fix(ci): rezip Electron macOS zips with ditto

Add a codesign verify step on extracted artifacts to catch signature/resource mismatches before upload.
Merge pull request #197 from VooDisss/issue-195
2026-02-23 08:54:57 +00:00 · 2026-02-23 08:27:11 +00:00 · 2026-02-23 02:30:44 +02:00 · 2026-02-22 17:32:28 +00:00 · 2026-02-22 16:53:51 +00:00 · 2026-02-22 16:48:49 +00:00
18 changed files with 229 additions and 29 deletions
--- a/.github/workflows/build-and-upload.yml
+++ b/.github/workflows/build-and-upload.yml
@@ -3,6 +3,11 @@ name: Build and Upload Binaries
 on:
  workflow_call:
    inputs:
+      ref:
+        description: "Git ref (branch, tag, or SHA) to build from"
+        required: false
+        default: ""
+        type: string
      version:
        description: "Version to apply to workspace packages (release builds)"
        required: false
@@ -45,6 +50,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -65,6 +72,78 @@ jobs:
      - name: Build macOS binaries (Electron)
        run: npm run build:mac --workspace @neuralnomads/codenomad-electron-app

+      - name: Repackage Electron macOS zips (ditto)
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Prefer the workflow-provided version; fall back to package.json.
+          VERSION_TO_USE="${VERSION:-}"
+          if [ -z "$VERSION_TO_USE" ]; then
+            VERSION_TO_USE=$(node -p "require('./packages/electron-app/package.json').version")
+          fi
+
+          release_root="packages/electron-app/release"
+          shopt -s nullglob globstar
+
+          apps=("$release_root"/**/CodeNomad.app)
+          if [ "${#apps[@]}" -eq 0 ]; then
+            echo "No CodeNomad.app found under $release_root" >&2
+            exit 1
+          fi
+
+          for app in "${apps[@]}"; do
+            bundle_dir=$(basename "$(dirname "$app")")
+            arch="x64"
+            if [[ "$bundle_dir" == *"arm64"* ]]; then
+              arch="arm64"
+            fi
+
+            out_zip="$release_root/CodeNomad-${VERSION_TO_USE}-mac-${arch}.zip"
+            rm -f "$out_zip"
+            echo "ditto -ck: $app -> $out_zip"
+            ditto -ck --sequesterRsrc --keepParent "$app" "$out_zip"
+          done
+
+      - name: Validate Electron macOS codesign (unzipped)
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          tmp_dir=$(mktemp -d)
+          trap 'rm -rf "$tmp_dir"' EXIT
+
+          zips=(packages/electron-app/release/CodeNomad-*-mac-*.zip)
+          if [ "${#zips[@]}" -eq 0 ]; then
+            echo "No Electron macOS zip artifacts found to validate" >&2
+            exit 1
+          fi
+
+          for zip in "${zips[@]}"; do
+            echo "Validating codesign for: $zip"
+            extract_dir="$tmp_dir/$(basename "$zip" .zip)"
+            mkdir -p "$extract_dir"
+
+            # Use ditto for extraction as well to preserve bundle metadata.
+            ditto -x -k "$zip" "$extract_dir"
+
+            app_path=""
+            for candidate in "$extract_dir"/*.app "$extract_dir"/*/*.app; do
+              if [ -d "$candidate" ]; then
+                app_path="$candidate"
+                break
+              fi
+            done
+
+            if [ -z "$app_path" ]; then
+              echo "No .app found after extracting $zip" >&2
+              exit 1
+            fi
+
+            codesign --verify --deep --strict --verbose=2 "$app_path"
+          done
+
      - name: Upload release assets
        if: ${{ inputs.upload && inputs.tag != '' }}
        run: |
@@ -85,6 +164,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -124,6 +205,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -164,6 +247,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -237,6 +322,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -310,6 +397,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -388,6 +477,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -490,6 +581,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3
@@ -587,6 +680,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
--- a/.github/workflows/dev-release.yml
+++ b/.github/workflows/dev-release.yml
@@ -1,12 +1,13 @@
 name: Develop Pre-Release

 on:
-  push:
-    branches:
-      - dev
+  schedule:
+    # Nightly build of dev (only if dev has new commits)
+    - cron: "0 1 * * *"
  workflow_dispatch:

