mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-28 05:12:33 +00:00
6a28e75e94
* feat(routing,local-ai): pluggable local inference + openhuman:// deep-link
Salvaged from recovery commit cfb1fd9f (Apr 19) — originally auto-backed up
by claude-mem recovery tool, not yet PR'd.
## Local AI routing becomes pluggable (factory.rs, health.rs)
Previously the IntelligentRoutingProvider hard-wired Ollama as the only local
inference backend. This commit lets operators point at any OpenAI-compatible
local server (llama.cpp / llama-server, LM Studio, MLX's mlx_lm.server /
mlx-omni-server, vLLM — anything exposing /v1/chat/completions + /v1/models).
Config surface:
- `OPENHUMAN_LOCAL_INFERENCE_URL` env var — full /v1 base URL. When set,
health is probed via GET {base}/models (OpenAI-compat) instead of Ollama's
/api/tags.
- `LocalAiConfig.provider` accepts "llamacpp" or "llama-server" as aliases
that default to http://127.0.0.1:8080/v1.
- Default (no env, no override) stays Ollama — zero config change for
existing users.
Motivation: Ollama's embedded llama.cpp cannot yet load Gemma 4 E2B and
other recent models; MLX is significantly faster on Apple Silicon.
Operators should be able to pick the backend; end users see nothing.
## Deep-link scheme (Info.plist)
Adds CFBundleURLTypes entry registering `openhuman://` for the macOS bundle
so browser-issued deep links (e.g. openhuman://auth?token=...) launch the
installed app. See .claude/rules/14-deep-link-platform-guide.md for the
flow — requires a .app bundle (not `tauri dev`).
## OpenSSL 3.x PKCS12 fix (setup-dev-codesign.sh)
Adds `-legacy` to the `openssl pkcs12 -export` call. Required on OpenSSL 3.x
because the modern SHA-256 MAC / AES-256-CBC defaults are not yet supported
by macOS `security` tool, which silently fails to import the cert.
Notes:
- Dropped the CLAUDE.md.new noise and the mic-description copy downgrade
from the original recovery commit; kept only the load-bearing changes.
- Cargo.lock files reset to upstream/main to avoid dependency drift — the
new code does not introduce new deps.
Co-Authored-By: WOZCODE <contact@withwoz.com>
* fix(routing,codesign): address CodeRabbit review on PR #750
- setup-dev-codesign.sh: probe for openssl `-legacy` support before
using it so older OpenSSL/LibreSSL installs don't silently fail;
drop the stderr suppression on pkcs12 so import errors surface.
- routing/factory.rs: trim provider before alias matching, lower the
local-inference diagnostic to `debug` and drop raw URLs from the
log fields, and honor `OPENHUMAN_OLLAMA_BASE_URL` via the existing
`ollama_base_url()` helper in the default Ollama branch.
- local_ai/mod.rs: re-export `ollama_base_url` for the routing factory.
* style(app/src-tauri): apply rustfmt to merged main
`cargo fmt --check` in the merge workspace flagged two hunks inherited
from upstream main:
- app/src-tauri/src/lib.rs: move `mod notification_settings;` between
the cfg(cef) imessage_scanner and slack_scanner declarations so the
ordering matches rustfmt's reordering output.
- app/src-tauri/src/webview_accounts/mod.rs: wrap the long
`try_state::<NotificationSettingsState>()` binding.
No behavior change.
* format
---------
Co-authored-by: Jwalin Shah <jshah1331@gmail.com>
Co-authored-by: WOZCODE <contact@withwoz.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
111 lines
4.1 KiB
Bash
Executable File
111 lines
4.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-time setup: create a stable local code-signing certificate for the
