Skip to content

build(gpui): default to the git GPUI pair (Zed + gpui-component) over crates.io - #1

Merged
hellno merged 2 commits into
mainfrom
hellno/swap-gpui-git-crates
Jun 5, 2026
Merged

build(gpui): default to the git GPUI pair (Zed + gpui-component) over crates.io#1
hellno merged 2 commits into
mainfrom
hellno/swap-gpui-git-crates

Conversation

@hellno

@hellno hellno commented Jun 5, 2026

Copy link
Copy Markdown
Owner

Summary

Swap the GPUI dependency from the pure-crates.io pair (gpui 0.2 + gpui-component 0.5 + -assets) to the matched git pair — gpui + gpui_platform from zed-industries/zed and gpui-component (+ -assets) from longbridge/gpui-component. This is the only way to pair fresh gpui with the component kit (gpui-component is developed against Zed's gpui HEAD).

Mirrors the upstream starter change in hellno/deck#2.

Reproducibility lives in the committed Cargo.lock, pinned to the exact commits deck#2 validated (not floating HEAD, so the API surface is exactly the documented drift):

  • Zed: 86effffd34634945a4971e1c6c65cd45b21ce6a9
  • longbridge/gpui-component: dadfca97fec7221acf3ce7047bccdc1eac0506b9

Changes

  • Cargo.toml — 3 crates.io lines → 4 git lines (gpui_platform carries features = ["font-kit"]).
  • rust-toolchain.toml — stable → 1.95.0 to match Zed (gpui HEAD uses std::hint::cold_path, stabilized in 1.95.0).
  • API drift on newer gpui:
    • Application::new() → gpui_platform::application() (drop Application from the gpui import) — src/main.rs
    • new required Menu.disabled: false field (×4 menu literals) — src/main.rs
    • window.focus(&handle, cx) now takes a context arg — src/shell.rs
    • drop let _ = on the now-infallible tray cx.update() (×2) — src/tray.rs
  • .github/workflows/ci.yml — drop dtolnay/rust-toolchain; rust-toolchain.toml is the single source of truth (renderer note blade → wgpu on Linux).
  • justfile — add bump-gpui recipe.
  • Docs — add docs/UPGRADING.md (git channel + crates.io fallback); update LEARNINGS.md §2/§15 to the two-channels reality.

Note vs deck#2: deck migrated window.focus in two files; deckard's palette (palette.rs) doesn't call window.focus, so there was only one site here (shell.rs).

Verification

Built locally against the pinned commits:

  • ✅ cargo build
  • ✅ cargo build --features tray
  • ✅ cargo clippy --all-targets --features tray -- -D warnings

Adversarial cross-model review by codex GPT-5.5 (xhigh): P0_FOUND: no. It independently confirmed the API-drift edits are complete (no leftover Application::new, no missing Menu.disabled, no one-arg window.focus, only the two tray cx.update), that gpui_platform::application() returns gpui::Application, that disabled: false keeps menus enabled, and that AsyncApp::update is infallible at the pinned Zed source.

The one P2 note (manifest pins via Cargo.lock rather than rev=) is by design — that's the intended reproducible pin, and docs/UPGRADING.md documents the optional rev path.

First build is slow

The first cargo build compiles gpui from Zed's git from source (a few minutes, once); rebuilds are fast. Bump cadence going forward: just bump-gpui (~monthly), per docs/UPGRADING.md.

hellno added 2 commits June 5, 2026 17:43
@hellno
build(gpui): default to the git GPUI pair over crates.io (deck#2)
92f49a7 
Swap the pure-crates.io GPUI stack (gpui 0.2 + gpui-component 0.5 +
gpui-component-assets 0.5) for the matched git pair: gpui + gpui_platform
from zed-industries/zed and gpui-component (+ -assets) from
longbridge/gpui-component. This is the only way to pair fresh gpui with the
component kit, which is developed against Zed's gpui HEAD. Mirrors deck PR #2.

