Repository navigation
P1: add extension support profile, package revisions and resource-only preparation - #191
Merged
Merged
Conversation
This was referenced Oct 12, 2026
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
…on (#197) ## User scenario and compatibility On current main, the Host-owned **Settings → Providers → MCP → Test** probe is the only consumer of manually configured stdio MCP connections that this environment migration changes. Its process receives platform/toolchain variables plus explicitly encrypted connection bindings, rather than arbitrary Host environment credentials. A service relying on an ambient Host token may fail the probe while continuing to work through Codex/ACP's independently launched MCP service. Native Codex/ACP launch behavior and stored v1 records, commands, arguments and cwd are unchanged. Pi does not accept manual MCP connection bindings on main; its built-in web search uses HTTP and is unaffected. Later Host-owned stdio consumers, such as extension execution paths, can reuse this boundary; this PR does not introduce those consumers. Design #195. Standalone main-based review extracted from #188. Current head `06a4fc2` contains audit repair `38089f7` and current main `0dbf7ef` (including merged #189 and #198). Keep Draft pending review/CI; no merge is requested. ## Changes and audit repairs - Explicit environment allowlist at the Host stdio boundary. Required tokens/toolchain variables belong in **Encrypted environment values**, then save/restart/retest. There is no unrestricted inheritance fallback or OS-sandbox claim. - Probe errors unwrap nested exception groups and show bounded underlying reasons, instead of `unhandled errors in a TaskGroup`. Explicit credentials and resolved HTTP bearer tokens are redacted before truncation. - Stdio failures retain a clear conditional migration hint even for long errors; this does not assert that every failure is a missing credential. The UI translates the hint into Chinese and preserves its separate line. HTTP errors receive no stdio migration advice. - Windows explicit bindings override inherited names case-insensitively (Path/PATH, proxy variants); POSIX retains case-sensitive names. - Corrected this PR, Issue #195, migration documentation and UI wording: the current mainline impact is the connection test, not Pi tool execution or all existing native MCP calls. The real legacy fixture now binds Codex, and its direct Host helper call is explicitly described as a helper test. ## Validation Five new/strengthened regression cases failed before repair, reproducing the TaskGroup message, missing guidance and Windows duplicate-key behavior. On the synchronized head: - `python -m pytest -q tests/test_mcp_connections.py tests/test_subprocess_environment.py tests/test_mcp_provider_adapter.py tests/test_pi_web_tools.py`: **26 passed**, including **15** focused environment/probe cases. - Real local peer: ambient-only credential is absent and the failed probe returns `Connection closed` plus migration guidance; adding the explicit binding makes discovery and a direct helper tool call succeed, preserving cwd without an unrelated Host secret. - `cd electron; npm test`: **406 passed**; `npm run build`: passed. The first run caught unsorted new translation keys; the final catalog is sorted and the entire suite passes. - Ruff and diff checks passed. Clean source-release gate: **3,905 selected, 95 excluded, 0 errors/warnings**. - No native Codex/ACP launch semantics are changed or newly qualified by these tests. [Migration documentation](https://github.com/Code-Amadeus/Amadeus/blob/codex/mcp-environment-migration/docs/mcp_environment.md). ## Latest main synchronization validation At `06a4fc2`: - MCP/environment/provider/Pi-web/release-tooling regressions: **39 passed**. - Electron full suite: **416 passed**; production build passed. - Clean source-release gate: **3,908 selected, 95 excluded, 0 errors/warnings**. - GitHub reports `MERGEABLE`; new-head CI and review requirements still apply. Draft status is retained. ## Review and integration #189 and #198 have been merged by the maintainer. Main `0dbf7ef` is now integrated here. The only conflict was the adjacent documentation insertion in `release/source_release_policy.json`; both `docs/mcp_environment.md` and `docs/backend_shutdown.md` are retained. No MCP or shutdown implementation was changed while resolving it. After approval, freeze this prerequisite; rebuild/restack #188 from its own net diff rather than replaying its pre-split history. This update does not cascade changes through #188/#191/#192. The earlier experimental bare-parameter MCP constructor regression was not a main defect; main already used `Client(stdio_client(...))`. No extension capability grant, backend-stop policy, SDK licensing work, diagnostics feature or memory implementation is included here.
