From 529e6b3611342472a46ed92df395c407df1e0900 Mon Sep 17 00:00:00 2001 From: Wanjun Gu Date: Mon, 28 Sep 2026 22:17:02 -0700 Subject: [PATCH] fix: remove unavailable Computer Use LFS archives --- scripts/vendor-computer-use-source.py | 37 ++++++++++--------- vendor/computer-use/README.md | 27 +++++++------- vendor/computer-use/source-manifest.json | 32 +++++----------- vendor/computer-use/source/.gitattributes | 1 - .../official-bundles/computer-use/1.0.750.zip | 3 -- .../official-bundles/computer-use/1.0.755.zip | 3 -- .../official-bundles/computer-use/README.md | 16 -------- .../official-bundles/computer-use/SHA256SUMS | 2 - 8 files changed, 44 insertions(+), 77 deletions(-) delete mode 100644 vendor/computer-use/source/.gitattributes delete mode 100644 vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip delete mode 100644 vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip delete mode 100644 vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md delete mode 100644 vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS diff --git a/scripts/vendor-computer-use-source.py b/scripts/vendor-computer-use-source.py index 6a1608ace..6661e391f 100755 --- a/scripts/vendor-computer-use-source.py +++ b/scripts/vendor-computer-use-source.py @@ -1,11 +1,11 @@ #!/usr/bin/env python3 """Refresh `vendor/computer-use/source/` and its integrity manifest. -The vendored tree is the PRISTINE upstream at `pin.json`'s commit — patches are -NOT applied to it. Keeping the two separate is what makes an upstream update -tractable: the tree is replaced wholesale and the reviewed patches are re-applied -on top, so a conflict is a real conflict rather than a merge of our edits with -themselves. +The included files are unmodified upstream at `pin.json`'s commit; documented +reference assets are omitted. Patches are NOT applied to the vendored files. +Keeping the two separate makes an upstream update tractable: the tree is +replaced wholesale and the reviewed patches are re-applied on top, so a +conflict is a real conflict rather than a merge of our edits with themselves. Usage: python3 scripts/vendor-computer-use-source.py --from @@ -24,18 +24,11 @@ MANIFEST = VENDOR / "source-manifest.json" SCHEMA = 1 -# Upstream paths that are deliberately NOT vendored. -# -# ⚠ This is a licensing boundary, not a size one. Upstream is MIT, and MIT covers -# upstream's OWN work — it cannot relicense artwork upstream extracted from -# somebody else's shipped application for reverse-engineering notes. Copying -# those into this repository would be asserting a licence upstream never had. -# -# Excluding them is safe because they are documentation references, not build -# inputs: nothing under `apps/` reads them, and the only code that names them -# lives in `experiments/` and a standalone `scripts/` renderer, neither of which -# is a built product. The exclusions are recorded in the manifest so the gap is -# explicit and auditable rather than a silent hole. +# Upstream paths that are deliberately NOT vendored. The extracted assets are +# artwork from another vendor's application, outside upstream's MIT licence. +# The official bundle archives are reference inputs whose LFS objects are not +# available in this repository. None of these files is a build input. Record +# each omission in the manifest so an upstream refresh cannot restore it. EXCLUDED = [ ( "docs/references/codex-computer-use-reverse-engineering/assets/extracted-", @@ -43,6 +36,16 @@ "does not extend to them, and they are documentation references rather " "than build inputs", ), + ( + ".gitattributes", + "only configures Git LFS for the omitted official bundle archives; " + "not a build input", + ), + ( + "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/", + "official plugin archives are unavailable in this repository's Git LFS " + "storage and are documentation references rather than build inputs", + ), ] diff --git a/vendor/computer-use/README.md b/vendor/computer-use/README.md index bdc7cdc49..ee9b09a1d 100644 --- a/vendor/computer-use/README.md +++ b/vendor/computer-use/README.md @@ -1,16 +1,16 @@ # BioRouter native Computer Use payload -`source/` is a COMPLETE copy of the MIT-licensed upstream project at the commit -`pin.json` names, committed to this repository. A build reads it and needs no +`source/` contains the MIT-licensed upstream project at the commit `pin.json` +names, with documented reference assets omitted. A build reads it and needs no network, so an upstream repository that is deleted, force-pushed or altered cannot affect BioRouter, and the exact bytes that go into a shipped helper are reviewable in this repository's own history. -`source/` is **pristine** — the patches are not applied to it. `patches/` is -applied in lexical order to a throwaway copy at build time. Keeping the two apart -is what makes an upstream update tractable: replace the tree wholesale, re-apply -the reviewed patches on top, and a conflict is a real conflict rather than a -merge of our own edits with themselves. +The included files in `source/` are **pristine** — the patches are not applied +to them. `patches/` is applied in lexical order to a throwaway copy at build +time. Keeping the two apart makes an upstream update tractable: replace the +tree wholesale, re-apply the reviewed patches on top, and a conflict is a real +conflict rather than a merge of our own edits with themselves. `source-manifest.json` carries a SHA-256 of every vendored file plus one digest over the whole tree, and the build verifies it before the bytes become build @@ -21,12 +21,13 @@ check in CI, and also asserts every manifest file is committable: repository-wid tree was first vendored, and a tree that verifies locally while those files never reach a fresh clone is worse than one that fails