From 4904e44345a0cb64a600a263408d057c7e09f8f3 Mon Sep 17 00:00:00 2001 From: neng Date: Tue, 18 Aug 2026 18:04:54 +0800 Subject: [PATCH 1/2] fix: pin browser-cli v1.1.13 --- README.md | 4 ++-- docs/implementation-status.md | 12 ++++++------ docs/manual-platform-validation.md | 13 +++++++------ docs/release-access.md | 2 +- native-source.json | 6 +++--- package-lock.json | 4 ++-- package.json | 2 +- src/binary.ts | 14 +++++++------- test/binary.test.mjs | 2 +- test/native-cli.test.mjs | 2 +- 10 files changed, 31 insertions(+), 30 deletions(-) diff --git a/README.md b/README.md index aaa512f..43d0464 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ The npm tarball contains no `browser-cli` or `browser-cli.exe` file. End users d | macOS Intel | `x86_64-apple-darwin` | Not currently supported; asset missing | | Linux x64 | `x86_64-unknown-linux-musl` | Not currently supported; asset missing | -`native-source.json` pins `browser-cli` v1.1.12 at commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`. This pre-release intentionally uses the two assets published by that immutable release. Adding Linux or macOS Intel requires a new browser-cli version and a new npm package version with fresh validation; it will not mutate this release in place. +`native-source.json` pins `browser-cli` v1.1.13 at commit `3af544780365309feae97d51b631070e7ca73762`. The Windows asset in this release statically links the C runtime. This pre-release intentionally uses the two assets published by that immutable release. Adding Linux or macOS Intel requires a new browser-cli version and a new npm package version with fresh validation; it will not mutate this release in place. ## Install @@ -175,7 +175,7 @@ npm run check npm run package:verify ``` -On a currently supported host, test a locally built v1.1.12 CLI without changing the package: +On a currently supported host, test a locally built v1.1.13 CLI without changing the package: ```bash LEXMOUNT_BROWSER_CLI_PATH=/absolute/path/to/browser-cli npm run test:native diff --git a/docs/implementation-status.md b/docs/implementation-status.md index 08feea8..9386cc3 100644 --- a/docs/implementation-status.md +++ b/docs/implementation-status.md @@ -1,6 +1,6 @@ # Implementation status -Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first npm preview and its matching Git tag are published; stable support remains blocked by real Windows/macOS and Lexmount service validation. +Status updated on 2026-08-18 for the `@lexmount/dsh-browser@0.1.0-rc.3` candidate. Earlier npm previews and their matching Git tags are published; stable support remains blocked by real Windows/macOS and Lexmount service validation. ## Completed and verified @@ -14,7 +14,7 @@ Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first - Screenshot output is stored through the DSH image attachment service; temporary screenshot files are removed. RC.6 PDF/download attachment limitations are documented separately. - `npm run check` passes 21 automated tests covering source/target pins, deferred unsupported-platform errors, checksum parsing, executable rejection paths, explicit-path resolution, protocol parsing, redaction, cancellation, forced cleanup, schema/argv mapping, 31-tool registration, and screenshot cleanup. - `npm run package:verify` reports a 24-file npm payload and rejects any native executable path. The current unpacked wrapper is about 105 KiB. -- `npm run native:assets` resolves the official v1.1.12 tag to the pinned commit, downloads the Windows x64 and macOS ARM64 assets from COS, and verifies both SHA-256 digests successfully. +- `npm run native:assets` resolves the official v1.1.13 tag to the pinned commit, downloads the Windows x64 and macOS ARM64 assets from COS, and verifies both SHA-256 digests successfully. The Windows PE import table has no dynamic Visual C++ runtime dependency. - `npm audit --omit=dev` reports zero known vulnerabilities. - The release workflow uses tag-only assembly, pins Node 24.15.0 and npm 12.0.2, creates one tarball, verifies it contains no executable, and passes the exact artifact through the npm environment approval gate without rebuilding. - The previous bundled Linux binary and all `vendor/` package entries have been removed from the working tree. @@ -28,11 +28,11 @@ Status captured on 2026-08-18 for `@lexmount/dsh-browser@0.1.0-rc.0`. The first ## Native source currently pinned - repository: `https://github.com/lexmount/browser-cli-rs.git`; -- version: `1.1.12`; -- tag commit: `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`; -- COS base: `https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12`. +- version: `1.1.13`; +- tag commit: `3af544780365309feae97d51b631070e7ca73762`; +- COS base: `https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13`. -The upstream v1.1.12 Action completed successfully and published macOS ARM64 and Windows x64. Those are the only platforms claimed by this npm pre-release. Linux x64 and macOS Intel are deferred to a new native and npm version. +The upstream v1.1.13 Action completed successfully and published macOS ARM64 and Windows x64. Its Windows build statically links the C runtime. Those are the only platforms claimed by this npm pre-release. Linux x64 and macOS Intel are deferred to a new native and npm version. ## Not yet complete diff --git a/docs/manual-platform-validation.md b/docs/manual-platform-validation.md index f6c0589..38f22e3 100644 --- a/docs/manual-platform-validation.md +++ b/docs/manual-platform-validation.md @@ -14,9 +14,9 @@ Run this checklist against the exact npm tarball that will be published. The cur ## First download and cache -1. Reinstall, run `lexmount_doctor`, and confirm the first tool call downloads exactly the current platform asset from the pinned v1.1.12 COS path. +1. Reinstall, run `lexmount_doctor`, and confirm the first tool call downloads exactly the current platform asset from the pinned v1.1.13 COS path. 2. Compare the cached executable hash with its `SHA256SUMS` entry. -3. Confirm cache metadata records v1.1.12, commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`, platform target, asset name, and digest. +3. Confirm cache metadata records v1.1.13, commit `3af544780365309feae97d51b631070e7ca73762`, platform target, asset name, and digest. 4. Disconnect outbound network access, restart DSH, and confirm the verified cache still runs. 5. Corrupt a disposable copy of the cache, restore network access, and confirm the next call refuses the corrupt file and replaces it from the pinned release. 6. Cancel a first-use download and confirm no temporary executable is selected or left as the active cache entry. @@ -58,17 +58,18 @@ Run this checklist against the exact npm tarball that will be published. The cur ### Windows x64 -- Asset: `browser-cli-v1.1.12-x86_64-pc-windows-msvc.exe`. +- Asset: `browser-cli-v1.1.13-x86_64-pc-windows-msvc.exe`. +- The PE import table contains no `VCRUNTIME` or `api-ms-win-crt` dependency. - SmartScreen/antivirus behavior is documented for the unsigned binary. - Cache paths containing spaces and non-ASCII characters work. -- The CLI reports v1.1.12 and cancellation leaves no `browser-cli.exe` process. +- The CLI reports v1.1.13 and cancellation leaves no `browser-cli.exe` process. ### macOS Apple Silicon -- Asset: `browser-cli-v1.1.12-aarch64-apple-darwin`. +- Asset: `browser-cli-v1.1.13-aarch64-apple-darwin`. - `codesign --verify --strict` succeeds. - Gatekeeper accepts the notarized executable on a clean machine. -- The process is native arm64 and reports browser-cli v1.1.12. +- The process is native arm64 and reports browser-cli v1.1.13. macOS Intel and Linux are not part of this pre-release validation because the pinned native release has no assets for them. diff --git a/docs/release-access.md b/docs/release-access.md index dc8a9c8..15e2578 100644 --- a/docs/release-access.md +++ b/docs/release-access.md @@ -4,7 +4,7 @@ Observed on 2026-08-18. These are external publication and account facts, not br ## Confirmed available -- `browser-cli` v1.1.12 is an official public tag at commit `f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4`. +- `browser-cli` v1.1.13 is an official public tag at commit `3af544780365309feae97d51b631070e7ca73762`. - Its GitHub release and COS path publicly expose the two assets claimed by this npm pre-release: Windows x64 and macOS ARM64. - `npm run native:assets` downloads both files and verifies their pinned SHA-256 digests. - npm account `lexmount` has read-write access to `@lexmount/dsh-browser`. diff --git a/native-source.json b/native-source.json index 749fe2a..f7d01ea 100644 --- a/native-source.json +++ b/native-source.json @@ -1,11 +1,11 @@ { "schemaVersion": 1, "name": "browser-cli", - "version": "1.1.12", + "version": "1.1.13", "repository": "https://github.com/lexmount/browser-cli-rs.git", - "commit": "f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4", + "commit": "3af544780365309feae97d51b631070e7ca73762", "download": { - "baseUrl": "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12", + "baseUrl": "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13", "checksums": "SHA256SUMS" }, "targets": { diff --git a/package-lock.json b/package-lock.json index 3149cf8..d5f8f07 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@lexmount/dsh-browser", - "version": "0.1.0-rc.2", + "version": "0.1.0-rc.