chore(deps): bump github/codeql-action from 3 to 4

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-05-20 04:31:08 +00:00
14 changed files with 541 additions and 337 deletions
@@ -38,15 +38,16 @@ concurrency:
  cancel-in-progress: true

 permissions:
-  contents: read
+  contents: write
  pull-requests: read
+  checks: write

 jobs:
  boundary-gates:
    name: Boundary gates
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      - name: Run all scripts/check-*.sh (excluding app-builds)
        run: |
          fail=0
@@ -72,13 +73,13 @@ jobs:
    name: Webview (pnpm test + build)
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@v4
        with:
          version: 10.30.2
      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "pnpm"
@@ -107,7 +108,7 @@ jobs:
      # Artifact is the production-stamped App/Resources/webview/ tree.
      # Downstream SPM + app-build jobs depend on this artifact name.
      - name: Upload App/Resources/webview artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4
        with:
          name: webview-resources
          path: App/Resources/webview/
@@ -181,7 +182,7 @@ jobs:
            | xargs -r -I{} kill -9 {} 2>/dev/null || true
          echo "Surviving xctest/swift-test processes (any age — includes concurrent CI work on sibling runners):"
          /bin/ps -A -o pid,etime,comm | grep -E '(xctest|swift-test|swift-driver)$' || echo "  (none)"
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      # Project targets macOS 26 Tahoe + Swift 6.2/6.3. Xcode 16 (Swift 6.0)
      # cannot parse `mlx-audio-swift` v0.1.2's `swift-tools-version:6.2`,
      # lacks the `withThrowingTaskGroup` overload used by MCP `swift-sdk`
@@ -216,7 +217,7 @@ jobs:
      # not mounted` because index.html + the JS bundle are missing from
      # App/Resources/webview/.
      - name: Download webview resources
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4
        with:
          name: webview-resources
          path: App/Resources/webview/
@@ -230,7 +231,7 @@ jobs:
      # the cache action to github-hosted only.
      - name: Cache SPM build artifacts (github-hosted only)
        if: runner.environment == 'github-hosted'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4
        with:
          path: |
            packages/${{ matrix.package }}/.build
@@ -278,7 +279,7 @@ jobs:
    runs-on: macos-15
    needs: [boundary-gates, webview]
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      # Same Xcode 26.x pin as swift-packages — Xcode 16 cannot resolve
      # mlx-audio-swift's swift-tools-version:6.2 manifest.
      - name: Select Xcode
@@ -292,11 +293,11 @@ jobs:
      # and re-stamps the bundle — and would error with
      # "[build-webview] FATAL: pnpm not found on PATH" without these.
      - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@v4
        with:
          version: 10.30.2
      - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "pnpm"
@@ -304,7 +305,7 @@ jobs:
      # Reuse the webview build from the upstream job rather than rebuilding.
      # The Xcode build phase will re-stamp these on top.
      - name: Download webview resources
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4
        with:
          name: webview-resources
          path: App/Resources/webview/
@@ -313,7 +314,7 @@ jobs:
      - name: verify-codesign-settings.sh
        run: bash scripts/verify-codesign-settings.sh
      - name: Upload Jarvis.app artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4
        with:
          name: Jarvis-app-debug
          path: build/Build/Products/Debug/Jarvis.app
@@ -326,7 +327,7 @@ jobs:
    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_real_hardware == 'true'
    needs: [swift-packages]
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      - name: JARVIS_REAL_MODELS Memory regression corpus
        env:
          JARVIS_REAL_MODELS: "1"
@@ -341,8 +342,6 @@ jobs:
        run: swift test --package-path packages/Voice --filter OrpheusTTFATests

  publish-tag:
-    permissions:
-      contents: write
    name: Publish tag
    runs-on: ubuntu-latest
    needs: [boundary-gates, webview, swift-packages, app-build]
@@ -354,7 +353,7 @@ jobs:
        startsWith(github.ref, 'refs/heads/release/')
      )
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Compute next version
@@ -17,18 +17,16 @@ on:

 permissions:
  contents: read
+  pull-requests: write

 jobs:
  dependency-review:
-    permissions:
-      contents: read
-      pull-requests: write
    name: Dependency Review
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
      - name: Dependency Review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high
          # Default license policy: warn on copyleft, fail on nothing automatically.
@@ -13,16 +13,14 @@ on:
      - "v[0-9]+.[0-9]+.[0-9]+-*"

 permissions:
-  contents: read
+  contents: write

 jobs:
  release:
-    permissions:
-      contents: write
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

