chore(codewhale): adopt published r12 baseline (#33 native search, #35 keyless Bing tail) with search-source guidance - #375
Conversation
接入 CodeWhale r12 候选（2e429c378）：API 后端失败后的免 key 链尾 由 DuckDuckGo 换成 Bing——实测 DDG 在中国大陆网络 DNS 污染 + SNI 重置完全不可达，Bing 全球与国内端点均免 key 可达；全链失败错误 追加 API 后端配置建议。fork-modifications 登记 r12、fork-guard 指纹 +2（forkguard 总数 56→57）。 配套：设置页搜索源新增引导文案（i18n 三语）；勘误 prefs/search.rs 中「底座 patch #42 已翻默认」的过期注释（实际由 bridge 显式注入）。 验证：./scripts/fork-guard.sh 全过、cargo test backend/web_search 全过、 npm run test:ui-language 通过、architecture-guard 通过。 Signed-off-by: pinvou3-dev <dev@pinvou3.local>
JensenChen28
left a comment
JensenChen28
left a comment
There was a problem hiding this comment.
Review at found two blockers:\n\n1. [P1] The parent repository does not yet accept or verify this CodeWhale gitlink. The PR points at the r12 candidate commit , but 公开 CodeWhale 基线校验通过：pinvou-v0.9.5-r11 -> 0d89a31be016457c180501417dd2c0f34ce844a6 still requires the immutable tag. Consequently the required fast gate fails deterministically with “r11 resolves to , parent gitlink is .” Please land/publish the foundation change under the intended immutable r12 tag, update the public-submodule verifier and its policy coverage to that tag, and rerun the required gates. An untagged candidate commit does not satisfy the repository's published-baseline contract.\n\n2. [P2] Collaboration metadata and newly changed diagnostics are not English. The PR title/body, commit subject/body, and the newly edited status/error messages are Chinese. requires PR metadata, commits, code comments, developer documentation, and diagnostics to use English; localized UI resources and the Chinese fork register remain valid exceptions.\n\nI inspected the foundation delta: the API-provider chain tail change to Bing and its regression are internally coherent, and the frontend test passes. The baseline publication/verifier mismatch must be resolved before this can merge.
JensenChen28
left a comment
JensenChen28
left a comment
There was a problem hiding this comment.
Formatting correction for my changes-requested review:
Review at e429ec24 found two blockers:
-
[P1] The parent repository does not yet accept or verify this CodeWhale gitlink. The PR points
CodeWhaleat the r12 candidate commit2e429c378, butscripts/verify-public-submodule.shstill requires the immutablepinvou-v0.9.5-r11tag. Consequently the required fast gate fails deterministically with “r11 resolves to0d89a31b, parent gitlink is2e429c378.” Please land/publish the foundation change under the intended immutable r12 tag, update the public-submodule verifier and its policy coverage to that tag, and rerun the required gates. An untagged candidate commit does not satisfy the repository's published-baseline contract. -
[P2] Collaboration metadata and newly changed diagnostics are not English. The PR title/body, commit subject/body, and the newly edited
fork-guard.shstatus/error messages are Chinese.CONTRIBUTING.mdrequires PR metadata, commits, code comments, developer documentation, and diagnostics to use English; localized UI resources and the Chinese fork register remain valid exceptions.
I inspected the foundation delta: the API-provider chain tail change to Bing and its regression are internally coherent, and the frontend test passes. The baseline publication/verifier mismatch must be resolved before this can merge.
r12 发布清单：verify-public-submodule.sh 的 PINVOU_CODEWHALE_TAG 随基线 tag 同步递增（r11→r12）；tag 已按 r11 同格式重建为 annotated tag（解引用指向 9c5f4f19）。 Signed-off-by: pinvou3-dev <dev@pinvou3.local>
上一直接经 git-data API 重建该文件时误写 100644，fast-gate 以 exit 126 失败；恢复为 100755。 Signed-off-by: pinvou3-dev <dev@pinvou3.local>
与上一提交同因：git-data API 重建丢失 100755。 Signed-off-by: pinvou3-dev <dev@pinvou3.local>
test_ci_gate_policy 对 verify-public-submodule.sh 的钉死断言 r11→r12，完成 r12 发布清单。 Signed-off-by: pinvou3-dev <dev@pinvou3.local>
asto18089
left a comment
asto18089
left a comment
There was a problem hiding this comment.
