This repository was archived by the owner on Mar 30, 2026. It is now read-only.
fix: privacy-hardened OpenWhispr fork with network guard and upstream sync#2
Merged
jrschumacher merged 15 commits intomainfrom Mar 16, 2026
Merged
Conversation
- Embeds Noto Sans woff2 variable-weight font files (weights 300–700, normal + italic, latin + latin-ext subsets) into src/assets/fonts/ - Replaces Google Fonts CDN links in index.html with local stylesheet reference - Eliminates outbound requests to fonts.googleapis.com and fonts.gstatic.com, improving privacy and enabling full offline functionality Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Replace the hook-based updater override with a simpler direct edit to owner/repo in updater.js. Document the updater change, electron-builder files addition, and sidebar account section removal in CLOUDFREE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Avoids collision with any future upstream allowlist file and makes the fork-owned config immediately identifiable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add reference to CLOUDFREE.md when manually resolving merge conflicts. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Combines release-please versioning with multi-platform build pipeline in a single workflow. Triggers on push to main, builds Linux/Windows/macOS when a release is created. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replaced by cloudfree-release.yml which combines release-please versioning with the multi-platform build pipeline. Upstream workflows kept in repo (trigger neutered) to avoid merge conflicts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Runs eslint and vitest on pull requests and pushes to main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use npm install instead of npm ci to avoid lockfile sync issues from upstream. Only lint and test CloudFree-owned code. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Root eslint.config.js ignores src/** — run from src/ to pick up the src/eslint.config.js that covers React/TS files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
tinyexec (vitest dep) needs postinstall to work. Using plain npm install instead of npm ci to tolerate lockfile drift from upstream. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Lockfile has peer dep conflicts from upstream that cause npm ci to fail. Using --legacy-peer-deps to tolerate them. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
tinyexec (vitest dep) is marked devOptional and was being skipped. Explicitly include dev and optional deps to ensure vitest works. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The upstream lockfile is out of sync (missing pg packages) which prevents normal install from resolving all transitive deps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a verification step that checks for tinyexec and reinstalls vitest if the transitive dep is missing after npm install --force. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jrschumacher
changed the title
jrschumacher
changed the title
This was referenced Mar 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces CloudFree, a privacy-hardened fork of OpenWhispr with network-level access controls. All CloudFree-specific code is isolated in
src/cloudfree/with minimal surgical edits to upstream files.Key Changes
Network Guard
src/cloudfree/networkGuard.js: Electron session-level URL filter enforcingcloudfree-allowlist.json/v1/audio/*,/*, etc.)UI Integration
jrschumacher/cloudfree-openwhisprAuto-Updater
src/updater.jsCI/CD
cloudfree-release.yml: Combined release-please + multi-platform build pipeline (Linux, Windows, macOS arm64/x64)cloudfree-ci.yml: Lint and test scoped tosrc/cloudfree/onlybuild-and-notarize.ymlandrelease.yml(kept for merge compatibility)Upstream Sync Workflow
CLOUDFREE.mdfor manual resolutionFile Organization
src/cloudfree/(hooks, network guard, UI components, branding)cloudfree-allowlist.json— domain+path allowlist with wildcard supportCLOUDFREE.md— comprehensive fork maintenance guideTesting
/v1/audio/*,/*/repo/main/*)🤖 Generated with Claude Code