@@ -72,7 +70,7 @@ jobs:
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
@@ -41,12 +41,12 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Run Scorecard
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
@@ -57,6 +57,6 @@ jobs:
          publish_results: true

      - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@ce5e7eeac396d720fe2d802714996c8ce561e311 # v3
+        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif
@@ -20,19 +20,17 @@ concurrency:

 permissions:
  contents: read
+  security-events: write

 jobs:
  semgrep:
-    permissions:
-      contents: read
-      security-events: write
    name: Semgrep scan
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4

      - name: Semgrep CI
        env:
@@ -49,7 +47,7 @@ jobs:

      - name: Upload SARIF (when present)
        if: hashFiles('semgrep.sarif') != ''
-        uses: github/codeql-action/upload-sarif@ce5e7eeac396d720fe2d802714996c8ce561e311 # v3
+        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: semgrep.sarif
          category: semgrep
@@ -54,7 +54,46 @@ view, the Bus is the only legal way they talk. Subsystems live in
 single-purpose SPM packages; **18 boundary-gate scripts** keep the
 isolation honest.

-![Jarvis 2-Process Architecture Topology](docs/architecture.png)
+```mermaid
+flowchart TB
+    User[User<br/>voice / text / hotkey]
+
+    subgraph Swift["Swift host (AppKit + SwiftUI)"]
+        AppDel[AppDelegate<br/>install DAG + lifecycle]
+        Orch[AgentOrchestrator<br/>tool-loop + streaming]
+        Bridge[WebviewBridge<br/>typed JSON Bus]
+        Voice[Voice<br/>wake / STT / TTS]
+        Vision[Vision<br/>camera + frame-attach]
+        Memory[Memory<br/>SQLite + vec + mem0]
+        MCP[MCPRuntime<br/>helpers + in-proc tools]
+        Replay[Replay<br/>turn-by-turn audit log]
+        Boot[BootHealth<br/>NOT FAKED probes]
+    end
+
+    LLM["LLMProvider<br/>Anthropic Opus 4.7 / Ollama"]
+
+    subgraph Web["WKWebView (React + R3F)"]
+        Ring[Particle ring]
+        Chat[Chat panel]
+        DevOv[Dev Overlay]
+    end
+
+    User --> Voice
+    User --> Bridge
+    AppDel --> Vision
+    AppDel --> Orch
+    AppDel --> Voice
+    AppDel --> Boot
+    Voice --> Orch
+    Orch <--> LLM
+    Orch --> MCP
+    Orch --> Memory
+    Orch --> Vision
+    Orch --> Replay
+    Orch --> Bridge
+    Boot --> Bridge
+    Bridge <-->|Bus protocol| Web
+```

 The deep architecture doc is [`ARCHITECTURE.md`](ARCHITECTURE.md) (subsystem
 deep-dives, anti-patterns, navigation cheat sheet). The v1.0 typed-API
@@ -97,7 +136,21 @@ asserts the spawn-line ordering AND that `voiceInstallTask` awaits
 `agentInstallTask?.value` (a strictly stronger guarantee than spawn-order
 alone).

-![Jarvis Install Order Sequence](docs/install_order.png)
+```mermaid
+flowchart LR
+    Boot([applicationWillFinishLaunching]) --> Vision[installVision]
+    Boot --> Memory[installMemory]
+    Boot --> MCP[installMCP]
+    Boot --> Replay[installReplay]
+    Vision --> Agent[installAgent]
+    Memory --> Agent
+    MCP --> Agent
+    Replay --> Agent
+    Agent --> Voice[installVoice]
+    Voice --> Probes[registerBootHealthProbes]
+    Probes --> Bridge[Webview handshake]
+    Bridge --> Ready([HUD ready])
+```

 ## Build & run

@@ -163,7 +216,21 @@ subscribers that need it. If a subsystem is degraded, the orchestrator
 **injects a system-prompt preamble** so the agent doesn't promise to
 remember things the memory store can't actually persist.

