feat: integrate Teach Mode host into v1.2.7

.gitattributes

@@ -0,0 +1,11 @@
+# Git Bash packaging scripts must remain executable after a Windows checkout.
+*.sh text eol=lf
+# Version synchronization emits LF; keep these generated files unchanged on Windows.
+package-lock.json text eol=lf
+App/memmy-agent/package.json text eol=lf
+App/memmy-agent/package-lock.json text eol=lf
+App/shell/desktop/package.json text eol=lf
+App/backend/src/project-version.ts text eol=lf
+App/native-computer-use/apps/OpenComputerUseLinux/version.go text eol=lf
+App/native-computer-use/apps/OpenComputerUseWindows/version.go text eol=lf
+App/native-computer-use/packages/OpenComputerUseKit/Sources/OpenComputerUseKit/OpenComputerUseVersion.swift text eol=lf

.github/workflows/computer-use-native.yml

@@ -61,6 +61,8 @@ jobs:
           if ($PSVersionTable.PSVersion.Major -ne 5) { throw 'These fixtures must use Windows PowerShell 5.1.' }
           & ./App/native-computer-use/apps/OpenComputerUseWindows/runtime-safety.tests.ps1 | Tee-Object -FilePath ocu-windows-fixtures.json
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          & ./App/native-computer-use/apps/OpenComputerUseWindows/focus-recovery.tests.ps1 | Tee-Object -FilePath ocu-windows-focus-fixtures.json
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Build Memmy Computer Use for macOS
         if: runner.os == 'macOS'
         run: |
@@ -98,6 +100,7 @@ jobs:
           path: |
             ocu-native-result.json
             ocu-windows-fixtures.json
+            ocu-windows-focus-fixtures.json
           if-no-files-found: warn
       - name: Record validation boundary
         if: always()

.github/workflows/macos-task-recording-validation.yml

@@ -0,0 +1,61 @@
+name: macOS task recording validation
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/macos-task-recording-validation.yml"
+      - "App/memmy-agent/**"
+      - "App/backend/local-api-contracts/**"
+      - "App/frontend/desktop/**"
+      - "App/shell/desktop/**"
+      - "scripts/internal/mac/build-computer-history-helpers.sh"
+      - "scripts/internal/mac/build-dmg.sh"
+      - "scripts/internal/shared/validate-computer-history.mjs"
+      - "tests/computer-history*"
+      - "package*.json"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: macos-latest
+    timeout-minutes: 35
+    env:
+      MEMMY_LEGAL_CN_BASE_URL: https://memmy.cn
+      MEMMY_LEGAL_INTL_BASE_URL: https://memmy.bot
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install dependencies
+        run: |
+          npm ci
+          npm ci --prefix App/memmy-agent
+      - name: Build production native helpers for Apple Silicon and Intel
+        run: |
+          mkdir -p .recording-ci/helpers
+          cp App/memmy-agent/src/tools/computer-history/mac/*.swift .recording-ci/helpers/
+          bash scripts/internal/mac/build-computer-history-helpers.sh .recording-ci/helpers arm64
+          bash scripts/internal/mac/build-computer-history-helpers.sh .recording-ci/helpers x64
+      - name: Run native media, macOS lifecycle, UI and packaging checks
+        run: node scripts/internal/shared/validate-computer-history.mjs --report-dir .recording-ci/regression
+      - name: Record validation scope
+        if: ${{ always() }}
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<'EOF'
+          This job compiles production helpers for both macOS architectures and runs real AVFoundation H.264 encode/decode, timestamp, color/orientation, sealed-prefix recovery and PNG extraction checks without screen or input permission prompts.
+          OS permission dialogs, real ScreenCaptureKit window visibility, multi-display/DPI transitions, a full 20-minute session and a signed installed application require manual Mac acceptance. The job does not claim those checks passed.
+          EOF
+      - uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        with:
+          name: macos-task-recording-validation
+          path: .recording-ci/regression/**
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/openadapt-recording-compat.yml

