diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..95000c9 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +# Default owners for review routing after the repo is public. +# Adjust GitHub handles as maintainers prefer. +* @Modsofthenation diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..9ee6819 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,54 @@ +name: Bug report +description: Something is broken or unsafe +title: "[bug] " +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for filing a bug. **Do not** report security vulnerabilities here — see [SECURITY.md](https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/SECURITY.md). + Never paste real employee PII, vault dumps, or live API keys. + - type: textarea + id: summary + attributes: + label: Summary + description: What went wrong? + validations: + required: true + - type: textarea + id: steps + attributes: + label: Steps to reproduce + description: Minimal steps with synthetic / demo data only + placeholder: | + 1. Create empty workspace… + 2. … + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + validations: + required: true + - type: dropdown + id: surface + attributes: + label: Surface + options: + - Browser (pnpm dev) + - Packaged desktop + - API / MCP only + - Unsure + validations: + required: true + - type: input + id: version + attributes: + label: Version / commit + description: Tag, commit SHA, or “main @ <date>” + - type: textarea + id: logs + attributes: + label: Logs / errors + description: Redact secrets. Desktop API log is under the OS app-data directory (e.g. %APPDATA%\\com.prm.workbench\\desktop-api.log). diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..975987d --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Security vulnerability + url: https://github.com/Modsofthenation/PerformanceReviewManager/security/advisories/new + about: Report security issues privately (do not file a public issue). See SECURITY.md. + - name: Product docs + url: https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/docs/PRODUCT_BRIEF.md + about: Scope, trust model, and v1 non-goals before requesting features. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..c63760a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,38 @@ +name: Feature request +description: Propose a product or DX improvement +title: "[feat] " +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Prefer aligning with [docs/PRODUCT_BRIEF.md](https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/docs/PRODUCT_BRIEF.md) and the solo-EM trust model. + - type: textarea + id: problem + attributes: + label: Problem + description: What EM workflow is painful today? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposal + description: Concrete behavior change (not just “make AI better”) + validations: + required: true + - type: dropdown + id: mode + attributes: + label: Mode + options: + - Workbench (local solo EM) + - Import-path collaboration + - Hosted-only (out of v1) + - Unsure + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Alternatives considered diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..240be74 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,23 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + production-minor: + dependency-type: production + update-types: + - "minor" + - "patch" + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + - package-ecosystem: cargo + directory: "/apps/desktop/src-tauri" + schedule: + interval: weekly + open-pull-requests-limit: 5 diff --git a/.gitignore b/.gitignore index 87fa5be..4a76abe 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ node_modules dist data/ +**/.session .DS_Store *.log .env diff --git a/AGENTS.md b/AGENTS.md index dc0f838..a36f14c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -26,6 +26,6 @@ Performance Review Manager — a local, single-user ("solo EM") pnpm monorepo. S ### Cursor MCP (`@prm/mcp`) - Stdio MCP for bulk-loading dossier evidence into the local API: `pnpm mcp` (or `pnpm --filter @prm/mcp start`). -- Requires API on `127.0.0.1:8787`; unlocks with `PRM_PASSWORD` (default `workbench`). +- Requires API on `127.0.0.1:8787`. Unlock via `prm_unlock` or set `PRM_PASSWORD` to the workspace password — there is **no** built-in demo default (demo vaults often use `workbench`, but never assume that for real data). - Setup example: `.cursor/mcp.json.example` and `packages/mcp/README.md`. - Typical flow with other MCPs (Jira/Google): fetch externally → `prm_bulk_load_evidence` / `prm_upload_document` here. diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..d7830b3 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,32 @@ +# Changelog + +All notable changes to Performance Review Manager are documented here. + +Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +Versions follow [SemVer](https://semver.org/) (`0.1.0-alpha.x` while the public API and packaging are still settling). + +## [Unreleased] + +### Added + +- Dedicated **Desktop Installers** and **Release** GitHub Actions workflows +- Public-release checklist (`docs/PUBLIC_RELEASE.md`) and clearer vulnerability reporting guidance + +### Changed + +- Settings → Check for updates explains missing GitHub Releases (404) instead of a generic failure +- MCP / AGENTS docs no longer imply a silent `PRM_PASSWORD=workbench` default + +### Fixed + +- Committed Tauri `gen/schemas/capabilities.json` aligned with source capabilities (no `shell:allow-open`) + +## [0.1.0-alpha.1] - TBD + +First tagged alpha intended for GitHub Releases via Actions → **Release**. + +### Notes + +- Unsigned desktop installers only +- Demo vault password `workbench` is exploration-only +- Merge gate remains `pnpm -r typecheck` + `pnpm test` diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a31d167..029cb8f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -41,11 +41,13 @@ Production `pnpm build` may still have packaging rough edges; typecheck + tests ## Desktop -Desktop installers are **not** built on every merge. Use Actions → **Desktop Installers** → **Run workflow** (defaults to Windows + Linux). See `apps/desktop/README.md`. +Desktop installers are **not** built on every merge. Use Actions → **Desktop Installers** → **Run workflow** (defaults to Windows + Linux), or Actions → **Release** to attach installers to a GitHub Release. See `apps/desktop/README.md`. ## Security -Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md). Do not file public issues that include exploit detail for unfixed flaws. +Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md) (prefer GitHub private vulnerability reporting when enabled). Do not file public issues that include exploit detail for unfixed flaws. + +Maintainer checklist before making the repo public: [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md). ## Code of conduct diff --git a/README.md b/README.md index 4806331..87e11db 100644 --- a/README.md +++ b/README.md @@ -249,16 +249,18 @@ Regenerate with `pnpm screenshots` (UI + API running; demo password `workbench`) - **Sprint pulse** for date-window coaching - **Eight accents × dark/light** appearance system (Coral, Amber, Magenta, Citrus plus Teal, Ocean, Forest, Slate) - **AI**: digests, section draft, peer synthesize, chat, with citation allowlist -- **Desktop** packaging (Tauri); installers via Actions → **Desktop Installers** → **Run workflow** -- **Delete / recreate workspace** from Unlock or Settings +- **Desktop** packaging (Tauri); installers via Actions → **Desktop Installers** or tagged **Release**- **Delete / recreate workspace** from Unlock or Settings ## Docs -Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Theme matrix: [`docs/screenshots/THEMES.md`](./docs/screenshots/THEMES.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md). +Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Theme matrix: [`docs/screenshots/THEMES.md`](./docs/screenshots/THEMES.md). Public flip checklist: [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md). ## License & community - License: [`LICENSE`](./LICENSE) (MIT) +- Third-party notices (bundled Node sidecar): [`THIRD_PARTY.md`](./THIRD_PARTY.md) +- Changelog: [`CHANGELOG.md`](./CHANGELOG.md) - Security reports: [`SECURITY.md`](./SECURITY.md) - Contributing: [`CONTRIBUTING.md`](./CONTRIBUTING.md) - Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) +- Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) diff --git a/SECURITY.md b/SECURITY.md index d1bd277..fbe6f3a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,7 +27,7 @@ What PRM does **not** claim today: - Automatic refusal of Dropbox / iCloud / OneDrive data directories (warn when detected; sync folders remain risky) - Cryptographic anonymity for peer feedback - Tamper-proof legal custody of the activity log (hash-chained and HMAC-exportable, but the EM can re-sign after unlock) -- Signed auto-update for desktop installers (manual **Desktop Installers** artifacts; verify checksums yourself) +- Signed auto-update for desktop installers (manual **Desktop Installers** / **Release** artifacts; verify checksums yourself) Details: [`docs/architecture/TRUST_MODEL.md`](./docs/architecture/TRUST_MODEL.md). @@ -35,7 +35,15 @@ Details: [`docs/architecture/TRUST_MODEL.md`](./docs/architecture/TRUST_MODEL.md **Do not open a public GitHub issue for security vulnerabilities.** -Email **zord.lack.net@gmail.com** with: +### Preferred: GitHub private vulnerability reporting + +If [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) is enabled on this repository, use **Security → Report a vulnerability** (or open a draft Security Advisory). That keeps PoCs out of the public issue tracker and gives maintainers a private thread. + +Maintainers: enable it under **Settings → Code security → Private vulnerability reporting** before or when making the repo public. See [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md). + +### Fallback: email + +If private reporting is unavailable, email **zord.lack.net@gmail.com** with: 1. A clear description of the issue and impact 2. Steps to reproduce (PoC welcome; keep payloads minimal) diff --git a/THIRD_PARTY.md b/THIRD_PARTY.md new file mode 