|
|
# openhuman-core sidecar. Run this once per development machine.
|
|
#
|
|
# Why: macOS TCC identifies unsigned binaries by content hash (Mach-O UUID).
|
|
# Every `yarn core:stage` recompiles the sidecar, changing its hash, so TCC
|
|
# no longer matches the old grant. Signing with a stable certificate causes
|
|
# TCC to use the certificate identity instead — grants persist across rebuilds.
|
|
#
|
|
# After running this script:
|
|
# 1. yarn core:stage (signs the sidecar with the new cert)
|
|
# 2. In OpenHuman → Request Permissions (removes old stale TCC entry,
|
|
# registers current binary)
|
|
# 3. Grant in System Settings → Refresh Status
|
|
# From this point the grant survives future `yarn core:stage` runs.
|
|
|
|
set -euo pipefail
|
|
|
|
IDENTITY="OpenHuman Dev Signer"
|
|
KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
|
|
TMPDIR_CERT=$(mktemp -d)
|
|
KEY="$TMPDIR_CERT/openhuman-dev.key"
|
|
CERT="$TMPDIR_CERT/openhuman-dev.crt"
|
|
P12="$TMPDIR_CERT/openhuman-dev.p12"
|
|
P12_PASS="${OPENHUMAN_P12_PASS:-openhuman-dev}"
|
|
|
|
cleanup() {
|
|
rm -rf "$TMPDIR_CERT"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
# ── Check if already set up ──────────────────────────────────────────────────
|
|
if security find-identity -v -p codesigning 2>/dev/null | grep -q "$IDENTITY"; then
|
|
echo "[setup-dev-codesign] Certificate \"$IDENTITY\" already exists — nothing to do."
|
|
echo "[setup-dev-codesign] Run 'yarn core:stage' to sign the sidecar."
|
|
exit 0
|
|
fi
|
|
|
|
echo "[setup-dev-codesign] Creating self-signed code-signing certificate: \"$IDENTITY\""
|
|
|
|
# ── Generate key + self-signed certificate ───────────────────────────────────
|
|
cat > "$TMPDIR_CERT/openssl.conf" <<EOF
|
|
[ req ]
|
|
distinguished_name = req_distinguished_name
|
|
prompt = no
|
|
x509_extensions = v3_ca
|
|
|
|
[ req_distinguished_name ]
|
|
CN = $IDENTITY
|
|
|
|
[ v3_ca ]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
|
|
extendedKeyUsage = codeSigning
|
|
EOF
|
|
|
|
openssl req \
|
|
-newkey rsa:2048 \
|
|
-nodes \
|
|
-keyout "$KEY" \
|
|
-x509 \
|
|
-days 3650 \
|
|
-out "$CERT" \
|
|
-config "$TMPDIR_CERT/openssl.conf" \
|
|
2>/dev/null
|
|
|
|
# ── Bundle to PKCS12 ─────────────────────────────────────────────────────────
|
|
# `-legacy` keeps PKCS12 MAC/encryption compatible with macOS `security` tool
|
|
# which does not yet support OpenSSL 3.x defaults (SHA256 MAC / AES-256-CBC).
|
|
# Older OpenSSL/LibreSSL (including the macOS-bundled LibreSSL) do not know
|
|
# about `-legacy`, so probe for support before adding it.
|
|
PKCS12_LEGACY_ARGS=()
|
|
if openssl pkcs12 -help 2>&1 | grep -q -- '-legacy'; then
|
|
PKCS12_LEGACY_ARGS=(-legacy)
|
|
fi
|
|
|
|
openssl pkcs12 \
|
|
-export \
|
|
"${PKCS12_LEGACY_ARGS[@]}" \
|
|
-out "$P12" \
|
|
-inkey "$KEY" \
|
|
-in "$CERT" \
|
|
-passout "pass:$P12_PASS"
|
|
|
|
# ── Import into login Keychain ───────────────────────────────────────────────
|
|
security import "$P12" \
|
|
-k "$KEYCHAIN" \
|
|
-P "$P12_PASS" \
|
|
-T /usr/bin/codesign \
|
|
-T /usr/bin/security
|
|
|
|
# ── Trust for code signing ───────────────────────────────────────────────────
|
|
# Note: we add both basic and codeSign trust.
|
|
security add-trusted-cert \
|
|
-r trustRoot \
|
|
-p basic \
|
|
-p codeSign \
|
|
-k "$KEYCHAIN" \
|
|
"$CERT"
|
|
|
|
echo ""
|
|
echo "[setup-dev-codesign] Done. Certificate \"$IDENTITY\" added to login Keychain."
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. yarn core:stage — rebuilds and signs the sidecar"
|
|
echo " 2. In OpenHuman click 'Request Permissions' to register the signed binary"
|
|
echo " 3. Grant in System Settings → Privacy & Security → Accessibility"
|
|
echo " 4. Click 'Refresh Status'"
|
|
echo ""
|
|
echo "After this, accessibility grants will survive future 'yarn core:stage' runs."
|