Dev

.dockerignore

@@ -3,8 +3,6 @@
 __pycache__
 *.py[cod]
 *.log
-.env
-.env.*
 .venv
 venv
 node_modules
@@ -23,3 +21,63 @@ install.bat
 OmniParser_CraftOS
 debug_images
 workspace
+
+# ---------------------------------------------------------------------------
+# Secrets and per-machine runtime state — never belongs in an image.
+#
+# `COPY . .` takes whatever is in the build context, i.e. a developer's working
+# tree, and the release workflow pushes the resulting image to a public
+# registry. Anything not listed here gets baked into a layer and published, and
+# layers are permanent: deleting the file in a later layer does not remove it.
+# CI escapes it only by checking out clean, which makes this a trap that fires
+# exactly once, on someone's laptop. (Same failure as the old PyInstaller spec's
+# blanket app/data entry, which shipped 1.1 GB of one machine's memory index
+# and databases.) Keep this list in step with .gitignore.
+# ---------------------------------------------------------------------------
+
+# Secrets and credentials
+.env
+.env.*
+.credentials
+.credentials/
+config.json
+app/config/settings.json
+app/config/mcp_config.json
+app/config/skills_config.json
+app/config/scheduler_config.json
+
+# Per-install agent state
+app/data/.usage
+app/data/.file_index
+agent_file_system
+agent_bundle
+chroma_db_memory
+*.db
+.craftbot
+**/.craftbot
+.craftbot-managed
+logs
+**/logs
+**/agent_logs.txt
+**/memory.txt
+**/USER.md
+**/CONVERSATION_HISTORY.md
+**/EVENT.md
+**/EVENT_UNPROCESSED.md
+**/onboarding_config.json
+**/gui/config
+**/.whatsapp_web_sessions
+
+# Provisioned runtimes and build caches — re-fetched inside the image
+runtime
+wheelhouse
+downloads-cache
+npm-cache
+playwright-browsers
+hf-cache
+.playwright-mcp
+
+# Editor / tooling
+.claude
+.vscode
+.idea

.github/workflows/living-ui.yml → .github/workflows/agent-app.yml

@@ -1,22 +1,22 @@
-name: living-ui
+name: agent-app
 
-# Self-test for the Living UI TEMPLATE code (kit/blueprint/tools) in this repo.
+# Self-test for the Agent App TEMPLATE code (kit/blueprint/tools) in this repo.
 # Scaffolds a throwaway project and runs the local validation gate on it.
-# User-made Living UIs never touch this workflow — they validate locally.
+# User-made Agent Apps never touch this workflow — they validate locally.
 
 on:
   push:
     paths:
-      - 'living-ui/**'
-      - '.github/workflows/living-ui.yml'
+      - 'agent-app/**'
+      - '.github/workflows/agent-app.yml'
   pull_request:
     paths:
-      - 'living-ui/**'
-      - '.github/workflows/living-ui.yml'
+      - 'agent-app/**'
+      - '.github/workflows/agent-app.yml'
 
 defaults:
   run:
-    working-directory: living-ui
+    working-directory: agent-app
 
 jobs:
   gate:
@@ -37,10 +37,10 @@ jobs:
         uses: actions/cache@v4
         with:
           path: |
-            ~/Library/Caches/craftos-living-ui/pb
-            ~/.cache/craftos-living-ui/pb
-            ~\AppData\Local\craftos-living-ui\pb
-          key: pb-${{ runner.os }}-${{ hashFiles('living-ui/spec/pocketbase.version') }}
+            ~/Library/Caches/craftos-agent-app/pb
+            ~/.cache/craftos-agent-app/pb
+            ~\AppData\Local\craftos-agent-app\pb
+          key: pb-${{ runner.os }}-${{ hashFiles('agent-app/spec/pocketbase.version') }}
 
       - name: Install workspace
         run: npm install

.github/workflows/launcher.yml

@@ -0,0 +1,73 @@
+name: Launcher
+
+# CI for the native launcher in launcher/ (Rust + Slint). The Release
+# workflow builds and ships it; this one catches breakage on the way there,
+# on every platform the launcher is shipped for.
+
+on:
+  push:
+    paths:
+      - "launcher/**"
+      - ".github/workflows/launcher.yml"
+  pull_request:
+    paths:
+      - "launcher/**"
+      - ".github/workflows/launcher.yml"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: Test (${{ matrix.os_label }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            os_label: linux
+          - os: windows-latest
+            os_label: windows
+          - os: macos-latest
+            os_label: macos
+
+    defaults:
+      run:
+        working-directory: launcher
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: launcher
+
+      # Same insurance as the Release workflow: Slint has no C build deps,
+      # but a few crates probe for these headers.
+      - name: Linux build prerequisites
+        if: matrix.os_label == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libfontconfig1-dev
+
+      - name: Format
+        if: matrix.os_label == 'linux'
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        if: matrix.os_label == 'linux'
+        run: cargo clippy --release -- -D warnings
+
+      - name: Test
+        run: cargo test --release
+
+      - name: Build
+        run: cargo build --release