fix(desktop): sign the macOS DMG and explain server conflicts - #121
Merged
Conversation
The DMG container was left unsigned and unnotarized: only mac.notarize was set, which covers the .app, while dmg.sign kept its default of false. A downloaded DMG was rejected by Gatekeeper with 'no usable signature'. Signing the DMG by hand afterwards fixed Gatekeeper but broke auto-update, because notarizing and stapling mutate the DMG after electron-builder has already written its sha512 and size into latest-mac.yml. electron-updater verifies downloads against that checksum. Enable dmg.sign so signing happens while the DMG is built, then notarize, staple and rewrite latest-mac.yml from the finished artifact in a step that runs after electron-builder returns. Delete the stale blockmap so a differential update falls back to a full download instead of corrupting. Also give the install window a deliberate layout instead of the stock electron-builder appearance.
The server lock at <PYTHINKER_CODE_HOME>/server/lock is global rather than per-port, so a CLI server on any port stops the desktop Host from starting. The Host exited non-zero and the desktop reported only 'Host exited before readiness (code 1, signal null)', which names neither the conflicting process nor a way out. Parse the Host's canonical conflict line and show a Retry/Quit dialog naming the process, port and start time. Do not stop the other server: it may be serving live sessions, and the choice belongs to the user. Keep the single-instance rule itself. Two servers sharing one Pythinker home would race on session state.json writes, truncate each other's wire.jsonl rewrites, and both claim the same next sequence in the shared event journal, so refusing to start is correct. Also honor an error's declared exit code in 'server run': ServerLockedError uses 2 to mark a lock conflict, which the catch-all flattened to 1.
|
Warning Review limit reached
Next review available in: 9 minutes Limit details: You’ve used all 3 included reviews currently available under your plan. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
Comment |
commit: |
Merged
elkaix
added a commit
that referenced
this pull request
Aug 17, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @pymodel/pythinker-code@0.21.0 ### Minor Changes - [#100](#100) [`cba1341`](cba1341) - Add server endpoints that list installed plugins, enable or disable one, and list subagent profiles, and let a named skill be turned off so it is hidden from the model, the slash menu and the API. - [#119](#119) [`0871533`](0871533) - Report each model's real capabilities in the catalog. Until now `capabilities` carried only what a user had typed into their config file by hand, so for almost every model it was empty. It is now derived from the model itself when the config says nothing, while an explicit list in the config still wins. A provider whose capabilities are genuinely unknown keeps omitting the field rather than claiming the model can do nothing. - [#119](#119) [`0871533`](0871533) - Prompt for desktop updates with a toast that offers install or skip, centre the settings button in the sidebar footer, and start a new session when the sidebar brand is clicked. - [#100](#100) [`cba1341`](cba1341) - Open the web settings inside the app shell instead of over it, and add pages for plugins, skills, subagents, connectors, hooks and usage statistics. - [#119](#119) [`0871533`](0871533) - Make `agent_config.tools` and `agent_config.mcp_servers` reach the running agent. A session profile update now persists the selection, merges each field independently so supplying one half does not clear the other, resumes an inactive session before the mutation, and applies the result through a single `setActiveTools` call. MCP server names are turned into tool patterns with the shared naming helper, so a server whose name needs sanitizing still matches its tools. - [#119](#119) [`0871533`](0871533) - Add a capability menu to the composer. It picks which tools and MCP servers the current session may use, lists the session's skills, and turns plugins on or off. Each group states how far its change reaches, because the three differ: tool and MCP changes apply to this session at once, skills are read-only here, and plugin changes are global to the daemon. Selected tools and servers appear as chips beside the composer controls. - [#119](#119) [`0871533`](0871533) - Add OpenAI Codex sign-in to the web and desktop app. The provider dialog now offers "Sign in with ChatGPT" next to the API-key form: the server runs the OAuth exchange, writes the credentials, and reports only which model it selected. When port 1455 is taken, the dialog asks for the redirect URL instead. - [#119](#119) [`0871533`](0871533) - Add starter suggestions to the empty conversation screen in the web UI. Each suggestion fills the composer for editing and does not send the message. - [#119](#119) [`0871533`](0871533) - Add, edit, and remove your own MCP servers from the connectors page in the web UI; a new or edited server starts with your next session. - [#119](#119) [`0871533`](0871533) - Add a Retry action to the last assistant reply and a copy button to user messages in the web UI. Retry asks for confirmation, then sends the original prompt again. - [#119](#119) [`0871533`](0871533) - Point the web provider calls at routes that exist. Adding a provider now writes through `POST /config`, refreshing reads `GET /providers/{id}`, and a new `DELETE /providers/{provider_id}` route removes a provider together with the model aliases that referenced it. - [#119](#119) [`0871533`](0871533) - Move the web tool picker out of the composer menu into a Tools page in settings, where the full list fits. Every tool stays on until you turn one off, and the selection still applies to the current session only. ### Patch Changes - [#121](#121) [`cb2ecdc`](cb2ecdc) - Say why the desktop app cannot start when another Pythinker server is already running. It now names the process, port and start time and offers Retry or Quit, in place of an exit code that explained nothing. Stopping the other server stays the user's choice. - [#119](#119) [`0871533`](0871533) - Repaint the desktop chrome. The sidebar footer now carries a pill button, so Settings and the way back out of it match New Session and stay visible. The transcript reserves room for the floating work chips instead of letting them sit on the last line. Windows gets round window controls on the trailing edge, in place of the native caption buttons that could not be styled. - [#121](#121) [`cb2ecdc`](cb2ecdc) - Sign, notarize and staple the macOS disk image, so a downloaded desktop build no longer opens with a Gatekeeper warning, and keep the update metadata in step with the finished file. The install window also gets a