Reproducibility lives in the committed Cargo.lock, pinned to the exact
commits deck#2 validated:
  - Zed:        86effffd34634945a4971e1c6c65cd45b21ce6a9
  - longbridge: dadfca97fec7221acf3ce7047bccdc1eac0506b9

Changes:
- Cargo.toml: 3 crates.io lines -> 4 git lines (gpui_platform carries
  features = ["font-kit"]).
- rust-toolchain.toml: stable -> 1.95.0 to match Zed (gpui HEAD uses
  std::hint::cold_path, stabilized in 1.95.0).
- API drift on newer gpui:
  * Application::new() -> gpui_platform::application() (drop Application import)
  * Menu.disabled: false (x4 menu literals in main.rs)
  * window.focus(&handle, cx) now takes a context arg (shell.rs)
  * drop `let _ =` on the now-infallible tray cx.update() (x2, tray.rs)
- ci.yml: drop dtolnay/rust-toolchain; rust-toolchain.toml is the single
  source of truth (renderer note blade -> wgpu on Linux).
- justfile: add `bump-gpui` recipe.
- docs: add docs/UPGRADING.md (git channel + crates.io fallback); update
  LEARNINGS.md sec 2 / sec 15 to the two-channels reality.

Verified locally on the pinned commits:
- cargo build
- cargo build --features tray
- cargo clippy --all-targets --features tray -- -D warnings
All pass. Adversarial review by codex GPT-5.5 (xhigh): no P0 findings;
API-drift edits confirmed complete.
@hellno
fix(ci): install libxdo-dev for the Linux tray build
91be8c6 
The Linux "cargo build --features tray" job failed to link with
"unable to find library -lxdo": tray-icon/muda link against the native
libxdo for menu event injection on X11, and deckard's CI never installed
the dev package (a pre-existing failure on main, surfaced now that we want
CI green). Matches upstream deck's ci.yml apt list.
@hellno
hellno force-pushed the hellno/swap-gpui-git-crates branch from bfe670e to 91be8c6 Compare June 5, 2026 17:07
@hellno
hellno merged commit c73ba1d into main Jun 5, 2026
2 checks passed
hellno added a commit that referenced this pull request Jun 7, 2026
@hellno
feat(helios): verified reads + ReadStatus across EthProvider and sign…
9e19e9a 
…erd (#1+#2)

Route both raw-RPC read paths through an embedded Helios light client and tag
every read with a trust label.

#1 deckard-contract: new ReadStatus { Verified | Degraded{reason} | Unsynced{reason} }
   + a read_status field on BalanceReport (round-trips JSON + CBOR).

#2 deckard-core: new helios.rs launcher (Helios localhost JSON-RPC server + the
   required with_default_block(latest) consumer-provider fix); EthProvider reads now
   go through it and return Read<T>{ value, status }. deckard-signerd: read_balance +
   the daemon Balance handler route through Helios the same way. App status line
   surfaces the tag (verified / NOT VERIFIED).

The heavy helios-ethereum dep is gated behind a default-on `verified-reads` feature
with an honest raw-RPC fallback: never claims Verified without a fresh Helios-backed
read (locked / Helios-down / feature-off all map to Unsynced; removed the old
unwrap_or(ZERO)-as-truth). v1 runs two independent Helios instances (app + daemon);
the failover supervisor and reads-consolidation are deferred (// TODO post-v1).

Adversarial review (Codex invoked + manual pass) fixed one P1: the daemon held its
global mutex across the multi-second Helios bootstrap, which could block the
STOP/Lock brake — Helios moved into an off-lock HeliosCell. Plus 3 P2 honesty fixes
(timestamp-based head freshness vs 60s, value-then-status ordering, no_std doc).

Verified green with the real cargo (rtk cache bypassed): build verified-reads ON+OFF,
deckard-app compiles; tests — signerd 15 lib + 9 daemon_e2e + 1 parity + 3 anvil_e2e
(STOP/zeroize + TOCTOU intact), contract 32, core 13.
hellno added a commit that referenced this pull request Jun 7, 2026
@hellno
feat(shield): key-less shield path wired into core + signerd + black-…
a0a37fd 
…box anvil test (#1)

Beat-2 shield is now a first-class write in Deckard's own path.

