BillyOutlast
30da3f8b4e
Replaces the 205-file fork delivery vehicle with patches/ + launcher/ + versioned packages, per the implementation plan: Phase 1: seam tripwires (27 tests) freezing every surgical target in upstream (Usage predicate, %16 gate, SubscriptionChecker, debugger, LoadingScreen branding, Electron hook surface, no-plugin-registry verdict). Phase 2: 5 generated Tier-1 hunks (round-trip verified; 3 files reach byte-identical fork parity) + apply driver (dry-run gate, marker verify, asar extract/repack). Phase 3: launcher hook (preload fetch/XHR spoof of the two usage GETs, BrowserWindow wrap, webRequest fallback, updater pin) + 06 loader patch. Module._load interception dropped: renderers run a webpack bundle, so the spoof rides the axios/XHR path the provider hydrates from instead. Phase 4: Tier-2 verbatim extraction (CustomAIClient + 12 Studio modules + offline mock harness, manifest-pinned) + 07/08 verbatim glue patches + pure generation shim with fail-closed leak guard. Phase 5: web userscript demo (Tier-1 only, documented CORS/LAN/churn limits). Phase 6 runbook + upstream provider-interface RFC draft included; fork archiving left to owners (destructive). Suite: 66 tests green (seams, patcher incl. re-apply refusal, launcher incl. vm-sandbox fallback eval, tier-2 provenance, web).
web-userscript — web demo, optional (Phase 5, issue #5)
Zero-install demo on editor.gdevelop.io only — not a delivery path for
the Studio loop. Non-blocking for Phase 6.
Mechanism (Vector D)
heretek-unlock.user.js (Tampermonkey/Violentmonkey, @run-at document-start): taps the window.webpackChunk* registry (convention
frozen by tests/seams/electron.seam.test.mjs) to re-apply fetch /
XHR wrappers on every chunk push — deliberately no module-factory
surgery (hash churn would break it on each rebuild). Spoofs only the two
Tier-1 GETs (usage/limits, usage/subscription-v2); generation is
untouched. A floating widget persists the BYOK base URL to the same
gd-custom-ai-config key the desktop client reads.
Ollama CORS setup (required for any BYOK call from the web demo)
The editor page is https; Ollama serves http://localhost:11434, so
the browser blocks calls unless Ollama allows the origin:
OLLAMA_ORIGINS=https://editor.gdevelop.io ollama serve
Without this, Tier-1 unlocks still work but every BYOK generation fails with a CORS error in the console. Desktop builds do not need this.
Known limits
- LAN preview unreachable from the hosted page (private IPs are not
routable from
editor.gdevelop.io) — use desktop for wifi preview. - No filesystem access; the Studio sub-agent loop is desktop-only.
- Chunk-hash churn may require reinstalling wrappers (handled automatically) but can break the demo on any web rebuild.