[Epic sync] Bring Electron runtime foundation into desktop UX lane - #1973
Merged
integry merged 19 commits intoAug 29, 2026
Merged
Conversation
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…untime and r Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…anging Electron security configuration. Implemented the packaging supply-chain follow-up without changing Electron security configuration. Changes: - Upgraded all Electron Forge packages to `8.0.0-alpha.10`. - Pinned safe overrides: - `@electron/packager` 20.3.0 - `@electron/rebuild` 4.2.0 - Regenerated [package-lock.json](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T14-44-22/package-lock.json). - Added separate runtime and packaging audit scripts in [package.json](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T14-44-22/package.json). - Added a lockfile-first [desktop release guard](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T14-44-22/.github/workflows/desktop-release-guard.yml) that fails: - Runtime advisories at low or higher. - Desktop packaging advisories at high or critical. - Documented the audit policy in [apps/desktop/README.md](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T14-44-22/apps/desktop/README.md). Verification passed: - Clean `npm ci` - Runtime audit: 0 vulnerabilities - Desktop packaging audit: 0 vulnerabilities - Full `npm audit`: 0 vulnerabilities - Desktop/UI typecheck - 15 desktop tests - Linux desktop packaging - Workflow YAML validation and `git diff --check` The vulnerable `extract-zip`, Electron `node-gyp`, and `cacache` chains are absent. No advisory exception or constrained-exposure documentation was necessary. Changes remain uncommitted as requested. PR: #1967 Comment by: @integry (ID: 5463039825) Model: gpt-5.6-sol
Implemented the release-blocking packaging fix. - Disabled only `LoadBrowserProcessSpecificV8Snapshot`; all hardened fuses remain enforced. - Added a packaged Linux smoke test that: - Validates every fuse state. - Launches without `--no-sandbox` or `--disable-sandbox`. - Requires Electron’s `ready-to-show` renderer event. - Requires a clean exit. - Added the smoke test to the desktop release guard using Xvfb and a correctly configured Chromium setuid sandbox helper. - Added `desktop:smoke` and documented its usage. Verification passed: - Shared package build - Desktop/UI typecheck - All 15 desktop tests - Forge Linux packaging - Fuse inspection, including the snapshot fuse disabled - Script syntax and `git diff --check` The current execution container cannot complete the final launch because it prohibits user namespaces and provides no root/sudo or Xvfb; Electron correctly failed closed instead of disabling its sandbox. The release CI now supplies the required sandbox helper configuration and display server to execute that proof automatically. PR: #1967 Comment by: @integry (ID: 5463056792) Model: gpt-5.6-sol
Implemented the self-contained desktop preparation: - Added `desktop:prepare` to build `@propr/shared`. - Made `desktop:typecheck` and `desktop:package` invoke preparation first. - Added `packages/shared/**` to the release-guard trigger. - Documented the behavior. Files changed: [package.json](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-02-01/package.json:75), [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-02-01/.github/workflows/desktop-release-guard.yml:10), and [README.md](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-02-01/apps/desktop/README.md:23). Verification: - Runtime audit: 0 vulnerabilities - Packaging audit: 0 vulnerabilities - `npm ci`: passed - Typecheck from absent `packages/shared/dist`: passed and recreated output - Desktop tests: 15/15 passed - Forge Linux package: passed, independently rebuilding shared first - JSON, script syntax, and `git diff --check`: passed The packaged launch smoke was attempted but this execution host lacks both `sudo` and Xvfb and forbids unprivileged user namespaces. The harness verified the fuse configuration, then correctly failed closed because `chrome-sandbox` could not be made root-owned mode `4755`. The CI workflow retains the required sandbox-helper setup and Xvfb launch steps. PR: #1967 Comment by: @integry (ID: 5463103357) Model: gpt-5.6-sol
…ed release smoke: Implemented the Electron entry-format repair and strengthened release smoke: - Main/preload now emit explicit CommonJS `.cjs` bundles; packaged manifest and preload path match. - Packaged renderer uses a restricted app-owned protocol, preserving the disabled file-protocol privilege fuse, as [Electron recommends](https://www.electronjs.org/docs/latest/tutorial/security). - Renderer-ready is emitted only after verifying `window.proprDesktop`. - Smoke rejects known main-process uncaught-exception markers. Key changes: [package.json](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-14-42/apps/desktop/package.json:11), [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-14-42/apps/desktop/src/main.ts:22), [smoke-packaged.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-14-42/apps/desktop/scripts/smoke-packaged.mjs:12). Validation: - Typecheck: passed - Desktop tests: 15/15 passed - Forge package: passed - Packaged manifest/bundle inspection: passed - Fuse validation: passed, including V8 snapshot fuse disabled - Functional packaged launch: reached renderer-ready with `"preloadBridgeExposed":true` The exact sandbox smoke was rerun but this container lacks `sudo` and cannot make `chrome-sandbox` root-owned mode `4755`; Chromium correctly refused to start rather than disabling sandboxing. The existing release workflow performs that ownership setup before running the unchanged smoke command. PR: #1967 Comment by: @integry (ID: 5463184150) Model: gpt-5.6-sol
