the deployment owner may link a host folder, so only they may browse one. This also + // closes folders that other members linked before linking was limited to the owner. + if (!actor.isDeploymentOwner) throw new ORPCError("FORBIDDEN"); const space = await prisma.space.findUnique({ - where: { id: spaceId }, + where: { id: actor.spaceId }, select: { workspacePath: true }, }); if (!space?.workspacePath) { @@ -5148,7 +5149,8 @@ async function spaceNavigationDto( memberships.length > 1 && !spacesWithContent.has(membership.spaceId) && (membership.space.deletingAt === null || membership.space.deletingAt < staleClaimBefore), - workspace: projectWorkspaceDto(membership.space), + // A linked folder is on the owner's host; other members see neither its path nor remote. + workspace: actor.isDeploymentOwner ? projectWorkspaceDto(membership.space) : null, bots: spaceBots.map((bot) => ({ id: bot.id, spaceId: bot.spaceId, diff --git a/apps/web/e2e/chat-contrast.spec.ts b/apps/web/e2e/chat-contrast.spec.ts index cd5553d..acadca2 100644 --- a/apps/web/e2e/chat-contrast.spec.ts +++ b/apps/web/e2e/chat-contrast.spec.ts @@ -16,11 +16,12 @@ test.use({ viewport: { width: 1280, height: 1000 } }); /** * Texts in `locator` below WCAG AA against the surface they are painted on. With `inside`, every - * visible text and typed value within it counts, except in disabled controls, which WCAG exempts. + * visible text and typed value within it counts, except in disabled controls, which WCAG exempts, + * and in elements matching `skip`. */ -function unreadableTexts(locator: Locator, inside: boolean) { +function unreadableTexts(locator: Locator, inside: boolean, skip: string | null) { return locator.evaluate( - (root, { inside, min }) => { + (root, { inside, skip, min }) => { const context = document .createElement("canvas") .getContext("2d", { willReadFrequently: true }); @@ -81,7 +82,11 @@ function unreadableTexts(locator: Locator, inside: boolean) { }; const elements = inside ? [root, ...root.querySelectorAll("*")].filter( - (element) => ownText(element) && shown(element) && !element.closest(":disabled"), + (element) => + ownText(element) && + shown(element) && + !element.closest(":disabled") && + !(skip && element.closest(skip)), ) : [root]; return elements.flatMap((element) => { @@ -90,14 +95,18 @@ function unreadableTexts(locator: Locator, inside: boolean) { return ratio < min ? [`${ratio.toFixed(2)}:1 ${text.slice(0, 48)}`] : []; }); }, - { inside, min: MIN_CONTRAST }, + { inside, skip, min: MIN_CONTRAST }, ); } -async function expectReadable(locator: Locator, what: string, { inside = false } = {}) { +async function expectReadable( + locator: Locator, + what: string, + { inside = false, skip = null }: { inside?: boolean; skip?: string | null } = {}, +) { await expect(locator).toBeVisible(); await expect - .poll(() => unreadableTexts(locator, inside), { message: `${what} is readable` }) + .poll(() => unreadableTexts(locator, inside, skip), { message: `${what} is readable` }) .toEqual([]); } @@ -213,6 +222,8 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t await composer.fill("Draft a note about owls"); const sidebar = page.getByTestId("bots-sidebar"); const sidePanel = page.getByTestId("side-panel"); + await expect(sidebar.locator("[data-main-conversation]")).toBeVisible(); + await expect(sidebar.getByRole("button", { name: "Researcher, 1:1 conversation" })).toBeVisible(); await inEachTheme(page, async (theme) => { await captureScreenshot(page, testInfo, `shell-contrast-${theme}`); @@ -220,24 +231,9 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t await expectReadable(page.getByTestId("composer-bar"), `${theme}: the composer`, { inside: true, }); - await expectReadable( - sidebar.getByRole("button", { name: "Today", exact: true }), - `${theme}: Today`, - { inside: true }, - ); - await expectReadable( - sidebar.locator("[data-main-conversation]"), - `${theme}: the main conversation row`, - { inside: true }, - ); - await expectReadable( - sidebar.getByRole("button", { name: "Researcher, 1:1 conversation" }), - `${theme}: the selected bot