fix(release): harden packaged backends for v1.4.12

.github/release-notes/v1.4.12.md

@@ -0,0 +1,183 @@
+## CatGo 1.4.12
+
+CatGo 1.4.12 is a cross-platform reliability release for CatBot, scientific
+workflows, large trajectories, and the integrated terminal. It includes the
+unpublished 1.4.10 and 1.4.11 improvements, plus release-time fixes verified on
+the Windows, macOS Apple Silicon, and Linux packaged build paths.
+
+### Highlights
+
+- **CatBot works from installed desktop packages** — Claude, Codex, and Gemini
+  CLI discovery follows platform-native user paths, while the bundled backend
+  and Agent Bridge expose the same Provider, MCP, Skills, voice, structure,
+  workflow, and Campaign capabilities as the source build.
+- **Packaged backends start with a coherent native runtime** — Linux bundles
+  one ABI-compatible conda C++ runtime, and Windows Campaign cold starts are
+  validated with reliable full-process-tree cleanup.
+- **Attachments reach the selected model** — images, PDFs, text files, and
+  general files are carried through SDK, direct-provider, and backend-relay
+  paths instead of being silently discarded.
+- **Surface workflows are scientifically complete** — the clean slab is
+  relaxed before adsorbate branches, frozen atoms stay consistent through
+  geometry optimization and frequency calculations, and workflow status comes
+  from actual task evidence.
+- **Large trajectories and terminals remain responsive and complete** — bounded
+  frame caches reduce memory pressure, while terminal resizing preserves CJK
+  cells and keeps the final column clear of the scrollbar.
+
+### Added
+
+#### Packaged CatBot verification
+
+- Added all-platform frozen-backend smoke tests covering the Provider catalogue,
+  native voice health, bundled core Skills, all 21 CatGo MCP tools, structure and
+  pane access, workflows, and real REST/MCP Campaign creation.
+- Added compiled Agent Bridge smoke tests for Claude, Codex, and Gemini session,
+  attachment, permission, failure, and stream-completion paths.
+- Added native attachment transport for Claude image/PDF blocks, Codex local
+  images, Gemini ACP images, and safe temporary file access for other formats.
+- Added a release boundary that publishes the VS Code extension to Marketplace
+  and Open VSX only after the exact-version Linux, macOS, and Windows sidecars
+  and their SHA256 metadata are available on the public mirror.
+
+#### CatBot and Codex integration
+
+- Added live Codex model discovery so CatBot's provider label follows the
+  installed CLI instead of carrying a stale hard-coded model version.
+- Preserved the user's Codex skills and MCP configuration while registering the
+  desktop CatGo server under its own namespace.
+- Routed CatBot structure, workflow, and export actions through the active CatGo
+  runtime connection rather than fixed localhost ports.
+- Added structure recovery for pop-out chat windows and viewer panels so closing
+  a presentation window does not erase the underlying structure.
+
+#### Workflow management and surface science
+
+- Added safe bulk selection and deletion to project and workflow views, with
+  durable success or failure feedback.
+- Added task-derived workflow state aggregation for CHECK, PAUSED, FAILED,
+  REMOTE_ERROR, RUNNING, and completed work.
+- Added a clean-slab geometry-optimization node before adsorbate branches in
+  generated surface workflows.
+- Persisted exact frozen-atom indices from slab generation through slab
+  optimization, adsorbate geometry optimization, and adsorbate-only frequency
+  calculations.
+
+### Fixed
+
+#### Cross-platform CatBot runtime
+
+- Fixed Linux frozen backends mixing Ubuntu 22.04's older `libstdc++` with
+  conda ICU. PyInstaller now selects the conda `libstdc++`/`libgcc` pair and
+  verifies that it provides every collected CXXABI and GLIBCXX version.
+- Fixed Windows packaged Campaign verification using a five-second generic API
+  timeout for the first frozen invocation. The smoke test now gives Campaign a
+  realistic cold-start budget and terminates the complete PyInstaller process
+  tree before removing logs.
+- Fixed GUI-launched Windows and macOS apps failing to find user-installed
+  Claude, Codex, or Gemini CLIs because desktop launchers supplied a reduced
+  PATH.
+- Fixed installed Windows local terminals opening with the wrong shell or losing
+  the selected shell and current directory across runtime transitions.
+- Fixed frozen desktop backends launching Campaign as `python -m catgo`, which
+  recursively invoked the packaged executable instead of the CatGo CLI.
+- Fixed the first microphone action racing the delayed voice router and becoming