 permissions:
+  actions: read
  id-token: write
  contents: write

@@ -15,25 +16,63 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  prepare:
+  gate:
    runs-on: ubuntu-latest
    outputs:
-      version_suffix: ${{ steps.vars.outputs.version_suffix }}
+      run: ${{ steps.gate.outputs.run }}
+      dev_sha: ${{ steps.gate.outputs.dev_sha }}
+      version_suffix: ${{ steps.gate.outputs.version_suffix }}
    steps:
-      - name: Compute version suffix
-        id: vars
+      - name: Decide whether to run
+        id: gate
        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
-          SHA8="${GITHUB_SHA::8}"
+
+          api() {
+            curl -sS \
+              -H "Authorization: Bearer ${GH_TOKEN}" \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "$1"
+          }
+
+          DEV_SHA=$(api "https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/heads/dev" | jq -r '.object.sha')
+          if [ -z "$DEV_SHA" ] || [ "$DEV_SHA" = "null" ]; then
+            echo "Failed to resolve dev head SHA" >&2
+            exit 1
+          fi
+
          DATE=$(date -u +%Y%m%d)
-          echo "version_suffix=-dev-${DATE}-${SHA8}" >> "$GITHUB_OUTPUT"
+          SHA8="${DEV_SHA::8}"
+          VERSION_SUFFIX="-dev-${DATE}-${SHA8}"
+
+          SHOULD_RUN="false"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            SHOULD_RUN="true"
+          else
+            # Nightly: only run if dev has advanced since last successful dev-release build.
+            LAST_SHA=$(api "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/dev-release.yml/runs?branch=dev&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty')
+            if [ -z "${LAST_SHA}" ]; then
+              SHOULD_RUN="true"
+            elif [ "${LAST_SHA}" != "${DEV_SHA}" ]; then
+              SHOULD_RUN="true"
+            fi
+          fi
+
+          echo "run=${SHOULD_RUN}" >> "$GITHUB_OUTPUT"
+          echo "dev_sha=${DEV_SHA}" >> "$GITHUB_OUTPUT"
+          echo "version_suffix=${VERSION_SUFFIX}" >> "$GITHUB_OUTPUT"

  prerelease:
-    needs: prepare
+    needs: gate
+    if: ${{ needs.gate.outputs.run == 'true' }}
    uses: ./.github/workflows/reusable-release.yml
    with:
-      version_suffix: ${{ needs.prepare.outputs.version_suffix }}
+      ref: ${{ needs.gate.outputs.dev_sha }}
+      version_suffix: ${{ needs.gate.outputs.version_suffix }}
      npm_package_name: "@neuralnomads/codenomad-dev"
      dist_tag: latest
      prerelease: true
--- a/.github/workflows/manual-npm-publish.yml
+++ b/.github/workflows/manual-npm-publish.yml
@@ -19,6 +19,10 @@ on:
        type: string
  workflow_call:
    inputs:
+      ref:
+        required: false
+        default: ""
+        type: string
      version:
        required: true
        type: string
@@ -46,6 +50,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
--- a/.github/workflows/release-ui.yml
+++ b/.github/workflows/release-ui.yml
@@ -1,7 +1,13 @@
 name: Release UI

 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref (branch, tag, or SHA) to build from"
+        required: false
+        default: ""
+        type: string
  workflow_dispatch: {}

 permissions:
@@ -18,6 +24,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -3,6 +3,11 @@ name: Reusable Release
 on:
  workflow_call:
    inputs:
+      ref:
+        description: "Git ref (branch, tag, or SHA) to build from"
+        required: false
+        default: ""
+        type: string
      version_suffix:
        description: "Suffix appended to package.json version"
        required: false
@@ -46,6 +51,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -84,6 +91,7 @@ jobs:
    needs: prepare-release
    uses: ./.github/workflows/build-and-upload.yml
    with:
+      ref: ${{ inputs.ref || github.ref }}
      version: ${{ needs.prepare-release.outputs.version }}
      tag: ${{ needs.prepare-release.outputs.tag }}
      release_name: ${{ needs.prepare-release.outputs.release_name }}
@@ -95,6 +103,8 @@ jobs:
    permissions:
      contents: read
    uses: ./.github/workflows/release-ui.yml
+    with:
+      ref: ${{ inputs.ref || github.ref }}
    secrets: inherit