#1a deckard-core: `shield::build_shield_native_intent(chain_id, recipient, value)
   -> Intent{kind:Shield, to, value, calldata}` — KEY-LESS (a deposit needs only the
   recipient 0zk address, no spending key), behind a default-on `shield` Cargo feature.
   Feature-off compiles without railgun and returns an honest "shield unavailable" error.
#1b deckard-signerd: `broadcast_intent` carries calldata (Shield/ContractCall); the
   execute path broadcasts Intent calldata+value+to. Native sends stay byte-identical
   (broadcast_native_send is now a thin &[] wrapper). The daemon stays ZK-free — it only
   signs+broadcasts the bytes it's handed.
#1c crates/deckard-signerd/tests/shield_e2e.rs: a repeatable BLACK-BOX integration test
   (#[ignore], fresh anvil Sepolia fork @ 10822990) that drives Deckard's path end to end
   (core builder -> daemon propose/execute -> on-chain -> railgun sync) and hard-asserts
   the privacy property: private +997_500 (exact 25bps on 1_000_000), public down by
   value+gas. shield-only (fast, no proving/artifacts).

Adversarial review (Codex + manual) fixed two P1s:
- signerd `shield` feature was leaky (deckard-core dep lacked default-features=false, so
  the off-switch didn't drop railgun) -> fixed; railgun now absent from signerd's normal
  tree when off.
- SECURITY: `Intent{kind:Shield, calldata: empty}` would have broadcast as a plain native
  send to an arbitrary `to` under the "Shield" label -> `calldata_ok` now requires
  non-empty calldata for Shield/Unshield/ContractCall (Decision::Deny{undecodable}); daemon
  + contract tests cover it.

vendor/eip-1193-provider: a native-only fork of kohaku's eip-1193-provider (rev 618c53f,
verbatim .rs, `js` dropped) + a workspace [patch]. Required because upstream's `js` feature
pins wasm-bindgen=0.2.108 exact while the GPUI app's web-sys pins 0.2.122 exact — irreconcilable
in one workspace; `js` is wasm32-only and unused. Maintenance + license (no upstream license
field, like railgun) to revisit before ship.

Verified GREEN with real cargo (pinned 1.95.0), rtk cache bypassed: build default + feature-off
(railgun absent) + whole workspace incl. GPUI app; daemon_e2e 9/9 + parity 1/1 (STOP/zeroize +
TOCTOU + Shield-Allow/empty-Shield-Deny intact); deckard-contract 32+1; shield_e2e re-run by me
on a fresh fork (private +997500). Deferred (// TODO post-v1): receive-watcher, MCP, railgun
key-derivation for balance-display, production HeliosEip1193, Unshield/ContractCall (Deny v1).
This was referenced Jun 7, 2026
Open
Open
hellno pushed a commit that referenced this pull request Jun 14, 2026
@claude
docs(walletbeat): fold in locked decisions
b0fad8d 
Record the 2026-06-14 product decisions in the compatibility map:
- Funding: self-funded, no protocol revenue (content for #21 FUNDING.md)
- Security audit (#1): decision spike, budget/vendor undecided
- Out of scope for v0: social/guardian recovery (#6) and L2
  force-withdrawal (#15), documented as deliberate trade-offs

No GitHub issues opened (per process decision).
This was referenced Jun 14, 2026
Closed
Merged
hellno pushed a commit that referenced this pull request Jun 14, 2026
@claude
docs(walletbeat): fold in locked decisions
d9f9c96 
Record the 2026-06-14 product decisions in the compatibility map:
- Funding: self-funded, no protocol revenue (content for #21 FUNDING.md)
- Security audit (#1): decision spike, budget/vendor undecided
- Out of scope for v0: social/guardian recovery (#6) and L2
  force-withdrawal (#15), documented as deliberate trade-offs

No GitHub issues opened (per process decision).
@hellno hellno mentioned this pull request Jun 14, 2026
Merged
@hellno hellno mentioned this pull request Jun 24, 2026
Closed
19 tasks
This was referenced Jul 2, 2026
Closed
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hellno