Skip to content

1.6.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Sep 17:50
· 27 commits to main since this release
v1.6.1
a96d7a6

Renegade Core Model Manager (RenegadeCMM) v1.6.1

Release Version: v1.6.1
Tag / Commit: v1.6.1 (a96d7a6)
Target: Inter-Application Compatibility & RenegadeSwarm Daemon Bearer Authentication Handshake

Executive Summary

RenegadeCMM v1.6.1 aligns inter-application communication with the RenegadeSwarm desktop daemon. Privileged daemon endpoints on port 5180 now require cryptographic Bearer authentication. RenegadeCMM discovers the local daemon.token on disk, attaches it to model ingest and window focus calls, detects Swarm path-confinement errors (403 Forbidden), and displays connection status in Settings without exposing raw token secrets to the renderer.

Endpoint Authorization Matrix

Call Method Auth Scheme Notes
/api/health, /health, /api/status GET None (Public) Heartbeat, peer count, version. Unauthenticated.
/api/ingest POST Authorization: Bearer <64-hex> Automatic single-model ingest notification.
/api/models/scan POST Authorization: Bearer <64-hex> Fallback directory rescan notification.
/api/window/focus POST Authorization: Bearer <64-hex> Programmatic desktop window focus / restore.
/api/cmm/status GET Authorization: Bearer <64-hex> Daemon inspection route.

Upgrade & Launch Sequence

  1. Start Swarm first: Launch RenegadeSwarm so its daemon initializes on port 5180 and writes daemon.token.
  2. Launch RenegadeCMM: Navigate to Settings $\rightarrow$ RenegadeSwarm Bridge. Status should report Connected and Token: Found.
  3. Folder permissions: Ensure download directories in CMM reside inside Swarm's configured root folders. If a path is outside Swarm's roots, ingest will return 403 ("Model path is outside Swarm's allowed folder roots").
  4. Database State: Operates on existing SQLite schema version 11 with no migrations required.

Changes in this Release (a96d7a6)

  • Local Token Discovery (swarmAuthToken.ts):
    • Main process searches standard platform paths for daemon.token:
      • Windows: %APPDATA%\RenegadeSwarm\daemon.token
      • macOS: ~/Library/Application Support/RenegadeSwarm/daemon.token
      • Linux: ~/.config/RenegadeSwarm/daemon.token (also checks ~/.config/renegadeswarm/daemon.token)
      • Dev fallback: .renegadeswarm_security/daemon.token
    • Validates format against ^[a-f0-9]{64}$.
    • Caches token in memory for ingest, scan, and focus calls.
    • Intercepts HTTP 401 Unauthorized on daemon restarts to flush cache, reload from disk once, and retry.
  • Path Confinement Handling (swarmBridge.ts):
    • Intercepts HTTP 403 from /api/ingest and surfaces: "Model path is outside Swarm's allowed folder roots (Path Confinement)".
  • Strict Window Focus Failure (swarmBridge.ts):
    • Focus tries POST /api/window/focus $\rightarrow$ OS window handle $\rightarrow$ local desktop binary.
    • If all three methods fail, returns { success: false } instead of masking failures.
  • Renderer Token Isolation (SettingsTab.tsx):
    • Bearer token stays in the Electron main process. Renderer only receives boolean presence status, diagnostic error copy, and the expected path with a copy-to-clipboard button.
  • CI Modernization:
    • Upgraded GitHub Actions to actions/checkout@v5 with FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true.
  • Test Suite:
    • Added token discovery, bearer header, 401 retry, 403 path confinement, and mocked daemon unit tests. 125 tests passing across 21 test files.

Post-Tag Fixes on main (Scheduled for v1.6.2)

The following commits landed on main after tag v1.6.1 and are not included in the v1.6.1 binary installer:

  • adm-zip Upgrade (f72ba4a): Bumps adm-zip from 0.6.0 to 0.6.1 (npm audit: 0 vulnerabilities).
  • Launcher Hardening (fb1c6e8): Refuses silent Node.js installations on Windows, decouples PyTorch from routine start, stamps lockfile hash in .installed, isolates Electron kill targets, and adds TCP port readiness polling.
Assets 16
Loading