Conversation
The sentence was split across two source lines with a backslash continuation, which keeps the indentation inside the string - so what reached the log had a run of spaces in the middle of it. concat! joins the pieces with nothing between them and cannot do that whatever the surrounding formatting is. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN
Three things about letting a second installation in, all of them in the way. The code had to be read off one screen and typed into the other before the approve button appeared. The eye had already done the comparing; the typing only added a chance to mistype sixteen characters and be told the codes did not match when they did. It is a checkbox now - the person either compared the two screens or decided not to, and that is their call to make either way. Nothing about the security changed with it. The fingerprint still travels to the backend, which recomputes it from the key it fetches at that moment, so a key swapped between the card being drawn and the button being pressed is still caught. That check was never the typing. The card itself now looks like the rest of the panel: the code sits in the same inset block the recovery code uses, large enough to read across a desk, the heading carries the shield the other headings do, and the action is a primary button with a spinner rather than an outline one that read as disabled. And the installation that was waiting now notices when it has been let in. It polled nothing, so it went on saying it was waiting until Settings was closed and reopened - which reads as the approval having failed. The panel already had a poll for the conversion sweep; it now also runs while this installation cannot open the key, and e2ee_status picks the key up opportunistically, so asking is also the act of unlocking. Waiting to be let in takes priority over watching the sweep, because an installation that cannot open the key can do nothing about the sweep anyway. The poll is quiet: it touches neither the busy flag nor the error line, so it cannot grey out a button under the cursor or wipe a message still being read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN
test:unit and test:integration both passed --testPathPattern, which is Jest's flag, not vitest's. Vitest takes file filters as positional arguments and its CLI parser rejects unknown options outright, so both died with `Unknown option --testPathPattern` before collecting a single file. They were introduced that way in f4b229e alongside vitest 4, which is the version that throws, so neither has ever run. Removed rather than repaired, because the split they describe does not exist. Every test file is named *.test.ts, so test:unit would match all fourteen and be a slower spelling of npm test, and test:integration would match none - the config only collects src/**/*.{test,spec}.{js,ts}, so an integration file would need a naming convention and an include change before a script could select it. CI never used either one: test.yml runs npm run test and npm run test:coverage, so nothing has been silently skipped. TESTING.md documented both and no longer does. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN
A plan filed through the MCP server, or a stash after AI enhancement, could run to several screens, and scrolling past one to reach the next item was most of the work of using the queue. A stash whose content is clearly taller than a fixed cap (not just a line or two over) now clamps to that height with a fade at the bottom, and a Show more / Show less button toggles it. Short stashes are unaffected. Collapsing a stash scrolled past its top brings the card back into view instead of leaving the reader stranded below it. Checked: svelte-check reports 0 errors, all 218 vitest tests pass, and I verified the clamp, toggle and no-accidental-copy behavior against the screenshot demo with a synthetic long stash (reverted after). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Measured one run: the rust matrix leg of codeql.yml took 6m36s against javascript-typescript's 1m1s and actions' 46s. Inside it, the extractor's own duration log breaks the 2m28s Extract phase down as LoadManifest (44.7s) and ExtractLibrary (46.0s) - resolving the dependency graph and its signatures for the 799 crates in src-tauri/Cargo.lock, the same crate count that made release.yml's own rust-cache entry worth adding. The remaining ~3m of the job is query evaluation shared across every query, security and diagnostic alike, and does not look reducible without shrinking the dependency graph itself or the query suite - out of scope here. Adding Swatinem/rust-cache before Initialize CodeQL, same as test.yml and release.yml already do, in case LoadManifest/ExtractLibrary are what it warms. Unverified: nothing in this run's log names a network fetch, so this may warm nothing the extractor reads. save-if mirrors release.yml's reasoning - this workflow's only run against main is the weekly schedule, so that is the only write, and everything else only restores. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Temporary, to be reverted after: save-if is normally main-only, and this run's whole point is to populate the develop-scoped cache so a follow-up dispatch can measure a hit against the baseline already recorded.
Two dispatched runs on develop, one cold and one on a full cache hit, 190 MB of ~/.cargo/registry restored in three seconds. The extractor's own timings barely moved: LoadManifest 58.2s to 50.6s, ExtractLibrary 57.2s to 55.1s, extraction as a whole 3m01s to 2m49s, and the rust job 8m37s to 8m16s. That is inside the spread between two uncached runs earlier the same evening (6m36s and 8m23s), so the cache is not what those phases are waiting on. It is not worth 190 MB of a 10 GB budget that release.yml and test.yml already fill to three quarters. This also undoes the temporary save-if override the measurement needed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The rust leg is the whole length of codeql.yml - six to eight minutes, against about one each for actions and javascript-typescript - and almost none of it is this repository's code. The extractor spends it resolving the 799 crates in Cargo.lock, and the queries spend it on one shared pass over the database that builds, which is why all 37 finish within seconds of each other. Caching the cargo registry was measured and saved nothing, so the remaining lever is not running it when it cannot find anything new. A small job now asks the pull request's file list whether anything under src-tauri/, or this workflow itself, changed. When nothing did, the rust leg still runs as a job but skips its steps and says so in its summary, so the check reads as skipped rather than disappearing. Every doubt resolves to analysing: a failed lookup, an empty list, or a list at the endpoint's 3000-file cap. The weekly schedule and a manual dispatch always analyse everything, which keeps the Security tab's baseline for main complete. Checked the lookup against real pull requests: #16 and #18 (npm only) skip, #19 and #21 (cargo) analyse, #23 (develop) analyses, a missing PR analyses, and a scheduled run analyses. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Dependabot's 20 open alerts were all Rust, all in Cargo.lock and all shipping in the binary. Most were in crates the app only pulls in through other crates, which the grouped version-update PRs never touch. The cargo one fixed none of them. - tauri 2.10.2 -> 2.11.6 (floor raised to 2.11.1): is_local_url() let a remote origin pass as app:// on Windows/Android. Not reachable today, since the webview never leaves its bundle. @tauri-apps/api and cli follow to 2.11, which the build requires. - openssl 0.10.81, rustls-webpki 0.103.15, tar 0.4.46, serde_with 3.22.0, rand 0.8.8 / 0.9.5 Still open: glib 0.18 (gtk-rs 0.18 pins it until Tauri moves off it) and rand 0.7.3, which is build-time only (phf_codegen via tauri-utils). dependabot.yml drops the npm and cargo version updates: dependencies are now refreshed by hand before a release, and alerts stay on. cargo test 147 passed, vitest 218 passed, tsc clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The sentence was split across two source lines with a backslash continuation,
which keeps the indentation inside the string - so what reached the log had a run
of spaces in the middle of it. concat! joins the pieces with nothing between them
and cannot do that whatever the surrounding formatting is.
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01P4Pn5YzK5yErCEZkV47WmN