@@ -0,0 +1,51 @@
+name: OpenAdapt recording export compatibility
+on:
+  pull_request:
+    paths:
+      - "App/memmy-agent/src/tools/computer-recordings/**"
+      - "App/memmy-agent/tests/tools/computer-recordings/**"
+      - "App/backend/local-api-contracts/src/computer-recordings.ts"
+      - "scripts/internal/shared/*openadapt*"
+      - ".github/workflows/openadapt-recording-compat.yml"
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  upstream-format:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          cache: pip
+          cache-dependency-path: scripts/internal/shared/openadapt-flow-compat.lock
+      - name: Install isolated development dependencies
+        run: |
+          npm ci --ignore-scripts --no-audit --no-fund
+          npm ci --prefix App/memmy-agent --ignore-scripts --no-audit --no-fund
+          npm run build -w @memmy/local-api-contracts
+          python -m pip install -r scripts/internal/shared/openadapt-flow-compat.lock
+      - name: Generate a real Flow export and compile it offline with upstream 1.35.1
+        run: |
+          node --import tsx App/memmy-agent/tests/tools/computer-recordings/generate-flow-fixture.ts "$RUNNER_TEMP/memmy-flow-fixture"
+          python scripts/internal/shared/verify-openadapt-export.py "$RUNNER_TEMP/memmy-flow-fixture/flow" "$RUNNER_TEMP/memmy-flow-bundle"
+          node --import tsx App/memmy-agent/tests/tools/computer-recordings/generate-flow-fixture.ts "$RUNNER_TEMP/memmy-flow-macos-fixture" --macos
+          python scripts/internal/shared/verify-openadapt-export.py "$RUNNER_TEMP/memmy-flow-macos-fixture/flow" "$RUNNER_TEMP/memmy-flow-macos-bundle"
+      - uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        with:
+          name: openadapt-format-fixture
+          path: |
+            ${{ runner.temp }}/memmy-flow-fixture/flow/**
+            ${{ runner.temp }}/memmy-flow-bundle/**
+            ${{ runner.temp }}/memmy-flow-macos-fixture/flow/**
+            ${{ runner.temp }}/memmy-flow-macos-bundle/**
+          if-no-files-found: warn

