release: 1.0.0-beta.6

.github/workflows/build-neko-rk3588-image.yml

@@ -0,0 +1,48 @@
+name: Build Neko RK3588 image
+
+# Builds the RK3588 VPU-encode neko image (MPP + gstreamer-rockchip compiled
+# from source against trixie GStreamer 1.26) on a GitHub arm64 runner, so the
+# Pi is never used for the build. The Pi only does the final validation run.
+# On a PR the image is built but NOT pushed (compile validation only); on
+# dev/master it is built and pushed to GHCR.
+on:
+  push:
+    branches: [master, dev]
+    paths:
+      - 'app-catalog/streaming/neko-browser/Dockerfile.rk3588'
+      - '.github/workflows/build-neko-rk3588-image.yml'
+  pull_request:
+    paths:
+      - 'app-catalog/streaming/neko-browser/Dockerfile.rk3588'
+      - '.github/workflows/build-neko-rk3588-image.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v3
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build (push only on dev/master)
+        uses: docker/build-push-action@v6
+        with:
+          context: app-catalog/streaming/neko-browser
+          file: app-catalog/streaming/neko-browser/Dockerfile.rk3588
+          platforms: linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: |
+            ghcr.io/jaylfc/taos-neko-rk3588:latest
+            ghcr.io/jaylfc/taos-neko-rk3588:${{ github.sha }}
+          cache-from: type=gha,scope=neko-rk3588
+          cache-to: type=gha,mode=max,scope=neko-rk3588

.github/workflows/dependabot-automerge.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.gitignore

@@ -115,3 +115,6 @@ docs/audit/
 .understand-anything/
 docs/agent-jobs/
 .design/
+
+# Update rollback target (written by the updater, never tracked)
+.taos-rollback

CHANGELOG.md

@@ -7,6 +7,23 @@ Versions follow semver beta: `1.0.0-beta.N`, bumped on each dev->master promotio
 
 ## [Unreleased]
 
+## [1.0.0-beta.6] - 2026-06-21
+
+### Added
+- Coding Studio gains a model-agnostic tool-calling loop: agents read, edit, and verify files inside a workspace-jailed sandbox using filesystem tool primitives, driven by a LiteLLM-backed model step.
+- Cluster capability map: worker registration and heartbeats populate a per-node capability and hardware map with admin endpoints, plus a non-destructive stale-node offline sweep.
+- Append-only board audit log: every task transition is recorded, with a project-scoped activity feed and a task audit endpoint, indexed for unbounded growth.
+- `taos rollback`: a CLI recovery path that restores the previous branch and version, so a broken update can be recovered even when the dashboard is unreachable.
+
+### Changed
+- One Browser app: the separate streamed-browser app is gone. The Browser app attaches a Neko streamed session through a toggle, and a RAM-capable Pi host can serve the session itself instead of reporting that it is not capable.
+- The default store no longer seeds the X, Reddit, YouTube, and GitHub apps; they are optional installs.
+
+### Fixed
+- Browser sessions resolve the target worker before creating the session row, so a failed placement no longer leaves an orphaned session.
+- Auto-expiring notification toasts no longer archive themselves into the History view.
+- Dependabot majors updated: actions/checkout v7, dependabot/fetch-metadata v3, and the dev Python dependency group.
+
 ## [1.0.0-beta.5] - 2026-06-20
 
 ### Added
@@ -24,6 +41,25 @@ Versions follow semver beta: `1.0.0-beta.N`, bumped on each dev->master promotio
 - Security: dompurify updated to 3.4.11; cryptography and pydantic-settings advisories cleared.
 - Install: the core install no longer aborts when optional components fail, and drops to the service user without assuming sudo (WSL robustness).
 
+## [1.0.0-beta.4.1] - 2026-06-20
+
+### Changed
+- Installs and in-app updates verify the prebuilt bundle's SHA256 before extracting; a corrupted or tampered bundle is rejected and falls back to a local build.
+- Re-installs update the existing install in place instead of forking a second copy.
+
+### Fixed
+- Symlink-safe staging (no fixed /tmp paths as root), atomic-rename swap, and a fix so the bundle is no longer treated as perpetually stale.
+- README corrected (installs download a prebuilt bundle, no local build) and links rebranded to jaylfc/taOS.
+
+## [1.0.0-beta.4] - 2026-06-20
+
+### Added
+- "Reduce effects" toggle (Settings, Accessibility) for low-end devices: disables background blur, heavy shadows, and continuous animations for a smoother UI on older hardware.
+
+### Changed
+- The installer and in-app update download a prebuilt UI bundle instead of building it locally, so installs and upgrades are faster and no longer fail or silently stay on the old version on low-memory machines including WSL. A local build, when still needed, now fails with a clear message instead of half-updating.
+- CI runs on self-hosted runners and gates the desktop test suite.
+
 ## [1.0.0-beta.3] - 2026-06-16
 
