chore(sync): merge sanitized upstream through v1.0.3 (Helm)

.dockerignore

@@ -1,17 +1,42 @@
+# What never enters a build context rooted here: the runtime image (Dockerfile) copies
+# pyproject.toml, README.md, LICENSE, nanomuse/ and config/config.example.toml; the showcase's
+# Caddy image (demo/showcase/caddy/Dockerfile, built from this root too) copies demo/mobilegym/
+# and demo/showcase/site/. A pattern without `**/` matches at the root only (Go's
+# filepath.Match, not gitignore), so the caches are listed with it.
 .git
+.github
 .venv
 .env
-__pycache__
-*.pyc
-.pytest_cache
-.ruff_cache
+.env.*
+**/__pycache__
+**/*.pyc
+**/.pytest_cache
+**/.ruff_cache
+**/.mypy_cache
+**/*.egg-info
+**/node_modules
 workspace/
 config/config.toml
 config/*.local.toml
 tests/
 docs/
 dist/
 build/
-*.egg-info
-web/node_modules/
-web/dist/
+# the other trees: the Android and iPhone apps with their native builds, the desktop, the
+# relay, the web console's sources (its build is committed under nanomuse/server/static/),
+# the docs site, the project page
+android/
+harness/
+cloud/
+web/
+website/
+site/
+assets/
+scripts/
+CHANGELOG.md
+# the showcase's run-time directories (demo/showcase/.gitignore): the dataset, other sites
+demo/showcase/data/
+demo/showcase/site/dist/
+demo/showcase/sites.d/
+demo/showcase/www/
+demo/showcase/mobilegym/

.gitattributes

@@ -3,3 +3,19 @@
 # normalised: android/ is an upstream subtree and carries a few vendored files as they came.
 *.sh text eol=lf
 gradlew text eol=lf
+
+# The desktop (harness/) is built and tested on Windows runners, whose checkout turns LF into
+# CRLF under core.autocrlf; its tests read their own sources and look for `\n` in them (the
+# v1.0.3 tag's Windows installer build failed on exactly that), so the tree's text files keep
+# LF on every platform. Git tells text from binary itself; the clips and pictures are named
+# so that the detection can never touch them.
+harness/** text=auto eol=lf
+harness/**/*.mp4 binary
+harness/**/*.png binary
+harness/**/*.webp binary
+harness/**/*.icns binary
+harness/**/*.ico binary
+# The phones' copies of the desktop's catalogues and Ideas lists: the desktop's tests compare
+# them with its own byte for byte (tests/fences.test.mjs), so they keep LF the same way.
+android/src/android/app/src/main/assets/nanomuse/*.json text eol=lf
+android/src/ios/NanoMuse/Resources/*.json text eol=lf

.github/ISSUE_TEMPLATE/app_bug_report.yml

@@ -30,7 +30,7 @@ body:
     id: version
     attributes:
       label: nanoMuse version
-      description: Settings → About, e.g. 1.0.2 (45)
+      description: Settings → About, e.g. 1.0.3 (46)
     validations:
       required: true
   - type: input

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -58,7 +58,7 @@ body:
     id: os
     attributes:
       label: OS and runtime
-      description: e.g. macOS 15 / Python 3.12, Ubuntu 24.04 / Docker, Windows 11 / desktop 1.0.2, iOS 18 / iPhone 15
+      description: e.g. macOS 15 / Python 3.12, Ubuntu 24.04 / Docker, Windows 11 / desktop 1.0.3, iOS 18 / iPhone 15
   - type: textarea
     id: logs
     attributes:

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,7 +2,7 @@
 
 ## What
 
-<!-- One or two sentences. Link the issue if there is one: Fixes #123 -->
+<!-- One or two sentences. Link the issue if there is one: For #123 (not Fixes or Closes; an issue stays open until the fix has shipped) -->
 
 ## Why
 
@@ -12,7 +12,7 @@
 
 <!-- Tick what applies; the commands are in AGENTS.md, one block per part of the tree. -->
 