.github/workflows/plugin-host-compatibility.yml

@@ -0,0 +1,123 @@
+name: Generic plugin Host compatibility
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+  release:
+    types: [published]
+permissions:
+  contents: read
+jobs:
+  host:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name || github.sha }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.12'
+          cache-dependency-path: App/native-computer-history/apps/OpenComputerHistoryWindows/go.mod
+      - run: npm ci --legacy-peer-deps
+      - run: npm --prefix App/memmy-agent ci --legacy-peer-deps
+      - run: npm run typecheck -w @memmy/backend
+      - run: npm run build -w @memmy/desktop-interface
+      - run: npm run typecheck -w @memmy/frontend-desktop
+      - run: npm --prefix App/memmy-agent run build
+      - name: Baseline plugin and account/service compatibility
+        working-directory: App/backend
+        run: npx vitest run src/adapters/outbound/plugin-runtime/tests src/adapters/outbound/plugin-registry/tests src/adapters/outbound/plugin-artifact/tests src/adapters/outbound/plugin-skill/tests src/adapters/outbound/agent-adapter/tests/plugin-loader.test.ts src/adapters/outbound/agent-adapter/tests/plugin-source.test.ts src/services/tests/plugin-service.test.ts src/services/tests/plugin-network-policy.test.ts src/services/tests/plugin-local-artifact-service.test.ts src/services/tests/bundled-plugin-bootstrap-service.test.ts src/services/tests/plugin-model-policy.test.ts src/services/tests/plugin-model-inference-service.test.ts src/services/tests/plugin-asr-service.test.ts src/services/tests/plugin-asset-key-service.test.ts src/services/tests/plugin-entitlement-reconcile-service.test.ts src/services/tests/account-plugin-integration.test.ts src/services/tests/plugin-generated-skills.test.ts src/services/tests/plugin-native-host-services.test.ts src/services/tests/plugin-update-service.test.ts src/infrastructure/app-state-store/tests/plugin-upgrade.test.ts src/infrastructure/app-state-store/tests/plugin-repo.test.ts src/adapters/inbound/local-api/tests/plugin-mcp.test.ts src/adapters/inbound/local-api/tests/plugins-routes.test.ts src/adapters/inbound/local-api/tests/plugin-sse-recovery.test.ts src/tests/plugin-host-e2e.test.ts
+      - name: Shared capture and contribution discovery
+        working-directory: App/memmy-agent
+        run: npx vitest run tests/tools/plugin-host tests/tools/computer-history/shared-event-capture.test.ts tests/tools/computer-history/mac/recorder-checkpoints.test.ts tests/tools/computer-history/mac/persisted-checkpoint.test.ts tests/tools/computer-history/mac/human-recorder-checkpoint-native.test.ts tests/tools/computer-history/win/recorder.test.ts tests/tools/computer-history/win/protocol-normalize.test.ts tests/tools/computer-history/win/product-service.test.ts tests/core/agent-runtime/plugin-skills.test.ts tests/core/agent-runtime/skill-creator-scripts.test.ts tests/core/agent-runtime/mcp-plugin-catalog.test.ts
+      - name: Build native macOS app and verify the shared recorder source
+        if: runner.os == 'macOS'
+        run: |
+          cmp App/memmy-agent/src/tools/computer-history/mac/human-recorder.swift App/native-computer-use/apps/OpenComputerUse/Sources/MemmyComputerHistoryKit/HistoryRecorder.swift
+          swift build --package-path App/native-computer-use
+      - name: macOS normalization and durable boundary pipeline
+        working-directory: App/memmy-agent
+        run: npx vitest run tests/tools/computer-history/mac/record-human-history-checkpoints.test.ts tests/tools/computer-history/mac/computer-history-transitions.test.ts tests/tools/computer-history/mac/recorder-health-forwarding.test.ts
+      - name: Teaching window capture and extension connection identity
+        working-directory: App/memmy-agent
+        run: npx vitest run tests/tools/computer-history/browser-event-capture.test.ts tests/core/agent-runtime/tools/external-browser-bridge.test.ts
+      - name: Browser extension teaching isolation
+        working-directory: App/shell/desktop
+        run: npx vitest run tests/teaching-browser-recorder.test.ts tests/external-browser-extension-packaging.test.ts
+      - name: Deferred Gateway startup and plugin readiness
+        working-directory: App/shell/desktop
+        run: npx vitest run tests/runtime-services.test.ts
+      - name: Baseline plugin UI and conversation controls
+        working-directory: App/frontend/desktop
+        run: npx vitest run src/pages/tests/plugin-conversation-recording.test.tsx src/pages/tests/plugin-store-section.test.tsx src/pages/tests/plugin-capability-host src/pages/tests/plugin-settings-section.interaction.test.tsx src/app/tests/routes.test.ts src/app/tests/plugin-ui-context.test.tsx src/api/tests/plugins-client.test.ts src/lib/tests/plugin-transcription-jobs.test.ts
+      - name: Native observer logic
+        working-directory: App/native-computer-history/apps/OpenComputerHistoryWindows
+        run: go test ./...
+      - name: Windows PowerShell UIA snapshot serialization
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $source = Get-Content -Raw 'App/native-computer-history/apps/OpenComputerHistoryWindows/worker.ps1'
+          $worker = Join-Path $env:RUNNER_TEMP 'plugin-history-worker-selftest.ps1'
+          [IO.File]::WriteAllText($worker, $source, [Text.UTF8Encoding]::new($true))
+          $powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+          $probe = & $powershell -NoProfile -NonInteractive -MTA -ExecutionPolicy Bypass -File $worker -SelfTest | ConvertFrom-Json
+          if ($LASTEXITCODE -ne 0 -or -not $probe.workerApiCompiled -or -not $probe.pureSelfTest -or $probe.desktopAccess -ne $false) { throw 'UIA worker serialization regression' }
+      - name: Verify source provenance
+        run: node -e "const cp=require('node:child_process');const status=cp.execFileSync('git',['status','--porcelain'],{encoding:'utf8'});if(status.trim()){console.error(status);process.exit(1)}"
+      - name: Build shared native task recorder
+        if: runner.os == 'Windows'
+        run: node scripts/internal/win/build-plugin-native-recorder.mjs "${{ runner.temp }}/plugin-native-recorder.exe"
+      - name: Build independently consumable Host kit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MEMMY_HOST_RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: node scripts/plugin-host/build-conformance-kit.mjs "${{ runner.temp }}/host-kit"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: plugin-host-conformance-${{ matrix.os }}
+          path: |
+            ${{ runner.temp }}/plugin-host-conformance-*.zip
+            ${{ runner.temp }}/plugin-host-conformance-*.zip.sha256
+          if-no-files-found: error
+  publish-host-kit:
+    if: github.event_name == 'release'
+    needs: host
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        include:
+          - artifact: ubuntu-latest
+            platform: linux
+          - artifact: windows-latest
+            platform: win32
+          - artifact: macos-latest
+            platform: darwin
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: plugin-host-conformance-${{ matrix.artifact }}
+          path: ${{ runner.temp }}/host-kit-input
+      - name: Attach fixed Host kit and SHA-256 to its published release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MEMMY_HOST_TAG: ${{ github.event.release.tag_name }}
+          MEMMY_HOST_REPOSITORY: ${{ github.repository }}
+          MEMMY_KIT_PLATFORM: ${{ matrix.platform }}
+        run: |
+          artifact_version="${MEMMY_HOST_TAG#v}"
+          artifact_base="plugin-host-conformance-${artifact_version}"
+          artifact_arch="$(python3 -c 'import json,sys,zipfile; d=json.loads(zipfile.ZipFile(sys.argv[1]).read("host-release.json")); assert d["platform"]==sys.argv[2] and d["arch"] in ("arm64","x64"); print(d["arch"])' "${RUNNER_TEMP}/host-kit-input/${artifact_base}.zip" "${MEMMY_KIT_PLATFORM}")"
+          release_asset="${RUNNER_TEMP}/${artifact_base}-${MEMMY_KIT_PLATFORM}-${artifact_arch}.zip"
+          mv "${RUNNER_TEMP}/host-kit-input/${artifact_base}.zip" "${release_asset}"
+          mv "${RUNNER_TEMP}/host-kit-input/${artifact_base}.zip.sha256" "${release_asset}.sha256"
+          gh release upload "${MEMMY_HOST_TAG}" "${release_asset}" "${release_asset}.sha256" --repo "${MEMMY_HOST_REPOSITORY}"

