Repository navigation
Conversation
…CK-2214) New Cargo workspace under apps/desktop, separate from runtime-core: - core: lenient models for hack --json and hackd payloads, a CLI runner that kills the whole process group on timeout, a read-only hackd socket client, project state derivation, list/detail view models and fixtures for every designed state. 33 hermetic unit tests. - app: the gpui-kit window (sidebar, header with Start/Stop/Restart/Open, services table, log tail, status bar, light and dark), --fixtures mode and offscreen PNG rendering behind the screenshots feature. - A separate, non-required Linux CI job for the desktop workspace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…finished one-shot services as completed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eout, drop stale log tails Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…abel Docker state as Docker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…arden chunk parsing, never count unknown as stopped Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…, gate native actions and logs, clear recovered failures Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…er peer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…iled log read as failed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r and machine rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Doctor runs once outside any project and once per project, and the app shows the findings as cards grouped by area: machine findings once, project findings with the projects they affect, ok checks collapsed into a count, and one action per card (copy a known command or open a doc; a one-click fix waits for request R7a). Includes doctor and doctor-clean fixtures and hermetic tests, including a report kept from exit 1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (17)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
… as down Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fbeb19d77e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: fbeb19d77e
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…verage, budget, refresh, stale guard) - Map the CLI's real check ids (caddy hosts is project-scoped; browser, secret, compose and amd64 checks added); a test reads them from src/commands/doctor.ts and src/lib/doctor-*.ts. - Project repairs copy one exact quoted command with --path; daemon repairs follow the reported state; otherwise the doc. - Only an explicit ok counts as passed; unknown statuses and reports without a checks array show as could-not-check. - Partial or failed runs never look clean: coverage line and grey/amber sidebar tone. - 90 s total budget with 4 at once; late projects are not checked. - Refresh every 10 minutes while visible and on reopen when older; a generation guard drops superseded results and re-runs when the project set changed. - The machine run uses a directory outside any Hack project. - Project headers link to their Doctor findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…/desktop-app-doctor
…; add Doctor boards Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 669b92b0d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…dentity, window visibility, project markers, named remedies) - secrets hygiene takes its scope from the run that reported it, so the global Hack home audit is kept with no projects registered. - The stale guard compares (name, checkout, backend), not names. - Automatic doctor runs need the pane shown in a visible window; stale or old results refresh when the window becomes visible again. - The neutral directory check resolves symlinks, recognises every CLI project marker (hack.project.json, .hack/, .dev/ with a project file) and fails closed on inspection errors. - A check's own named remedy wins: caddy hosts copies hack restart --path '<root>' (or hack global up), not doctor --fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Ready for lead: aa8c30e The head contains What changed since the last note: fixes for the bot findings.
Decision flagged: if the CLI is a What ran
Not verified or not waited for
|
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: aa8c30e36c
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
Codex couldn't complete this request. Try again later. |
# Conflicts: # apps/desktop/README.md # apps/desktop/app/src/main.rs # apps/desktop/app/src/view.rs # apps/desktop/core/src/runner.rs # apps/desktop/core/src/source.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…paths Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 868284df21
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0dcc2323c5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bca7e9c685
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…fore Doctor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Ready for lead: 4eb4eee The base is What changed since the last note
Open decisions (Doctor security limits, documented in the README, unmitigated):
My reviewer judged deferring these acceptable for an unsupported preview, but they need your explicit acceptance. What ran
Not verified or not waited for: hosted macOS jobs (queued); the automatic Codex security review of this head (running, non-blocking); no live Doctor run on a Mac. |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex couldn't complete this request. Try again later. |
Summary
Add the optional Doctor pane from
apps/desktop/DESIGN.mdsection 3 (HACK-2214). Targetsnextafter #801 merged; includes core's final script warmups and accepted-refresh tail clearing. No CLI or release changes.Doctor reads the machine and registered checkouts with bounded read-only CLI probes. Machine findings deduplicate, project findings retain exact checkout evidence, missing rows remain unchecked without being probed, and stale/unknown/incomplete results cannot show all clear. Compose and native backends are explicit; adopted Compose diagnostics retain exact-path coverage. Cards copy an allowlisted, quoted remedy or open documentation; no Doctor fix executes in the app.
