Enhance FlowChat with export options, session management, and performance optimizations

.cargo/config.toml

@@ -0,0 +1,10 @@
+# ts-rs (Rust -> TypeScript) export configuration.
+# `cargo test --features ts` (or the frontend `gen:types` script) emits `.ts`
+# files into the directory below. Generated types are NOT committed (see
+# `.gitignore`); the `prebuild` step regenerates them locally and in CI.
+# See docs/plans/step1-ts-rs-integration.md.
+[env]
+TS_RS_EXPORT_DIR = { value = "src/web-ui/src/generated/api", relative = true }
+# Map i64/u64 to `number` (not `bigint`) so generated types match the existing
+# frontend convention (timestamps are `number` ms throughout the web UI).
+TS_RS_LARGE_INT = "number"

.gitattributes

@@ -0,0 +1,38 @@
+#**
+# Line-ending policy.
+#
+# Git for Windows defaults to `core.autocrlf=true`, which rewrites every text
+# file to CRLF on checkout. Two BitFun paths break silently when that happens:
+#
+#   1. `src/apps/relay-server/*.sh` is embedded into the Desktop binary with
+#      `include_str!` and uploaded verbatim to the relay host. A CR turns each
+#      blank line into `$'\r': command not found`, and `set -e` aborts the
+#      one-click deploy on the first one.
+#   2. Rust raw string literals (`r#"..."#`) that hold remote bash carry the
+#      checkout's CRLF into the generated scripts the same way.
+#
+# Force LF for everything that has to run on a POSIX host, regardless of where
+# it was checked out. Windows-only scripts (`*.ps1`) are left alone — PowerShell
+# reads LF fine and pinning them would churn every non-Windows working tree.
+#**
+
+*.sh                text eol=lf
+*.bash              text eol=lf
+*.rs                text eol=lf
+*.py                text eol=lf
+*.mjs               text eol=lf
+*.cjs               text eol=lf
+
+# models.dev provenance hashes exact redistributed bytes. Keep these assets
+# stable across checkout platforms so the offline release check is reproducible.
+src/crates/services/services-integrations/assets/models-dev.json text eol=lf
+src/crates/services/services-integrations/assets/models-dev.LICENSE.txt text eol=lf
+src/crates/services/services-integrations/assets/models-dev.provenance.json text eol=lf
+
+Dockerfile          text eol=lf
+Dockerfile.*        text eol=lf
+*.Dockerfile        text eol=lf
+.dockerignore       text eol=lf
+docker-compose.yml  text eol=lf
+docker-compose.*.yml text eol=lf
+Caddyfile           text eol=lf

.github/workflows/ci.yml

@@ -21,15 +21,81 @@ permissions:
   contents: read
 
 jobs:
+  # ── Shell deploy assets: LF endings + syntax ───────────────────────
+  # Relay one-click deploy embeds these scripts into the Desktop binary and
+  # uploads them verbatim to a Linux host, where a single CR aborts the deploy
+  # with `$'\r': command not found`. .gitattributes pins LF; this is the guard.
+  shell-scripts:
+    name: Shell Deploy Scripts
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
+
+      - name: Reject CRLF in shell and deploy assets
+        run: |
+          bad=$(git ls-files -z \
+                  '*.sh' '*.bash' 'Dockerfile' 'Dockerfile.*' '*.Dockerfile' 'Caddyfile' \
+                  'docker-compose.yml' 'docker-compose.*.yml' \
+                | xargs -0 -r grep -lU $'\r' || true)
+          if [ -n "$bad" ]; then
+            echo "::error::CRLF line endings found; these must stay LF (see .gitattributes):"
+            echo "$bad"
+            exit 1
+          fi
+          echo "All shell and deploy assets are LF-only."
+
+      - name: bash -n every tracked shell script
+        run: |
+          rc=0
+          while IFS= read -r -d '' f; do
+            bash -n "$f" || { echo "::error file=$f::bash syntax error"; rc=1; }
+          done < <(git ls-files -z '*.sh' '*.bash')
+          exit "$rc"
+
+      - name: Verify release and version-generation contracts
+        run: node --test scripts/tauri-release-manifest.test.mjs scripts/linux-binaries-manifest.test.mjs scripts/version-generation.test.mjs
+
+      - name: Verify minisign download fallback
+        run: |
+          set -euo pipefail
+          test_root="$(mktemp -d)"
+          trap 'rm -rf "$test_root"' EXIT
+          mkdir -p "$test_root/stubs"
+          printf '#!/usr/bin/env bash\nexit 1\n' >"$test_root/stubs/sudo"
+          chmod +x "$test_root/stubs/sudo"
+
+          PATH="$test_root/stubs:/usr/bin:/bin" \
+            RUNNER_TEMP="$test_root" \
+            BITFUN_SIGNING_KEY="YQ==" \
+            bash scripts/sign-release-assets.sh "$test_root/missing-asset"
+
+          "$test_root/bitfun-minisign-0.12/bin/minisign" -v
+
   # ── CLI: independent tests ─────────────────────────────────────────
   cli-test:
-    name: CLI Tests (ubuntu-latest)
-    runs-on: ubuntu-latest
+    name: CLI Tests (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            cache_key: ubuntu
+          - os: macos-15
+            cache_key: macos
     steps:
       - uses: actions/checkout@v5
 
       - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
         shell: bash
         run: |
           sudo apt-get update
@@ -44,23 +110,37 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
-      - name: Generate dependency lockfile
-        run: cargo generate-lockfile
-
       - uses: swatinem/rust-cache@v2
         with:
-          shared-key: "cli-ci-v2-ubuntu"
+          shared-key: "cli-ci-v2-${{ matrix.cache_key }}"
           cache-bin: false
-          save-if: ${{ github.event_name != 'pull_request' }}
+          # PRs restore trusted caches but never publish merge-ref artifacts.
+          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+
+      - name: Run CLI and ACP tests on macOS
+        if: runner.os == 'macOS'
+        run: cargo test --locked -p bitfun-cli -p bitfun-acp
 
-      - name: Run CLI, ACP, SDK Host, and agent runtime tests
-        run: cargo test --locked -p bitfun-cli -p bitfun-acp -p bitfun-sdk-host -p bitfun-sdk-host-app -p bitfun-agent-runtime
+      - name: Run CLI, ACP, and agent runtime tests
+        if: runner.os == 'Linux'
+        run: cargo test --locked -p bitfun-cli -p bitfun-acp -p bitfun-agent-runtime
+
+      - name: Run SDK Host tests
+        if: runner.os == 'Linux'
+        run: cargo test --locked -p bitfun-sdk-host -p bitfun-sdk-host-app
+
+      - name: Run SDK Host terminal cleanup regressions
+        if: runner.os == 'Linux'
+        run: |
+          cargo test --locked -p terminal-core shutdown_returns_only_after_process_exit_is_confirmed -- --test-threads=1
+          cargo test --locked -p terminal-core shutdown_evicts_a_process_whose_controller_already_confirmed_exit -- --test-threads=1
+          cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1
 
   # ── Rust: build check ─────────────────────────────────────────────
   rust-build-check:
     name: Rust Build Check (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    needs: frontend-build
     env:
       # Keep the workspace check plus desktop test profiles within hosted-runner disk limits.
       CARGO_INCREMENTAL: "0"
@@ -76,20 +156,11 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Setup OpenSSL (Windows, prebuilt)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: ./scripts/ci/setup-openssl-windows.ps1
-
-      - name: Download frontend build artifacts
-        uses: actions/download-artifact@v7
-        with:
-          name: frontend-dist
-          path: dist
-
-      - name: Create mobile-web dist directory (workaround for Tauri)
+      # Tauri code generation only requires its configured resource roots to
+      # exist during check/test; distributable assets remain frontend-build's owner.
+      - name: Create Tauri resource directories
         shell: bash
-        run: mkdir -p src/mobile-web/dist
+        run: mkdir -p dist src/mobile-web/dist
 
       - name: Install Linux system dependencies (Tauri)
         if: runner.os == 'Linux'
@@ -124,37 +195,26 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
-      - name: Generate dependency lockfile
-        run: cargo generate-lockfile
-
       - uses: swatinem/rust-cache@v2
         with:
           shared-key: "ci-check-v3-${{ runner.os }}-no-cargo-bin-v1"
           cache-bin: false
-          # PR caches are scoped to merge refs; main pushes own shared cache refreshes.
-          save-if: ${{ github.event_name != 'pull_request' }}
+          # PR caches are scoped to merge refs; trusted main pushes own shared
+          # refreshes and retain completed dependency builds after late test failures.
+          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
       - name: Check compilation
         run: cargo check --locked --workspace
 
-      - name: Run SDK Host terminal cleanup regressions
-        # This PR changes only the PTY/session shutdown path required by
-        # connection-scoped Session cleanup. Keep the gate scoped to those
-        # regressions instead of adopting unrelated terminal command tests.
-        run: |
-          cargo test --locked -p terminal-core shutdown_returns_only_after_process_exit_is_confirmed -- --test-threads=1
-          cargo test --locked -p terminal-core shutdown_evicts_a_process_whose_controller_already_confirmed_exit -- --test-threads=1
-          cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1
-
-      - name: Run standalone SDK Host process smokes
-        run: cargo test --locked -p bitfun-sdk-host-app --test process_initialization --test stdio_process
-
-      - name: Run Windows ConPTY CLI smoke test
+      # The installer is intentionally excluded from the root Cargo workspace,
+      # so the workspace check above cannot catch drift in its shared Rust APIs.
+      - name: Check installer compilation
         if: runner.os == 'Windows'
-        run: cargo test --locked -p bitfun-cli --test terminal_process_contracts
+        run: cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml
 
-      - name: Run core and desktop Rust tests
-        run: cargo test --locked -p bitfun-core -p bitfun-desktop
+      - name: Run core and desktop library tests
+        run: cargo test --locked -p bitfun-core -p bitfun-desktop --lib
 
       # These crates own platform-sensitive behavior that is not exercised by
       # testing bitfun-core/bitfun-desktop alone. Keep their focused contract
@@ -167,7 +227,27 @@ jobs:
         run: cargo test --locked -p bitfun-relay-service
 
       - name: Run subscription authentication tests
-        run: cargo test --locked -p bitfun-ai-adapters --features subscription-auth subscription_auth
+        run: cargo test --locked -p bitfun-ai-adapters --features subscription-auth --lib subscription_auth
+
+      # File watching is backed by a different OS API on every platform
+      # (ReadDirectoryChangesW / FSEvents / inotify), so watch registration
+      # regressions surface per-OS. The suite is behind a non-default feature
+      # and would otherwise never run anywhere.
+      #
+      # macOS is excluded: this suite already fails there before any of this
+      # branch's changes (the debounce/atomic-rename contracts time out under
+      # FSEvents coalescing), which is worth fixing separately rather than
+      # blocking unrelated work.
+      - name: Run file watch contract tests
+        if: runner.os != 'macOS'
+        run: cargo test --locked -p bitfun-services-integrations --no-default-features --features file-watch --test file_watch_contracts
+
+      # Search tools resolve paths and symlinks directly, which also differs
+      # across platforms. Scoped to the search module: the glob tests in this
+      # crate fail on Windows independently of this branch (walk-root
+      # derivation treats separators differently) and need their own fix.
+      - name: Run search tool tests
+        run: "cargo test --locked -p tool-runtime --lib search::"
 
   # ── Frontend: build ────────────────────────────────────────────────
   frontend-build:
@@ -240,10 +320,3 @@ jobs:
 
       - name: Build mobile web
         run: pnpm run build:mobile-web
-
-      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@v6
-        with:
-          name: frontend-dist
-          path: dist
-          retention-days: 1

.github/workflows/cli-package.yml

@@ -119,6 +119,10 @@ jobs:
       - name: Build CLI (Unix)
         if: runner.os != 'Windows'
         shell: bash
+        env:
+          # Keep the CLI self-updater and SSH installer on the same embedded
+          # minisign trust root used by the Desktop updater.
+          BITFUN_RELEASE_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
         run: |
           set -euo pipefail
           cargo build --release \
@@ -168,6 +172,19 @@ jobs:
         run: |
           ./scripts/cli/package-windows.ps1 -Version $env:VERSION -Target $env:TARGET
 
+      - name: Sign CLI archive and checksum (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        env:
+          BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+        run: |
+          set -euo pipefail
+          bash scripts/sign-release-assets.sh \
+            "${{ steps.stage.outputs.archive }}" \
+            "${{ steps.stage.outputs.checksum }}"
+
       - name: Upload artifact
         uses: actions/upload-artifact@v6
         with:
@@ -176,6 +193,8 @@ jobs:
           path: |
             ${{ steps.stage.outputs.archive || steps.stage-windows.outputs.archive }}
             ${{ steps.stage.outputs.checksum || steps.stage-windows.outputs.checksum }}
+            bitfun-cli-*.tar.gz.sig
+            bitfun-cli-*.tar.gz.sha256.sig
 
   # ── Aggregate and upload to GitHub Release ─────────────────────────
   upload-release-assets:
@@ -227,6 +246,8 @@ jobs:
           files: |
             cli-release-assets/bitfun-cli-*.tar.gz
             cli-release-assets/bitfun-cli-*.tar.gz.sha256
+            cli-release-assets/bitfun-cli-*.tar.gz.sig
+            cli-release-assets/bitfun-cli-*.tar.gz.sha256.sig
             cli-release-assets/bitfun-cli-*.zip
             cli-release-assets/bitfun-cli-*.zip.sha256
             cli-release-assets/SHA256SUMS