.github/workflows/windows-history-native-validation.yml

@@ -0,0 +1,93 @@
+name: Windows Computer History validation
+
+on:
+  push:
+    branches:
+      - "pxlin/dev"
+      - "integrate/**"
+  pull_request:
+    paths:
+      - ".github/workflows/windows-history-native-validation.yml"
+      - "scripts/internal/win/history-*.ps1"
+      - "scripts/internal/shared/validate-computer-history.mjs"
+      - "tests/*computer-history*"
+      - "tests/windows-history-workflow.test.ts"
+      - "App/memmy-agent/**"
+      - "App/native-computer-history/**"
+      - "App/frontend/desktop/**"
+      - "App/shell/desktop/**"
+      - "App/backend/local-api-contracts/**"
+      - "Knowledge/**"
+      - "Migrations/**"
+      - "package.json"
+      - "package-lock.json"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: windows-2025
+    timeout-minutes: 35
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          architecture: x64
+          cache: npm
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22.12"
+          cache-dependency-path: App/native-computer-history/apps/OpenComputerHistoryWindows/go.mod
+      - name: Install dependencies
+        run: |
+          npm ci
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          npm ci --prefix App/memmy-agent
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Build native recorder and controlled fixtures
+        run: |
+          ./scripts/internal/win/history-recorder-native.ps1 -Configuration Release -BuildRoot "$env:GITHUB_WORKSPACE/.history-ci/build" -ArtifactsRoot "$env:GITHUB_WORKSPACE/.history-ci/artifacts"
+      - name: Run native tests serially and save results
+        run: |
+          $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio/Installer/vswhere.exe'
+          $vsRoot = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+          $ctest = Join-Path $vsRoot 'Common7/IDE/CommonExtensions/Microsoft/CMake/CMake/bin/ctest.exe'
+          & $ctest --test-dir .history-ci/build/release --parallel 1 --output-on-failure --output-junit "$env:GITHUB_WORKSPACE/.history-ci/native-results.xml"
+          $testExit = $LASTEXITCODE
+          ./scripts/internal/win/history-validation-report.ps1 -Report .history-ci/native-results.xml -Output .history-ci/native-summary.json
+          if ($testExit -ne 0) { exit $testExit }
+      - name: Run History contracts, UI, packaging and native lifecycle validation
+        env:
+          MEMMY_LEGAL_CN_BASE_URL: https://memmy.cn
+          MEMMY_LEGAL_INTL_BASE_URL: https://memmy.bot
+        run: |
+          node scripts/internal/shared/validate-computer-history.mjs --report-dir "$env:GITHUB_WORKSPACE/.history-ci/regression" --native-bin "$env:GITHUB_WORKSPACE/.history-ci/build/release"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Record validation scope
+        if: ${{ always() }}
+        run: |
+          @'
+          Windows History validation covers the native recorder, controlled fixture privacy tests, strict adapter, application settings, UI and packaged collector contracts.
+          Foreground cases unavailable on the runner are explicitly skipped in native-summary.json; skipped cases are not passed. Unit, metadata and CLI tests must run.
+          This job does not install a signed App or validate real application providers, IME, pixel visibility or a model service.
+          '@ | Add-Content -Path $env:GITHUB_STEP_SUMMARY
+      - uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        with:
+          name: windows-computer-history-validation-results
+          path: |
+            .history-ci/native-results.xml
+            .history-ci/native-summary.json
+            .history-ci/artifacts/**
+            .history-ci/regression/**
+            .history-ci/build/release/Testing/**
+          if-no-files-found: warn
+          retention-days: 7