From b7edb7987716cfd44e1e410cd4ca97caaadb9c7e Mon Sep 17 00:00:00 2001 From: tiye Date: Sat, 5 Sep 2026 16:33:24 +0800 Subject: [PATCH 1/4] chore: upgrade to Calcit 0.13.77 --- .github/workflows/upload.yaml | 34 +++++++++++++++++--- calcit.cirru | 11 +++++-- deps.cirru | 14 ++++---- history/202609051630-upgrade-calcit-01377.md | 12 +++++++ package.json | 2 +- yarn.lock | 10 +++--- 6 files changed, 63 insertions(+), 20 deletions(-) create mode 100644 history/202609051630-upgrade-calcit-01377.md diff --git a/.github/workflows/upload.yaml b/.github/workflows/upload.yaml index c456ec4..3ce5169 100644 --- a/.github/workflows/upload.yaml +++ b/.github/workflows/upload.yaml @@ -29,20 +29,46 @@ jobs: - name: Resolve Calcit dependencies run: caps --strict --ci + - name: Verify Calcit toolchain + run: caps verify --toolchain + - name: Install JavaScript dependencies run: yarn install --immutable + - name: Check canonical Calcit snapshot + run: | + before="$(sha256sum calcit.cirru | cut -d ' ' -f 1)" + calcit calcit.cirru edit format + after="$(sha256sum calcit.cirru | cut -d ' ' -f 1)" + test "$before" = "$after" + git diff --exit-code -- calcit.cirru + - name: Check Calcit types run: calcit calcit.cirru --check-only + - name: Check application dynamic methods + run: calcit calcit.cirru analyze dynamic-methods --max 0 --format json + + - name: Audit provider dynamic methods + run: calcit calcit.cirru analyze dynamic-methods --deps --summary-only --format json + - name: Check Calcit quality baseline run: calcit calcit.cirru analyze quality --baseline config/calcit-quality.cirru - - name: Compile Calcit JavaScript - run: calcit calcit.cirru js + - name: Run Calcit regression tests + run: calcit calcit.cirru test --summary-only --format json + + - name: Build extension package + run: yarn build - - name: Build site - run: yarn vite build --base=./ + - name: Validate extension package + run: | + test -f extension/dist/index.html + find extension/dist/assets -maxdepth 1 -name '*.css' -print -quit | grep -q . + node --check extension/content.js + node --check extension/service-worker.js + node --check extension/get-selected.mjs + node -e 'const manifest = require("./extension/manifest.json"); if (manifest.manifest_version !== 3 || manifest.side_panel?.default_path !== "dist/index.html") process.exit(1)' - name: Select deployment path id: deploy-path diff --git a/calcit.cirru b/calcit.cirru index 8c73816..a97472d 100644 --- a/calcit.cirru +++ b/calcit.cirru @@ -138,9 +138,14 @@ if (wo-log done?) (:: :unit) do let - events $ -> value .split-lines - filter $ fn (s) (.starts-with? s "|data: ") + events $ -> (stream-text value) .split-lines + filter $ fn (s) + hint-fn $ {} + :args $ [] 'String + .starts-with? s "|data: " map $ fn (s) + hint-fn $ {} + :args $ [] 'String -> (.strip-prefix s "|data: ") js/JSON.parse to-calcit-data apply-args (events) fn (xs) @@ -2379,7 +2384,7 @@ :tags $ #{} :regression :unit 'store $ %{} 'CodeEntry (:doc |) :code $ quote - def store $ {} + def store $ %{} Store :states $ {} :cursor $ [] :sessions $ [] diff --git a/deps.cirru b/deps.cirru index 9ca5a56..a1db2fc 100644 --- a/deps.cirru +++ b/deps.cirru @@ -1,9 +1,9 @@ -{} (:calcit-version |0.13.75) +{} (:calcit-version |0.13.77) :version |0.0.5 - :dependencies $ {} (|Respo/alerts.calcit |0.10.27) - |Respo/reel.calcit |0.6.11 - |Respo/respo-feather.calcit |0.4.8 - |Respo/respo-markdown.calcit |0.4.29 - |Respo/respo-ui.calcit |0.7.14 - |Respo/respo.calcit |0.16.89 + :dependencies $ {} (|Respo/alerts.calcit |0.10.29) + |Respo/reel.calcit |0.6.13 + |Respo/respo-feather.calcit |0.4.10 + |Respo/respo-markdown.calcit |0.4.31 + |Respo/respo-ui.calcit |0.7.16 + |Respo/respo.calcit |0.16.91 diff --git a/history/202609051630-upgrade-calcit-01377.md b/history/202609051630-upgrade-calcit-01377.md new file mode 100644 index 0000000..c887051 --- /dev/null +++ b/history/202609051630-upgrade-calcit-01377.md @@ -0,0 +1,12 @@ +# Upgrade Calcit 0.13.77 provider graph / 升级 Calcit 0.13.77 provider 依赖图 + +- Pin Calcit and `@calcit/procs` to exact 0.13.77 while preserving the application version at 0.0.5. +- 将 Calcit 与 `@calcit/procs` 精确固定到 0.13.77，并保持应用版本为 0.0.5。 +- Align Alerts 0.10.29, Reel 0.6.13, Feather 0.4.10, Markdown 0.4.31, UI 0.7.16, and Respo 0.16.91 with their published provider releases. +- 对齐已发布的 Alerts 0.10.29、Reel 0.6.13、Feather 0.4.10、Markdown 0.4.31、UI 0.7.16 与 Respo 0.16.91。 +- Revalidate strict Caps/toolchain, immutable Yarn, canonical Snapshot, static quality and dynamic-method analysis, JS/Vite output, extension packaging, and the representative browser-extension path. +- 重新验证严格 Caps/toolchain、不可变 Yarn、canonical Snapshot、静态质量与动态 method 分析、JS/Vite 输出、扩展打包和代表性浏览器扩展路径。 +- Narrow Anthropic SSE chunks through the existing `stream-text` boundary and annotate String callbacks, bringing application-owned dynamic-method findings to zero. +- 通过既有 `stream-text` 边界收窄 Anthropic SSE chunk，并为字符串回调补齐 schema，使应用自身 dynamic-method findings 清零。 +- Construct the initial store as the declared nominal `Store`; this preserves Reel's typed updater boundary during real browser dispatch instead of relying on a plain Map that fails generated field access. +- 初始 store 按声明构造为 nominal `Store`，在真实浏览器 dispatch 中保持 Reel 的类型化 updater 边界，不再依赖会导致生成字段访问失败的普通 Map。 diff --git a/package.json b/package.json index c00c07f..78e81fb 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "@calcit/procs": "0.13.75", + "@calcit/procs": "0.13.77", "@google/genai": "^2.20.0", "@tiye/main-fonts": "0.0.1", "axios": "^1.15.0", diff --git a/yarn.lock b/yarn.lock index 2cb07bf..70b6f30 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5,14 +5,14 @@ __metadata: version: 8 cacheKey: 10c0 -"@calcit/procs@npm:0.13.75": - version: 0.13.75 - resolution: "@calcit/procs@npm:0.13.75" +"@calcit/procs@npm:0.13.77": + version: 0.13.77 + resolution: "@calcit/procs@npm:0.13.77" dependencies: "@calcit/ternary-tree": "npm:0.0.26" "@cirru/parser.ts": "npm:^0.0.9" "@cirru/writer.ts": "npm:^0.1.9" - checksum: 10c0/e07fabba496261c49f32b398d0a01d229ff7048e3b7b4c12dedbbfb879bc9d0208b4c7838e85b6579394c0c1c983fcbf45f207315aaeefd726f85eefd47748ac + checksum: 10c0/7f0d79ad9e7963728518c3754174136d7c2e906c7177785d633f622300be11b84a8f9ae659c5b93c9fb8f7d47e4fffba773bbe90a30a0f53fc3d1258ab850851 languageName: node linkType: hard @@ -1573,7 +1573,7 @@ __metadata: version: 0.0.0-use.local resolution: "root-workspace-0b6124@workspace:." dependencies: - "@calcit/procs": "npm:0.13.75" + "@calcit/procs": "npm:0.13.77" "@google/genai": "npm:^2.20.0" "@tiye/main-fonts": "npm:0.0.1" axios: "npm:^1.15.0" From 74ae1f57d49cfe987f32aa04ec9ac273a9973d35 Mon Sep 17 00:00:00 2001 From: tiye Date: Sat, 5 Sep 2026 16:38:02 +0800 Subject: [PATCH 2/4] ci: keep pull requests validation-only --- .github/workflows/upload.yaml | 9 +++++- history/202609051630-upgrade-calcit-01377.md | 31 ++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/.github/workflows/upload.yaml b/.github/workflows/upload.yaml index 3ce5169..0c70be7 100644 --- a/.github/workflows/upload.yaml +++ b/.github/workflows/upload.yaml @@ -6,6 +6,9 @@ on: - main pull_request: {} +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -50,7 +53,7 @@ jobs: run: calcit calcit.cirru analyze dynamic-methods --max 0 --format json - name: Audit provider dynamic methods - run: calcit calcit.cirru analyze dynamic-methods --deps --summary-only --format json + run: calcit calcit.cirru analyze dynamic-methods --deps --format json - name: Check Calcit quality baseline run: calcit calcit.cirru analyze quality --baseline config/calcit-quality.cirru @@ -71,6 +74,7 @@ jobs: node -e 'const manifest = require("./extension/manifest.json"); if (manifest.manifest_version !== 3 || manifest.side_panel?.default_path !== "dist/index.html") process.exit(1)' - name: Select deployment path + if: github.event_name == 'push' && github.ref == 'refs/heads/main' id: deploy-path env: EVENT_NAME: ${{ github.event_name }} @@ -83,6 +87,7 @@ jobs: fi - name: Prepare deployment directory + if: github.event_name == 'push' && github.ref == 'refs/heads/main' env: DEPLOY_KEY: ${{ secrets.rsync_private_key }} DEPLOY_DEST: ${{ steps.deploy-path.outputs.dest }} @@ -94,6 +99,7 @@ jobs: ssh -i "$key_file" -o StrictHostKeyChecking=no rsync-user@tiye.me "mkdir -p -- '$deploy_path'" - name: Deploy to server + if: github.event_name == 'push' && github.ref == 'refs/heads/main' id: deploy uses: Pendect/action-rsyncer@v2.0.0 env: @@ -106,4 +112,5 @@ jobs: dest: ${{ steps.deploy-path.outputs.dest }} - name: Display status from deploy + if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: echo "${{ steps.deploy.outputs.status }}" diff --git a/history/202609051630-upgrade-calcit-01377.md b/history/202609051630-upgrade-calcit-01377.md index c887051..ef7b9d2 100644 --- a/history/202609051630-upgrade-calcit-01377.md +++ b/history/202609051630-upgrade-calcit-01377.md @@ -10,3 +10,34 @@ - 通过既有 `stream-text` 边界收窄 Anthropic SSE chunk，并为字符串回调补齐 schema，使应用自身 dynamic-method findings 清零。 - Construct the initial store as the declared nominal `Store`; this preserves Reel's typed updater boundary during real browser dispatch instead of relying on a plain Map that fails generated field access. - 初始 store 按声明构造为 nominal `Store`，在真实浏览器 dispatch 中保持 Reel 的类型化 updater 边界，不再依赖会导致生成字段访问失败的普通 Map。 + +## Dynamic-method provider inventory / Provider dynamic-method 清单 + +Exact command / 精确命令： + +```bash +calcit calcit.cirru analyze dynamic-methods --deps --format json +``` + +The application-owned budget is zero. The remaining 26 findings are entirely inside the exact published provider graph and are not owned by this focused msg-buffer PR. + +应用自身预算为 0。剩余 26 项全部位于精确固定的已发布 provider 依赖图内，不属于本次聚焦的 msg-buffer PR 修改范围。 + +| Published provider | Namespaces | Missing receiver schema | Receiver resolves to Dynamic | Unbound generic | Total | +| --- | --- | ---: | ---: | ---: | ---: | +| Reel 0.6.13 | `reel.core` | 0 | 2 | 2 | 4 | +| Markdown 0.4.31 | `respo-md.comp.md`, `respo-md.util.core`, `respo-md.util.math` | 14 | 0 | 2 | 16 | +| UI 0.7.16 | `respo-ui.util` | 3 | 0 | 0 | 3 | +| Respo 0.16.91 | `respo.css`, `respo.render.diff` | 2 | 1 | 0 | 3 | +| Alerts 0.10.29 / Feather 0.4.10 | no direct namespace findings | 0 | 0 | 0 | 0 | +| **Total** | provider namespaces only | **19** | **3** | **4** | **26** | + +This immutable consumer inventory belongs to the strict real-application evidence tracked by `calcit-lang/calcit#684` and the dynamic-dispatch program `calcit-lang/calcit#580`. The separate released-Respo strict capability gap at `respo.controller.resolve/build-deliver-event` remains owned by `calcit-lang/calcit#864`; msg-buffer does not consume its unpublished branch or suppress that diagnostic. + +这份不可变 consumer 清单归入 `calcit-lang/calcit#684` 的严格真实应用证据与 `calcit-lang/calcit#580` 的动态 dispatch 主线。`respo.controller.resolve/build-deliver-event` 的另一项已发布 Respo strict capability 缺口继续由 `calcit-lang/calcit#864` 负责；msg-buffer 不引用其未发布分支，也不 suppress 该诊断。 + +## Pull-request deployment boundary / PR 部署边界 + +The workflow declares top-level `contents: read` permissions. Pull requests run validation only; deployment-path selection, SSH preparation, rsync, and status display each require a main-branch push and therefore cannot access deployment secrets during PR validation. + +Workflow 顶层权限限定为 `contents: read`。Pull request 仅运行验证；deployment path 选择、SSH 准备、rsync 与状态展示均显式要求 main 分支 push，因此 PR 验证不会访问部署 secret。 From bfb8606f368512c8ea57d039a6c3be0095932e03 Mon Sep 17 00:00:00 2001 From: tiye Date: Sat, 5 Sep 2026 18:10:40 +0800 Subject: [PATCH 3/4] ci: install procs before toolchain verification --- .github/workflows/upload.yaml | 6 +++--- ...202609051810-fix-toolchain-verification-order.md | 13 +++++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 history/202609051810-fix-toolchain-verification-order.md diff --git a/.github/workflows/upload.yaml b/.github/workflows/upload.yaml index 0c70be7..c6cd886 100644 --- a/.github/workflows/upload.yaml +++ b/.github/workflows/upload.yaml @@ -32,12 +32,12 @@ jobs: - name: Resolve Calcit dependencies run: caps --strict --ci - - name: Verify Calcit toolchain - run: caps verify --toolchain - - name: Install JavaScript dependencies run: yarn install --immutable + - name: Verify Calcit toolchain + run: caps verify --toolchain + - name: Check canonical Calcit snapshot run: | before="$(sha256sum calcit.cirru | cut -d ' ' -f 1)" diff --git a/history/202609051810-fix-toolchain-verification-order.md b/history/202609051810-fix-toolchain-verification-order.md new file mode 100644 index 0000000..a0ccebd --- /dev/null +++ b/history/202609051810-fix-toolchain-verification-order.md @@ -0,0 +1,13 @@ +# Fix CI toolchain verification order / 修复 CI 工具链验证顺序 + +## English + +- PR #40 Actions run 33959853973 failed because `caps verify --toolchain` ran before the Yarn dependency installation and could not resolve the pinned `@calcit/procs` package. +- Move immutable Yarn installation before toolchain verification so the verifier checks the installed 0.13.77 package rather than relying on a pre-existing local `node_modules` directory. +- Keep strict Caps dependency resolution first and leave all subsequent Snapshot, type, quality, test, build, and extension-package gates unchanged. + +## 中文 + +- PR #40 的 Actions run 33959853973 失败，因为 `caps verify --toolchain` 在 Yarn 安装之前运行，无法解析已固定的 `@calcit/procs` 包。 +- 将不可变 Yarn 安装移到工具链验证之前，使验证器检查实际安装的 0.13.77 包，而不是依赖本地预先存在的 `node_modules`。 +- strict Caps 依赖解析仍保持第一步，后续 Snapshot、类型、质量、测试、构建和扩展包门禁均不变。 