+  stuck on an unavailable browser fallback.
+- Fixed CatBot attachments appearing in the composer but never reaching SDK,
+  direct-provider, or backend-relay requests.
+- Fixed migrated tool-registry tests importing the obsolete pre-package module
+  path, restoring coverage of packaged tool discovery.
+- Fixed official VS Code builds becoming visible before their matching server
+  sidecars, which previously produced unrecoverable HTTP 404 downloads.
+
+#### Workflow correctness and recovery
+
+- Fixed workflows that were reported as generated but never appeared in the
+  visible CatGo workspace.
+- Fixed completed, failed, or checking workflows that remained labeled RUNNING,
+  while continuing to protect genuinely executing tasks and unresolved remote
+  jobs from deletion.
+- Fixed slab and geometry-optimization previews showing different frozen layers
+  despite sharing the same structure.
+- Fixed manual freeze edits that appeared selected but were not persisted into
+  downstream inputs.
+
+#### Database and networking
+
+- Prevented Materials Project, OPTIMADE, and PubChem requests from inheriting
+  agent-only SOCKS proxy settings. Normal HTTP proxy configuration remains
+  available to the backend.
+- Improved OPTIMADE provider recovery so a failed upstream request is reported
+  accurately instead of leaving database search unusable.
+
+#### Trajectory and terminal rendering
+
+- Synchronized typed trajectory positions with topology and bond snapshots in
+  Large System Performance Mode.
+- Bounded decoded frame caches and refreshed bond snapshots without retaining an
+  unbounded object graph during playback.
+- Reserved terminal columns beside the scrollbar so the right edge is visible.
+- Reflowed active full-screen terminal applications on font changes and repaired
+  pre-existing tabs after hot reload, preventing CJK character loss.
+
+#### Citation
+
+- Updated the preferred CatGo citation to the published *Digital Discovery*
+  article, DOI `10.1039/D6DD00273K`.
+
+### Upgrade notes
+
+- No project, workflow database, structure-file, or trajectory migration is
+  required.
+- Existing Codex skills and MCP configuration are retained. CatGo's desktop MCP
+  entry is isolated automatically; remove obsolete hand-written CatGo entries
+  only if you previously added duplicates yourself.
+- Workflow deletion remains unavailable for tasks that are executing or whose
+  remote job identity is unresolved. This is an intentional safety boundary.
+- Generated surface workflows contain a clean-slab relaxation node. Review slab
+  constraints before submitting a newly generated DAG.
+- CatBot keeps attachment metadata in restored chat history but does not persist
+  attachment bytes in browser storage. Reattach a file before asking a follow-up
+  question that requires rereading it.
+- VS Code, Cursor, VSCodium, and Theia users should install the Marketplace or
+  Open VSX build. A manually version-edited VSIX has no matching sidecar and is
+  intentionally rejected instead of silently running a different backend.
+
+### Included pull requests
+
+- [#571](https://github.com/Hello-QM/catgo-LRG/pull/571) — Update the preferred
+  citation to the published *Digital Discovery* article.
+- [#574](https://github.com/Hello-QM/catgo-LRG/pull/574) — Harden CatBot,
+  workflow lifecycle and slab constraints, provider networking, large-system
+  trajectories, and terminal resizing.
+- [#576](https://github.com/Hello-QM/catgo-LRG/pull/576) — Repair Windows local
+  shells and working-directory synchronization, then harden the complete
+  packaged CatBot runtime across supported desktop platforms.
+
+### Downloads
+
+- **Windows x86-64** — `.msi` or `-setup.exe`
+- **macOS Apple Silicon** — Developer-ID signed `.dmg`
+- **Linux x86-64** — `.deb` or `.rpm`
+- **Android** — `CatGo-v*-android-universal.apk`
+- **iOS** — [TestFlight beta](https://testflight.apple.com/join/FdHup5Hz)
+- **VS Code** — `.vsix`
+- **Headless/HPC** — platform sidecars and `catgo-hpc-bundle.tar.gz`
+
+### License and citation
+
+CatGo 1.4.12 distributions use **AGPL-3.0-or-later**.
+
+If CatGo contributes to your work, please include this acknowledgement and the
+preferred citation:
+
+> This work used CatGo (https://app.catgo-ucsd.org).
+
+Please cite DOI
+[`10.1039/D6DD00273K`](https://doi.org/10.1039/D6DD00273K).
+This request is not an additional condition of the AGPL license. Third-party
+materials retain their own terms. Historical AGPL grants remain in effect.
+
+See the
+[CHANGELOG](https://github.com/Hello-QM/catgo-LRG/blob/main/CHANGELOG.md)
+for the complete release history.

