Repository navigation
EnvScope 0.25: scoped permissions, persistent guards and minimal desktop UI - #12
Merged
Merged
Conversation
…ission expectations
qudadd
marked this pull request as ready for review
October 30, 2026 11:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EnvScope 0.25.0 distinguishes denied access from unavailable observations, provides scoped permission guidance and rechecks the original selection on return. Windows adds a protected native timezone guard with reviewed installation, recovery and persistent actionable notifications. Unsigned open-source packages retain stable native identity and reject inconsistent update metadata.
The desktop interface follows target → check → problems/repair → guard, with a compact sidebar, original application/tray/navigation icons and retained scroll/disclosure state. Regressions cover repeated audits, settings refresh/save, first-run location reads and nested repair rechecks.
Final review fixes preserve the recovery entry when an upgrade leaves an incomplete baseline/worker pair, prevent scheduled writes throughout an incomplete lifecycle, and share strict heartbeat version/policy/target validation. Workers and lifecycle operations share an exclusive lock; only a committed protected receipt enables scheduled writes.
Validation: 726 Python tests (5 platform skips), 19 JavaScript tests, module syntax, wheel/vendor checks, six Windows/macOS browser viewport fixtures, permission/selection/region/full repair/usability workflows, and a frozen Windows package plus archive update/native startup. Dedicated CI additionally covers native service lifecycle, scheduled cycles, changed-worker interruption and a truncated baseline. The checks attached to this PR identify the exact tested source.
Windows packages remain unsigned; macOS uses ad-hoc signing without Developer ID/notarization. Human UAC/TCC allow/cancel/revoke, reboot/sleep and real Claude authentication remain separate pending device evidence in docs/PERMISSION_ACCEPTANCE.md. No real user configuration, networking or accounts changed during tests.