Follow-up review at the current head (I rebased the branch locally onto latest main — zero conflicts — and re-ran the gates on the rebased tree).
Verification of the prior blockers
- P1 (baseline publication) is resolved.
refs/tags/pinvou-v0.9.5-r12^{}on the public repo resolves to exactly the parent gitlink9c5f4f19;scripts/verify-public-submodule.shpasses;./scripts/fork-guard.sh --fastpasses (layer-0 topology: 36 commits over853cb707, 98/98 fingerprints);python3 scripts/tests/test_ci_gate_policy.py18/18. - I also audited the foundation delta
0d89a31b..9c5f4f19(17 files, +1941/-188): the chain-tail switch reuses the existing Bing scrape backend (no new engine),forkguard_api_provider_chain_tail_is_binggenuinely locks the behavior for all 7 API providers, the #33 four-way native-search gating is fail-closed with regression-tested counterexamples, and there is zero serde-schema change (no parent adaptation needed). Theprefs/search.rserrata is accurate: the foundation default is stillDuckDuckGo(#[default]atcrates/tui/src/config/search.rs:20) and Bing comes from the explicit bridge injection locked byforkguard_search_provider_translates_from_prefs. The i18n hint passestests/ui_language_coverage.test.mjswith all three languages. - I agree with the prior review's P2: the English-language requirement (CONTRIBUTING.md, "Use English for … pull requests, commits … diagnostics") applies to the title, body, and commit messages; CI validates format only, not language.
Remaining blockers (fix in this PR)
-
The errata missed its twins —
bridge.rsnow contradictsprefs/search.rs. pinvou3-app/src-tauri/src/features/assistant/platform/bridge.rs:1462 still asserts "Bing 是默认 (fork patch #42 在底座 SearchProvider::default())", while this PR's own errata (and the foundation code) establish the opposite. The comment sits exactly at the injection site the errata describes, so the two comments directly contradict each other after merge. Same file,bridge.rs:4592(test docstring) still carries the superseded mechanism story ("DDG 被 GFW + 代理 datacenter IP 反爬") that this PR replaces with the DNS-poisoning + SNI-reset account. -
Register tail not updated to the final state.
docs/fork-modifications.md§4 still reports56 passed / 0 failed(:198),CodeWhale 56 passed(:206),pinvou-v0.9.5-r11 -> 0d89a31be…(:213), and "已锁定不可变标签pinvou-v0.9.5-r11" (:216) — contradicting §0's own "57 条" and the r12 verifier this PR ships. The T2 topic ledger'scommitslist (:112+) was not extended with the #33/#35 commits.docs/fork-modifications.md:23anddocs/fork-modifications.en.md:22cite24a17335, a pre-rebase sha that is not in the published r12 lineage — the tightened-endpoint commit in the published baseline is4f612e548.docs/fork-modifications.en.md:3("r12 candidate pending") and:81("All 56 … r11") are stale the same way. -
docs/fork-policy.md/docs/fork-policy.en.mdare untouched. They still declare r11 /0d89a31be/ "最后更新：2026-08-27" as the current baseline, while the register header declares the two docs jointly the single source of truth for the baseline (AGENTS.md likewise). Syncing one and not the other leaves the authoritative doc false at merge time. -
PR title/body numbers are stale (on top of the language issue). The body still documents gitlink
2e429c378, "30 commits", "指纹 +2", "drift3 files +59/-7", and mentions only foundation #35 — the final state is gitlink9c5f4f19, 36 commits, +4 fingerprint rows (94→98), 17 files +1941/-188, with both #33 and #35 in the bump. The body was written for the first commit and never updated after the baseline was widened; it also self-contradicts its own verification section (57 forkguard) in the overview numbers.
