Skip to content

Record packaged Auto validation in V4 #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jay23606 merged 1 commit into from
Oct 9, 2026
Merged

Record packaged Auto validation in V4 #66

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion DESIGN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -594,7 +594,7 @@ Findings that change the backlog:
- **V4b latest-head documentation and rerun (2026-10-03, `7e43d2d`).** The first current-head Windows Avalonia UI run failed `Footer_auto_default_is_visible_without_project_and_inherited_by_new_code_task_workspace` while asserting the persisted settings value: the file still held Auto after the test clicked Ask. The assertion occurs before the test creates a Code task workspace, so it did not demonstrate an inherited workspace-mode failure. The test had polled a file while the async settings write could still be in flight; a no-source rerun passed the full 35-test Windows UI suite. The current working-tree fix awaits the persistence task started by the click, then checks the live mode and saved value directly. Cross-platform CI and four-RID packaging were green at `7e43d2d`; release publishing was skipped for the PR. The current checkout still lacks the .NET 10 SDK, so local reproduction is unavailable.
- **V4b persistence-test follow-up (2026-10-03, `2dfe416`).** The footer regression now asserts the live Ask mode immediately after the menu click, awaits the actual settings-persistence task, then checks the saved value before creating a workspace and checking inherited mode. Windows CI [#37147343576](https://github.com/jay23606/codev/actions/runs/37147343576) passed 936 portable tests (2 opt-in skips), all 35 Avalonia headless UI tests on Windows/Linux/macOS, the 8 Windows UI tests, and native credential-vault smoke checks. Desktop preview [#37147343579](https://github.com/jay23606/codev/actions/runs/37147343579) passed build, launch, and packaging for win-x64, linux-x64, osx-arm64, and osx-x64; the public-release job was skipped for the PR. Local execution remains unavailable because this host has only .NET SDK 9 while the projects target .NET 10.
- **V4b Auto-mode disclosure review (2026-10-03, `1729220`).** Adversarial review confirmed that Auto mode also approves configured MCP tool calls, not only shell commands. The footer tooltip, command-permissions explainer, and Code task system prompt now state that MCP tools run without approval unless an exact project server/tool deny rule blocks them, and warn that they may affect external services. Regression checks cover the tooltip and prompt wording. Windows CI [#37148187560](https://github.com/jay23606/codev/actions/runs/37148187560) passed 936 portable tests (2 opt-in skips), 35 Avalonia headless UI tests on Windows/Linux/macOS, 8 Windows UI tests, and native credential-vault smoke checks. Desktop preview [#37148187564](https://github.com/jay23606/codev/actions/runs/37148187564) passed app/CLI build, launch, and packaging on all four RIDs; publishing was skipped for the PR. This review found no additional policy-routing bypass, but it does not satisfy Q3's full manual security review.
- **V4c. Real-use log (first pass, 2026-10-09).** The first Codev dogfood reports have been read and triaged in [`docs/real-use-log-release-2.md`](docs/real-use-log-release-2.md). They map to B1 (Auto prompts), B15 (local-model cold load), P2/P6 (saved hosted-key reconnect), collapsed activity/readability, sidebar ordering, and the existing Windows hidden-process follow-up. Recheck user-visible fixes against the Release 2 package; native manual items remain open.
- **V4c. Real-use log (first pass, 2026-10-09).** The first Codev dogfood reports have been read and triaged in [`docs/real-use-log-release-2.md`](docs/real-use-log-release-2.md). They map to B1 (Auto prompts), B15 (local-model cold load), P2/P6 (saved hosted-key reconnect), collapsed activity/readability, sidebar ordering, and the existing Windows hidden-process follow-up. The [PR #62 Windows package preview #37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) ran the reported deletion-plus-Git-status command in Auto without a prompt, then verified an exact Deny after switching back to Auto; PR #65 records the evidence. Confirm the behavior again after the public Release 2 install; native manual items remain open.

**Done when:** V4a stays green, the checklist is committed and has been run at least once, and the first real-use log has been read and its items triaged.

Expand Down
Loading