Primora

82 Commits 10 Branches 10 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Tomas DvorakandDevin	edef002beb	feat: Desktop auto-updater + release SBOMs - tauri-plugin-updater + process: pubkey embedded in tauri.conf.json, createUpdaterArtifacts, endpoint = GitHub latest.json manifest. - Connect screen checks before auto-connect (bounded 5s) — a saved URL would otherwise navigate away before the check resolves. "Update & restart" downloads, verifies minisign, installs, relaunches. - Release workflow signs updater artifacts with TAURI_SIGNING_PRIVATE_KEY secrets, ships the .sig files, and assembles latest.json from them. No key → no manifest → no update, never a silent unsigned install. - anchore/sbom-action emits CycloneDX SBOMs per GHCR image plus the source tree, attached to every release. Note: the signing keypair was generated locally (~/.tauri/primora-updater.key); the private half must be added to repo secrets before the next release for updates to activate. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 20:41:16 +02:00
Tomas DvorakandDevin	585bb04ab2	feat: encrypted secrets vault across CLI, desktop, dashboard, and backend Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 18:46:37 +02:00
Tomas Dvorak	deb56d9a23	feat: phase 5 distribution — tauri shell, pwa, desktop release artifacts - apps/desktop: Tauri 2 thin shell; connect screen stores the deployment URL, webview renders the remote console, tray with Show/Change Server/ Quit, close-to-tray, single-instance - frontend: vite-plugin-pwa generates manifest + Workbox SW (shell precache, /api /auth /mailpit NetworkOnly), install banner on beforeinstallprompt, rasterized PWA icons - release.yml: desktop bundle matrix (linux/macos/windows) attached to GitHub Releases - workspace 0.5.0; Dockerfiles copy the desktop workspace manifest Authored By: TDvorak <[email protected]>	2026-09-16 19:59:53 +02:00

Author

SHA1

Message

Date

Tomas DvorakandDevin

edef002beb

feat: Desktop auto-updater + release SBOMs

- tauri-plugin-updater + process: pubkey embedded in tauri.conf.json,
  createUpdaterArtifacts, endpoint = GitHub latest.json manifest.
- Connect screen checks before auto-connect (bounded 5s) — a saved
  URL would otherwise navigate away before the check resolves.
  "Update & restart" downloads, verifies minisign, installs, relaunches.
- Release workflow signs updater artifacts with
  TAURI_SIGNING_PRIVATE_KEY secrets, ships the .sig files, and assembles
  latest.json from them. No key → no manifest → no update, never a
  silent unsigned install.
- anchore/sbom-action emits CycloneDX SBOMs per GHCR image plus the
  source tree, attached to every release.

Note: the signing keypair was generated locally
(~/.tauri/primora-updater.key); the private half must be added to repo
secrets before the next release for updates to activate.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-24 20:41:16 +02:00

Tomas DvorakandDevin

585bb04ab2

feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-24 18:46:37 +02:00

Tomas Dvorak

deb56d9a23

feat: phase 5 distribution — tauri shell, pwa, desktop release artifacts

- apps/desktop: Tauri 2 thin shell; connect screen stores the deployment
  URL, webview renders the remote console, tray with Show/Change Server/
  Quit, close-to-tray, single-instance
- frontend: vite-plugin-pwa generates manifest + Workbox SW (shell
  precache, /api /auth /mailpit NetworkOnly), install banner on
  beforeinstallprompt, rasterized PWA icons
- release.yml: desktop bundle matrix (linux/macos/windows) attached to
  GitHub Releases
- workspace 0.5.0; Dockerfiles copy the desktop workspace manifest

Authored By: TDvorak <[email protected]>

2026-09-16 19:59:53 +02:00