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
## Outcome Community TTS, MCP and Skill packages share an explicit install/configure/bind/update/remove lifecycle. Electron owns installation and durable settings; Python consumes startup snapshots; independent SDK Runners own external TTS. Packages install disabled, backend changes require restart, and Main Chat gains no tools, Skills or Host grants. Design: #194. This PR now targets **main**, with the maintainer's authorization to merge after the rebuilt head passes CI. ## Mainline integration and review - Current head `c9b5f93` is one contribution commit on main `52194c0`, which already contains #189, #198 and the corrected #197. - Only the reviewed `7ea55dc..43eda97` net diff was applied, not the old pre-split commit history. It applied without conflicts. Its stable patch-id before status-only documentation updates was identical (`592bba5c748e042587fda10ba4b18c2748d923d6`). Scope remains 132 files, +9,653/-136. - The only additional changes state that the pinned protocol source is now in protocol main history. No runtime or SDK behavior was added during reconstruction. Main's MCP migration messages, credential handling, translations and both source-release documentation entries remain present. - Protocol [#1](Code-Amadeus/Amadeus-Extensions#1) was merged with merge commit `c770dfe`. Its pinned `49449a0f3572e74ac7269129c02c5b9a9e685bef` remains an ancestor of main; no new wheel or pin is needed. - Public annotated tag [`extension-host-profile-v0.1-55e62ab`](https://github.com/Code-Amadeus/Amadeus/tree/extension-host-profile-v0.1-55e62ab) retains the Host commit referenced by the wheel's immutable README link. This is a documentation snapshot, not a release. - Maintainer-provided external re-review accepted the implementation, cancellation recovery, SDK artifact and main-based reconstruction. #191/#192 and protocol #2 are separate follow-ups and were not restacked in this merge preparation. ## SDK delivery and runtime boundaries - Protocol/SDK use Apache-2.0; authored examples use MIT-0; Host remains AGPL-3.0. External models/voices/assets retain their own rights. - The Host carries one canonical SDK wheel selected by `protocol-source.json`. Frontend builds verify it with Node and do not invoke Python to build or download the SDK. Source archives and packaged Electron contain the same artifact. - SDK SHA-256 remains `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084`. Independent Windows/Linux builds, a local rebuild and the vendored bytes match. Source hashes, PEP 639 metadata and embedded LICENSE are verified against the accepted source commit. - Static package inspection accepts compatible SDK ranges/exact versions, evaluates active markers, and rejects incompatible versions/direct SDK URLs before pip. Installation verifies its staged SDK bytes. Confirmation discloses the declared license, complete plugin wheel digest and local source filename. - Non-cooperative TTS cancellation has a 10-second cleanup grace, then bounded Runner recovery without replaying speech. Cooperative cleanup keeps the process/budget; old requests cannot cancel a replacement Runner. - MCP and Skill execution stays with the existing Provider paths. Installation is not a Host permission grant, and unsupported combinations fail closed. ## Validation on rebuilt head - `python -m pytest -q -rs tests/test_extensions.py tests/test_extension_sdk_build.py tests/test_extension_protocol_provenance.py tests/test_extension_mcp.py tests/test_extension_skills.py tests/test_extension_examples.py tests/test_extension_fish_audio.py tests/test_mcp_connections.py tests/test_mcp_provider_adapter.py tests/test_subprocess_environment.py tests/test_pi_web_tools.py tests/test_release_tooling.py tests/test_work_artifact_registry.py tests/test_work_artifact_preview.py tests/test_work_read_model.py`: **190 passed, 2 skipped** (local Windows symlink privileges). - Electron full suite: **463 passed**. Production build passed with `AMADEUS_PYTHON` pointing to a nonexistent interpreter. - Canonical-source comparison passes; the pinned protocol commit is in protocol main history. The vendored wheel and its digest are unchanged. - Clean source-release gate: **3,985 selected, 101 excluded, 0 errors/warnings**. Diff checks pass. - Final main-based CI must pass before merging; old-head green checks are not substituted for it. ## Remaining experimental limits Historical native Windows install/update/enable/restart/Chat playback/removal evidence is recorded in the Host profile. This reconstruction does not claim a new native-dialog acceptance run or new paid-service/natural-voice qualification. MiMo Japanese is unsupported. DSH stdout and Windows DACL/integrity limitations remain observable and fail closed. The accepted #197 follow-up about the MCP SDK reintroducing Windows `PATH` beside explicit `Path` remains a non-blocking independent migration fix; this reconstruction does not alter the approved MCP policy. The earlier bare-parameter MCP constructor defect was introduced and fixed within this experiment, not an existing main bug. Theme support/unified Plugins navigation (#191/#192), developer mode, logs, public SDK publication and memory are outside this PR. Merge to main with squash after final checks; do not merge to the retired temporary review base.