Card.authored_remedyalso exposes a private-constructionAuthoredRemedywith executable-freeargv()and a boundproject_root(), so integrations can bind their selected checked CLI/environment without parsing copy text. Standalone copy display uses terminal PATH; it does not select a candidate CLI or home.Both async project snapshot paths use ordered refresh/action-epoch admission before clearing a changed selection's old log tail and invalidating Doctor. Machine probes use a private runtime directory or root. Doctor builds a private per-refresh PATH from individually checked executable paths, preserving safe siblings and owner-writable Homebrew/shim layouts while excluding writable directory chains and executable/symlink targets and overrides Git fsmonitor/hooks configuration so nested observations do not execute repository-configured programs.
Visual evidence: Doctor light, Doctor dark. All 19 fixtures are rerendered in light/dark for local evidence.
Verification and open gates
Pinned Rust 1.98.1, offline Cargo, two build jobs, unit-owned target, temporary HOME/HACK_HOME/TMPDIR, autostart disabled:
cargo fmt --all --checkpassed.cargo test --offline --locked -j 2 -p hack-desktop-core: 129 unit + 4 integration passed.--all-targets -- -D warnings) passed.Regression coverage includes process-group termination/pipe deadlines, private Unix sockets and peer ownership, warmed Doctor fake-CLI budgets, exact project/adoption coverage, stale-clean invalidation, backend isolation, command boundaries, harmless fsmonitor/PATH negative controls, and terminal-free command/JSON adapters. These Linux passes do not qualify macOS process/socket behavior, real Doctor probes, clipboard/docs clicks, timer/visibility behavior or a native Terminal adapter.
Exact-head Codex review and the same persistent second-family review remain required; the parent queues Claude after the implementation evidence. Earlier ready notes are superseded. Hosted CI remains separate. No merge is requested before a clean exact-head receipt.
Current boundary fixes preserve Docker HOME/config/context selectors, stream only public plugin-directory metadata, and validate documented standard Unix discovery paths, original/intermediate links, modes, ownership and ACLs before probes. Opaque/custom discovery remains unsupported and requires the same reviewer assessment; no credential-bearing config is copied. Fixed absolute Mutagen selections receive the same preflight. Owner-writable Homebrew/shims remain supported; unknown discovery fails conservatively. macOS ACL mutation grants are refused; Linux access ACLs are conservatively refused. Native ACL execution and real Mac PATH/plugin/context qualification remain open.
DoctorRun.exact_native_rootis an explicit pre/post exact-root marker witness; native check IDs alone cannot establish checkout coverage. Fixture integrations must initialize it. Authored remedy argv API is unchanged. Latest filesystem-only fixes preserve rendered fixtures; 38 offscreen renders and inspected light/dark boards remain applicable.PATH scans now deduplicate canonical directories before caps, retain checked tools at cutoff and mark dependent findings Unknown with incomplete coverage, rather than aborting or implying unsearched tools are missing/healthy. Fake-source tests bind temporary homes and a small explicit tool PATH.
DoctorRun.probe_starteddistinguishes local preflight notes from actual CLI probes; preflight refusal leaves machine coverage unchecked. Darwin ACL queries use acl_get_file with stable pre/post link/target metadata to distinguish absent ACL metadata from missing paths without requiring executable read access; its native fixture remains a required macOS gate. Group-writable Applications/app targets remain refused and explicitly unchecked.Coverage is scoped to fixed Doctor tool names and check dependencies: unrelated unsafe executables are ignored, independent checks retain their observations, and one card names unchecked tools. Native ACL fixtures include owned 0711/0111 executables, absent ACL, missing path and mutation grants; hosted macOS remains required.
External prerequisite — blocks readiness
The NSS read-path finding 4573575142 remains open. A separate CLI trust-contract guard is assigned to the existing DNS/trust owner; its PR/head is pending. Doctor does not duplicate NSS discovery, modify the CLI, hide profiles through HOME/HACK_HOME/XDG overrides or probe certutil. Readiness requires integration of that guard and resolution of this thread with evidence. Current local review progress does not satisfy that prerequisite.
The full fixed tool/dependency audit is documented in
apps/desktop/DOCTOR_TOOLS.md, including actual read invocations, conditional/transitive calls and file-only exclusions. Filtered Docker preserves ingress-network and native-feature warnings from Compose/adaptation files; independent errors, guidance and authored remedies remain visible.Update (Nov 15)
nexte47681e, which brings fix(desktop): isolate process tests and close unlisted Apple child descriptors #846's macOS spawn boundary and fix(trust): guard observe-only NSS queries (HACK-2218) #847's NSS read guard (the NSS thread is resolved).#!interpreter. Only a trusted interpreter with no arguments, or exactly#!/usr/bin/env <name>, is accepted; any other form makes that tool Unknown.