* fix(infra): relocate wizard password file under OCTOP_HOME with legacy fallback
Derive the wizard password location from PathLayout root (OCTOP_HOME)
instead of hardcoding Path.home(). When OCTOP_HOME is relocated, the
password file is created and resolved from <OCTOP_HOME>/octop-login.txt.
To preserve complete backward compatibility for existing installations,
resolve_password_path, ensure_password, and read_password maintain a
fallback to legacy ~/octop-login.txt, migrating and synchronizing the
secret on boot when upgrading so no duplicate secrets are generated.
Closes#2171
* docs(changelog): record octop-login.txt OCTOP_HOME relocation fix (#2171)
* fix(setup): stop issuing wizard tokens after the first user exists
Anonymous POST /setup/resume-wizard minted a bearer that could replace
the active model on any single-user install. Tokens are now only issued
before any user exists; afterwards they can only be validated.
* fix(test): accept 404 when the setup wizard route is absent
CI does not mount the dashboard SPA, so a removed POST is 404. A local
tree with the built SPA returns 405 from the GET-only catch-all. Either
status means no wizard token was issued.
* fix: harden remote desktop setup on macOS and Linux
Show macOS TCC permission guidance when deps are ready but capture is blocked, and treat incomplete Linux installs (missing systemd units) as needs_install so install is retried instead of a broken start-only path.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: pin desktop icon size and prefer bundled wallpaper
Set xfdesktop icon-size to 48 so Ubuntu hosts match Docker defaults, and install the local wallpaper.png before falling back to remote download.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: force larger xfdesktop icons and clear stale xfce config
Bump default desktop icon-size to 72, apply it via a dedicated post-start script with verification/reload, and remove leftover xfce4 desktop config on uninstall/reinstall so Ubuntu hosts no longer keep tiny icons.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: fix tiny desktop icons via VNC DPI and icon themes
Headless TigerVNC without -dpi makes fonts and labels look normal while xfdesktop icons stay as fixed tiny pixels. Install Adwaita icons (skipped by --no-install-recommends), force -dpi 96, and hard-restart xfdesktop after applying size/theme.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: install SVG icon loader and materialize desktop launcher PNGs
Tiny desktop icons on Ubuntu came from missing librsvg2-common (Adwaita SVGs) plus xfconf applied without the session D-Bus. Install the pixbuf SVG loader, write static xsettings, render launcher icons to PNGs, and log apply-icon-size failures.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: restore normal desktop icons/panel and clarify terminal WS logs
Revert oversized letter-tile icon fallbacks to 48px theme icons, seed a default xfce4-panel with Applications menu, and add terminal websocket accept/close logging plus tolerant agent-id resolution.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: stabilize web terminal and polish remote desktop chrome
Fix macOS PTY spawn (setsid None), harden terminal reconnect/error handling,
move the XFCE start button to a top panel with the Octop logo, and replace
full-height edge rails with corner controls that no longer block desktop edges.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: put start menu on bottom panel and open appfinder for menu shortcut
Restore the XFCE panel to the bottom edge, bind Super/Alt-F1 to xfce4-appfinder
in openbox, and make the remote-desktop「开始菜单」action spawn appfinder
instead of relying on an unbound Alt+F1 chord.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: keep XFCE start button across desktop service restarts
Hard-reset xfconfd when seeding the panel so in-memory channel state cannot
override our launcher XML, keep a canonical panel layout under /opt, and stop
apply-icon-size from re-entering ensure-panel (which raced and dropped the
start button after restarts).
