Remove unavailable Computer Use LFS archives

scripts/vendor-computer-use-source.py

@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """Refresh `vendor/computer-use/source/` and its integrity manifest.
 
-The vendored tree is the PRISTINE upstream at `pin.json`'s commit — patches are
-NOT applied to it. Keeping the two separate is what makes an upstream update
-tractable: the tree is replaced wholesale and the reviewed patches are re-applied
-on top, so a conflict is a real conflict rather than a merge of our edits with
-themselves.
+The included files are unmodified upstream at `pin.json`'s commit; documented
+reference assets are omitted. Patches are NOT applied to the vendored files.
+Keeping the two separate makes an upstream update tractable: the tree is
+replaced wholesale and the reviewed patches are re-applied on top, so a
+conflict is a real conflict rather than a merge of our edits with themselves.
 
 Usage:
     python3 scripts/vendor-computer-use-source.py --from <path-to-upstream-clone>
@@ -24,25 +24,28 @@
 MANIFEST = VENDOR / "source-manifest.json"
 SCHEMA = 1
 
-# Upstream paths that are deliberately NOT vendored.
-#
-# ⚠ This is a licensing boundary, not a size one. Upstream is MIT, and MIT covers
-# upstream's OWN work — it cannot relicense artwork upstream extracted from
-# somebody else's shipped application for reverse-engineering notes. Copying
-# those into this repository would be asserting a licence upstream never had.
-#
-# Excluding them is safe because they are documentation references, not build
-# inputs: nothing under `apps/` reads them, and the only code that names them
-# lives in `experiments/` and a standalone `scripts/` renderer, neither of which
-# is a built product. The exclusions are recorded in the manifest so the gap is
-# explicit and auditable rather than a silent hole.
+# Upstream paths that are deliberately NOT vendored. The extracted assets are
+# artwork from another vendor's application, outside upstream's MIT licence.
+# The official bundle archives are reference inputs whose LFS objects are not
+# available in this repository. None of these files is a build input. Record
+# each omission in the manifest so an upstream refresh cannot restore it.
 EXCLUDED = [
     (
         "docs/references/codex-computer-use-reverse-engineering/assets/extracted-",
         "assets extracted from a third party's application; upstream's MIT licence "
         "does not extend to them, and they are documentation references rather "
         "than build inputs",
     ),
+    (
+        ".gitattributes",
+        "only configures Git LFS for the omitted official bundle archives; "
+        "not a build input",
+    ),
+    (
+        "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/",
+        "official plugin archives are unavailable in this repository's Git LFS "
+        "storage and are documentation references rather than build inputs",
+    ),
 ]
 
 

vendor/computer-use/README.md

@@ -1,16 +1,16 @@
 # BioRouter native Computer Use payload
 
-`source/` is a COMPLETE copy of the MIT-licensed upstream project at the commit
-`pin.json` names, committed to this repository. A build reads it and needs no
+`source/` contains the MIT-licensed upstream project at the commit `pin.json`
+names, with documented reference assets omitted. A build reads it and needs no
 network, so an upstream repository that is deleted, force-pushed or altered
 cannot affect BioRouter, and the exact bytes that go into a shipped helper are
 reviewable in this repository's own history.
 
-`source/` is **pristine** — the patches are not applied to it. `patches/` is
-applied in lexical order to a throwaway copy at build time. Keeping the two apart
-is what makes an upstream update tractable: replace the tree wholesale, re-apply
-the reviewed patches on top, and a conflict is a real conflict rather than a
-merge of our own edits with themselves.
+The included files in `source/` are **pristine** — the patches are not applied
+to them. `patches/` is applied in lexical order to a throwaway copy at build
+time. Keeping the two apart makes an upstream update tractable: replace the
+tree wholesale, re-apply the reviewed patches on top, and a conflict is a real
+conflict rather than a merge of our own edits with themselves.
 
 `source-manifest.json` carries a SHA-256 of every vendored file plus one digest
 over the whole tree, and the build verifies it before the bytes become build
@@ -21,12 +21,13 @@ check in CI, and also asserts every manifest file is committable: repository-wid
 tree was first vendored, and a tree that verifies locally while those files never
 reach a fresh clone is worse than one that fails outright.
 
