Context
Upstream maintainer (Lightheartdevs) asked for PR Light-Heart-Labs/DreamServer#975 to be split into 4 separate PRs because only ~17 of ~2968 lines were the actual security fix.
Split (a) — security-loopback — shipped as Light-Heart-Labs/DreamServer#988 and the original Light-Heart-Labs#975 is now closed.
The remaining three splits still need to be carved out from the original branch commits (all on `origin/fix/network-exposure-hardening`).
Remaining splits
(b) macos-overlay-relocation — ~5 commits
Candidates: `a961dfcd` (resolve-compose-macos-overlay), `c2c196e1` (macos-installer-paths), `4dee1b79` (dream-macos-script-dir-autodetect), `3b41c115` (launchd-plist-early-unload), `f499b61e` (overlay-plist-contracts tests).
(c) dashboard-api-refactor — ~28 commits
The host-agent + extensions-router work: `b7b28ff9`, `14acb82d`, `693d580c`, `303a32de`, `ba6cf0c3`, `0b12f0a4`, `e1a0c0a8`, `528fea24`, `90f1c75f`, `088aa6e4`, `4735ef67`, `f0bca515`, `a3d48473`, `a0ae12fc`, `4f32d818`, `2a24fb9d`, `ec950131`, `25827ae9`, `4ff43384`, `c0149ed2`, `b0706925`, `aa850940`, `ff4841d5`, `8b576a7c`, `a1ae64f2`, `c78c0cc7`.
(d) dashboard-ui-updates — ~5 commits
`213342c9` (cancel errors), `f975f7bd` (usesystemstatus hidden tab), `bb49575d` (tooltip/theme), `15e676a9`/`a8a901dd` (extensions-page-ux), `73224eee` (model download indicator).
Leftover / drop — ~12 commits
Out-of-scope or one-offs better submitted as their own focused PRs (listed in the original analyst report; see `a975`'s message in this session's history for the full breakdown).
Approach
Each split should:
- Branch off fresh `upstream/main`
- Cherry-pick (or squash-cherry-pick) the relevant commits
- Get its own Critique Guardian review before submission
- Be submitted independently — the three don't share strict dependencies, though (b) is a prerequisite for some paths in (c)
Priority
Medium — no urgent pressure, but these contain real fixes and features sitting unshipped. Tackle one at a time, in order b → c → d.
Context
Upstream maintainer (Lightheartdevs) asked for PR Light-Heart-Labs/DreamServer#975 to be split into 4 separate PRs because only ~17 of ~2968 lines were the actual security fix.
Split (a) — security-loopback — shipped as Light-Heart-Labs/DreamServer#988 and the original Light-Heart-Labs#975 is now closed.
The remaining three splits still need to be carved out from the original branch commits (all on `origin/fix/network-exposure-hardening`).
Remaining splits
(b) macos-overlay-relocation — ~5 commits
Candidates: `a961dfcd` (resolve-compose-macos-overlay), `c2c196e1` (macos-installer-paths), `4dee1b79` (dream-macos-script-dir-autodetect), `3b41c115` (launchd-plist-early-unload), `f499b61e` (overlay-plist-contracts tests).
(c) dashboard-api-refactor — ~28 commits
The host-agent + extensions-router work: `b7b28ff9`, `14acb82d`, `693d580c`, `303a32de`, `ba6cf0c3`, `0b12f0a4`, `e1a0c0a8`, `528fea24`, `90f1c75f`, `088aa6e4`, `4735ef67`, `f0bca515`, `a3d48473`, `a0ae12fc`, `4f32d818`, `2a24fb9d`, `ec950131`, `25827ae9`, `4ff43384`, `c0149ed2`, `b0706925`, `aa850940`, `ff4841d5`, `8b576a7c`, `a1ae64f2`, `c78c0cc7`.
(d) dashboard-ui-updates — ~5 commits
`213342c9` (cancel errors), `f975f7bd` (usesystemstatus hidden tab), `bb49575d` (tooltip/theme), `15e676a9`/`a8a901dd` (extensions-page-ux), `73224eee` (model download indicator).
Leftover / drop — ~12 commits
Out-of-scope or one-offs better submitted as their own focused PRs (listed in the original analyst report; see `a975`'s message in this session's history for the full breakdown).
Approach
Each split should:
Priority
Medium — no urgent pressure, but these contain real fixes and features sitting unshipped. Tackle one at a time, in order b → c → d.