.github/workflows/tauri-build.yml

@@ -350,7 +350,7 @@ jobs:
             One window for the whole loop: **read almost any code's files → build & edit → run DFT / ML / MD → submit to HPC → analyse → publish.** Ships with the bundled backend server (MLP libraries excluded to keep the download lean).
 
             ### License and citation
-            CatGo 1.4.11 distributions use **AGPL-3.0-or-later**.
+            CatGo 1.4.12 distributions use **AGPL-3.0-or-later**.
 
             If CatGo contributes to your work, please include this acknowledgement and the preferred citation:
 
@@ -380,7 +380,8 @@ jobs:
             - **Analysis** — DOS / band / COHP, Brillouin zone, XRD, phase diagrams, Gibbs & volcano plots
             - Built-in xTB / EMT calculators · OPTIMADE & PubChem search · HD render & trajectory video export
 
-            ### New in 1.4.11
+            ### New in 1.4.12
+            - **Packaged backends start reliably on Linux and Windows** — Linux bundles one ABI-compatible conda C++ runtime, while Windows Campaign cold starts are verified with complete process-tree cleanup.
             - **Installed CatBot is complete across supported desktops** — Claude, Codex, and Gemini discovery, attachments, voice, Skills, MCP tools, structures, workflows, and Campaigns are covered by packaged-runtime smoke tests.
             - **Windows terminal and Campaign workflows are reliable** — native shell selection, working-directory synchronization, GUI PATH recovery, and frozen Campaign dispatch use the correct runtime.
             - **Surface workflows relax slabs and preserve constraints** — clean-slab optimization precedes adsorption branches, with exact frozen atoms inherited by geometry and frequency steps.
@@ -563,7 +564,7 @@ jobs:
         run: bash scripts/ensure-release-body.sh "$CATGO_RELEASE_TAG"
 
       - name: Finalize canonical release body
-        if: env.CATGO_RELEASE_TAG == 'v1.4.11'
+        if: env.CATGO_RELEASE_TAG == 'v1.4.12'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: bash scripts/ensure-release-body.sh "$CATGO_RELEASE_TAG"

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.4.12] - 2026-08-25
+
+### Fixed
+
+- **Linux packaged backend startup** — PyInstaller now bundles the coherent conda `libstdc++`/`libgcc` pair and verifies its CXXABI/GLIBCXX coverage, preventing conda ICU from loading against Ubuntu 22.04's older C++ runtime.
+- **Windows frozen Campaign verification** — packaged Campaign creation receives a realistic cold-start timeout, and smoke-test cleanup terminates the complete PyInstaller process tree without masking the original failure behind a locked log file.
+
 ## [1.4.11] - 2026-08-25
 
 ### Added

CITATION.cff

@@ -1,6 +1,6 @@
 cff-version: 1.2.0
 message: If CatGo contributes to your work, please acknowledge and cite it as described below. This request is not an additional condition of AGPL-3.0-or-later.
-version: 1.4.11
+version: 1.4.12
 title: CatGo
 license: AGPL-3.0-or-later
 license-url: https://github.com/Hello-QM/catgo-LRG/blob/main/license

extensions/rust-wasm/CITATION.cff

@@ -1,6 +1,6 @@
 cff-version: 1.2.0
 message: If CatGo contributes to your work, please acknowledge and cite it as described below. This request is not an additional condition of AGPL-3.0-or-later.
-version: 1.4.11
+version: 1.4.12
 title: CatGo
 license: AGPL-3.0-or-later
 license-url: https://github.com/Hello-QM/catgo-LRG/blob/main/license

extensions/vscode/CITATION.cff

@@ -1,6 +1,6 @@
 cff-version: 1.2.0
 message: If CatGo contributes to your work, please acknowledge and cite it as described below. This request is not an additional condition of AGPL-3.0-or-later.
-version: 1.4.11
+version: 1.4.12
 title: CatGo
 license: AGPL-3.0-or-later
 license-url: https://github.com/Hello-QM/catgo-LRG/blob/main/license