Non-blocking
- The settings hint "所选服务失败时自动回退内置搜索" over-promises slightly: configuration errors (e.g. a missing Bocha/Baidu key) fail closed without crossing providers (
crates/tui/src/config/search.rs, "Configuration and network-policy errors fail closed"). Consider narrowing to runtime failures ("运行失败时自动回退") in all three languages. - Informational only: commit
ab3aac22silently flippedscripts/fork-guard.shto 100644 (git-data API rebuild side effect); two later commits restore it. Final state is correct, but the two intermediate commits are not--fast-runnable for bisect. Already disclosed in the commit messages.
Foundation-side leftovers (cannot be fixed in this PR without moving the published r12 gitlink — please file an issue or defer to the next baseline)
crates/tui/src/tools/web_search.rs:106— the model-visible tool description still says "Configured API backends visibly degrade through DuckDuckGo then Bing when unavailable", which the chain-tail change makes false (API backends now degrade straight to Bing; there is no DDG hop). This is the most user-visible stale text and will keep steering model narration. The module doc atweb_search.rs:2-4has the same staleness.crates/tui/src/tools/web/backend.rs:264— the all-chains-failed suggestion lists(tavily, bocha, metaso, baidu, volcengine)but omitssearxng/sofya, whichtools/spec.rsanddocs/CONFIGURATION.mdboth count as API-backed providers.- No CHANGELOG entry for the chain-tail change in
9c5f4f19. - Out of scope but the same reachability argument applies: the DuckDuckGo image-search path in
web_run.rshas no Bing tail.
Everything else checks out: no unrelated changes ride along (bundling #33 follows the published-baseline convention set by #367; the register documents both foundation PRs), the file set and exec bits are exactly as claimed, and the three gates pass locally on the rebased tree. Once items 1–4 are addressed, I have no further objections.
…ect bridge comments Address the four remaining review blockers on PR #375: - bridge.rs: the EngineConfig injection-site comment still claimed "fork patch #42 flipped the engine default"; state the real mechanism instead (the engine default stays DuckDuckGo and the bridge injects the app-side Bing default, locked by forkguard_search_provider_translates_from_prefs), and replace the outdated "GFW + datacenter-IP anti-scrape" account in the test docstring with the measured DNS-poisoning + SNI-reset behavior. - fork-modifications.md/.en.md: correct the pre-rebase sha 24a17335 to the published 4f612e548, extend the T2 commit ledger with the six #33 commits and #35, refresh the verification tail to 57 forkguard tests and the r12 tag pointer, and state the full r12 drift figures. - fork-policy.md/.en.md: align the baseline header, maintenance-branch pointer, published-PR list, and drift paragraph with the published r12 baseline. Comment/doc-only, no behavior change. Verified locally: fork-guard --fast, verify-public-submodule (r12), ci-fork-link-check, architecture-guard, and scripts/tests (83 OK). Signed-off-by: pinvou3-dev <dev@pinvou3.local>
h3c-hexin
changed the title
|
Thanks for the thorough follow-up review. All four blockers are addressed in d04cc73 (comment/doc-only, no behavior change):
On the non-blocking hint: agreed the "failure → automatic fallback" wording over-promises for fail-closed configuration errors; we'll narrow it to runtime failures ("运行失败时自动回退" etc.) as a follow-up so this review round stays scoped to the four blockers. Foundation-side leftovers (web_search tool description, backend suggestion list, CHANGELOG, image-search tail) will be filed as a CodeWhale issue against the next baseline rather than moving the published r12 tag. Local gates on d04cc73: |