-![Jarvis Agent Turn Lifecycle](docs/turn_lifecycle.png)
+```mermaid
+flowchart LR
+    In[User input<br/>text / voice transcript] --> Orch[AgentOrchestrator]
+    Health[BootHealth.rollup] -->|degradation preamble| Orch
+    Orch --> Provider[LLMProvider.stream]
+    Provider --> Events[(streaming events<br/>token / thinking / tool-use / stop)]
+    Events --> Bcast[Broadcaster<br/>single consumer]
+    Bcast --> Tx[Transcript]
+    Bcast --> Mem[Memory extractor]
+    Bcast --> Dev[DevOverlay]
+    Bcast --> Voice[Voice / TTS]
+    Bcast --> Bus[WebviewBridge → HUD]
+    Orch --> Tools[MCP tool calls]
+    Tools --> Provider
+```

 ## Boot-health probes

@@ -174,7 +241,32 @@ failures turn the menu-bar icon **red**, raise a non-dismissible HUD
 banner, and inject the degradation preamble into the agent's system
 prompt.

-![Jarvis Boot-Health Probe Ladder](docs/boot_health.png)
+```mermaid
+flowchart LR
+    M[MemoryBootHealthProbe<br/>vec0 + FTS5 reachable]
+    A[AnthropicBootHealthProbe<br/>keychain has API key]
+    O[OllamaBootHealthProbe<br/>service reachable + model loaded]
+    Vc[VoiceBootHealthProbe<br/>audio graph alive]
+    Vi[VisionBootHealthProbe<br/>AVCapture authorized]
+    Mc[MCPBootHealthProbe<br/>helper apps + in-proc tools]
+    R[ReplayBootHealthProbe<br/>WAL writable]
+    W[WebviewBootHealthProbe<br/>handshake completed]
+    Roll[BootHealthOrchestrator.rollup]
+    Icon[Menu-bar icon<br/>red on critical]
+    Banner[Non-dismissible banner]
+    Pre[Agent system-prompt<br/>degradation preamble]
+    M --> Roll
+    A --> Roll
+    O --> Roll
+    Vc --> Roll
+    Vi --> Roll
+    Mc --> Roll
+    R --> Roll
+    W --> Roll
+    Roll --> Icon
+    Roll --> Banner
+    Roll --> Pre
+```

 ## Project culture

@@ -3,9 +3,7 @@
  "private": true,
  "version": "0.0.0",
  "packageManager": "pnpm@10.30.2",
-  "engines": {
-    "node": ">=20.0.0"
-  },
+  "engines": { "node": ">=20.0.0" },
  "scripts": {
    "test": "pnpm -r test",
    "build": "pnpm -r build",
@@ -13,18 +11,13 @@
  },
  "devDependencies": {
    "typescript": "^5.5.0",
-    "vitest": "^4.1.11",
+    "vitest": "^3.0.0",
    "@types/node": "^20.0.0"
  },
  "pnpm": {
    "overrides": {
-      "vite": ">=8.0.16",
-      "esbuild": ">=0.25.0",
-      "undici": "^7.29.1",
-      "nanoid": "^3.3.12",
-      "postcss": "^8.5.23",
-      "fflate": "^0.8.3",
-      "source-map-js": "^1.2.2"
+      "vite": ">=8.0.12",
+      "esbuild": ">=0.25.0"
    }
  }
 }
@@ -19,6 +19,6 @@
  },
  "devDependencies": {
    "typescript": "^5.5.0",
-    "vitest": "^4.1.11"
+    "vitest": "^3.0.0"
  }
 }
@@ -25,7 +25,7 @@
    "@vitejs/plugin-react": "^6.0.1",
    "typescript": "^5.9.0",
    "vite": "^8.0.0",
-    "vitest": "^4.1.11",
+    "vitest": "^3.0.0",
    "@testing-library/react": "^16.3.0",
    "@testing-library/jest-dom": "^6.6.0",
    "jsdom": "^29.1.1"