outright. -⚠ **Ten upstream files are deliberately NOT vendored**, listed under `excluded` in -the manifest with the reason. They are assets upstream extracted from another -vendor's shipped application for reverse-engineering notes. MIT covers upstream's -own work; it cannot relicense somebody else's artwork. They are documentation -references, not build inputs — nothing under `apps/` reads them — and a build is -byte-identical with and without them (verified). +The manifest's `excluded` list records files deliberately omitted from upstream. +Some are artwork extracted from another vendor's application for reverse +engineering notes; upstream's MIT licence does not cover that artwork. The +official plugin archive directory and its Git LFS rule are also omitted +because the ZIP contents are unavailable in this repository's LFS storage. +They are documentation references, not build inputs. Historical upstream +documentation under `source/docs/` still describes those archives. ### Checking for upstream changes diff --git a/vendor/computer-use/source-manifest.json b/vendor/computer-use/source-manifest.json index 1bfc17b9a..df3cfb051 100644 --- a/vendor/computer-use/source-manifest.json +++ b/vendor/computer-use/source-manifest.json @@ -3,12 +3,20 @@ "upstream_repository": "https://github.com/iFurySt/open-codex-computer-use.git", "upstream_commit": "547b4ffb8ed731a8f16486e6d8a3b215484267d3", "upstream_version": "0.3.5", - "file_count": 396, - "tree_sha256": "cec233608c6e54d7faa9d58803f5c8a12c6d4d95c5142a57e460b967b01f4be1", + "file_count": 391, + "tree_sha256": "43343196d44587cef6f5530cdb2ae594bb59e55fec25c5abf189910386c80b81", "excluded": [ { "path_prefix": "docs/references/codex-computer-use-reverse-engineering/assets/extracted-", "reason": "assets extracted from a third party's application; upstream's MIT licence does not extend to them, and they are documentation references rather than build inputs" + }, + { + "path_prefix": ".gitattributes", + "reason": "only configures Git LFS for the omitted official bundle archives; not a build input" + }, + { + "path_prefix": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/", + "reason": "official plugin archives are unavailable in this repository's Git LFS storage and are documentation references rather than build inputs" } ], "files": [ @@ -16,10 +24,6 @@ "path": ".agents/plugins/marketplace.json", "sha256": "1d8e600c09f73e535229c6be1ddf7d137e33fcebab0223b1d72a6309b4a32562" }, - { - "path": ".gitattributes", - "sha256": "df3531f1f3b5bb05470d0f4457d58b0fa1bd756943d5704d44d9e0e4b84a83f3" - }, { "path": ".github/workflows/release.yml", "sha256": "b2f31674ed0a3082afeeac623d16f948dc855053f873d65c089babe54e838e38" @@ -1120,22 +1124,6 @@ "path": "docs/references/codex-computer-use-reverse-engineering/assets/README.md", "sha256": "daa15411ebb48c5519a7172c17319297736160f1e4edfb05abc75ea4c37be8d2" }, - { - "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip", - "sha256": "bb0a8e0db982f9d37e48f30b51bb32814470a1bcd4e40695f3eb6065a092a2f3" - }, - { - "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip", - "sha256": "b1eb458fee1e000c3d1f4c323a6a81fe54f39372537eaeb91b0d9b26e5679df8" - }, - { - "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md", - "sha256": "b6b56fa918cc6a03059f89bafb9aedc3de50ccf2ce213b069840e428bd89b390" - }, - { - "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS", - "sha256": "8c8dfb8b653107cbe5e84d2c1e80f5e0b39f2f6f6d19a9ce7e06f0596fcf1b36" - }, { "path": "docs/references/codex-computer-use-reverse-engineering/background-click-free-tooling.md", "sha256": "07b6fb2d380bcecd128ae0357adedda95c14ae1230d42d11338d1734734c1c76" diff --git a/vendor/computer-use/source/.gitattributes b/vendor/computer-use/source/.gitattributes deleted file mode 100644 index 29c5a78c8..000000000 --- a/vendor/computer-use/source/.gitattributes +++ /dev/null @@ -1 +0,0 @@ -docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/*.zip filter=lfs diff=lfs merge=lfs -text diff --git a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip b/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip deleted file mode 100644 index b23434f05..000000000 --- a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:7afe231e98ddb3b95030c8c56bb178a0217e98fcbb08abf9e1b467fd7ead5b9d -size 13458495 diff --git a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip b/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip deleted file mode 100644 index 4a36b29c8..000000000 --- a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:cfabe3f41bfec1ea1d5f99ca2f5424eac98487e9474a099394c372d5df7a6460 -size 13467875 diff --git a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md b/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md deleted file mode 100644 index f74ed7014..000000000 --- a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# Official Computer Use Bundles - -这个目录保存从本地 bundled plugin cache 归档的官方 `computer-use` zip 包，用作逆向分析和版本对比输入。 - -## 当前归档 - -| File | Size | SHA-256 | -| --- | ---: | --- | -| `1.0.750.zip` | 13 MB | `7afe231e98ddb3b95030c8c56bb178a0217e98fcbb08abf9e1b467fd7ead5b9d` | -| `1.0.755.zip` | 13 MB | `cfabe3f41bfec1ea1d5f99ca2f5424eac98487e9474a099394c372d5df7a6460` | - -## 维护约定 - -- 这里的 zip 只作为原始官方制品归档，不直接参与构建。 -- 新增 zip 时同步更新 `SHA256SUMS` 和本文件。 -- 该目录下的 zip 通过 Git LFS 跟踪，避免把大二进制直接写入普通 Git object。 diff --git a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS b/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS deleted file mode 100644 index 7d9431963..000000000 --- a/vendor/computer-use/source/docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS +++ /dev/null @@ -1,2 +0,0 @@ -7afe231e98ddb3b95030c8c56bb178a0217e98fcbb08abf9e1b467fd7ead5b9d 1.0.750.zip -cfabe3f41bfec1ea1d5f99ca2f5424eac98487e9474a099394c372d5df7a6460 1.0.755.zip