extensions/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "catgo",
   "displayName": "CatGo",
   "description": "3D viewer for crystal structures, molecules and MD / optimization trajectories — reads the file formats of VASP, Quantum ESPRESSO, CP2K, ABACUS, ORCA, Gaussian, CASTEP, SIESTA, OpenMX, LAMMPS and ASE: POSCAR/CONTCAR · CIF · XYZ/extXYZ · mol2 · PDB · vasprun.xml · OUTCAR · XDATCAR · .traj · HDF5 · cube/CHGCAR isosurfaces. Cross-cell PBC bond rendering, moyo space-group + Wyckoff symmetry, trajectory scrubbing with energy/force overlays, themes that follow VS Code. Right-click → Render, or Ctrl/Cmd+Shift+V.",
-  "version": "1.4.11",
+  "version": "1.4.12",
   "license": "AGPL-3.0-or-later",
   "publisher": "Guangsheng",
   "icon": "icon.png",

package.json

@@ -4,7 +4,7 @@
   "homepage": "https://github.com/Hello-QM/catgo-LRG",
   "repository": "https://github.com/Hello-QM/catgo-LRG",
   "license": "AGPL-3.0-or-later",
-  "version": "1.4.11",
+  "version": "1.4.12",
   "type": "module",
   "packageManager": "pnpm@10.28.2",
   "bugs": "https://github.com/Hello-QM/catgo-LRG/issues",

scripts/__tests__/docs-citation-license.test.mjs

@@ -48,7 +48,7 @@ test('CITATION.cff carries the exact non-binding citation request', () => {
   assert.equal(message, CITATION_REQUEST)
   assert.match(cff, new RegExp(
     `^cff-version: 1\\.2\\.0\\nmessage: ${escapeRegExp(CITATION_REQUEST)}\\n` +
-    'version: 1\\.4\\.11\\ntitle: CatGo\\nlicense: AGPL-3\\.0-or-later\\n' +
+    'version: 1\\.4\\.12\\ntitle: CatGo\\nlicense: AGPL-3\\.0-or-later\\n' +
     'license-url: https://github\\.com/Hello-QM/catgo-LRG/blob/main/license$',
     'm',
   ))

scripts/__tests__/license-policy.test.mjs

@@ -158,6 +158,7 @@ const licenseClaimInventory = {
     '.github/release-notes/v1.4.9.md',
     '.github/release-notes/v1.4.10.md',
     '.github/release-notes/v1.4.11.md',
+    '.github/release-notes/v1.4.12.md',
     '.github/workflows/tauri-build.yml',
   ],
   historicalOnly: [
@@ -296,7 +297,7 @@ test('canonical citation file requests citation without adding an AGPL condition
   assert.equal(existsSync(resolve(ROOT, 'citation.cff')), false)
   const text = read('CITATION.cff')
   assert.match(text, /^cff-version: 1\.2\.0$/m)
-  assert.match(text, /^version: 1\.4\.11$/m)
+  assert.match(text, /^version: 1\.4\.12$/m)
   assert.match(text, /^license: AGPL-3\.0-or-later$/m)
   assert.match(text, /^license-url: https:\/\/github\.com\/Hello-QM\/catgo-LRG\/blob\/main\/license$/m)
   assert.match(text, /CatGo: Bridging CLI Coding Agents/)

scripts/__tests__/release-body.test.mjs

@@ -14,7 +14,7 @@ import test from 'node:test'
 import { fileURLToPath } from 'node:url'
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
-const TAG = 'v1.4.11'
+const TAG = 'v1.4.12'
 const NOTES = resolve(ROOT, `.github/release-notes/${TAG}.md`)
 const WORKFLOW = readFileSync(
   resolve(ROOT, '.github/workflows/tauri-build.yml'),
@@ -79,11 +79,11 @@ test('canonical current release body contains every mandatory disclosure', () =>
 test('existing release is always edited to the canonical body', () => {
   const { result, calls } = runEnsure({ existing: true })
   assert.equal(result.status, 0, result.stderr || result.stdout)
-  assert.match(calls, /^release view v1\.4\.11$/m)
+  assert.match(calls, /^release view v1\.4\.12$/m)
   assert.doesNotMatch(calls, /^release create /m)
   assert.match(
     calls,
-    /^release edit v1\.4\.11 --title CatGo v1\.4\.11 --notes-file \.github\/release-notes\/v1\.4\.11\.md$/m,
+    /^release edit v1\.4\.12 --title CatGo v1\.4\.12 --notes-file \.github\/release-notes\/v1\.4\.12\.md$/m,
   )
 })
 