  publish-server:
@@ -103,6 +113,7 @@ jobs:
      - build-and-upload
    uses: ./.github/workflows/manual-npm-publish.yml
    with:
+      ref: ${{ inputs.ref || github.ref }}
      version: ${{ needs.prepare-release.outputs.version }}
      dist_tag: ${{ inputs.dist_tag }}
      package_name: ${{ inputs.npm_package_name }}
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "codenomad-workspace",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codenomad-workspace",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "license": "MIT",
      "dependencies": {
        "7zip-bin": "^5.2.0",
@@ -11985,7 +11985,7 @@
    },
    "packages/electron-app": {
      "name": "@neuralnomads/codenomad-electron-app",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "license": "MIT",
      "dependencies": {
        "@codenomad/ui": "file:../ui",
@@ -12021,7 +12021,7 @@
    },
    "packages/server": {
      "name": "@neuralnomads/codenomad",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "license": "MIT",
      "dependencies": {
        "@fastify/cors": "^8.5.0",
@@ -12062,7 +12062,7 @@
    },
    "packages/tauri-app": {
      "name": "@codenomad/tauri-app",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "license": "MIT",
      "devDependencies": {
        "@tauri-apps/cli": "^2.9.4"
@@ -12070,7 +12070,7 @@
    },
    "packages/ui": {
      "name": "@codenomad/ui",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "license": "MIT",
      "dependencies": {
        "@git-diff-view/solid": "^0.0.8",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "codenomad-workspace",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "private": true,
  "description": "CodeNomad monorepo workspace",
  "license": "MIT",
--- a/packages/cloudflare/release-config.json
+++ b/packages/cloudflare/release-config.json
@@ -1,4 +1,4 @@
 {
-  "minServerVersion": "0.11.1",
+  "minServerVersion": "0.11.4",
  "latestServerUrl": "https://github.com/NeuralNomadsAI/CodeNomad/releases/latest"
 }
--- a/packages/electron-app/package.json
+++ b/packages/electron-app/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@neuralnomads/codenomad-electron-app",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "description": "CodeNomad - AI coding assistant",
  "license": "MIT",
  "author": {
--- a/packages/opencode-config/package.json
+++ b/packages/opencode-config/package.json
@@ -4,6 +4,6 @@
  "private": true,
  "license": "MIT",
  "dependencies": {
-    "@opencode-ai/plugin": "1.2.6"
+    "@opencode-ai/plugin": "1.2.10"
  }
 }
--- a/packages/server/package-lock.json
+++ b/packages/server/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "@neuralnomads/codenomad",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@neuralnomads/codenomad",
-      "version": "0.11.3",
+      "version": "0.11.4",
      "dependencies": {
        "@fastify/cors": "^8.5.0",
        "@fastify/reply-from": "^9.8.0",
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@neuralnomads/codenomad",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "description": "CodeNomad Server",
  "license": "MIT",
  "author": {
--- a/packages/tauri-app/package.json
+++ b/packages/tauri-app/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@codenomad/tauri-app",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "private": true,
  "license": "MIT",
  "scripts": {
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@codenomad/ui",
-  "version": "0.11.3",
+  "version": "0.11.4",
  "private": true,
  "license": "MIT",
  "type": "module",
--- a/packages/ui/src/components/file-viewer/monaco-diff-viewer.tsx
+++ b/packages/ui/src/components/file-viewer/monaco-diff-viewer.tsx
@@ -61,6 +61,11 @@ export function MonacoDiffViewer(props: MonacoDiffViewerProps) {
        // Keep enough gutter space so unified diffs don't overlap `+`/`-` markers.
        lineNumbersMinChars: 4,
        lineDecorationsWidth: 12,
+        // Use legacy diff algorithm for better performance with large files
+        // See: https://github.com/microsoft/vscode/issues/184037
+        diffAlgorithm: "legacy",
+        // Limit computation time to avoid freezing on large files
+        maxComputationTime: 10000,
      })

      setReady(true)
--- a/packages/ui/src/components/tool-call/renderers/task.tsx
+++ b/packages/ui/src/components/tool-call/renderers/task.tsx
@@ -287,7 +287,9 @@ export const taskRenderer: ToolRenderer = {
                content: promptContent()!,
                cacheKey: "task:prompt",
                disableScrollTracking: true,
-                disableHighlight: true,
+                // Always use the normal markdown render path for prompt (even while running)
+                // so the prompt doesn't visually change between running/completed states.
+                disableHighlight: false,
              })}
            </div>
          </section>
--- a/packages/ui/src/stores/session-events.ts
+++ b/packages/ui/src/stores/session-events.ts
@@ -40,7 +40,7 @@ import {
 } from "./instances"
 import { showAlertDialog } from "./alerts"
 import { createClientSession, mapSdkSessionStatus, type Session, type SessionStatus } from "../types/session"
-import { sessions, setSessions, syncInstanceSessionIndicator, withSession } from "./session-state"
+import { ensureSessionParentExpanded, sessions, setSessions, syncInstanceSessionIndicator, withSession } from "./session-state"
 import { normalizeMessagePart } from "./message-v2/normalizers"
 import { updateSessionInfo } from "./message-v2/session-info"
 import { tGlobal } from "../lib/i18n"
@@ -108,6 +108,8 @@ interface TuiToastEvent {
 const ALLOWED_TOAST_VARIANTS = new Set<ToastVariant>(["info", "success", "warning", "error"])