Address the four remaining review blockers on PR #375: - bridge.rs: the EngineConfig injection-site comment still claimed "fork patch #42 flipped the engine default"; state the real mechanism instead (the engine default stays DuckDuckGo and the bridge injects the app-side Bing default, locked by forkguard_search_provider_translates_from_prefs), and replace the outdated "GFW + datacenter-IP anti-scrape" account in the test docstring with the measured DNS-poisoning + SNI-reset behavior. - fork-modifications.md/.en.md: correct the pre-rebase sha 24a17335 to the published 4f612e548, extend the T2 commit ledger with the six #33 commits and #35, refresh the verification tail to 57 forkguard tests and the r12 tag pointer, and state the full r12 drift figures. - fork-policy.md/.en.md: align the baseline header, maintenance-branch pointer, published-PR list, and drift paragraph with the published r12 baseline. Comment/doc-only, no behavior change. Verified locally: fork-guard --fast, verify-public-submodule (r12), ci-fork-link-check, architecture-guard, and scripts/tests (83 OK). Signed-off-by: pinvou3-dev <dev@pinvou3.local>
d04cc73 to
63c161d
Compare
|
Note: the fix commit was reworded to satisfy the commit-message check (50-character description limit) — d04cc73 is now |
评审条件已满足：P1 r12 已发布（annotated tag pinvou-v0.9.5-r12 → 9c5f4f19，verifier/策略断言/元测试均已递增，fast-gate 绿）；P2 标题/正文已重写为英文最终数字。按维护者指示落地 r12。
Fifth-round rebase onto ef15188 (#252 native browser workspaces, #375 CodeWhale r12, #374 version bump) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12 arrivals; Cargo.lock follows the 0.8.8 version bump Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env. Signed-off-by: asto <asto18089@126.com>
Fifth-round rebase onto ef15188 (#252 native browser workspaces, #375 CodeWhale r12, #374 version bump) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12 arrivals; Cargo.lock follows the 0.8.8 version bump Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env. Signed-off-by: asto <asto18089@126.com>
Fifth-round rebase onto 794a13d (#252 native browser workspaces, #375 published CodeWhale r12 baseline, #374 version 0.8.8, #336 web-ACP follow-up hardening) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12/#336 arrivals; Cargo.lock follows the 0.8.8 version bump - both lockfiles move chacha20 0.10.1 -> 0.10.2 (0.10.1 was yanked after this PR turned cargo-deny yanked into a deny) Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env; transfer.rs keeps main's web attachment sha256 integrity verification; attachment_upload.rs keeps main's widened append_chunk digest parameter with style-2024 formatting. Signed-off-by: asto <asto18089@126.com>
Fifth-round rebase onto 794a13d (#252 native browser workspaces, #375 published CodeWhale r12 baseline, #374 version 0.8.8, #336 web-ACP follow-up hardening) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12/#336 arrivals; Cargo.lock follows the 0.8.8 version bump - both lockfiles move chacha20 0.10.1 -> 0.10.2 (0.10.1 was yanked after this PR turned cargo-deny yanked into a deny) Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env; transfer.rs keeps main's web attachment sha256 integrity verification; attachment_upload.rs keeps main's widened append_chunk digest parameter with style-2024 formatting. Signed-off-by: asto <asto18089@126.com>
Fifth-round rebase onto 794a13d (#252 native browser workspaces, #375 published CodeWhale r12 baseline, #374 version 0.8.8, #336 web-ACP follow-up hardening) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12/#336 arrivals; Cargo.lock follows the 0.8.8 version bump - both lockfiles move chacha20 0.10.1 -> 0.10.2 (0.10.1 was yanked after this PR turned cargo-deny yanked into a deny) Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env; transfer.rs keeps main's web attachment sha256 integrity verification; attachment_upload.rs keeps main's widened append_chunk digest parameter with style-2024 formatting. Signed-off-by: asto <asto18089@126.com>