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor: trim remote-desktop dead weight without dropping fixes
Drop unused whiskermenu packaging and duplicate panel reseeds, narrow D-Bus
env parsing to session bus keys, prefer a single appfinder spawn for the menu
shortcut, and demote terminal happy-path logs back to info.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: ship Octop wallpaper.png as the default virtual desktop backdrop
Use the packaged asset next to install.sh (no COS download by default), avoid
center-cropping the lower-right brand mark, and keep a copy under /opt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: ship Octop wallpaper.png as the default virtual desktop backdrop
Use the packaged asset next to install.sh (no COS download by default), avoid
center-cropping the lower-right brand mark, and keep a copy under /opt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: align remote browser with desktop HUD and safer Chromium lifecycle
Detect system Chrome/Chromium via find_chrome for env readiness and launch,
fall back to Playwright install when missing, and uninstall only Playwright
Chromium. Match StreamEdgeControls hover HUD and install/uninstall viewport
layout with remote desktop; clear stale profile locks before attach.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: make remote browser launch writable and show on virtual desktop
Force a private XDG_RUNTIME_DIR, recreate non-writable harness profiles,
and inject DISPLAY=:99 when Xvnc is up so Chrome starts headed on the
remote desktop instead of failing with ProcessSingleton exit 21.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: persist setup wizard UI locale on initial admin
Create the first admin with the wizard's current language (or
Accept-Language) instead of hard-coding zh, so Finish/login no longer
silently switches English browsers to Chinese after setup.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ui): narrow stream HUD hover hotzone to HUD width
Only the centered top strip (~320px) captures hover so left/right
stream content stays click-through. Also reformat remote desktop and
terminal control pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(remote-browser): persist stream open/closed across page visits
Remember whether the user left the stream running, and only auto-
reconnect on enter when it was open (or deep-linked via ?thread=).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(browser): relocate root profiles and bump harness-browser 0.7.4
Host agents can allow Python writes under /root but deny Chrome
SingletonLock creation. Proactively use /tmp profiles, pin
ProfileManager to the resolved base dir, require harness-browser
0.7.4 for launch-time XDG/env injection, and refresh the lockfile.
Co-authored-by: Cursor <cursoragent@cursor.com>
* style: format browser setup unit test for ruff
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): rename browser setup tests to avoid basename clash
pytest cannot collect both unit/browser/test_setup.py and
unit/desktop/test_setup.py under the same module name.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(typecheck): use posix_compat.chown for Windows mypy
os.chown is unavailable on Windows stubs; route ownership fixes through
the shared posix_compat helper like the rest of infra.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): expect catalog label for bootstrapped main agent
Setup now uses the general-assistant manifest name (小通 · 通用助手)
instead of a hard-coded 通用助手 string.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: honor macOS /private and tempfile paths in host guards
/etc resolves to /private/etc on macOS, so strip that prefix before
denied-prefix checks. Allow media previews from tempfile.gettempdir()
(/var/folders/…) in addition to /tmp.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): make browser binary verify fixture work on Windows
The fake Chrome was a shebang shell script, which Windows cannot
execute. Use a .bat stub on nt so --version verification succeeds.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
CI:
- Drop Python 3.11 from the test matrix (package requires >=3.12); the
3.11 jobs failed at `uv sync`. Linux and Windows now test Python 3.12.
- Rename tests/unit/infra/setup/tls/test_store.py -> test_tls_store.py to
fix the pytest import collision (duplicate basename) that aborted
collection on the 3.12 job.
Source bugs uncovered by the suite:
- Move ACTOR_SYSTEM to a runtime import in infra/cron/job.py (was wrongly
placed under TYPE_CHECKING, causing NameError at runtime).
- Add missing users-table columns (login_failed_count, login_locked_until,
preferences_json) in infra/db/migrate.py for legacy schema repair.
- Make auth.update_me honor explicit nulls via model_dump(exclude_unset=True).
- Relax skills hub endpoints to existence/ownership checks (require_agent_row)
instead of requiring the agent to be running.
- Marshal WebSocket frames onto the owning event loop in chat/ws.py so the
starlette TestClient portal does not deadlock.
- Include error details in the browser session 503 response.
Tests:
- Update tests to match current source APIs (harness async create/remove/
rebuild, FakeHarnessAgent skill methods, workspace nested layout, JWT
middleware, CLI surface, proactive config defaults, general-assistant
template manifest).
- Migrate WebSocket tests to starlette TestClient(...).websocket_connect
(httpx 0.28 removed AsyncClient.websocket_connect).
- Skip memory API tests when the optional harness_memory dependency is absent
via pytest.importorskip.
- Remove the invalid diagnostic test tests/integration/test_diag_e2e.py
(no assertions; inspected private internals only).
Also includes the pre-existing uncommitted orca -> Octop rename across docs,
README, LICENSE, Dockerfile and docker assets, as requested.
王愈甫