row`, - { inside: true }, - ); - await expectReadable(page.getByTestId("user-menu-trigger"), `${theme}: the user menu`, { - inside: true, - }); + // The header carries the logo, which WCAG exempts; its create button is checked on its own. + await expectReadable(sidebar, `${theme}: the sidebar`, { inside: true, skip: ".app-drag" }); + await expectReadable(page.getByTestId("create-menu-trigger"), `${theme}: the create button`); }); await openNewBot(page); @@ -256,4 +252,12 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t await captureScreenshot(page, testInfo, `shell-contrast-${theme}-settings`); await expectReadable(sidePanel, `${theme}: the bot settings form`, { inside: true }); }); + + await sidebar.getByRole("button", { name: "Today", exact: true }).click(); + const heute = page.getByTestId("heute-brief"); + await expect(heute).toBeVisible(); + await inEachTheme(page, async (theme) => { + await captureScreenshot(page, testInfo, `shell-contrast-${theme}-heute`); + await expectReadable(heute, `${theme}: the Heute brief`, { inside: true }); + }); }); diff --git a/apps/web/e2e/spaces.spec.ts b/apps/web/e2e/spaces.spec.ts index 5b29d7f..176f48b 100644 --- a/apps/web/e2e/spaces.spec.ts +++ b/apps/web/e2e/spaces.spec.ts @@ -3,6 +3,7 @@ import { captureScreenshot, completeOnboarding, openNewSpace, + routePatchRpc, rpc, signup, unterhaltungenOnly, @@ -45,6 +46,30 @@ test("Projects + opens new project dialog instead of group form", async ({ page await expect(page.getByTestId("project-start-main")).toHaveText(/Start/); }); +for (const owner of [true, false]) { + const role = owner ? "owner" : "member"; + const title = owner + ? "new project dialog offers a host folder to the deployment owner" + : "new project dialog offers no host folder to a member"; + test(title, async ({ page }, testInfo) => { + await signup(page, `proj-folder-${role}-${Date.now()}@rakazo.test`, "password12", "Folder"); + await completeOnboarding(page); + // Whoever signs up first owns the deployment, which depends on spec order. + await routePatchRpc(page, "bootstrap", (json) => ({ + ...json, + me: { ...(json.me as Record), isDeploymentOwner: owner }, + })); + await page.goto("/app"); + await page.waitForURL(/\/app\/[^/]+$/); + + await page.locator(".sidebar-projekte").getByTestId("create-project-trigger").click(); + const dialog = page.getByRole("dialog", { name: "New project" }); + await expect(dialog.getByLabel("Name")).toBeVisible(); + await expect(dialog.getByLabel("Project folder")).toHaveCount(owner ? 1 : 0); + await captureScreenshot(page, testInfo, `new-project-${role}`); + }); +} + test("spaces stay invisible by default and chat creation requires approval", async ({ page, }, testInfo) => { diff --git a/apps/web/src/pages/HeuteBrief.tsx b/apps/web/src/pages/HeuteBrief.tsx index 1511736..c23ed72 100644 --- a/apps/web/src/pages/HeuteBrief.tsx +++ b/apps/web/src/pages/HeuteBrief.tsx @@ -285,7 +285,7 @@ function EmptyDay({ onStartChat, hasBots }: { onStartChat: () => void; hasBots: function ActionableChip({ label }: { label: string }) { return ( - + {label} ); diff --git a/apps/web/src/pages/Shell.tsx b/apps/web/src/pages/Shell.tsx index 7253e6e..b436e34 100644 --- a/apps/web/src/pages/Shell.tsx +++ b/apps/web/src/pages/Shell.tsx @@ -3454,7 +3454,7 @@ export function ShellPage() { className={`app-no-drag flex size-control-sm items-center justify-center rounded-full ${ activityMode ? "bg-primary text-primary-foreground" - : "text-muted-foreground/70 hover:text-foreground/75" + : "rk-sidebar-muted hover:text-foreground/75" }`} > @@ -3590,7 +3590,7 @@ export function ShellPage() { type="button" aria-label={t`New conversation`} data-testid="conversation-picker-trigger" - className="text-muted-foreground/60 hover:text-foreground/90 transition-colors" + className="rk-sidebar-muted hover:text-foreground/90 transition-colors" > @@ -3631,7 +3631,7 @@ export function ShellPage() { ) : null} {conversationSidebarGroups.length === 0 && !mainConversationEntry ? ( -
+

{t`No conversations yet.`}

{projectSidebarGroups.length === 0 ? ( -
+

{t`No projects yet.`}