okooooooo/openless
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
13ccf85a48b73b489f4e3f204929414344ca5213
openless/openless-all
T
History
H-Chris233 13ccf85a48 Store credentials in the system vault 
Provider credentials should follow the platform credential-store threat model instead of continuing normal plaintext JSON writes. The vault now stores the existing multi-provider credentials payload in the OS credential store, migrates the legacy JSON file only when the vault has no entry, removes the legacy file after a successful write, and keeps raw credential IPC restricted to the main settings window.

Constraint: User explicitly chose Keychain/Credential Manager/Linux keyring for issue #230.

Constraint: Preserve the existing provider schema and active-provider routing with minimal frontend churn.

Rejected: Keep plaintext JSON as the documented product choice | user rejected this direction.

Rejected: Split every credential field into separate vault entries | larger migration surface and risks losing active provider state.

Confidence: medium

Scope-risk: moderate

Directive: Security-model and storage-strategy choices must be confirmed with the user before implementation.

Tested: cargo check --manifest-path src-tauri/Cargo.toml; npm run -s build; git diff --check; grep for stale plaintext/Keychain fallback wording.

Not-tested: Manual migration on macOS Keychain, Windows Credential Manager, or Linux desktop keyring.

Related: https://github.com/appergb/openless/issues/230
2026-05-06 14:39:40 +08:00
..
app
Store credentials in the system vault
2026-05-06 14:39:40 +08:00
design_handoff_openless
chore(repo): 统一项目目录命名 (#39)
2026-04-30 10:44:31 +08:00
README.md
docs(readme): document macOS-only qwen-asr submodule init step
2026-05-06 06:29:38 +08:00

README.md

OpenLess All-Platform

This is the current cross-platform OpenLess workspace.

App Directory

The runnable Tauri app lives in app/. The macOS build links a vendored C ASR engine (antirez/qwen-asr) tracked as a git submodule under app/src-tauri/vendor/qwen-asr/, so initialize submodules on first clone.

# First clone only — pull in vendored submodules
git submodule update --init --recursive

cd app
npm ci
npm run tauri dev

macOS Build

Use the project build script instead of calling tauri build directly:

cd app
INSTALL=0 ./scripts/build-mac.sh

Generated macOS artifacts:

  • app/src-tauri/target/release/bundle/macos/OpenLess.app
  • app/src-tauri/target/release/bundle/dmg/OpenLess_1.1.0_aarch64.dmg

For local install during development:

cd app
./scripts/build-mac.sh

Windows Build

The runnable Tauri app is still app/. Windows contributors should run a preflight before building so missing MSVC, Windows SDK, or MinGW tools fail with actionable messages.

cd app
powershell -ExecutionPolicy Bypass -File .\scripts\windows-preflight.ps1

MSVC Route

Use this route when Visual Studio Build Tools and the Windows SDK are installed. Open a Developer PowerShell, or call vcvars64.bat, then run:

cd app
npm ci
npm run tauri -- build

Required Visual Studio Installer components:

  • Microsoft.VisualStudio.Workload.VCTools
  • MSVC v143 x64/x86 build tools
  • Windows 10/11 SDK that provides kernel32.lib

If link.exe or kernel32.lib is missing, rerun:

powershell -ExecutionPolicy Bypass -File .\scripts\windows-preflight.ps1 -Toolchain msvc

GNU / MinGW Route

Use this route when MSVC/Windows SDK is unavailable. The app now lives under the no-space openless-all directory to avoid GNU/MinGW path quoting issues while generating import libraries. Use the helper script to keep the GNU build environment and target setup consistent.

cd app
scoop install rustup mingw
rustup toolchain install stable-x86_64-pc-windows-gnu
rustup target add x86_64-pc-windows-gnu
powershell -ExecutionPolicy Bypass -File .\scripts\windows-preflight.ps1 -Toolchain gnu
powershell -ExecutionPolicy Bypass -File .\scripts\windows-build-gnu.ps1

Generated GNU artifacts:

  • %TEMP%\openless-windows-gnu\src-tauri\target\x86_64-pc-windows-gnu\release\openless.exe
  • %TEMP%\openless-windows-gnu\src-tauri\target\x86_64-pc-windows-gnu\release\bundle\msi\OpenLess_*_x64_en-US.msi
  • %TEMP%\openless-windows-gnu\src-tauri\target\x86_64-pc-windows-gnu\release\bundle\nsis\OpenLess_*_x64-setup.exe

Hotkey Injection Gate

Use this gate before/after Windows hotkey changes when a physical keyboard regression is unavailable. It injects a dev/test-only hotkey click through the coordinator handle_pressed / handle_released path, asserts the log contains [coord] hotkey pressed, and cancels the dry-run session automatically.

cd app
npm run check:hotkey-injection

Windows Runtime Notes

  • Windows does not need the macOS Accessibility permission. Use Settings -> Permissions -> Global hotkey to inspect listener status.
  • Microphone permission is checked by opening a short-lived input stream, so a device-format query alone is not treated as permission granted.
  • Text insertion through Ctrl+V is treated as copy fallback unless the app can confirm insertion.

Release Signing

Tagged releases (v*-tauri) must be Developer ID signed and notarized so users can download and open the macOS app without manually removing quarantine attributes.

Required GitHub secrets:

  • APPLE_CERTIFICATE
  • APPLE_CERTIFICATE_PASSWORD
  • APPLE_ID
  • APPLE_PASSWORD
  • APPLE_TEAM_ID

Optional:

  • APPLE_PROVIDER_SHORT_NAME
  • KEYCHAIN_PASSWORD

Manual workflow runs can still produce ad-hoc signed test builds, but tagged macOS releases fail if signing/notarization secrets are missing.

Ignored Local Output

The following are intentionally local-only:

  • app/node_modules/
  • app/dist/
  • app/src-tauri/target/
  • app/src-tauri/gen/
  • .DS_Store
Reference in new issue View Git Blame Copy Permalink