-- [ ] The checks for the part I changed pass (runtime: `ruff check nanomuse tests scripts && ruff format --check nanomuse tests scripts && mypy && python -m pytest -q -m "not live"`; relay: `cd cloud && ruff check . && pytest`; web: `cd web && npm run check && npm run build`; desktop: `cd harness/dsh-nanomuse && pnpm build && pnpm typecheck && pnpm test`)
+- [ ] The checks for the part I changed pass (runtime: `ruff check nanomuse tests scripts && ruff format --check nanomuse tests scripts && mypy && python -m pytest -q -m "not live"`; relay: `cd cloud && ruff check . && ruff format --check . && pytest`; web: `cd web && npm run check && npm run build`; desktop: `cd harness/dsh-nanomuse && pnpm build && pnpm typecheck && pnpm test`)
 - [ ] New behaviour has a test; tests use `MockLLM`, no network
 - [ ] If a person sees or does something differently: a line under `## [Unreleased]` in `CHANGELOG.md` (past tense, concrete, in the right section) and the page under `docs/` with its `docs/zh/` twin
 - [ ] If a user-visible string was added or changed: every locale of that file (English first, then 简体中文, then the rest; same placeholders)

.github/labeler.yml

@@ -0,0 +1,52 @@
+# Platform labels for pull requests, from the files a pull request touches (actions/labeler).
+# The kind label (bug, enhancement, documentation, ci, release, maintenance) comes from the title;
+# see .github/workflows/labels.yml and CONTRIBUTING.md, "Issues and pull requests (maintainers)".
+
+android:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "android/src/android/**"
+          - "android/deps/**"
+          - "android/scripts/**"
+          - "scripts/android/**"
+          - "scripts/release-apk.sh"
+
+ios:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "android/src/ios/**"
+          - "scripts/gen-ios-icons.py"
+          - ".github/workflows/ios-*.yml"
+
+desktop:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "harness/**"
+          - ".github/workflows/desktop-app.yml"
+          - ".github/workflows/harness.yml"
+
+web:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "web/**"
+          - "nanomuse/server/static/**"
+          - "demo/**"
+
+runtime:
+  - changed-files:
+      - any-glob-to-any-file:
+          # nanomuse/ without nanomuse/server/static/, the committed web build (that is `web`,
+          # above): the four globs together cover every other file under nanomuse/
+          - "nanomuse/*"
+          - "nanomuse/!(server)/**"
+          - "nanomuse/server/*"
+          - "nanomuse/server/!(static)/**"
+          - "tests/**"
+          - "pyproject.toml"
+          - "Dockerfile"
+          - "docker-compose.yml"
+
+cloud:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "cloud/**"

.github/workflows/android.yml

@@ -88,12 +88,24 @@ jobs:
           ./gradlew :app:assembleDebug --console=plain --no-daemon
 
       # Our unit tests (io.github.nanomuse.*: the guards, the hub client, the sandbox paths, the
-      # strings' parity). Same Gradle invocation as AGENTS.md; the compiled classes are warm.
+      # strings' parity), plus the upstream provider and sandbox tests, the two OpenMinis packages
+      # our edits touch (#333, #334, #335). Same Gradle invocation as AGENTS.md; the compiled
+      # classes are warm.
       - name: Unit tests
         working-directory: android/src/android
         run: |
           export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION"
-          ./gradlew :app:testDebugUnitTest --tests 'io.github.nanomuse.*' --console=plain --no-daemon
+          ./gradlew :app:testDebugUnitTest --tests 'io.github.nanomuse.*' \
+            --tests 'com.openminis.app.provider.*' --tests 'com.openminis.app.sandbox.*' \
+            --console=plain --no-daemon
+
+      # The on-device tests cannot run here (no emulator), but the source set must keep
+      # compiling or io.github.nanomuse.reach.ReachHubInstrumentedTest never runs anywhere (#332).
+      - name: androidTest compiles
+        working-directory: android/src/android
+        run: |
+          export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION"
+          ./gradlew :app:compileDebugAndroidTestKotlin --console=plain --no-daemon
 
       - name: Badging
         run: |

.github/workflows/ci.yml

@@ -35,6 +35,7 @@ jobs:
               - "nanomuse/**"
               - "tests/**"
               - "scripts/**"
+              - "config/**" # config.example.toml: the tests read it, the image carries it
               - "pyproject.toml"
               - "Dockerfile"
               - ".dockerignore"
@@ -172,6 +173,10 @@ jobs:
         if: env.RUN == 'true'
         run: uv run ruff check .
 
