This repository was archived by the owner on Oct 16, 2026. It is now read-only.
Repository navigation
Fix PartyKit esbuild advisory, clear PoseEstimator complexity, add iOS test target (#26) - #46
Merged
Merged
Conversation
PartyKit 0.0.115 (latest) pins esbuild 0.21.5, affected by the moderate dev-server CORS advisory. Override only partykit>esbuild to 0.25.12, the first patched minor line. Motion's partykit.json has no serve.build assets config, so PartyKit uses esbuild only to bundle the worker; the real relay qualifier passes with the new version. pnpm audit: no known vulnerabilities. Refs #26 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
buildAndEmit (149 lines) and computeHands (CCN 22, 101 lines) were the last two complexity violations. Move joint mapping, smoothing, quality, ROI geometry and ROI lifting into PoseMath (no Vision requests, no pixel buffers) and split the hand pass into computeHands (MediaPipe primary), visionHands and performHandRequests. Arithmetic, thresholds, left/right swaps, fallback order and request side effects are unchanged. Complexity ratchet: violations 2 -> 0, max CCN 22 -> 15, max length 149 -> 95. Refs #26 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hosted Swift Testing target generated by XcodeGen, added to the Motion scheme, with a CocoaPods search-path inherit so it resolves MediaPipe. 14 tests pin the y flip, mirrored left/right swap, head/torso fallbacks, smoothing and dropout reuse, quality, ROI clamping and ROI-to-image lifting. CI runs them after the Swift ratchets on the first available iPhone simulator. Refs #26 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI aborted the hosted test run at launch: CocoaPods copied MediaPipe's -force_load graph library into Pods-MotionTests, so its classes were registered twice (app + test bundle). Strip -force_load from the test target xcconfigs in post_integrate; the app keeps it. Refs #26 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continues #26. These are the three remaining code items: the esbuild advisory, the PoseEstimator complexity violations, and an iOS test target. Device testing is still the owner's job.
1. PartyKit esbuild advisory (GHSA-67mh-4wv8-2f99, moderate)
partykit@0.0.115is the latest release, and it pinsesbuild 0.21.5. The fix is a singlepnpm.overridesentry,partykit>esbuild: 0.25.12(the patched minor line). The lockfile was regenerated with--lockfile-only; no other package moved.partykit.jsonhas noserve.buildassets config, so PartyKit uses esbuild only to bundle the worker (context/build). The vulnerablectx.servepath never runs here.node scripts/qualify-relay.mjspasses locally against 0.25.12: real relay handshake/presence, ping/pong, pose/start relay, duplicate/replacement/malformed/disconnect, inspector fetch.pnpm audit: 1 moderate → "No known vulnerabilities found" (323 audited).partykit deploybundling. It uses the same esbuild API, but nothing was deployed.2. PoseEstimator complexity (behavior-preserving)
Vision/PoseMath.swift: joint mapping with the y flip and mirrored L/R swap, head/torso fallbacks, exponential smoothing (one generic function now covers both the joint and arm loops), quality, ROI clamp, ROI→image lift, and the fingertips omission rule.computeHands(MediaPipe primary),visionHands(Vision fallback) andperformHandRequests. Arithmetic expressions, thresholds, fallback order, request/ROI side effects and left-before-rightanalyzeSideordering are unchanged.3. iOS test target
MotionTests(Swift Testing, hosted in the app) is defined inproject.ymland added to theMotionscheme. The Podfile getsinherit! :search_paths, soPodfile.lockchanges only its Podfile checksum.build-for-testingsucceeds. On this Mac,xcodebuild testhangs at simulator connect (DTServiceHubClient failed to bless service hub) with both Xcode 27 beta and 26.6, sandboxed or not. This PR's CI run is the first actual test execution.Before / after
11041e8)pnpm auditLocal checks run:
pnpm check(all gates),pnpm quality:swiftwithMOTION_INDEX_STORE, unsigned simulatorxcodebuild build+build-for-testing, andqualify-relay.mjs. No device run, deploy or release.🤖 Generated with Claude Code