 ### Added

app-catalog/streaming/neko-browser/Dockerfile.rk3588

@@ -1,22 +1,47 @@
-# taOS Neko Chromium for RK3588 (Orange Pi 5 Plus) — HW decode + WebRTC encode via VPU.
-# Device nodes (/dev/mpp_service, /dev/dri, /dev/rga) are passed at `docker run`
-# by the host-tier resolver, not baked in. Software encode is the fallback when
-# this image/devices aren't available (see resolve_neko_image).
-# Multi-arch base (has a linux/arm64 variant — verified on the Pi). The old
-# `arm-chromium` tag does not exist.
-FROM ghcr.io/m1k1o/neko/chromium:latest
+# taOS Neko Chromium for RK3588 — VPU H.264 encode via MPP + gstreamer-rockchip.
+# Multi-stage: stage 1 compiles Rockchip MPP, RGA and the gstreamer-rockchip
+# plugin against GStreamer 1.26 (trixie, matching the neko-cdp runtime, so the
+# plugin ABI lines up). Stage 2 layers the built libs onto the CDP image.
+#
+# Built for the Rockchip VENDOR kernel (6.1.x-vendor-rk35xx) which exposes the
+# VPU via /dev/mpp_service (no V4L2). Shared publicly for the community (#624).
 
-# Rockchip MPP + RGA + Mali userspace for GStreamer rkmpp HW encode/decode.
+# ---- stage 1: build the rockchip multimedia userspace --------------------
+FROM debian:trixie AS rkbuild
+ENV GIT_TERMINAL_PROMPT=0 LIBDIR=lib/aarch64-linux-gnu
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        gstreamer1.0-rockchip \
-        librockchip-mpp1 \
-        librga2 \
-    && rm -rf /var/lib/apt/lists/* || true
+        git ca-certificates build-essential cmake meson ninja-build pkg-config \
+        libdrm-dev \
+        libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+# MPP (Media Process Platform) — nyanmisaka's maintained fork builds cleanly.
+RUN git clone --depth=1 -b jellyfin-mpp https://github.com/nyanmisaka/mpp.git mpp \
+    && cmake -S mpp -B mpp/build -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_INSTALL_LIBDIR=$LIBDIR \
+         -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON -DBUILD_TEST=OFF \
+    && cmake --build mpp/build -j"$(nproc)" && cmake --install mpp/build
+# RGA (2D raster graphics accel).
+RUN git clone --depth=1 -b jellyfin-rga https://github.com/nyanmisaka/rk-mirrors.git rga \
+    && meson setup rga rga/build --prefix=/usr --libdir=$LIBDIR -Dlibdrm=false -Dlibrga_demo=false --buildtype=release \
+    && meson install -C rga/build
+# gstreamer-rockchip plugin (mpph264enc) — BoxCloud streaming fork, against 1.26.
+RUN git clone --depth=1 https://github.com/BoxCloudIRL/gstreamer-rockchip.git gst \
+    && meson setup gst gst/build --prefix=/usr --libdir=$LIBDIR --buildtype=release \
+    && meson install -C gst/build
+# Collect outputs into a staging dir (tolerant of exact naming); logged for debug.
+RUN mkdir -p /stage/gst \
+    && cp -a /usr/lib/aarch64-linux-gnu/librockchip_mpp.so* /stage/ 2>/dev/null || true \
+    && cp -a /usr/lib/aarch64-linux-gnu/librockchip_vpu.so* /stage/ 2>/dev/null || true \
+    && cp -a /usr/lib/aarch64-linux-gnu/librga.so* /stage/ 2>/dev/null || true \
+    && cp -a /usr/lib/aarch64-linux-gnu/gstreamer-1.0/libgstrockchip*.so* /stage/gst/ 2>/dev/null || true \
+    && echo "=== staged libs ===" && ls -la /stage /stage/gst
 
-LABEL taos.app.id="neko-browser" \
-      taos.streaming.encode="rkmpp" \
-      taos.hardware.soc="rk3588"
-
-# Prefer the VPU encoder; Neko reads its pipeline from env / its own config.
-ENV NEKO_VIDEO_CODEC=h264 \
-    GST_PLUGIN_FEATURE_RANK="mpph264enc:512"
+# ---- stage 2: layer onto the CDP image -----------------------------------
+FROM ghcr.io/jaylfc/taos-neko-cdp:latest
+COPY --from=rkbuild /stage/ /tmp/rkstage/
+RUN cp -a /tmp/rkstage/*.so* /usr/lib/aarch64-linux-gnu/ 2>/dev/null || true \
+    && cp -a /tmp/rkstage/gst/*.so* /usr/lib/aarch64-linux-gnu/gstreamer-1.0/ 2>/dev/null || true \
+    && rm -rf /tmp/rkstage && ldconfig
+LABEL taos.app.id="neko-browser-rk3588" taos.streaming.encode="rkmpp" \
+      taos.hardware.soc="rk3588" taos.base="taos-neko-cdp"
+ENV NEKO_VIDEO_CODEC=h264 GST_PLUGIN_FEATURE_RANK="mpph264enc:512"

desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyagentos-desktop",
   "private": true,
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "type": "module",
   "scripts": {
     "dev": "vite",

desktop/src/apps/CalendarApp.test.tsx

@@ -0,0 +1,103 @@
+import { render, screen, fireEvent } from "@testing-library/react";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { CalendarApp } from "./CalendarApp";
+
+const FIXED_DATE = new Date(2025, 5, 15); // June 15, 2025
+
+function mockToday() {
+  vi.useFakeTimers();
+  vi.setSystemTime(FIXED_DATE);
+}
+
+describe("CalendarApp", () => {
+  beforeEach(() => {
+    mockToday();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("renders the current month and year in the header", () => {
+    render(<CalendarApp windowId="w1" />);
+    expect(screen.getByText("June 2025")).toBeTruthy();
+  });
+
+  it("renders all seven day-of-week column headers", () => {
+    render(<CalendarApp windowId="w1" />);
+    expect(screen.getByText("Mon")).toBeTruthy();
+    expect(screen.getByText("Tue")).toBeTruthy();
+    expect(screen.getByText("Wed")).toBeTruthy();
+    expect(screen.getByText("Thu")).toBeTruthy();
+    expect(screen.getByText("Fri")).toBeTruthy();
+    expect(screen.getByText("Sat")).toBeTruthy();
+    expect(screen.getByText("Sun")).toBeTruthy();
+  });
+
+  it("renders the correct number of days for the current month", () => {
+    render(<CalendarApp windowId="w1" />);
+    // June 2025 has 30 days; day "1" appears as both a trailing prev-month day
+    // and the first day of June, so use getAllByText for that one.
+    const days1 = screen.getAllByText("1");
+    expect(days1.length).toBeGreaterThanOrEqual(1);
+    const day30 = screen.getAllByText("30");
+    expect(day30.length).toBeGreaterThanOrEqual(1);
+    // There are 30 current-month cells plus leading/trailing fill cells
+    const currentMonthCells = document.querySelectorAll(
+      ".text-shell-text.hover\\:bg-shell-surface",
+    );
+    expect(currentMonthCells.length).toBe(30);
+  });
+
+  it("navigates to the next month when the right arrow is clicked", () => {
+    render(<CalendarApp windowId="w1" />);
+    const nextBtn = screen.getByRole("button", { name: /next month/i });
+    fireEvent.click(nextBtn);
+    expect(screen.getByText("July 2025")).toBeTruthy();
+  });
+
+  it("navigates to the previous month when the left arrow is clicked", () => {
+    render(<CalendarApp windowId="w1" />);
+    const prevBtn = screen.getByRole("button", { name: /previous month/i });
+    fireEvent.click(prevBtn);
+    expect(screen.getByText("May 2025")).toBeTruthy();
+  });
+
+  it("wraps from January to December of the previous year when going prev", () => {
+    // Set "today" to January 2025
+    vi.setSystemTime(new Date(2025, 0, 10));
+    render(<CalendarApp windowId="w1" />);
+    expect(screen.getByText("January 2025")).toBeTruthy();
+    const prevBtn = screen.getByRole("button", { name: /previous month/i });
+    fireEvent.click(prevBtn);
+    expect(screen.getByText("December 2024")).toBeTruthy();
+  });
+
+  it("wraps from December to January of the next year when going next", () => {
+    // Set "today" to December 2025
+    vi.setSystemTime(new Date(2025, 11, 10));
+    render(<CalendarApp windowId="w1" />);
+    expect(screen.getByText("December 2025")).toBeTruthy();
+    const nextBtn = screen.getByRole("button", { name: /next month/i });
+    fireEvent.click(nextBtn);
+    expect(screen.getByText("January 2026")).toBeTruthy();
+  });
+
+  it("highlights today's date with the accent class", () => {
+    render(<CalendarApp windowId="w1" />);
+    // June 15 is "today" per our fixed clock; the cell should have the accent bg
+    const todayCell = screen.getByText("15")?.closest("span");
+    expect(todayCell?.className).toContain("bg-accent");
+  });
+
+  it("returns to the current month when Today is clicked after navigating", () => {
+    render(<CalendarApp windowId="w1" />);
+    const nextBtn = screen.getByRole("button", { name: /next month/i });
+    fireEvent.click(nextBtn);
+    fireEvent.click(nextBtn);
+    expect(screen.getByText("August 2025")).toBeTruthy();
+    const todayBtn = screen.getByRole("button", { name: /today/i });
+    fireEvent.click(todayBtn);
+    expect(screen.getByText("June 2025")).toBeTruthy();
+  });
+});