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@lexmount/dsh-browser", - "version": "0.1.0-rc.2", + "version": "0.1.0-rc.3", "license": "MIT", "devDependencies": { "@deepseek-ai/cordis": "4.0.1", diff --git a/package.json b/package.json index 1ea1be6..3f37ba7 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@lexmount/dsh-browser", - "version": "0.1.0-rc.2", + "version": "0.1.0-rc.3", "description": "Lexmount cloud browser tools for DeepSeek Harness", "type": "module", "main": "./lib/index.js", diff --git a/src/binary.ts b/src/binary.ts index 64b4dc2..25f368b 100644 --- a/src/binary.ts +++ b/src/binary.ts @@ -21,12 +21,12 @@ import { HarnessError } from "@deepseek-ai/dsh-llm"; import { isJsonRecord, type JsonValue } from "./json.js"; import { redactText } from "./redact.js"; -export const EXPECTED_CLI_VERSION = "1.1.12"; -export const EXPECTED_CLI_COMMIT = "f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4"; +export const EXPECTED_CLI_VERSION = "1.1.13"; +export const EXPECTED_CLI_COMMIT = "3af544780365309feae97d51b631070e7ca73762"; export const EXPECTED_CLI_REPOSITORY = "https://github.com/lexmount/browser-cli-rs.git"; export const EXPECTED_DOWNLOAD_BASE_URL = - "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.12"; + "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli/v1.1.13"; const CHECKSUM_ASSET = "SHA256SUMS"; const MAX_CHECKSUM_BYTES = 1024 * 1024; @@ -36,22 +36,22 @@ const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), ".."); const PLATFORM_TARGETS = { "win32-x64": { - asset: "browser-cli-v1.1.12-x86_64-pc-windows-msvc.exe", + asset: "browser-cli-v1.1.13-x86_64-pc-windows-msvc.exe", executable: "browser-cli.exe", target: "x86_64-pc-windows-msvc", }, "darwin-arm64": { - asset: "browser-cli-v1.1.12-aarch64-apple-darwin", + asset: "browser-cli-v1.1.13-aarch64-apple-darwin", executable: "browser-cli", target: "aarch64-apple-darwin", }, "darwin-x64": { - asset: "browser-cli-v1.1.12-x86_64-apple-darwin", + asset: "browser-cli-v1.1.13-x86_64-apple-darwin", executable: "browser-cli", target: "x86_64-apple-darwin", }, "linux-x64": { - asset: "browser-cli-v1.1.12-x86_64-unknown-linux-musl", + asset: "browser-cli-v1.1.13-x86_64-unknown-linux-musl", executable: "browser-cli", target: "x86_64-unknown-linux-musl", }, diff --git a/test/binary.test.mjs b/test/binary.test.mjs index 6609e75..17a8a9c 100644 --- a/test/binary.test.mjs +++ b/test/binary.test.mjs @@ -80,7 +80,7 @@ test("selects only the two currently published platform keys", () => { }); test("reads the exact asset checksum from a sha256sum manifest", () => { - const asset = "browser-cli-v1.1.12-x86_64-unknown-linux-musl"; + const asset = "browser-cli-v1.1.13-x86_64-unknown-linux-musl"; const digest = "a".repeat(64); assert.equal( checksumForAsset(`${"b".repeat(64)} other\n${digest} *${asset}\n`, asset), diff --git a/test/native-cli.test.mjs b/test/native-cli.test.mjs index 77c1fb5..2bc7285 100644 --- a/test/native-cli.test.mjs +++ b/test/native-cli.test.mjs @@ -25,7 +25,7 @@ test("downloads, resolves, and executes the native browser CLI", async () => { const signal = new AbortController().signal; try { const version = await runner.run(["version"], signal); - assert.equal(version.version, "1.1.12"); + assert.equal(version.version, "1.1.13"); const status = await runner.run(["auth", "status"], signal); assert.equal(typeof status.valid, "boolean"); From 974a1c71b9b752be0db1c12c2fa9916632282847 Mon Sep 17 00:00:00 2001 From: neng Date: Tue, 18 Aug 2026 18:17:16 +0800 Subject: [PATCH 2/2] ci: update browser-cli source pin --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a4da403..b034e80 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: - run: npm run package:verify - name: Verify native source pin run: | - node --input-type=module -e "import source from './native-source.json' with { type: 'json' }; if (source.commit !== 'f0ad71be2fb7f34413a08a4eaf630dfd22c6c2a4' || source.version !== '1.1.12') process.exit(1)" + node --input-type=module -e "import source from './native-source.json' with { type: 'json' }; if (source.commit !== '3af544780365309feae97d51b631070e7ca73762' || source.version !== '1.1.13') process.exit(1)" - name: Verify Bundle manifest run: | node --input-type=module -e "import pkg from './package.json' with { type: 'json' }; if (pkg.dsh?.bundle?.patch !== './cordis.patch.yml') process.exit(1)"