Fifth-round rebase onto 794a13d (#252 native browser workspaces, #375 published CodeWhale r12 baseline, #374 version 0.8.8, #336 web-ACP follow-up hardening) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the #252/r12/#336 arrivals; Cargo.lock follows the 0.8.8 version bump - both lockfiles move chacha20 0.10.1 -> 0.10.2 (0.10.1 was yanked after this PR turned cargo-deny yanked into a deny) Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env; transfer.rs keeps main's web attachment sha256 integrity verification; attachment_upload.rs keeps main's widened append_chunk digest parameter with style-2024 formatting. Signed-off-by: asto <asto18089@126.com>
…ty linters (Pinvou#343) * chore(rust): migrate to edition 2024 and harden lint gates Upgrade both first-party crates from edition 2021 to 2024 (rustc 1.97.1 toolchain unchanged; MSRV 1.89 already satisfies the 2024 floor of 1.85), aligning with the CodeWhale foundation (workspace edition 2024); at the same time harden the compiler and linter gates following mainstream practice (official clippy groups + the uv/rust-analyzer config style), and clear the backlog of every enabled lint. - cargo fix --edition mechanical migration across 43 files (env:: set_var/remove_var wrapped in unsafe etc.); 8 bare sites behind cfg(windows/linux) gates were unreachable for fix on macOS and were patched by hand (ui_cache.rs / windows_path.rs / windows_system.rs) - All 328 env write sites classified per the audit conclusion: the startup sequence (run() single-threaded phase, call-chain evidence) gets SAFETY comments stating the single-thread rationale; runtime multi-threaded phases get the new platform/env_write.rs process-level write lock for serialization (boot env injection / MCP secret sync and resolution / uninstall cleanup), eliminating the use-after-free race between installer flows and the foundation's child-process env snapshots (vars_os iteration); test code is uniformly serialized via ENV_LOCK + 41 lock additions; the 308 cargo fix FIXME noise comments are all replaced with semantic comments - knowledge crate: 3 tail-expr-drop-order sites individually adjudicated (all are local reqwest::Client vs tail-expression temporaries with no destructor side-effect interaction; the new order is safe) - [lints.rust] adds rust_2018_idioms=warn (25 backlog hits cleared in this PR), rust_2024_compatibility/future_incompatible=deny (zero backlog) - [lints.clippy] adds ptr_as_ptr/rc_mutex/empty_drop/single_match/ get_unwrap/negative_feature_names/redundant_feature_names=deny; undocumented_unsafe_blocks/expect_used/unwrap_used/unwrap_in_result/ exit=warn (backlog cleared in this PR: 65 unsafe blocks get real SAFETY invariant comments, 47 production expect/unwrap sites convert to error propagation/idioms/reasoned allows) - rustfmt bumped to style_edition 2024 with a full reformat - Adopt cargo-shear (unused dependency check, same tool as uv/oxc): both workspaces green; the single unlinked file rustc-stack-wrapper.rs is registered as an exemption per its selector script usage - cargo-deny tuning: yanked=deny; drop the no-longer-matching RUSTSEC-2026-0195 ignore entry - cargo-semver-checks advisory run: knowledge crate passes all 196 checks; the edition migration breaks no API - Investigated but not adopted (rationale in the PR description): cargo-audit (duplicates deny), cargo-machete/udeps (superseded by shear precision), cargo-spellcheck (low Chinese-comment coverage), dylint (no macOS prebuilt, low ROI), Kani/Prusti/MIRAI (research-grade) - clippy expanded from --lib to a two-step --lib --bins (-D warnings hard gate) + --tests (deny enforced, warn exempted for testing conventions); adds the clippy step for the standalone pinvou-knowledge workspace; adds the cargo-shear step (dependency changes trigger it) - Two-crate clippy two-step gates all green; cargo fmt --check green - cargo test: app 1370 pass (1 runtime_bundle parallel flake passes on rerun; the lock is held correctly, a