 function applySessionStatus(instanceId: string, sessionId: string, status: SessionStatus) {
+  let parentToExpand: string | null = null
+
  withSession(instanceId, sessionId, (session) => {
    const current = session.status ?? "idle"
    if (current === status) return false
@@ -117,7 +119,17 @@ function applySessionStatus(instanceId: string, sessionId: string, status: Sessi
    }

    session.status = status
+
+    // Auto-expand the parent thread when a child session starts working.
+    // Users can still collapse it; we only expand on the transition.
+    if (session.parentId && status === "working" && current !== "working") {
+      parentToExpand = session.parentId
+    }
  })
+
+  if (parentToExpand) {
+    ensureSessionParentExpanded(instanceId, parentToExpand)
+  }
 }

 async function fetchSessionInfo(instanceId: string, sessionId: string, directory?: string): Promise<Session | null> {
@@ -158,6 +170,7 @@ async function fetchSessionInfo(instanceId: string, sessionId: string, directory
    const fetched = createClientSession(info, instanceId, "", { providerId: "", modelId: "" }, fetchedStatus)

    let updatedInstanceSessions: Map<string, Session> | undefined
+    let shouldExpandParent: string | null = null

    setSessions((prev) => {
      const next = new Map(prev)
@@ -174,11 +187,19 @@ async function fetchSessionInfo(instanceId: string, sessionId: string, directory
      instanceSessions.set(sessionId, merged)
      next.set(instanceId, instanceSessions)
      updatedInstanceSessions = instanceSessions
+
+      if (merged.parentId && merged.status === "working" && (existing?.status ?? "idle") !== "working") {
+        shouldExpandParent = merged.parentId
+      }
      return next
    })

    syncInstanceSessionIndicator(instanceId, updatedInstanceSessions)

+    if (shouldExpandParent) {
+      ensureSessionParentExpanded(instanceId, shouldExpandParent)
+    }
+
    return fetched
  } catch (error) {
    log.error("Failed to fetch session info", error)
--- a/packages/ui/src/stores/session-state.ts
+++ b/packages/ui/src/stores/session-state.ts
@@ -347,10 +347,23 @@ function clearActiveParentSession(instanceId: string): void {
 }

 function setSessionStatus(instanceId: string, sessionId: string, status: SessionStatus): void {
+  let parentToExpand: string | null = null
+
  withSession(instanceId, sessionId, (session) => {
    if (session.status === status) return false
+    const previous = session.status
    session.status = status
+
+    // If a child session starts working, auto-expand its parent thread once.
+    // Users can still collapse it afterwards; we only expand on the transition.
+    if (session.parentId && status === "working" && previous !== "working") {
+      parentToExpand = session.parentId
+    }
  })
+
+  if (parentToExpand) {
+    ensureSessionParentExpanded(instanceId, parentToExpand)
+  }
 }

 function getActiveParentSession(instanceId: string): Session | null {
Author	SHA1	Message	Date
Shantur Rathore	90baefbb7e	fix(ci): rezip Electron macOS zips with ditto Add a codesign verify step on extracted artifacts to catch signature/resource mismatches before upload.	2026-02-23 08:54:57 +00:00
Shantur Rathore	1c138f4489	Merge pull request #197 from VooDisss/issue-195 fix: Use legacy diff algorithm for better large file performance	2026-02-23 08:27:11 +00:00
VooDisss	d36e568ed0	fix: Use legacy diff algorithm for better large file performance - Set diffAlgorithm to 'legacy' for Monaco DiffEditor - Add maxComputationTime of 10s to avoid UI freeze on huge files This addresses the issue where sessions with large JSON files (50k-100k+ lines) would cause the UI to freeze. The 'legacy' algorithm is faster than 'advanced' for large files, similar to VSCode's workaround for the same issue. See: https://github.com/microsoft/vscode/issues/184037	2026-02-23 02:30:44 +02:00
Shantur Rathore	d6462ef524	Min version 0.11.4	2026-02-22 17:32:28 +00:00
Shantur Rathore	a06884ebce	Bump to v0.11.4	2026-02-22 16:53:51 +00:00
Shantur Rathore	62bd88f6a4	chore(plugin): Upgrade dependency version	2026-02-22 16:48:49 +00:00
Shantur Rathore	6479561779	fix(ui): auto-expand session thread when child starts working	2026-02-22 16:47:04 +00:00
Shantur Rathore	635237c258	fix(ui): render task prompt consistently while running	2026-02-22 08:58:39 +00:00
Shantur Rathore	33f0aa5714	ci: run dev prerelease nightly Replace dev push builds with nightly schedule that only runs when dev head advances; still runs on manual dispatch. Plumb a ref input through reusable workflows so scheduled runs build the dev commit.	2026-02-20 13:58:32 +00:00