…ing the user-facing product name and all security settings. Implemented the Linux space-free package path while preserving the user-facing product name and all security settings. Changes: - Forge now emits `apps/desktop/out/propr-desktop-linux-x64` via [forge.config.ts](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-42-24/apps/desktop/forge.config.ts:11). - Smoke launches the exact space-free binary path in [smoke-packaged.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-42-24/apps/desktop/scripts/smoke-packaged.mjs:20). - CI configures the exact sandbox helper path without globbing in [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-42-24/.github/workflows/desktop-release-guard.yml:62). - Packaged ASAR metadata still contains `"productName":"ProPR Desktop"`. Verification passed: - Both audits: 0 vulnerabilities - Clean `npm ci`: 0 vulnerabilities - Desktop and renderer typecheck - Desktop tests: 15/15 - Forge package - Exact artifact and metadata assertions - Hardened fuse validation - `git diff --check` The final local renderer-ready launch could not complete because this container has neither `sudo` nor `xvfb-run`; it stopped at Chromium’s expected root/setuid ownership check. Its diagnostic used the complete new space-free path without truncation. The CI workflow retains the required `chown root:root`, mode `4755`, Xvfb, and sandboxed renderer-ready/bridge proof. PR: #1967 Comment by: @integry (ID: 5463320073) Model: gpt-5.6-sol
…st.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-50-52/test/orchestratorConfig.test.mjs:25). Fixed the full-suite failure in [test/orchestratorConfig.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T15-50-52/test/orchestratorConfig.test.mjs:25). The VAPID fixture now pads OpenSSL-generated private scalars to the required 32-byte width, preventing intermittent “malformed” results when a leading zero was omitted. Validation: - Exact suite-runner test: 56/56 passed - `git diff --check`: passed - No commit created - Only the test fixture file was modified PR: #1967 Comment by: @github-actions[bot] (ID: 5463323066) Model: gpt-5.6-sol
Implemented F1–F3 only. - [security.ts](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T16-10-43/apps/desktop/src/security.ts): packaged renderer trust now allows hash routes while rejecting queries, alternate hosts, and documents. - [desktop.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T16-10-43/propr-ui/src/desktop.tsx): activating a profile now reloads the renderer for fresh REST/socket module configuration. - [package.json](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T16-10-43/apps/desktop/package.json): dev, make, DEB, and RPM entrypoints prepare `@propr/shared`. - Added routed-IPC and two-endpoint switching regression tests. Validation passed: - Desktop tests: 15/15 - UI tests: 466/466 - Desktop and UI typechecks - All preparation hooks - `git diff --check` No commit created. PR: #1967 Comment by: @integry (ID: 5463457877) Model: gpt-5.6-sol
Implemented only F4, F5, and F6. - F4: Deep-link IPC now registers eagerly in preload and buffers links until React subscribes. Main-process pending links are queued, preserving startup and loading-time second-instance links. - F5: Desktop logout now uses the active Electron session with credentials and manual redirects, then navigates internally to `#/login?logged_out=true` without external browsing. - F6: Credential mutations are serialized per profile with deterministic invocation-order semantics, including profile removal. Verification passed: - Desktop tests: 20/20 - UI tests: 467/467 - Desktop and UI typechecks - Electron Forge package - `git diff --check` No commit was created. PR: #1967 Comment by: @integry (ID: 5463548749) Model: gpt-5.6-sol
Implemented only F7, F8, and F9. - F7: Added an exact shared `propr-app://renderer` CORS boundary for REST and Socket.IO, enabled CORS on the registered scheme, and extended the packaged smoke test with a real credentialed renderer request. - F8: Added development-only inline-script CSP support and corrected Vite’s shared renderer entry resolution. Packaged output retains strict `script-src 'self'`. - F9: Added deterministic deep-link queue coordination and regression coverage for the post-load/pre-assignment race. Verification passed: - Desktop tests: 22/22 - API CORS tests: 12/12 - Desktop, UI, and API typechecks - API lint - Desktop profile UI test - Forge packaging - Vite development HTML and renderer module loading The packaged launch smoke was attempted but this container cannot configure the Chromium helper as root-owned mode `4755` or provide Xvfb. The existing release workflow provisions both before running the enhanced smoke test. PR: #1967 Comment by: @integry (ID: 5463673605) Model: gpt-5.6-sol