pre-existing main pattern); knowledge 85 pass; integration tests pass - architecture-guard / fork-guard --fast all pass; CodeWhale gitlink untouched Signed-off-by: asto <asto18089@126.com> * fix(rust): cover platform-only unsafe gaps CI on Linux/Windows runners caught 5 sites unreachable by macOS-side checks in the edition 2024 migration: - rust-lint (Linux): 3 unsafe blocks in features/pet/platform/detach.rs (X11 pointer poll path) lacked the SAFETY comment required by clippy::undocumented_unsafe_blocks (-D warnings). Added comments stating the actual invariants (valid Display*, stack-lifetime out params), same format as the macOS CG block in the same file. - windows-rust-test: edition 2024 makes env::set_var unsafe; 2 sites missed in windows_path.rs (ORT_DYLIB_PATH) and windows_system.rs (PATH prepend). Wrapped in unsafe with the env_write lock held and a SAFETY comment, matching the established runtime-write pattern in marketplace/secrets.rs. The lock scope covers only the write itself per env_write.rs conventions. Verified: cargo fmt --check and both CI clippy invocations (--lib --bins -D warnings, --lib --bins --tests) pass on macOS; rustfmt parse-checks the two Windows-only files; remaining set_var sites audited as already wrapped (grep hits were multi-line calls). Signed-off-by: asto <asto18089@126.com> * fix(knowledge): satisfy clippy chunks_exact_to_as_chunks lint CI rust-lint fails on clippy::chunks_exact_to_as_chunks (deny warnings) in blob_to_vec and cosine_blob; switch to as_chunks::<4>() as suggested. Signed-off-by: asto <asto18089@126.com> * style(sessions): reformat for style_edition 2024 after rebase The lazy-loading changes merged via Pinvou#341 arrived on main formatted under the old import/assert styles. Apply rustfmt style_edition 2024 so the fmt hard gate stays green after the rebase. No behavior change. Signed-off-by: asto <asto18089@126.com> * fix(marketplace): store MCP secrets in keyring, not process env Edition 2024 makes std::env::set_var unsafe; its precondition is the absence of concurrent env readers, which the app cannot guarantee: the embedded engine snapshots child environments via vars_os() and WebKit/glib call libc getenv on threads the app does not own. The writer-only env_write lock therefore could not satisfy the safety contract at runtime. Following the reviewer's preferred option, runtime process-env writes are eliminated entirely: - CodeWhale gains a host MCP secret resolver hook (install_mcp_secret_resolver, Pinvou/CodeWhale#25, published in the immutable r11 baseline): mcp.json ${...} expansion, env_headers and bearer_token_env_var resolution consult the host callback before falling back to the process env. - The app stores MCP secrets in the system keyring plus an in-process RwLock registry; install/uninstall/migrate/restart-sync paths write the registry instead of calling set_var/remove_var, and the boot-time resolver installation is pinned before any engine spawn. Test helpers install the same resolver so validation paths do not depend on having run the bridge-boot test first. - The remaining legitimate env writes (PINVOU3_SESSION_ARTIFACTS and, on Windows, ORT_DYLIB_PATH plus the LibreOffice PATH prepend) move to a single-threaded startup window: startup_process_env is called from run() and from the headless host before the tokio runtime starts. platform/env_write.rs is removed. The startup-platform-env rustdoc and its platform implementations are in English. - Fork register: after rebasing onto the r11 baseline sync (Pinvou#367) the gitlink stays aligned with the published immutable r11 tag (pinvou-v0.9.5-r11 = 0d89a31be, including Pinvou#25). The register keeps main's published-r11 inventory, gains the resolver hook entry in the T1 detail list, and adds two APP fingerprints (install_mcp_secret_resolver, startup_process_env). verify-public-submodule.sh passes against the published tag. Signed-off-by: asto <asto18089@126.com> * fix(knowledge): harden managed-source cleanup vs symlinks remove_managed_sources deleted files under documents_dir using paths read back from document storage with lexical-only validation. CodeQL rust/path-injection flagged the remove_dir sink: a managed directory replaced by a symlink could redirect the deletion outside documents_dir. Every deletion target is now canonicalized first and must still resolve inside the canonicalized documents_dir before remove_file/remove_dir runs, which also defeats symlinked ancestors at cleanup time; targets that no longer exist fail canonicalization and are already gone. The lexical managed_relative_path validation is kept as the shared managed-path contract. canonicalize + starts_with is the remediation shape CodeQL rust/path-injection models (PathNormalization + SafeAccessCheck), so the taint barrier is structural rather than implied. Regression: permanent_delete_does_not_descend_through_a_replaced_managed_directory (Unix-only; Windows symlink creation needs privileges the runner lacks). Signed-off-by: asto <asto18089@126.com> * fix(rust): align r12 arrivals with edition 2024 lint gates Fifth-round rebase onto 794a13d (Pinvou#252 native browser workspaces, Pinvou#375 published CodeWhale r12 baseline, Pinvou#374 version 0.8.8, Pinvou#336 web-ACP follow-up hardening) brought new code that predates this PR's lint table; clear it so the hard gate stays zero-backlog on the combined tree: - browser: rename `gen` bindings (reserved keyword in edition 2024); restructure 3 expect/unwrap sites to early return / error propagation; annotate 17 checked-invariant expects with allow + per-site rationale; 7 macOS unsafe blocks gain SAFETY invariants; new test env writes take the crate-wide ENV_LOCK with the established SAFETY wording; 2 deny-level get_unwrap hits in tests fixed per clippy's suggestion - filesystem.rs: 12 newly arrived anchored-ops unsafe blocks gain SAFETY comments (including the Linux-only renameat2 site) - extraction.rs / runtime_bundle mod.rs / lib.rs: new expects allow- annotated with rationale or restructured; new test env writes wrapped - build.rs: 4 expects converted to the file's existing unwrap_or_else(panic!) idiom - style_edition 2024 reformat of the Pinvou#252/r12/Pinvou#336 arrivals; Cargo.lock follows the 0.8.8 version bump - both lockfiles move chacha20 0.10.1 -> 0.10.2 (0.10.1 was yanked after this PR turned cargo-deny yanked into a deny) Conflict resolutions: work_layer_sections keeps main's three-section signature (plus the expect_used allow); ensure_builtin_mcp_servers keeps main's browser-residue cleanup on the PR's let-else error propagation; voice_asr keeps main's shared parse_asr_transcript; sessions/store.rs and platform/os re-export lists merged as unions; lib.rs keeps both the browser-cleanup block and startup_process_env; transfer.rs keeps main's web attachment sha256 integrity verification; attachment_upload.rs keeps main's widened append_chunk digest parameter with style-2024 formatting. Signed-off-by: asto <asto18089@126.com> * fix(rust): unsafe-wrap cfg-gated env writes Signed-off-by: asto <asto18089@126.com> * fix(rust): mark windows test extern block unsafe Signed-off-by: asto <asto18089@126.com> * fix(rust): satisfy Linux lint gate on WebKit automation The Linux-gated linux_automation.rs never compiles on the macOS dev machine, so the Linux rust-lint runner saw six gate errors on the previous head (all six confirmed in CI before fixing): - elided lifetime on the Plugin::on_event event parameter; - geteuid/getpid/pre_exec unsafe blocks lack SAFETY invariants; - two same-lock registry lookups expect() without a narrow justification, now annotated like the established host.rs pattern. Also folds in the rebase-onto-90f18bf9d (Pinvou#249/Pinvou#385/Pinvou#366/Pinvou#362) fallout: - marketplace uninstall merges Pinvou#249's state transaction with this PR's keyring/secret-registry cleanup; the new cleanup_uninstalled_tool_state goes through remove_secret_value (in-process registry) instead of a bare process-env write, matching the resolver redesign; - the Pinvou#249 arrivals' PINVOU3_HOME/PINVOU3_PYTHON test env writes take the ENV_LOCK unsafe+SAFETY treatment (E0133 under edition 2024), including the Windows-gated paths.rs test caught by the Windows runner only; - style_edition 2024 reformatting for the arrivals. Signed-off-by: asto <asto18089@126.com> --------- Signed-off-by: asto <asto18089@126.com>