-⚠ **Ten upstream files are deliberately NOT vendored**, listed under `excluded` in
-the manifest with the reason. They are assets upstream extracted from another
-vendor's shipped application for reverse-engineering notes. MIT covers upstream's
-own work; it cannot relicense somebody else's artwork. They are documentation
-references, not build inputs — nothing under `apps/` reads them — and a build is
-byte-identical with and without them (verified).
+The manifest's `excluded` list records files deliberately omitted from upstream.
+Some are artwork extracted from another vendor's application for reverse
+engineering notes; upstream's MIT licence does not cover that artwork. The
+official plugin archive directory and its Git LFS rule are also omitted
+because the ZIP contents are unavailable in this repository's LFS storage.
+They are documentation references, not build inputs. Historical upstream
+documentation under `source/docs/` still describes those archives.
 
 ### Checking for upstream changes
 

vendor/computer-use/source-manifest.json

@@ -3,23 +3,27 @@
   "upstream_repository": "https://github.com/iFurySt/open-codex-computer-use.git",
   "upstream_commit": "547b4ffb8ed731a8f16486e6d8a3b215484267d3",
   "upstream_version": "0.3.5",
-  "file_count": 396,
-  "tree_sha256": "cec233608c6e54d7faa9d58803f5c8a12c6d4d95c5142a57e460b967b01f4be1",
+  "file_count": 391,
+  "tree_sha256": "43343196d44587cef6f5530cdb2ae594bb59e55fec25c5abf189910386c80b81",
   "excluded": [
     {
       "path_prefix": "docs/references/codex-computer-use-reverse-engineering/assets/extracted-",
       "reason": "assets extracted from a third party's application; upstream's MIT licence does not extend to them, and they are documentation references rather than build inputs"
+    },
+    {
+      "path_prefix": ".gitattributes",
+      "reason": "only configures Git LFS for the omitted official bundle archives; not a build input"
+    },
+    {
+      "path_prefix": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/",
+      "reason": "official plugin archives are unavailable in this repository's Git LFS storage and are documentation references rather than build inputs"
     }
   ],
   "files": [
     {
       "path": ".agents/plugins/marketplace.json",
       "sha256": "1d8e600c09f73e535229c6be1ddf7d137e33fcebab0223b1d72a6309b4a32562"
     },
-    {
-      "path": ".gitattributes",
-      "sha256": "df3531f1f3b5bb05470d0f4457d58b0fa1bd756943d5704d44d9e0e4b84a83f3"
-    },
     {
       "path": ".github/workflows/release.yml",
       "sha256": "b2f31674ed0a3082afeeac623d16f948dc855053f873d65c089babe54e838e38"
@@ -1120,22 +1124,6 @@
       "path": "docs/references/codex-computer-use-reverse-engineering/assets/README.md",
       "sha256": "daa15411ebb48c5519a7172c17319297736160f1e4edfb05abc75ea4c37be8d2"
     },
-    {
-      "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.750.zip",
-      "sha256": "bb0a8e0db982f9d37e48f30b51bb32814470a1bcd4e40695f3eb6065a092a2f3"
-    },
-    {
-      "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/1.0.755.zip",
-      "sha256": "b1eb458fee1e000c3d1f4c323a6a81fe54f39372537eaeb91b0d9b26e5679df8"
-    },
-    {
-      "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/README.md",
-      "sha256": "b6b56fa918cc6a03059f89bafb9aedc3de50ccf2ce213b069840e428bd89b390"
-    },
-    {
-      "path": "docs/references/codex-computer-use-reverse-engineering/assets/official-bundles/computer-use/SHA256SUMS",
-      "sha256": "8c8dfb8b653107cbe5e84d2c1e80f5e0b39f2f6f6d19a9ce7e06f0596fcf1b36"
-    },
     {
       "path": "docs/references/codex-computer-use-reverse-engineering/background-click-free-tooling.md",
       "sha256": "07b6fb2d380bcecd128ae0357adedda95c14ae1230d42d11338d1734734c1c76"