Skip to content

fix(release): harden and unblock the Mac preview #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unlockdigital merged 3 commits into from
Oct 27, 2026
Merged

fix(release): harden and unblock the Mac preview #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
745d3ad
fix(release): defer checkout cleanup past vendored references
unlockdigital Oct 27, 2026
5a65548
fix(security): pin patched desktop and HTTP runtimes
unlockdigital Oct 27, 2026
9accbf5
fix(release): scope fresh trials to qualified providers
unlockdigital Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions .github/workflows/fork-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ jobs:
preflight:
runs-on: ubuntu-24.04
timeout-minutes: 10
permissions:
actions: read
checks: read
contents: read
if: github.repository == 'unlockdigital/t3code'
outputs:
version: ${{ steps.meta.outputs.version }}
Expand All @@ -41,7 +45,9 @@ jobs:
- uses: actions/checkout@v6
with:
fetch-depth: 0
persist-credentials: false
# Eager auth cleanup traverses optional vendored gitlinks with incomplete metadata.
# Keep the scoped token until checkout's normal post-job cleanup.
persist-credentials: true
sparse-checkout: |
/*
!/.repos/
Expand Down Expand Up @@ -329,7 +335,7 @@ jobs:
with:
ref: ${{ needs.preflight.outputs.ref }}
path: release-source
persist-credentials: false
persist-credentials: true
sparse-checkout: |
/packaging/fork/
/docs/unlock-digital/PORTABLE_TRIAL.md
Expand Down
2 changes: 1 addition & 1 deletion apps/desktop/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"@t3tools/tailscale": "workspace:*",
"dbus-next": "0.10.2",
"effect": "catalog:",
"electron": "44.9.3",
"electron": "44.10.0",
"electron-store": "^8.2.0",
"electron-updater": "^6.8.9",
"electron-webauthn": "catalog:",
Expand Down
2 changes: 2 additions & 0 deletions docs/unlock-digital/PORTABLE_TRIAL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ The package carries the fork's code, interface, and bundled application runtime.

In Settings, configure the providers you want to test and follow their supported sign-in flow on this Mac. Follow the bundled [provider setup guidance](../user/install.md#providers) for provider CLIs. If this Mac already has CLI accounts, create separate connection homes when testing fresh account sign-ins. Select the intended connection explicitly before running a task.

Use Codex or Claude for the initial qualification. The starter profile keeps Cursor disabled while its legacy Zod v3 input-validation path receives further advisory and transport-limit review. Existing trial settings are preserved. Enabling Cursor expands beyond this preview's qualified trial scope.

Usage windows and billing links describe provider-reported evidence. Account routing supplies a preview and keeps automatic dispatch disabled. Grant coordinator approval authority explicitly to the chosen thread, and check its destination and permission limits. Replacing or resetting that shortcut requires successful revocation of the previous environment's grant.

N2ition is optional and starts without a live grant on a clean installation. An owner must qualify and enroll the destination's inference route and connector separately. A grant's approved route must match the effective provider configuration; route changes require requalification. Personal project launch restrictions are environment-local policy and can be provisioned separately by the owner.
Expand Down
14 changes: 13 additions & 1 deletion packaging/fork/Launch Unlock Digital Trial.command
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/zsh
set -euo pipefail

T3_TRIAL_ROOT="${HOME}/Library/Application Support/T3 Code Unlock Digital Trial"
T3_TRIAL_ROOT="${T3CODE_TRIAL_PROFILE_DIR:-${HOME}/Library/Application Support/T3 Code Unlock Digital Trial}"
T3_TRIAL_APP="${T3CODE_TRIAL_APP_PATH:-/Applications/T3 Code Unlock Digital Preview.app}"
if [[ ! -d "$T3_TRIAL_APP" ]]; then
print -u2 'Install the fork preview as /Applications/T3 Code Unlock Digital Preview.app, then run this launcher again.'
Expand All @@ -15,6 +15,18 @@ fi
T3_TRIAL_EXECUTABLE="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$T3_TRIAL_APP/Contents/Info.plist")"
mkdir -p "$T3_TRIAL_ROOT"
chmod 700 "$T3_TRIAL_ROOT"
mkdir -p "$T3_TRIAL_ROOT/server/userdata"
chmod 700 "$T3_TRIAL_ROOT/server" "$T3_TRIAL_ROOT/server/userdata"
if [[ ! -e "$T3_TRIAL_ROOT/server/userdata/settings.json" ]]; then
# Keep the initial trial within the qualified provider scope; retain existing owner settings.
(
umask 077
set -o noclobber
cat > "$T3_TRIAL_ROOT/server/userdata/settings.json" <<'JSON'
{"providerInstances":{"cursor":{"driver":"cursor","enabled":false}}}
JSON
)
fi
export T3CODE_HOME="$T3_TRIAL_ROOT/server"
export T3CODE_DESKTOP_APP_DATA_DIR="$T3_TRIAL_ROOT/desktop"
export T3CODE_TELEMETRY_ENABLED=false
Expand Down
Loading
Loading