mirror of
https://github.com/storytold/wordcraft.git
synced 2026-10-27 03:47:09 -06:00
Martin BallandClaude Opus 5.5
4095cc3413
* #3680: Read Aloud tidies in one linear pass and cuts space-free sentences Finding 56. tidy() repeated whole-string replacements until nothing changed; each pass removed one level of nested empty brackets, so 40,000 pairs took ~50 s in a debug build. It is now one pass that drops a closing bracket's empty pair as it goes, checked against the old algorithm on 20,000 generated strings. Sentences with no space to split at are cut at MAX_UTTERANCE (1,200) characters, and each sentence is sliced from a char vector instead of skipping from the paragraph's start. Fixes #3680 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3692: Paste Special reads only a regular picture file, bounded Finding 24. A copied path naming a device such as /dev/zero reports a length of 0, so the size check passed and std::fs::read read forever. The path and the opened handle must both be regular files, and at most the picture limit + 1 bytes are read. A named pipe swapped in between the check and the open can still block the open (no portable non-blocking open without platform flags); noted in the code. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3692: macOS signing import decodes the certificate into a private temp folder Finding 25. The .p12 bundle was written to a predictable name in the shared temp folder, where a planted link could redirect it. It now goes into a mktemp -d folder under the same temp root, removed on exit. The keychain is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3666: engine file reads open once and check the handle; a FIFO is refused without blocking read_file_capped checked the path's metadata and then read the path again, so a file swapped or grown after the check was read whole; read_file_head opened the path with no type check, so saving to a FIFO .xml path (the Word 2003 sniff) blocked until a writer appeared. Both now go through open_regular_file (path checked before opening, handle checked after, opened once) and a bounded read; read_regular_file uses the same pieces. Tests: both helpers refuse a FIFO without blocking and a folder; read_file_capped refuses content over the cap. Fixes #3666 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3692: Paste Special reads picture files through the engine's bounded read Ultrareview finding 9: paste_picture kept a third copy of the regular-file bounded read; it now calls wordcraft_engine::io::read_regular_file (public, with a wasm stub). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3666: open a checked file non-blocking so a swap to a named pipe can't hang CodeRabbit: a path replaced by a FIFO between the regular-file check and File::open blocked in open, before the handle check could refuse it. On Unix the open now uses O_NONBLOCK (no effect on regular files; libc is already in the lockfile) and the handle check refuses the pipe. The FIFO tests' cleanup writers open non-blocking too, so a regression fails the test instead of hanging it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * #3666: review — Paste Special refuses a picture file whose handle reports more than the cap before reading it Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o * #3692: review — macOS signing keychain lives in the private mktemp folder too; removed if the import fails Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o * #3666: review — libc comes from the workspace dependencies Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o * #3680: review — Read Aloud logs a warning when its sentence cap leaves text unread Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o * #3692: review — engine speech timing test gets a margin a busy CI machine can't break tidy_is_linear_on_nested_brackets: 2 s -> 10 s. The one-pass tidy takes ~13 ms on a loaded machine; tidy_by_replacing (the old tidy, kept in the tests) took 293 s on the same input. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
65 lines
2.8 KiB
Bash
Executable File
65 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# CI only: import the Developer ID certificate into a temporary keychain so codesign can use it.
|
|
#
|
|
# Inputs (env): APPLE_CERTIFICATE (base64 .p12), APPLE_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD
|
|
# (optional; random if unset), RUNNER_TEMP (or TMPDIR).
|
|
# Outputs: MACOS_SIGN_IDENTITY (SHA-1 of the identity) and MACOS_KEYCHAIN, appended to
|
|
# $GITHUB_ENV when running in Actions, otherwise printed.
|
|
#
|
|
# Missing certificate: prints a warning and exits 0, so package.sh falls back to ad-hoc signing.
|
|
set -euo pipefail
|
|
umask 077
|
|
# shellcheck source=../env.sh
|
|
. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
|
|
|
|
if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
|
|
warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
|
|
exit 0
|
|
fi
|
|
|
|
TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
|
|
KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
|
|
|
|
# The decoded bundle and the keychain go in a fresh private directory with an unpredictable name:
|
|
# a predictable name in a shared temp folder could be planted beforehand (a link that sends the key
|
|
# somewhere readable, or a keychain someone else made) (#3692). The bundle is removed on exit; the
|
|
# keychain is kept for the signing steps that follow, unless this script fails.
|
|
WORK="$(mktemp -d "$TMP/wordcraft-signing.XXXXXXXX")"
|
|
CERT="$WORK/wordcraft-signing.p12"
|
|
KEYCHAIN="$WORK/wordcraft-signing.keychain-db"
|
|
cleanup() {
|
|
local status=$?
|
|
rm -f "$CERT"
|
|
if [ "$status" -ne 0 ]; then
|
|
security delete-keychain "$KEYCHAIN" 2>/dev/null || true
|
|
rm -rf "$WORK"
|
|
fi
|
|
exit "$status"
|
|
}
|
|
trap cleanup EXIT
|
|
printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
|
|
security create-keychain -p "$KC_PASS" "$KEYCHAIN"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN"
|
|
security unlock-keychain -p "$KC_PASS" "$KEYCHAIN"
|
|
security import "$CERT" -P "${APPLE_CERTIFICATE_PASSWORD:-}" -T /usr/bin/codesign -T /usr/bin/security -t cert -f pkcs12 -k "$KEYCHAIN"
|
|
rm -f "$CERT"
|
|
# Let codesign use the key without a UI prompt.
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS" "$KEYCHAIN" >/dev/null
|
|
# Put it on the search list (keeping the login keychain) so codesign and notarytool find it.
|
|
# shellcheck disable=SC2046
|
|
security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
|
|
|
|
IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
|
|
if [[ -z "$IDENTITY" ]]; then
|
|
security find-identity -v -p codesigning "$KEYCHAIN" >&2
|
|
echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
|
|
exit 1
|
|
fi
|
|
echo "Imported signing identity $IDENTITY"
|
|
if [[ -n "${GITHUB_ENV:-}" ]]; then
|
|
{ echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
|
|
else
|
|
echo "MACOS_SIGN_IDENTITY=$IDENTITY"
|
|
echo "MACOS_KEYCHAIN=$KEYCHAIN"
|
|
fi
|