+      - name: Ruff format
+        if: env.RUN == 'true'
+        run: uv run ruff format --check .
+
       - name: Tests
         if: env.RUN == 'true'
         run: uv run python -m pytest -q

.github/workflows/desktop-app.yml

@@ -8,8 +8,8 @@
 # Each platform builds the bundle (harness/dsh-nanomuse: pnpm build, test, pack), stages dsh
 # next to it with npm (scripts/prepare-dsh.mjs, the platform's own native prebuilds), builds
 # the runtime (scripts/desktop-app/build-runtime.py --target harness/desktop/runtime, a
-# PyInstaller build), wraps it all with electron-builder, and
-# then boots the unpacked app's harness once in Node mode (scripts/smoke.mjs) to see the Host
+# PyInstaller build), runs the shell's own tests (harness/desktop: npm test), wraps it all
+# with electron-builder, and then boots the unpacked app's harness once in Node mode (scripts/smoke.mjs) to see the Host
 # come up with the bundle's rows. On macOS the Swift helper that holds the hands' permissions
 # (harness/desktop/mac/computer-use/build.sh → "nanoMuse Computer Use.app") is built first and
 # electron-builder lays out the .app with it inside;
@@ -40,7 +40,10 @@ permissions:
   contents: read
 
 # One run per branch; a newer push to the same branch cancels the older build,
-# but a tag or a manual run is never cancelled.
+# but a tag or a manual run is never cancelled. A manual run shares the group of the branch it
+# runs on: "Run workflow" on main while a push to main is building waits for that build to end
+# rather than running beside it, which is slower but never leaves two runs attaching the
+# same installers.
 concurrency:
   group: desktop-app-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' && !startsWith(github.ref, 'refs/tags/') }}
@@ -144,6 +147,7 @@ jobs:
         run: |
           npm ci
           npm run typecheck
+          npm test
           npm run dist
       - name: The helper that holds the hands' permissions (macOS, nanoMuse Computer Use.app, Swift)
         if: runner.os == 'macOS'
@@ -167,6 +171,7 @@ jobs:
         run: |
           npm ci
           npm run typecheck
+          npm test
           npm run dist:dir
           ../../scripts/desktop-app/package-mac.sh "${{ matrix.label == 'macos-arm64' && 'arm64' || 'x64' }}"
       - name: Boot the packaged harness once

.github/workflows/docker.yml

@@ -3,6 +3,7 @@ name: Docker image
 # Publishes ghcr.io/nano-muse/nanomuse for linux/amd64 and linux/arm64:
 #   main            -> :edge
 #   tag vX.Y.Z      -> :X.Y.Z, :X.Y, :latest
+#   tag vX.Y.Z-rc1  -> :X.Y.Z-rc1 only (a pre-release moves neither :X.Y nor :latest)
 # Pull requests build the amd64 image without pushing (the CI workflow smoke-tests it).
 
 on:
@@ -47,7 +48,8 @@ jobs:
             type=edge,branch=main
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-fork.') }}
+            # fork tags (v1.0.3-fork.1) contain '-' and never move latest; neither do prereleases
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}
           labels: |
             org.opencontainers.image.title=nanoMuse
             org.opencontainers.image.description=Open-source version of Meta's Muse personal agent: phone app, Sentinel gatekeeper, credential vault, memory and goals. Bring your own model.
@@ -80,7 +82,8 @@ jobs:
             type=edge,branch=main
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-fork.') }}
+            # fork tags (v1.0.3-fork.1) contain '-' and never move latest; neither do prereleases
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}
           labels: |
             org.opencontainers.image.title=nanoMuse (with browser)
             org.opencontainers.image.description=nanoMuse with Chromium bundled for the browser tool.

.github/workflows/harness.yml

@@ -5,20 +5,24 @@
 #                                   (docs/harness.md, harness/README.md); nanoMuse Desktop
 #                                   itself carries the same bundle (desktop-app.yml)
 #
-# A push or pull request that touches harness/ builds, typechecks and tests the bundle; a
-# release tag `v*` also packs it and attaches the tarball and its checksum to the release of
+# A push or pull request that touches harness/ builds, typechecks and tests the bundle and the
+# Electron shell (harness/desktop: typecheck and its node tests, no installer), on Linux and on
+# Windows, where the tests see a checkout made with core.autocrlf and Windows paths; a
+# release tag `v*` also packs the bundle and attaches the tarball and its checksum to the release of
 # the same name (the one scripts/release-apk.sh creates with the APK), retrying until it
 # exists. "Run workflow" with a release tag does the same for a release that already exists.
 # The bundle's version must be the tag's: the release recipe bumps harness/dsh-nanomuse/package.json.
+# The paths include the phones' copies of the catalogues and of the Ideas list: the tests
+# check that they match the desktop's (tests/fences.test.mjs, connectors-json.mjs --check).
 name: harness bundle
 