@@ -93,9 +93,9 @@ test('concurrent draft creation still converges through an explicit edit', () =>
     createStatus: 1,
   })
   assert.equal(result.status, 0, result.stderr || result.stdout)
-  assert.match(calls, /^release create v1\.4\.11 --draft /m)
-  assert.match(calls, /^release view v1\.4\.11$/m)
-  assert.match(calls, /^release edit v1\.4\.11 /m)
+  assert.match(calls, /^release create v1\.4\.12 --draft /m)
+  assert.match(calls, /^release view v1\.4\.12$/m)
+  assert.match(calls, /^release edit v1\.4\.12 /m)
 })
 
 test('Tauri workflow finalizes the canonical body after tauri-action', () => {
@@ -104,7 +104,7 @@ test('Tauri workflow finalizes the canonical body after tauri-action', () => {
   assert.ok(action >= 0)
   assert.ok(finalize > action)
   const block = WORKFLOW.slice(finalize)
-  assert.match(block, /if: env\.CATGO_RELEASE_TAG == 'v1\.4\.11'/)
+  assert.match(block, /if: env\.CATGO_RELEASE_TAG == 'v1\.4\.12'/)
   assert.match(block, /scripts\/ensure-release-body\.sh "\$CATGO_RELEASE_TAG"/)
 })
 

scripts/__tests__/release-version-verifier.test.mjs

@@ -53,7 +53,7 @@ function runVerifierWithEnvironment(root, environment) {
   })
 }
 
-function replaceVersion(root, path, from = '1.4.11', to = '1.4.9') {
+function replaceVersion(root, path, from = '1.4.12', to = '1.4.9') {
   const target = resolve(root, path)
   const current = readFileSync(target, 'utf8')
   assert.match(current, new RegExp(from.replaceAll('.', '\\.')), path)
@@ -63,9 +63,9 @@ function replaceVersion(root, path, from = '1.4.11', to = '1.4.9') {
 test('accepts a consistent release tree and its exact v-prefixed tag', () => {
   const root = fixture()
   try {
-    const result = runVerifier(root, '--tag', 'v1.4.11')
+    const result = runVerifier(root, '--tag', 'v1.4.12')
     assert.equal(result.status, 0, result.stderr)
-    assert.match(result.stdout, /release version 1\.4\.11 verified/)
+    assert.match(result.stdout, /release version 1\.4\.12 verified/)
   } finally {
     rmSync(root, { recursive: true, force: true })
   }
@@ -78,7 +78,7 @@ test('accepts Windows CRLF checkouts', () => {
       const target = resolve(root, path)
       writeFileSync(target, readFileSync(target, 'utf8').replaceAll('\n', '\r\n'))
     }
-    const result = runVerifier(root, '--tag', 'v1.4.11')
+    const result = runVerifier(root, '--tag', 'v1.4.12')
     assert.equal(result.status, 0, result.stderr)
   } finally {
     rmSync(root, { recursive: true, force: true })
@@ -106,7 +106,7 @@ test('rejects a tag that does not exactly match the manifest version', () => {
   try {
     const result = runVerifier(root, '--tag', 'v1.4.9')
     assert.notEqual(result.status, 0)
-    assert.match(result.stderr, /expected v1\.4\.11/)
+    assert.match(result.stderr, /expected v1\.4\.12/)
   } finally {
     rmSync(root, { recursive: true, force: true })
   }
@@ -127,7 +127,7 @@ test('honors the workflow tag and publishing requirement environment', () => {
   const root = fixture()
   try {
     const matching = runVerifierWithEnvironment(root, {
-      RELEASE_VERSION_TAG: 'v1.4.11',
+      RELEASE_VERSION_TAG: 'v1.4.12',
       RELEASE_VERSION_REQUIRE_TAG: 'true',
     })
     assert.equal(matching.status, 0, matching.stderr)
@@ -137,7 +137,7 @@ test('honors the workflow tag and publishing requirement environment', () => {
       RELEASE_VERSION_REQUIRE_TAG: 'true',
     })
     assert.notEqual(mismatched.status, 0)
-    assert.match(mismatched.stderr, /expected v1\.4\.11/)
+    assert.match(mismatched.stderr, /expected v1\.4\.12/)
 
     const missing = runVerifierWithEnvironment(root, {
       RELEASE_VERSION_TAG: '',