Lucas1479
changed the base branch from
codex/extension-expansion-integration
to
main
October 12, 2026 16:01
Lucas1479
force-pushed
the
codex/extension-profile-p1
branch
from
October 12, 2026 16:02
9cdbb35 to
80ae98e
Compare
Lucas1479
marked this pull request as ready for review
October 12, 2026 19:35
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
## Outcome and accepted dependencies P2 adds constrained desktop themes and one **Plugins** entry for TTS, MCP, Skill and theme lifecycle. Settings reuses that manager; Appearance selects themes. Pure frontend packages apply immediately; mixed packages use their actually loaded version until backend restart. Design #194. Final head `5de6b4e8d3ec009f2360dd199dffb8f06f563281` targets **main**, after #191 was squash-merged as `2799ba8`. Only P2's own commits were rebased, with identical file trees before/after. [Protocol #2](Code-Amadeus/Amadeus-Extensions#2) was merged using merge commit `bf1a848`, retaining pinned source `b30df73669c50d95d08fb2cd57c289ecddc959f2` in protocol main history. Host provenance now records the accepted source. The contract remains experimental. SDK source `49449a0` and wheel SHA-256 `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084` are unchanged. External re-review confirmed all eight earlier defects fixed; the maintainer requested the remaining documentation/guidance fixes and authorized merging this final head only after CI is green. ## Behavior and review fixes - Themes use a pinned 25-token allowlist and bounded literal syntax. Shared CSS cases and the canonical theme example are checked against Host validation. **v0 supports PNG/JPEG only**, with signature and actual native decode validation; both protocol documents now agree. - The Host proves text/status/accent/faint contrast on the actual token surfaces, preserves light/dark base identity, requires opaque surfaces and derives readable accent-button labels. Builtin gradients do not override extension surfaces. Real Chromium checks the paints/contrast and restoration of builtin decorations. - Mixed-package updates that drop/rename a selected theme retain the loaded v1 theme until restart. Additions wait for v2 admission; disable/remove closes frontend admission immediately. Startup receipts distinguish explicit rejection from missing/invalid evidence through accepted P1 behavior. - **Missing-theme guidance is actionable:** recommend restart only when a different saved revision contains that theme and the package needs restart. A theme removed by a frontend-only update, or absent after restart, instead directs the user to choose another theme in Appearance. Its saved identity and last verified base are retained. Regressions cover both sides. - Native Ctrl+Shift+F12 (Cmd on macOS) and the existing Windows wallpaper tray restore/persist classic independently of package fonts. Environment locks remain authoritative. Plugins → Voice opens navigable Settings and preserves its remembered section; IPC notifications strip raw Electron events and startup chrome uses the verified base. ## Verification - Complete Electron suite: **507 passed**; lifecycle/guidance file **62 passed**. Rebase preserved the tested code exactly; subsequent provenance changes only recorded the already-merged source. - Final clean build, real native PNG/JPEG/CSS validation (**3 check groups**) and offline startup settings (**8 checks**) passed. - Final clean-source and freshly packaged Windows applications each passed **14 real GUI checks**, including native recovery input, saved settings and complete process shutdown. Both reports identify final head `5de6b4e` with `workspace_dirty: false`. - Final extension/resource/SDK/provenance/release Python run: **75 passed, 1 skipped** (POSIX executable contract on Windows). Canonical-source comparison passed. Clean release gate: **4,024 selected, 95 excluded, zero errors/warnings**. - Final-head CI is complete: **16/16 successful checks**, including [Windows Python and source/packaged model-less smoke](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275117), [Windows Electron](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275058), Linux/macOS, installation qualification and [Source Release](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275329). Earlier successful runs are not substituted. - Protocol final-head Windows/Linux contracts and wheel comparison: **3/3 passed** in [run 38298697935](https://github.com/Code-Amadeus/Amadeus-Extensions/actions/runs/38298697935). - Earlier reviewed `d94719a` evidence remains historical: 275 scoped Python passes/4 platform or optional-runtime skips, 125 launcher passes, 8 production component journeys, and real installer/store/SDK Runner lifecycle. The installer driver supplies confirmation decisions (`nativeDialogs: false`); it is not a new manual native-dialog or natural-voice test. Commands: `npm test --prefix electron`; `node --experimental-strip-types --test electron/tests/extensions.test.mjs`; clean `npm run build --prefix electron`; actual Electron running `electron/tests/extensionThemeNative.smoke.mjs` and `electron/scripts/smoke-startup-settings.cjs`; `python -X utf8 tools/smoke_electron_model_less.py`; `npx electron-builder --win --x64 --dir --publish never`, then that smoke with `--packaged-executable electron/build/win-unpacked/amadeus-desktop.exe`; `python -X utf8 tools/check_extension_protocol.py --source <protocol-checkout>`; `python -X utf8 tools/build_source_release.py`. Focused final Python selection: `python -X utf8 -m pytest -q -rs tests/test_extensions.py tests/test_extension_resources.py tests/test_extension_sdk_build.py tests/test_extension_protocol_provenance.py tests/test_release_tooling.py`. ## Corrected GUI evidence and limits The old pre-repair **14/14 claim is withdrawn as recovery evidence**. It ignored a failed settings-save reply and used Playwright's asynchronous `wait_for_function` predicate as proof, which returned on Promise truthiness even when resolved false. A clean old-head reproduction and independent Chromium probe confirmed the cause; see existing [Playwright #29132](microsoft/playwright#29132). The repaired smoke checks save replies, explicitly awaits and compares persisted values, and asserts DOM transitions under the shipping CSP. Missing/wrong/never-returning values fail regressions. Reports bind source identity and build digest. Native recovery testing uses an explicitly authorized temporary loopback main inspector only for the isolated, secret-free test profile. It verifies the owned process/window and uses Electron `sendInputEvent` to reach the real input hook, disconnecting immediately and exiting the owned process. It does not invoke recovery directly and is not a claim of manual/physical keyboard input or a production debugging feature. Preparation failures preserve the previous installation. **After old references are released, a mixed update may collect v1 before v2 starts; there is no automatic startup rollback.** No new paid-service voice or cross-platform GUI qualification is claimed. MiMo Japanese remains unsupported; existing DSH stdout and Windows ACL limitations stay observable and fail closed. Developer mode, logs, registry, ASR, installed AUIP, character features and memory are outside this batch. Repository protection is unchanged; the maintainer explicitly permitted administrator merge for this PR after all final-head CI checks pass. Final local GUI build identities (report filename/content digest, not installer signature): - Source dist: `aba8baa5c0c5e6e1955768202b578113bc24352dc639f91464839a0eb411dfeb`, UTC `2026-10-12T19:42:31.898582+00:00`. - Packaged ASAR: `4c81de1f5c49d287025582119a26b82096f873fd91a110157d189036a3c1a553`, UTC `2026-10-12T19:45:05.101227+00:00`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome and dependencies
P1 supplies the Host-owned support matrix, saved/loaded revisions and resource-only preparation consumed by #192. It adds no Host authority or new executable contribution kind; themes remain closed until P2. Design #194. External re-review completed; maintainer requested merge after all checks passed.
Head
b263720f786c16000d3d178812109583266eb896targets accepted mainc569a0f, which contains #189/#197/#198/#188. #192 is stacked on this repaired head. The earlier reconstruction retained P1's original patch-id; subsequent audit repairs are explicit commits. No pre-split history was replayed.Lifecycle invariants and audit repairs
startup: acceptedorstartup: rejected. A rejected launch settles that exact revision without creating a loaded receipt. Later Runner/contribution failures do not rewrite an already admitted snapshot.startup_errorrecords settle their exact launch revision as before. Frontend-only unavailable/removal errors do not create backend restart work.SDK source remains
49449a0; wheel SHA-256 remains274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084. Protocol #2 is a dependency of the theme consumer, not of P1.Validation
npm run buildpassed.python -X utf8 tools/build_source_release.pyon the clean final P1 head passed: 3,991 selected, 101 excluded, zero errors/warnings. Exact-head CI is complete: 16/16 successful checks, including Windows Python/model-less smoke, Electron, Linux/macOS and source release.Review and scope
Review admission acknowledgment versus runtime health and physical cleanup. Keep #192 stacked until P1 is accepted, then move only its own diff onto main. This merge closes P1 only. Developer mode, logs feature, later phases and memory remain outside this batch.