…st.ts](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T17-17-44/packages/api/test/webPushDispatcher.test.ts:15). Fixed the flaky full-suite failure in [webPushDispatcher.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1967-followup-2026-08-29T17-17-44/packages/api/test/webPushDispatcher.test.ts:15). The fixture now uses a stable historical timestamp, preventing SQLite wall-clock comparisons from intermittently hiding claimable delivery jobs. Validation passed: - Dispatcher suite: 20 consecutive runs, 340/340 tests - Notification suites: 42/42 tests - API typecheck - API lint - `git diff --check` Only the intended test file changed; no commit was created. PR: #1967 Comment by: @github-actions[bot] (ID: 5463780771) Model: gpt-5.6-sol
…ecure-elect-20260829-1408-gux [1956 by GPT-5.6 Sol] Scaffold the secure Electron desktop runtime and reusable Web UI renderer
…to 1952-epic-electron-runtime-app
…f281`. Implemented the requested follow-ups on synced head `a9fde0f281`. - Added cross-platform Vite `/@fs/` normalization with explicit POSIX and `C:\...` tests. - Desktop dev/typecheck/package/make hooks now build `@propr/shared` then `@propr/client`. - Release guard packages before typechecks from asserted-clean build inputs; audits remain before `npm ci`. - Added `[::1]` support across desktop API/external/dev URL validation, renderer CSP, client normalization, and development CORS while retaining unsafe-scheme/non-loopback rejection. Key changes: [vite-file-system-url.ts](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T17-47-07/apps/desktop/src/vite-file-system-url.ts), [security.ts](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T17-47-07/apps/desktop/src/security.ts:3), [package.json](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T17-47-07/package.json:75), [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T17-47-07/.github/workflows/desktop-release-guard.yml:52). Validation passed: - Desktop, UI, and client typechecks - Desktop tests: 24/24 - Client tests: 10/10 - REST/Socket CORS tests: 12/12 - Actual `npm run desktop:package` - All nine hardened Electron fuse checks - Development HTML emitted a valid POSIX `/@fs/.../desktop.tsx` URL The sandboxed packaged launch was attempted but this runner lacks `sudo` and Xvfb, while AppArmor blocks unprivileged user namespaces. The release guard retains the root-owned `4755` helper plus `xvfb-run` path needed to complete renderer-ready/API-origin smoke in CI. No commit was created. PR: #1971 Comment by: @integry (ID: 5463922441) Model: gpt-5.6-sol
…ees/integry/propr/pr-1971-followup-2026-08-29T17-57-47/propr-ui/src/App.tsx:43) by reducing its counted lines from 401 to 400 with a formatting-only change. Fixed the CI failure in [App.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T17-57-47/propr-ui/src/App.tsx:43) by reducing its counted lines from 401 to 400 with a formatting-only change. Validation passed: - UI lint with zero warnings - UI typecheck - `git diff --check` No commit created. PR: #1971 Comment by: @github-actions[bot] (ID: 5463945190) Model: gpt-5.6-sol
[Epic] 1951-epic-desktop-experience-uxs
Implemented F2 only. - [`normalizeApiBaseUrl`](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T18-13-46/apps/desktop/src/security.ts:17) now rejects path-bearing URLs, accepts root slashes only, and returns `url.origin`. - Added security, logout, and profile-store regressions covering `/base` rejection, non-persistence, trailing roots, and exact `[::1]` origins. - Scheme, host, and loopback allowlists were unchanged. All runnable checks passed, including: - Desktop tests: 24/24 - Client tests: 10/10 - API CORS tests: 12/12 - Desktop/UI typechecks - Production package and ASAR inspection - Root fast suite: 278 tests - Hosted regressions: 314 tests plus 66 UI tests - Notification regressions and browser smoke: 4/4 - Builds/lints, audits, release verification, CLI packaging - `git diff --check` The sandboxed Electron GUI launch could not complete because this unprivileged container lacks root/setuid sandbox setup and Xvfb. Workflow lint was likewise unavailable because Docker/actionlint/shellcheck are not installed. No commit was created. PR: #1971 Comment by: @integry (ID: 5464048347) Model: gpt-5.6-sol
…epic-electron-runtime-app Automatically resolved merge conflicts after merging target branch into PR branch. Resolved conflicts in: - package-lock.json - propr-ui/src/App.tsx - propr-ui/src/components/Layout.tsx - propr-ui/src/pages/LoginPage.tsx PR: #1971 Model: gpt-5.6-sol
…ees/integry/propr/pr-1971-followup-2026-08-29T18-33-24/propr-ui/src/App.tsx:44) by reducing the ESLint-counted lines from 401 to 400. This is formatting-only. Fixed the CI blocker in [App.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1971-followup-2026-08-29T18-33-24/propr-ui/src/App.tsx:44) by reducing the ESLint-counted lines from 401 to 400. This is formatting-only. Validated successfully: - UI lint, typecheck, and production build - Core/API lint and build - CLI typecheck and build - Desktop typecheck and production package - Desktop tests: 24/24 - Client tests: 10/10 - CORS tests: 12/12 - DesktopExperience tests: 21/21 - Local-setup tests: 10/10 - `git diff --check` Only the sandboxed launch could not run locally because this container lacks both `sudo` and `xvfb-run`. No commit was created. PR: #1971 Comment by: @github-actions[bot] (ID: 5464141981) Model: gpt-5.6-sol
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration-only sync from the top-combined runtime branch into the UX sub-epic so #1960 can start from the real secure Electron bridge, transport client, and chooser/setup extraction. This targets a sub-epic branch, never main. The runtime CSS production-build repair remains active on #1971 and will be resynchronized before child integration.