100644 index 0000000..50ae924 --- /dev/null +++ b/THIRD_PARTY.md @@ -0,0 +1,24 @@ +# Third-party notices + +Performance Review Manager is MIT-licensed (see [`LICENSE`](./LICENSE)). Packaged desktop builds may also ship the following redistributed components: + +## Node.js (desktop API sidecar) + +When building installers with `PRM_BUNDLE_NODE=1` / `bundle-api-sidecar.mjs --node`, a portable **Node.js** binary is copied next to `prm-api.mjs` under `apps/desktop/src-tauri/sidecars/`. + +- Project: [nodejs/node](https://github.com/nodejs/node) +- License: MIT (see Node’s `LICENSE` in the upstream release tarball) +- Purpose: runtime for the bundled Hono API sidecar inside the Tauri app + +Node is **not** modified; it is redistributed as a binary dependency of the desktop package. + +## better-sqlite3 (native binding) + +The sidecar copies the `better-sqlite3` package (and small helper deps such as `bindings`) into `sidecars/node_modules/` so the API can open SQLite without a system-wide install. + +- Package: [WiseLibs/better-sqlite3](https://github.com/WiseLibs/better-sqlite3) +- License: MIT + +## Other npm / Cargo dependencies + +Application source depends on many MIT/Apache-2.0 (and similar) libraries declared in the root `pnpm-lock.yaml` and `apps/desktop/src-tauri/Cargo.lock`. Those licenses apply to their respective packages; this notice only calls out binaries/resources that are **copied into** desktop installer artifacts beyond normal node_modules resolution at build time. diff --git a/apps/api/package.json b/apps/api/package.json index b09face..e53b066 100644 --- a/apps/api/package.json +++ b/apps/api/package.json @@ -24,5 +24,6 @@ "@types/node": "^22.13.10", "tsx": "^4.19.3", "typescript": "^5.8.2" - } + }, + "license": "MIT" } diff --git a/apps/desktop/README.md b/apps/desktop/README.md index 609114a..4251cef 100644 --- a/apps/desktop/README.md +++ b/apps/desktop/README.md @@ -44,7 +44,7 @@ On Windows the Node child is spawned with `CREATE_NO_WINDOW`. Sidecar stdout/std ### Updates -Settings → **Check for updates** compares the packaged version (`get_app_version` IPC) to the latest GitHub Release. Fully signed silent auto-update still needs `tauri-plugin-updater` + CI signing keys. +Settings → **Check for updates** compares the packaged version (`get_app_version` IPC) to the latest GitHub Release. If no release exists yet (404), the UI says so and points at the **Release** / **Desktop Installers** workflows. Fully signed silent auto-update still needs `tauri-plugin-updater` + CI signing keys. Packaged data lives in the OS app-data directory (for example `%APPDATA%\com.prm.workbench` on Windows). Sidecar stdout/stderr is appended to `desktop-api.log` there for debugging startup failures. diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 74c5633..5bbcbff 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -13,5 +13,6 @@ "devDependencies": { "@tauri-apps/cli": "^2.4.0", "esbuild": "^0.25.12" - } + }, + "license": "MIT" } diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml index 65fbd94..7f2ef78 100644 --- a/apps/desktop/src-tauri/Cargo.toml +++ b/apps/desktop/src-tauri/Cargo.toml @@ -3,6 +3,7 @@ name = "prm-desktop" version = "0.1.0-alpha.1" description = "Performance Review Manager desktop shell" authors = ["Damon van der Linde"] +license = "MIT" edition = "2021" [build-dependencies] diff --git a/apps/desktop/src-tauri/gen/schemas/capabilities.json b/apps/desktop/src-tauri/gen/schemas/capabilities.json index 2e9057d..264354f 100644 --- a/apps/desktop/src-tauri/gen/schemas/capabilities.json +++ b/apps/desktop/src-tauri/gen/schemas/capabilities.json @@ -1 +1,13 @@ -{"default":{"identifier":"default","description":"Default permissions for the EM workbench window","local":true,"windows":["main"],"permissions":["core:default","shell:allow-open"]}} \ No newline at end of file +{ + "default": { + "identifier": "default", + "description": "Default permissions for the EM workbench window — no shell/open IPC", + "local": true, + "windows": ["main"], + "permissions": [ + "core:default", + "allow-get-launch-config", + "allow-get-app-version" + ] + } +} diff --git a/apps/ui/package.json b/apps/ui/package.json index cd6383f..d9d7b88 100644 --- a/apps/ui/package.json +++ b/apps/ui/package.json @@ -21,5 +21,6 @@ "@vitejs/plugin-react": "^4.3.4", "typescript": "^5.8.2", "vite": "^6.2.2" - } + }, + "license": "MIT" } diff --git a/apps/ui/src/pages/SettingsPage.tsx b/apps/ui/src/pages/SettingsPage.tsx index 64392d8..5263f2c 100644 --- a/apps/ui/src/pages/SettingsPage.tsx +++ b/apps/ui/src/pages/SettingsPage.tsx @@ -604,7 +604,7 @@ export function SettingsPage({ id="settings-desktop" title="Desktop updates" when="Use on packaged desktop builds when you want to know if a newer installer is available." - how="Check GitHub Releases for the latest tag versus your installed version; signed auto-update needs Tauri updater keys in CI." + how="Compares your installed version to the latest GitHub Release tag. This is a manual check only — signed silent auto-update needs Tauri updater keys in CI." action={