From 68bae018597e42af979a0731f4a50c2843c6249a Mon Sep 17 00:00:00 2001 From: tiye Date: Sat, 5 Sep 2026 18:15:52 +0800 Subject: [PATCH 4/4] fix: align store schema with nominal value --- .github/workflows/upload.yaml | 7 +------ calcit.cirru | 8 +++++--- history/202609051810-fix-toolchain-verification-order.md | 4 ++++ 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/upload.yaml b/.github/workflows/upload.yaml index c6cd886..40d248c 100644 --- a/.github/workflows/upload.yaml +++ b/.github/workflows/upload.yaml @@ -77,14 +77,9 @@ jobs: if: github.event_name == 'push' && github.ref == 'refs/heads/main' id: deploy-path env: - EVENT_NAME: ${{ github.event_name }} REPOSITORY: ${{ github.repository }} run: | - if [ "$EVENT_NAME" = "pull_request" ]; then - echo "dest=rsync-user@tiye.me:/web-assets/repo/${REPOSITORY}/pr" >> "$GITHUB_OUTPUT" - else - echo "dest=rsync-user@tiye.me:/web-assets/repo/${REPOSITORY}" >> "$GITHUB_OUTPUT" - fi + echo "dest=rsync-user@tiye.me:/web-assets/repo/${REPOSITORY}" >> "$GITHUB_OUTPUT" - name: Prepare deployment directory if: github.event_name == 'push' && github.ref == 'refs/heads/main' diff --git a/calcit.cirru b/calcit.cirru index a97472d..acb6a15 100644 --- a/calcit.cirru +++ b/calcit.cirru @@ -557,8 +557,10 @@ :code $ quote defcomp comp-container (reel) let - raw-store $ option:unwrap-or (get reel :store) store - app-store $ if (struct? raw-store) (unsafe-coerce raw-store 'app.schema/Store) (decode-map-as raw-store 'app.schema/Store) + app-store $ option:fold (get reel :store) + fn () store + fn (raw-store) + if (struct? raw-store) (unsafe-coerce raw-store 'app.schema/Store) (decode-map-as raw-store 'app.schema/Store) sessions $ :sessions app-store archived-count $ :archived-count app-store current-session-id $ :current-session-id app-store @@ -2392,7 +2394,7 @@ :model nil :archived-count 0 :examples $ [] - :schema $ :: 'Map + :schema $ :: 'app.schema/Store :ns $ %{} 'NsEntry (:doc |) :code $ quote ns app.schema $ :require diff --git a/history/202609051810-fix-toolchain-verification-order.md b/history/202609051810-fix-toolchain-verification-order.md index a0ccebd..39dbc87 100644 --- a/history/202609051810-fix-toolchain-verification-order.md +++ b/history/202609051810-fix-toolchain-verification-order.md @@ -5,9 +5,13 @@ - PR #40 Actions run 33959853973 failed because `caps verify --toolchain` ran before the Yarn dependency installation and could not resolve the pinned `@calcit/procs` package. - Move immutable Yarn installation before toolchain verification so the verifier checks the installed 0.13.77 package rather than relying on a pre-existing local `node_modules` directory. - Keep strict Caps dependency resolution first and leave all subsequent Snapshot, type, quality, test, build, and extension-package gates unchanged. +- Follow up on Copilot review by declaring `app.schema/store` as the nominal `app.schema/Store` it constructs. Split the absent-reel fallback from the raw persisted-value decode so already nominal data is used directly, while external Map/host values remain explicitly validated. +- Remove the now unreachable pull-request deployment-path branch; the whole step already runs only for pushes to `main`. ## 中文 - PR #40 的 Actions run 33959853973 失败，因为 `caps verify --toolchain` 在 Yarn 安装之前运行，无法解析已固定的 `@calcit/procs` 包。 - 将不可变 Yarn 安装移到工具链验证之前，使验证器检查实际安装的 0.13.77 包，而不是依赖本地预先存在的 `node_modules`。 - strict Caps 依赖解析仍保持第一步，后续 Snapshot、类型、质量、测试、构建和扩展包门禁均不变。 +- 根据 Copilot review，将 `app.schema/store` 声明为它实际构造的 nominal `app.schema/Store`。同时分离 reel 缺失时的 fallback 与原始持久化值 decode：已经 nominal 的数据直接使用，外部 Map/host 值继续显式验证。 +- 删除已不可达的 PR 部署路径分支；整个步骤本身只会在 `main` push 时运行。