Integrate reviewed DEV stack (#51, #54, #55, #56, #58)

.github/workflows/release.yml

@@ -47,6 +47,8 @@ jobs:
         run: npm test
       - name: Build installers
         run: npm run ${{ matrix.script }}
+      - name: Audit built bundle secrets
+        run: npm run audit:secrets
       - name: Verify macOS app signature
         if: runner.os == 'macOS'
         run: |
@@ -63,16 +65,23 @@ jobs:
         if: runner.os == 'Linux'
         timeout-minutes: 2
         run: xvfb-run -a npm run smoke:appimage
-      - name: Upload installers
+      # electron-updater reads the channel manifests (latest.yml, latest-mac.yml,
+      # latest-linux.yml) next to the installers, and the NSIS differential
+      # download needs the .blockmap files. Without them the packaged
+      # checkForUpdates() path has nothing to check against.
+      - name: Upload installers and update manifests
         uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}
           path: |
             release/*.AppImage
             release/*.deb
             release/*.exe
+            release/*.exe.blockmap
             release/*.dmg
             release/*.zip
+            release/*.zip.blockmap
+            release/latest*.yml
           if-no-files-found: error
 
   release:

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 [English](CHANGELOG.md) · [Русский](CHANGELOG.ru.md) · [简体中文](CHANGELOG.zh-CN.md)
 
