From 1ad5ddd48a57ca9d5c4916623dfe8445b4a385a0 Mon Sep 17 00:00:00 2001 From: t Date: Sun, 2 Aug 2026 15:17:48 +0800 Subject: [PATCH] =?UTF-8?q?docs(changelog):=200.2.0=20=E2=80=94=20app-serv?= =?UTF-8?q?er=20architecture,=20thin=20clients,=20dep=20majors?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Covers the 31-PR Codex alignment stack (#180-#210) plus the dependency work (#211-#214, #155, #177-#179). Leads with the security section because that is what this release is: the central tool gate could be skipped entirely when `mode` was omitted (#181), and the desktop renderer held provider credentials (#192). Upgrade notes call out the two things a user could otherwise be surprised by — the ~6.7 MB → ~115 MB desktop size increase from the Node sidecar, and that the plugin capability RPC is not an OS boundary. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 94 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d9f3d68..43a0098 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,100 @@ All notable changes to DeepCode are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.2.0] — 2026-08-02 + +Largest release so far: the desktop app, VS Code extension, and LSP server stop +being independent runtimes and become thin clients of a single supervised +app-server. Landed as a reviewed 31-PR stack (#180–#210) plus dependency work. + +### 🔒 Security + +- **The central tool gate could be skipped entirely.** `runAgent` gated dispatch + behind `if (opts.mode)`, and `mode` was optional — so any caller that omitted + it bypassed mode policy, permission rules, and the PreToolUse hook chain, and + every tool call was allowed. Both VS Code entry points and the LSP handler were + such callers. `mode` is now required, with a fail-safe fallback for untyped + callers. (#181) +- **Provider credentials left the desktop renderer.** The Tauri WebView no longer + holds API keys or runs the agent loop; `read_credentials` is replaced by a + presence-only `credential_status`, and the renderer's read-only file preview + refuses to resolve the backend credentials path. (#192, #207) +- **Untrusted project settings can no longer widen policy** — provider/base-URL, + model cost, permissions, sandbox, environment, hooks, MCP, worktree, update, + and executable config are all gated by directory trust, with leaf-level + provenance tracking and prototype-pollution rejection. (#197) +- **Project hook commands now require exact-definition review** on top of + directory trust, with automatic invalidation when a definition changes. + New `deepcode hooks list|trust|revoke`. (#201) +- **Tauri capabilities cut to least privilege** — the filesystem plugin is + removed entirely, `dialog`/`opener`/`process` narrowed to single permissions, + and the provider API dropped from the renderer CSP. (#209) +- **`/add-dir` is enforced.** `permissions.additionalDirectories` was declared in + the schema but consumed nowhere; it now folds into the sandbox's writable roots + across every host — CLI, headless, and app-server (desktop/VS Code/LSP). (#214) +- Real cancellation: LSP `abort` previously deleted a bookkeeping entry and + reported success while the turn kept running. Aborts now propagate through + providers, pending approvals, and POSIX process groups. (#181, #184) + +### ✨ Added + +- **App-server** (`deepcode app-server`) — single-owner, line-delimited JSON + protocol with atomic thread snapshots, orphaned-turn recovery on resume, and + backpressure that may drop only transient deltas, never completed items. + (#186, #188, #190) +- **Desktop runtime as a supervised Node 22 sidecar**, checksum-pinned and signed + before the app bundle. (#187, #189) +- **Canonical session v1** format shared by core and desktop, with a + cross-process writer lock, legacy dual-read, and exact-line corruption + diagnostics. Legacy files are never rewritten. (#182, #185, #191) +- **Workspace diff review** (`workspace/diff`) — shell-free Git invocation with + inherited `GIT_*` stripped, external diff/textconv disabled, and refusal to + read untracked symlink targets or binary content. (#203) +- **Review findings lifecycle** — `SubmitReviewFinding`, `review/apply` (single + and batch), and conflict-safe `review/revert` with all-files compare-and-swap + against exact post-images. Apply and revert run as ordinary turns, so they keep + normal permissions, approvals, hooks, sandboxing, cancellation, and snapshots. + (#204, #205, #206) +- **Trust-aware config diagnostics** surfaced through `deepcode doctor`, Desktop + About, VS Code, and the LSP bridge — value-free, from one shared DTO. (#197, #198) +- **Redacted structured tracing** with a strict metadata allowlist, mode-0600 + bounded NDJSON, and `deepcode diagnostics export`. Best-effort: a broken trace + sink cannot affect protocol or execution. (#202) +- **Release gates** over real packaged artifacts — bundle budgets, protocol + journeys, and a thin-client scan asserting clients never import the provider, + credentials, agent loop, or `RuntimeHost`. npm publication now waits until the + VSIX and signed DMG succeed. (#208) +- Desktop Playwright protocol journey in CI, driving the production renderer + bridge. (#193) + +### ♻️ Changed + +- `RunAgentOptions.mode` is now **required** (breaking for library consumers). +- Host services are assembled once behind `RuntimeHost` instead of per-client. (#184) +- MCP servers and plugins are composed inside a turn-scoped lease with + deterministic teardown on success, interruption, preprocessing failure, and + shutdown. Plugin trees are hashed whole and symlinks rejected. (#199, #200) +- `react` 18 → 19, `react-dom` 18 → 19 (React 19 removed the global `JSX` + namespace; 38 annotations across 25 files now import it explicitly). (#211) +- `vite` 5 → 8 and `@vitejs/plugin-react` 4 → 6. Previously blocked by rolldown + failing to resolve `openai` from the renderer graph — removing provider code + from renderer bundles in #192 cleared it. (#212) +- `typescript-eslint` 8.18 → 8.65; root lint is now `--max-warnings=0`. (#213, #210) +- GitHub Actions: `checkout` 6→7, `setup-node` 6→7, `cache` 4→6, + `download-artifact` 4→8 (v8 fails on digest mismatch instead of warning). + (#177, #178, #179, #155) + +### ⚠️ Upgrade notes + +- **The macOS desktop app grows from ~6.7 MB to ~115 MB.** That is the cost of + bundling a Node 22 sidecar so provider credentials and the agent loop leave the + WebView. Deliberate trade, measured in #187. +- **Plugins are not OS-sandboxed.** The capability RPC gates the supported plugin + API; it is not a boundary against a plugin calling Node APIs directly. Earlier + docs overstated this. Treat third-party plugins as trusted code. (#200, #209) +- `@types/vscode` stays pinned at `^1.85.0` to match `engines.vscode`; raising it + would drop support for VS Code 1.85–1.124. + ## [0.1.6] — 2026-05-28 ### 🐛 Critical fix — Bash tool calls were always reporting "error"