git:20261103.08b42be to git:20261106.4a9345d

39 added, 47 removed. Audit A to A.

- # Coding Rules

+ # Project architecture

- 1. Fail fast with explicit errors: do not add fallback logic unless explicitly requested.

- 2. Let exceptions and errors bubble up as early as possible: do not handle errors inside the business layer.

- 3. Use effective tests: first prove that the bug or issue exists by making the test fail. Do not only write tests that pass, since they prove nothing.

- 4. Document externally exposed types, interfaces, functions, and classes, and add functional comments to key logic branches.

- 5. Reuse utility functions from `utils` whenever possible. If a general-purpose function does not exist but can be extracted and reused, add it to `utils` and reuse it there.

- 6. When writing unit tests, strictly mirror the source structure in `tests` directory. Each unit test file must test only the functionality of its corresponding source file.

- 7. Do not add unit tests that match stylesheets or source files with regular expressions; styles should be verified through component behavior and the toolchain.

- 8. Always use source types from the owning library or module. Do not create local duplicate types, and do not assert values as locally substituted types just to work around TypeScript issues.

- 9. Avoid abstraction layers that do not simplify the code or maintain a real boundary. Prefer calling the owning module or service directly instead of passing values through broad wrapper objects layer by layer.

- 10. Do not add explicit return types to functions unless TypeScript cannot infer them correctly or an explicit annotation is required to preserve a public contract.

- 11. Do not extract one-off helper functions unless they maintain a real boundary, hide meaningful complexity, or are expected to be reused. Prefer inlining simple one-use logic.

- 12. Do not revert files that are already staged in Git.

- 13. Keep source files under 500 lines where practical; split them as needed to keep files short and focused. This limit does not apply to unit test files.

- 14. When write commit message, follow `.github/COMMIT_MESSAGE_INSTRUCTIONS.md`.

+ Aidget is a cross-platform desktop widget host built with Rust/Tauri 2 and

+ TypeScript/Vite+. `src/main.rs` dispatches GUI, CLI, and MCP modes in one binary.

- # Collaboration workflow

+ - `src/interfaces/` exposes CLI and stdio MCP. CLI widget reads and writes use

+ `widgets::store::Store` offline; MCP forwards requests to the resident GUI over

+ local IPC, starting it on demand. `src/transport/` owns that IPC, widget resource

+ serving, and CSP. IPC uses Unix sockets or Windows named pipes.

+ - `src/widgets/` owns persisted widget content, metadata, and board frames.

+ `src/runtime/` owns native windows, placement, screenshots, and host APIs;

+ its watcher reconciles stored changes with running windows.

+ - `ui/src/main/` implements the management window. `ui/src/widget/` is the trusted

+ shell around an opaque-origin sandboxed iframe containing widget content.

+ Keep widget content outside the shell's Tauri privileges.

+ - `src/agents/` manages external Agent integrations; `src/community/` handles the

+ widget catalog and package installation; `src/update/` handles app self-update.

- - Keep one pull request to one behavior change. Name the exact commands and

- platforms that were tested, plus anything that was not tested.

- check out, commit from, clean, or delete another session's worktree or logs.

- - CI must pass and a reviewer other than the author must review the current

- head. Record the reviewed SHA before merge; a pushed head needs a new review.

- - Follow [docs/development.md](docs/development.md) for local checks and the

- version model.

+ # Cross-layer contracts

- # Release workflow

+ - Rust owns shared frontend types. Edit their Rust definitions, register new

+ exports in `src/bin/typegen.rs`, then run `pnpm typegen`; never edit

+ `ui/src/types/rust.ts` by hand. CI verifies it with `pnpm typegen --check`.

+ - A Tauri command needs registration in `src/runtime/commands.rs`, a window-role

+ entry in `src/runtime/command_names.rs`, and a matching capability grant.

+ Native authorization and Tauri ACL are separate gates, tested independently.

+ `permissions/autogenerated/` is build output; do not edit it.

- - Follow [docs/releasing.md](docs/releasing.md).

- - A release is an annotated `vMAJOR.MINOR.PATCH` or

- `vMAJOR.MINOR.PATCH-beta.N` tag on a reviewed commit that is already on

- `main`. Create the tag only after the commit is on `main` and `main` is green.

- - Do not commit release version bumps. The tag is the release version; the

- workflow injects it into the three manifests before checks and packaging.

- - Never move, delete or reuse a failed or published tag. A release that needs a

- code or workflow change gets a new commit and a new patch tag. Retry an

- unpublished tag only for a transient runner or service failure.

- - `DEEPSEEK_API_KEY` is required for the bilingual release notes. Never commit

- it or print it in logs.

- - A release is complete only when the workflow has published the seven platform

- packages listed in `docs/releasing.md` plus `SHA256SUMS`. Stable releases are

- marked Latest; beta releases are marked Pre-release and must not become Latest.

- - Do not hand-upload, replace or remove assets on a published release.

- - macOS and Windows artifacts are currently unsigned. Do not claim notarization

- or code signing.

- - Every build checks updates only from `aidget-ai/aidget`. Do not add a runtime

- or compile-time product setting that redirects updates to another repository.

- Test repositories must be injected through `UpdateService::for_build`.

- - The user's GitHub token may be sent only to HTTPS `api.github.com` for Release

- metadata. Installer and `SHA256SUMS` downloads must remain anonymous from the

- first `github.com` request through object-storage redirects.

+ # Working rules

+ - Fail fast with explicit errors; do not add fallback logic unless requested.

+ Let errors propagate without handling them inside the business layer.

+ - Preserve existing changes. Do not revert staged files or check out, commit

+ from, clean, or delete another session's worktree or logs.

+ # Required reading

+ - Before changing code, follow [docs/coding.md](docs/coding.md).

+ - For local checks, pull requests, merging, and the version model, follow

+ [docs/development.md](docs/development.md).

+ - Before changing the updater, follow [docs/self-update.md](docs/self-update.md).

+ - Before release work, follow [docs/releasing.md](docs/releasing.md).

+ - When writing a commit message, follow

+ [.github/COMMIT_MESSAGE_INSTRUCTIONS.md](.github/COMMIT_MESSAGE_INSTRUCTIONS.md).