Skip to content

v0.2.0 — CLONE FRAME HUB, first public build

Choose a tag to compare

View all tags
@devclone20 devclone20 released this 27 Jul 21:03
v0.2.0
51dc44a

A visual interface between you and your machine — a Unix with a face. One HTML
file for the window, one Node daemon for the hands. Your model, your keys, your
computer.

🔒 Read this first. The app gives real access to your shell, files,
network and wallet. Every powerful permission ships OFF. If you are only
curious, run it in Docker (below) rather than on your primary machine. You are
the pilot — the app hands you the controls, it does not fly itself.

Run it

Sandboxed (recommended for a first look)

git clone https://github.com/devclone20/cloneframe_app_executable.git
cd cloneframe_app_executable
docker compose up --build
# then open http://127.0.0.1:8765

Native, on macOS

git clone https://github.com/devclone20/cloneframe_app_executable.git
cd cloneframe_app_executable/bridge && npm install
./launch.sh

Then connect a model: MY MACHINE → BRAIN, paste an API key, press CONNECT,
pick a model. There is no house AI — the app is useless until you bring one, and
that is the point. Full walkthrough: docs/CONNECT.md.

Requirements: Node ≥ 18 and a Chromium browser for the window.

Why there is no .app to download here

bridge/make-app.sh builds the double-clickable on your machine, because the
bundle has to point at the launcher where you unpacked it. A prebuilt one would
carry someone else's paths. Run it once, after the steps above:

cd bridge && ./make-app.sh     # → ~/Applications/CLONE FRAME HUB.app

Verify what you are running

The app is a single self-contained file, built from web/ with esbuild. The build
is deterministic, so you do not have to take our word for what is in it:

npm install && npm run build
shasum -a 256 dist/index.html
71268e4a5f4d709784be362def080307fa48c669b9f0f34f61c5ac703e56c33f

That is the hash of index.html in this repository, of
clone-frame-hub-0.2.0.html attached below, and of what you just built. Same
bytes, three ways.

What is in this build

A full release audit ran before it: six independent readers, every claim then
handed to a skeptic whose job was to refute it. 14 findings survived and all 14
are fixed, each with a regression test verified failing against the old code.

Security

  • The file tools canonicalise a path (realpath + case fold) before deciding it is
    secret. macOS ships a case-insensitive filesystem, so ~/.SSH/id_ed25519 and
    ~/.ssh/id_ed25519 are the same file and different strings; a symlink was
    equally invisible.
  • Token metadata reaching an agent's system prompt is flattened, clamped and
    fenced as data — a hostile NFT name can no longer pose as instructions.
  • The boot banner no longer prints the pairing token, which is the whole
    authentication for the daemon and the first thing anyone pastes into a bug
    report.

Bringing your own model

  • The brain route authenticated with a Keychain placeholder instead of the key,
    so every chat and every background AI feature returned 401.
  • CONNECT probes your provider and refuses a key it rejects, at that moment, in
    the provider's own words. A failed answer is never quietly replaced.
  • Each key has an ON/OFF switch. Settings → AI Defaults now actually decides
    which model answers; it used to save your choice and ignore it.
  • COMPARE sends each model to the provider that serves it. It used to send every
    model in a cross-vendor run to one of them.

Windows and panels

  • Live terminals survive a reload; a docked terminal or browser window survives a
    grid rebuild instead of leaking its sessions; a panel opened before pairing
    wakes up when the bridge arrives.
  • The LAB conversation outlives the window that showed it — dock mid-answer and
    it finishes; ✕ cancels; reload restores.
  • A harness gate that outlived its run is retired and says so, instead of coming
    back with APPROVE/REJECT buttons that do nothing.

627 automated tests, deterministic build, and a sterilization gate that refuses
to publish if a key, a private path or a non-parsing app is in the tree.

Where this build is thin — please aim here

Honest coverage, so your report is worth your time:

  • 20 of 27 panels have not yet had a dedicated live pass. EMAIL, CALENDAR,
    CONTACTS, REMINDERS, TASKS, LIBRARY, SEARCH, COOKBOOK, GALLERY, AUTOMATIONS and
    INTEGRATIONS are the least exercised.
  • 41 of 151 hands-on QA tests have been run, and none of the 7 end-to-end
    user journeys    .
  • macOS is the only tested platform. The daemon is portable Node and should
    run elsewhere; the launch and packaging scripts are macOS-first.
  • Anything involving a second machine (MATRIX multi-node) is unproven outside
    a single host.

Reporting a bug

Open an issue. What helps most, in order:

  1. What you expected, and what happened
  2. The exact text the app or the terminal showed — but never paste your
    pairing token or an API key    ; the banner hides the token by default now, and
    ~/.clone-frame-hub/bridge.token should never leave your machine
  3. curl -s http://127.0.0.1:8765/health output
  4. macOS version, Node version, browser
  5. A screenshot if it is visual

Security issues: see SECURITY.md — please report those privately rather than in a public issue.

MIT licensed. Built in the open.

Assets 4
Loading