deliberate icon layout in place of the stock one. - [#119](#119) [`0871533`](0871533) - Keep provider and model ids exactly as you type them, open the ChatGPT sign-in window reliably, stop a second sign-in attempt from holding the callback port, hide provider errors behind a safe message, and finish writing the event journals during shutdown. - [#119](#119) [`0871533`](0871533) - Keep provider and model ids exactly as written when a config patch is saved, so an id containing an underscore still resolves. - [#119](#119) [`0871533`](0871533) - Stop the session snapshot request from timing out on busy sessions. Each recorded event no longer pays a fresh file open and close, the watermark is read without waiting for pending writes, and the session list is scanned in parallel, so opening or refreshing a session stays fast even with a long history. This was most visible on Windows, where the per-event file cost is highest. - [#119](#119) [`0871533`](0871533) - Show the sign-in state, the provider, and the model as separate fields in the web settings account section, and label the button for what it opens. - [#119](#119) [`0871533`](0871533) - Fix web capability and retry controls: the capability panel takes keyboard focus when it opens, Retry stays reachable with Tab, rapid capability toggles reach the daemon in order, and retrying a prompt keeps its attachments. - [#119](#119) [`0871533`](0871533) - Widen the chat reading column to 928px and restyle the composer card: a 24px radius, a translucent blurred surface, a border that strengthens on hover and focus, and an input that grows to 384px before it scrolls. The toolbar controls are 30px circles with a divider after the attachment button. - [#122](#122) [`5f51b83`](5f51b83) - Lay the MCP server form out in even rows instead of a ragged grid, and stop the provider manager header and footer from squaring off the dialog corners. - [#119](#119) [`0871533`](0871533) - Clean up the web composer capability control: the selected tools no longer render as chips in the toolbar, the button reads "Connectors", and the menu panel stays inside the window when its content loads. - [#119](#119) [`0871533`](0871533) - Show model capabilities as badges in the model picker instead of a comma-separated string, and bring its rows and search field onto the app's row metrics, sized from `--ui-font-size` so the font-size setting still scales them. A model that reasons adaptively is now distinguishable from one that exposes an explicit thinking capability, and an unrecognised capability still renders rather than being dropped. - [#119](#119) [`0871533`](0871533) - Make the web settings surface use the app design tokens: token corner radii, a theme-aware switch shadow, and control sizes that grow with the UI font size. - [#119](#119) [`0871533`](0871533) - Quieten the sidebar session rows. Hover becomes a translucent wash instead of a solid fill, the selected row becomes a faint tint instead of a solid accent, and the radius and sizing match the shared menu row, so the row scales with the UI font-size setting. The same change is applied to the per-theme overrides, so all three themes agree. - [#119](#119) [`0871533`](0871533) - Recover the web and desktop app when a session snapshot request fails. It is now retried with a growing delay instead of leaving the todo list and the sub-agent list frozen until a reload, and a failed task refresh reports itself rather than failing in silence. - [#119](#119) [`0871533`](0871533) - Add four shared UI primitives to the web app: `Popover`, `MenuRow`, `SwitchToggle` and `Chip`. `Popover` holds the anchored-menu positioning that each menu used to write for itself, including the flip above the trigger and the viewport clamp. `MenuRow` carries the standard list row, sized from `--ui-font-size` so the font-size setting still scales it. All four style themselves only from theme tokens, and a guard test fails on any colour literal. - [#119](#119) [`0871533`](0871533) - Open the browser on Windows through `rundll32` instead of `cmd /c start`. `cmd` cut every URL at the first `&`, so OAuth logins reached the provider with only the first query parameter and failed with an invalid authorize request. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: M Elkholy <melkholy@techmatrix.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
No issue — both problems were found while producing the first signed macOS release from a new Developer ID certificate.
Problem
1. The DMG was not signed. Only
mac.notarizewas set, which covers the.app.dmg.signkept its documented default offalse, so the disk image itself shipped unsigned:Signing and stapling it by hand afterwards fixed Gatekeeper but broke auto-update, because those operations mutate the DMG after electron-builder has already written its checksum into
latest-mac.yml, whichelectron-updaterverifies downloads against:vXP6moUrffhA…lQbTRViFFbuS…2. A server conflict was unreadable. The server lock is global rather than per-port, so a CLI server on any port stops the desktop app from starting. The user saw only:
which names no way out.
What changed
DMG signing. Enable
dmg.signso signing happens while electron-builder builds the image — before it hashes it. Notarizing and stapling still must follow the artifact, so a finalize step runs after electron-builder returns, then rewriteslatest-mac.ymlfrom the finished file and deletes the stale blockmap so a differential update falls back to a full download rather than corrupting. This is deliberately not anafterAllArtifactBuildhook: that fires after hashing and would reintroduce the same drift. The install window also gets an explicit icon layout.Server conflict. Parse the canonical conflict line and show a Retry/Quit dialog naming the process, port and start time. It does not stop the other server — it may be serving live sessions, and that is the user's call.
server runalso now honors an error's declared exit code, soServerLockedError's2survives instead of being flattened to1.The single-instance rule itself is kept deliberately. Two servers sharing one Pythinker home would race on session
state.jsonwrites, truncate each other'swire.jsonlrewrites, and both claim the same next sequence in the shared event journal. Refusing to start is correct; only the diagnosis was broken.Verification
cd apps/desktop && npx vitest run— 97 passed (was 87)pnpm --filter @pymodel/pythinker-desktop run typecheck— cleanpnpm --filter @pymodel/pythinker-code run typecheck— cleanpnpm run lint— no: errorlineslatest-mac.ymlfrom the broken build and reproduced the correct checksum and size exactly.Not covered: no full
dist:machas been run with this code, so thexcrunorchestration is exercised only through an injected command runner.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.