+## Unreleased
+
+- Made the agent orchestration endpoint an explicit setting (Settings → Agents → "Agent orchestration endpoint", `agentControlEnabled`, off by default; `--agent-control` / `CANVASTTY_AGENT_CONTROL=1` still force it on for one launch) that starts and stops the endpoint at runtime, and added an **Orchestrator** role to the launch dialog next to the normal/YOLO profile: the session keeps the provider you opened the dialog for, gets `CANVASTTY_CONTROL_CONNECTION` and `CANVASTTY_CONTROL_CLI` in its environment so the bundled CLI works without setup, shows an "Orchestrator" badge, keeps its role across restore, and the dialog offers to enable the endpoint first when it is off instead of enabling anything silently. The endpoint's `create` now accepts every agent provider (`codex, claude, qwen, kimi, opencode, hermes, grok, omp, pi`) and reports `capabilities { result, menus }` per worker on `create` and `list`: both are `true` for Codex only; other providers' `screen` has no menu interaction, `choose`/`dismiss` fail with `NOT_SUPPORTED`, `send` relies on the idle status alone, and `result` completes as `no_result`.
+- Added a native Codex orchestration CLI (`agent-control/canvastty-control.mjs`, documented in `agent/orchestrator/SKILL.md`) behind `--agent-control` or `CANVASTTY_AGENT_CONTROL=1`: a local controller creates Codex sessions in a project directory, sends work, observes bounded terminal output against a screen revision, and collects the final answer. Each controller sees only the sessions it created, grants are bound to the session generation, mutation IDs are deduplicated, and only controlled sessions opt into authenticated Stop-hook result capture. No automatic approval or terminal deletion endpoint is included.
+- Added the opt-in Even G2 companion (Settings → Controls → Even G2, with the Even App companion under `integrations/even-g2`): Bonjour discovery, short-lived SRP-6a pairing with a six-digit code and explicit device approval, encrypted local requests and audio, per-session grants, bounded terminal presentation on the glasses HUD, local speech recognition through the pinned transcribe.cpp helper (bundled on macOS only), and session creation through the existing desktop launcher. The final answer of a Codex turn reaches the companion only for sessions spawned while the companion is enabled: the runtime hook reports it under a separate per-session grant, bounded to 4000 characters, and the gateway refuses it for any other session.
+
+- Denied browser and device permissions on the default session: permission requests, permission checks, and device handlers now refuse, so plugin windows and shells cannot obtain camera, microphone, geolocation, or notification access. The built-in browser keeps its own separate partition policy.
+- Hardened packaged builds with Electron fuses that disable the `NODE_OPTIONS` environment variable and CLI inspect arguments and enable embedded asar integrity validation. `runAsNode` stays enabled on purpose because provider CLIs and the agent runtime spawn the bundled helpers through `ELECTRON_RUN_AS_NODE`; cookie encryption is not enabled because that transition is one-way.
+- Added renderer crash recovery: if the renderer process is lost, the main process logs the reason and exit code and reloads the application surface instead of leaving a blank window, while terminal services and live sessions keep running across the recovery. Losing a utility or GPU child is logged.
+- Added scrollback search: `Ctrl+Shift+F` in a focused terminal card opens an in-card search row with the input, match counter, previous/next, and close. `Enter` moves to the next match, `Shift+Enter` to the previous, and `Escape` closes the row and returns focus to the terminal so keystrokes never leak into the PTY. The row stays hidden in semantic summary mode.
+- Cards now show the title the provider sets through OSC 0/2 while their title is not user-customized, falling back to the existing path display when the provider sets none. Renaming wins permanently, and the provider title is display-only: it is never written back and never persisted.
+- Added a “Fit to content” canvas control that frames the HOME zone and every window with a margin inside the existing `0.2–1.35` zoom range; an empty canvas goes HOME instead. It is also offered in the canvas palette, and there is no keyboard chord for it.
+- Added directional focus: `Alt+ArrowUp/Down/Left/Right` (`Option` on macOS) moves focus to the nearest window in that direction across terminal cards, the built-in browser, and plugin canvases, requiring the target to be strictly ahead with a perpendicular-distance tie-break. The gesture does not run while renaming or capturing a shortcut, and leaves `Ctrl+K` and `Ctrl+,` untouched.
+- Added marquee selection: `Shift+drag` on empty canvas selects every terminal card it intersects (plugin canvases, the built-in browser, and sticky notes are not tested), and dragging any selected terminal moves the whole selection by the same delta, while a press that does not travel stays a plain click. Plain empty-canvas drag still pans the canvas exactly as before.
+- Added the session path to canvas palette search alongside the label and provider, so a session entry is found by its working directory. No second palette and no new key binding.
+- Added a HOME attention queue of sessions that need approval or have failed, derived only from session snapshots, always rendering its title row and an explicit empty state; clicking a row focuses that session. Failure details (trigger, popover, copy) were extracted into one shared implementation used by both the queue and the existing session rows.
+- Added an attention ring on cards whose session needs approval or has failed, plus the “Notify when attention is needed” setting in Settings → General (on by default) that raises one OS notification on a genuine transition into needing approval or failing: repeated snapshots and already-seen restore-time failures stay silent, and a failure the user triggers by restarting also notifies. Toggling the setting persists.
+- Cards now report whether they render live output: those in semantic summary mode (zoom below 0.5) stop receiving streamed output while their scrollback stays canonical and complete within the bounded history, and the missed output is replayed once when the card becomes visible again; if more output was produced while hidden than the bounded history holds, the oldest part of that stretch is gone and the replay says so instead of pretending the output is continuous.
+- Limited WebGL to the focused terminal card: one context at a time, disposed when focus leaves, with a fallback to the DOM renderer when the context is lost. Palette and transparency rendering are unchanged.
+- Added a self-update section in Settings → Updates with the honest states: idle, checking, update available with the version, downloading with the percent when known, ready to install, and unavailable for dev, offline, or error. Downloading and installing are explicit user actions, install-and-restart is offered only once the update is downloaded, and in development the row reports unavailable instead of throwing.
+- Hardened the repository secret audit to ignore key prefixes embedded inside identifiers, so names such as `disk-…` or `task-…` no longer produce false positives while real keys still match.
 ## 1.5.2
 
 - Fixed terminal history jumping to the beginning when Codex clears and redraws its history after a card resize. Readers retain their relative scroll position, while terminals at the bottom continue following new output.