Skip to content

Covel v0.0.13

Latest

Choose a tag to compare

@github-actions github-actions released this 10 Jul 02:48
bbf3a40

[0.0.13] - 2026-07-10

The Windows release. The dev environment (spawn shims, plugin loading, supervised pnpm dev) now works on Windows, and CI builds Windows installers alongside the macOS bundles on every tag. Public web-only (browser IndexedDB) deployments are hardened: the shared session listing is hidden and the Render blueprint pins the memory backend explicitly.

Added

  • Windows desktop CI. release.yml gains a build-electron-win job (windows-latest): full desktop build with Electron-ABI native rebuild, staged-server smoke under Electron's Node mode, electron-builder --win (NSIS + portable, x64, unsigned until a cert is configured), and .exe artefacts attached to GitHub Releases alongside the macOS bundles. Windows targets are x64-only: the staged server ships a better-sqlite3 rebuilt for the build host's arch, so an arm64 installer from an x64 runner would carry an addon the arm64 sidecar cannot load — Windows-on-ARM runs the x64 installer via emulation.

Fixed

  • Windows dev environment. Dev scripts spawn through cross-spawn (resolves pnpm.cmd-style shims with correct cmd.exe quoting); plugin/runtime dynamic imports of absolute paths go through pathToFileURL so plugin loading works on Windows; pnpm dev launches web + server directly with supervised teardown; --env-file-if-exists tolerates a missing .env (raises the minimum Node to 22.9).
  • Desktop staging smoke now exercises the Electron ABI. The native rebuild runs before the smoke test and the staged server boots under ELECTRON_RUN_AS_NODE; a missing Electron binary fails the build instead of silently downgrading the check (COVEL_SMOKE_HOST_NODE=1 opts into the weaker host-Node smoke).
  • Electron runtime binary is materialised explicitly. electron@42 removed its postinstall hook, so pnpm install no longer downloads the binary into node_modules/electron/dist (whitelisting in onlyBuiltDependencies has nothing to run). The desktop build and dev shell now run ensure-electron.mjs first, which invokes electron's install.js when the binary is missing — without this, every desktop CI build died at the staging smoke on both macOS and Windows.
  • Public web-only hosting hardening. On memory-backend production deploys without debug routes, GET /api/session returns an empty list — server-side sessions there are transient sync copies of browser-IndexedDB data, and the only callers of a shared listing would be other players. render.yaml pins STORE_BACKEND=memory explicitly (the sqlite default would pool every player's data in one shared DB), adds a health check, and disables the debug page; the Docker image regains the workspace manifests (settings, plugin-handlers-utils, and four plugins) missing from its dependency-install stage.

What's Changed

  • feat: web-only (IndexedDB) public hosting hardening + Render blueprint fixes by @ackness in #13
  • [codex] Fix Windows dev environment by @ackness in #14
  • Release v0.0.13 by @ackness in #15
  • fix: v0.0.13 CI — Electron binary download (electron@42 dropped postinstall), actions/cache v5 by @ackness in #16
  • fix: Windows portable exe overwrote the NSIS installer (artifact name collision) by @ackness in #17

Full Changelog: v0.0.12...v0.0.13