3 participants
Overview
Adopt the published CodeWhale r12 baseline (
9c5f4f19b, immutable tagpinvou-v0.9.5-r12, foundation PRs Pinvou/CodeWhale#33 + #35) and complete the parent-side companion changes: the keyless chain tail after API-backed search providers is now Bing, and the settings page explains search-source behavior. Comment-only corrections align app comments and the fork docs with the final published state.Background
Live measurements (mainland-China egress) show DuckDuckGo is fully unreachable (DNS poisoning + SNI reset), while Bing serves both global and China endpoints without a key. Previously an API-backend outage (Tavily/Bocha/Metaso/Baidu, …) fell through to the dead DDG tail and failed as a whole. The engine now picks the reachable keyless Bing tail (no geo detection); the app-side default Bing mechanism is unchanged — the bridge injects
EngineConfig.search_providerexplicitly, locked byforkguard_search_provider_translates_from_prefs.Changes
0d89a31be(r11) →9c5f4f19b(pinvou-v0.9.5-r12). Foundation delta: fix(platform): tmp/ 中间文件不再误入产出物面板 #33 provider-native search adapters (DeepSeek Responses, Model Studio Token Plan, Moonshot/Kimi K2.6/K3-Formula/Kimi-Code, Z.AI/Zhipu, Xiaomi MiMo) with exact fail-closed endpoint gating, and refactor(rust): 清理 clippy 告警 #35 keyless chain tail DDG→Bing + all-chain failure guidance +forkguard_api_provider_chain_tail_is_bing(forkguard 56→57). Engine-side r12 is published; this PR lands the parent gitlink.scripts/fork-guard.shbaseline pointer r11→r12 (36 commits overv0.9.5), fingerprints +4 (94→98);scripts/verify-public-submodule.shandscripts/tests/test_ci_gate_policy.pypin the immutablepinvou-v0.9.5-r12tag.docs/fork-modifications.md/.en.md): r12 section; drift110 files, +9781/-1168total, r11→r1217 files, +1941/-188; T2 commit ledger extended with the six fix(platform): tmp/ 中间文件不再误入产出物面板 #33 commits and refactor(rust): 清理 clippy 告警 #35; pre-rebase sha24a17335corrected to the published4f612e548; verification tail updated to 57 forkguard tests and the r12 tag pointer.docs/fork-policy.md/.en.md): baseline header, maintenance-branch pointer, published-PR list, and drift paragraph aligned to published r12.searchSourceHint, i18n zh/en/ja): built-in search is keyless, failed services fall back automatically, and a Chinese search service improves long Chinese queries.platform/prefs/search.rsandfeatures/assistant/platform/bridge.rs(injection-site comment + test docstring) now state the real mechanism — the engine default is stillDuckDuckGo; the app default Bing comes from the bridge's explicit injection. The stale "GFW + datacenter-IP anti-scrape" account is replaced with the measured DNS-poisoning + SNI-reset behavior.Verification
./scripts/fork-guard.shfull four layers (baseline topology 36 commits / fingerprints / CodeWhale 57 forkguard / parent 22 forkguard)./scripts/verify-public-submodule.sh→pinvou-v0.9.5-r12 -> 9c5f4f19b…./scripts/ci-fork-link-check.sh,python3 scripts/architecture-guard.py,python3 -m unittest discover -s scripts/tests(83 OK)tools::web::backend9 passed,tools::web_search63 passed,cargo fmt --checknpm run test:ui-language(zh/en/ja coverage)test:settings-ui(no chromium in this environment); the hint is static i18n text rendered in a single line — covered by CI frontend-test.Checklist
shared/i18n.jswith zh/en/ja