 on:
   push:
     branches: ["**"]
-    paths: ["harness/**", "scripts/connectors-json.mjs", "scripts/providers-json.mjs", "nanomuse/llm/providers.json", "android/src/android/app/src/main/assets/nanomuse/connectors.json", "android/src/android/app/src/main/assets/nanomuse/providers.json", "android/src/ios/NanoMuse/Resources/connectors.json", "android/src/ios/NanoMuse/Resources/providers.json", ".github/workflows/harness.yml"]
+    paths: ["harness/**", "scripts/connectors-json.mjs", "scripts/providers-json.mjs", "nanomuse/llm/providers.json", "android/src/android/app/src/main/assets/nanomuse/connectors.json", "android/src/android/app/src/main/assets/nanomuse/providers.json", "android/src/android/app/src/main/assets/nanomuse/ideas.*.json", "android/src/ios/NanoMuse/Resources/connectors.json", "android/src/ios/NanoMuse/Resources/providers.json", ".github/workflows/harness.yml"]
     tags: ["v*"]
   pull_request:
-    paths: ["harness/**", "scripts/connectors-json.mjs", "scripts/providers-json.mjs", "nanomuse/llm/providers.json", "android/src/android/app/src/main/assets/nanomuse/connectors.json", "android/src/android/app/src/main/assets/nanomuse/providers.json", "android/src/ios/NanoMuse/Resources/connectors.json", "android/src/ios/NanoMuse/Resources/providers.json", ".github/workflows/harness.yml"]
+    paths: ["harness/**", "scripts/connectors-json.mjs", "scripts/providers-json.mjs", "nanomuse/llm/providers.json", "android/src/android/app/src/main/assets/nanomuse/connectors.json", "android/src/android/app/src/main/assets/nanomuse/providers.json", "android/src/android/app/src/main/assets/nanomuse/ideas.*.json", "android/src/ios/NanoMuse/Resources/connectors.json", "android/src/ios/NanoMuse/Resources/providers.json", ".github/workflows/harness.yml"]
   workflow_dispatch:
     inputs:
       release_tag:
@@ -40,6 +44,7 @@ jobs:
   bundle:
     name: build · test · pack
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
@@ -59,6 +64,16 @@ jobs:
           pnpm build
           pnpm typecheck
           pnpm test
+      # The Electron shell's own checks (AGENTS.md). Its tests stand in a fake `electron`
+      # module, so the Electron binary is not downloaded; desktop-app.yml builds the real thing.
+      - name: The desktop shell typechecks and its tests pass
+        working-directory: harness/desktop
+        env:
+          ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
+        run: |
+          npm ci
+          npm run typecheck
+          npm test
       - name: The phones' copies of the connectors catalogue are current
         run: node scripts/connectors-json.mjs --check
       - name: The clients' copies of the provider catalogue are current
@@ -99,6 +114,42 @@ jobs:
           path: packages/*
           if-no-files-found: error
 
+  # The same build, typecheck and tests on Windows, on every pull request: the v1.0.3 tag's
+  # Windows installer build failed on a test that first met a CRLF checkout there, which
+  # desktop-app.yml only runs on a tag or by hand. No pack, no dsh install, no installer.
+  windows:
+    name: build · test (Windows)
+    runs-on: windows-latest
+    # a test that leaves a handle open hangs the process; the limit turns that into a failure
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: harness/dsh-nanomuse/pnpm-lock.yaml
+      - name: The bundle
+        working-directory: harness/dsh-nanomuse
+        shell: bash
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build
+          pnpm typecheck
+          pnpm test
+      - name: The desktop shell
+        working-directory: harness/desktop
+        shell: bash
+        env:
+          ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
+        run: |
+          npm ci
+          npm run typecheck
+          npm test
+
   release:
     if: (startsWith(github.ref, 'refs/tags/v') || inputs.release_tag != '') && !contains(inputs.release_tag || github.ref_name, '-fork.')
     needs: bundle

.github/workflows/ios-testflight.yml

@@ -6,6 +6,8 @@ name: iOS · TestFlight
 #   IOS_DIST_P12_BASE64, IOS_DIST_P12_PASSWORD
 # Signing is manual: the team's Apple Distribution certificate from the secrets, the App Store
 # profiles fetched from the account with the key. Nothing that signs is in the repository.
+# The build number (CFBundleVersion) is this workflow's run number, so every upload counts up
+# on its own and the release notes can name it; the marketing version is the project's.
 
 on:
   workflow_dispatch: