Root cause: dynamic import('@tauri-apps/plugin-opener') silently fails on
Android Tauri WebView because the module resolution path for @tauri-apps/api
(plugin dependency) differs from npm expectations in the bundled context.
Rewrote tauri.ts to use window.__TAURI_INTERNALS__.invoke() directly:
- openUrl() → invoke('plugin:opener|open_url', {url})
- setupDeepLinkHandler() → invoke('plugin:deep-link|get_current')
- Warm-start listener still uses import('@tauri-apps/api/event') for
deep-link://new-url events (bundled as separate chunk by Vite)
- Added @tauri-apps/api as direct dependency
Also kept withGlobalTauri: true (needed for __TAURI_INTERNALS__ injection)
but reverted APK frontendDist back to bundled React app (../web/dist)
since redirect-to-live-web approach was unreliable.
Co-Authored-By: Claude <noreply@anthropic.com>
Without this, the redirect page loads zeavisedu.asepharyana.my.id but
__TAURI_INTERNALS__ is not injected, so isTauri() returns false,
handleGoogleLogin uses window.location.href (WebView navigation), and
Google blocks embedded WebView since 2016.
With withGlobalTauri=true, the live web page detects Tauri, uses tauri-
plugin-opener to open system browser, and Google OAuth works.
Co-Authored-By: Claude <noreply@anthropic.com>
APK architecture change: replaces bundled React SPA with minimal redirect
page that always loads live web content. No more APK rebuilds for web changes.
Root cause of OAuth failure on Android:
1. Cold-start deep links lost — APK's old bundled JS called onOpenUrl()
(warm-start listener only) but NOT getCurrent() which is required for
cold-start deep links. Fix: redirect page + setupDeepLinkHandler both
call getCurrent() before redirecting/navigating.
2. Session cookie was dropped — renderTauriDeepLinkPage returned a raw
new Response() which overwrote the Set-Cookie header set by the
callback handler. Fix: inject Set-Cookie into the Response.
3. tauri.conf.json frontendDist → "./web/dist-tauri" (redirect page)
4. Added @tauri-apps/plugin-deep-link and @tauri-apps/plugin-opener as
web app deps so live-web imports work in Tauri WebView.
Co-Authored-By: Claude <noreply@anthropic.com>
- New 'Platform' section detailing Tauri 2 Android app (WebView, Deep Link OAuth, Camera)
- Add Android CI/CD info, build commands, and GitHub Actions workflow reference
- Tagline updated to include 'Rust ONNX Runtime' and 'Tauri 2 Android'
- Architecture tree now shows apps/tauri/
- Components table: Android App row with Tauri 2, Rust, WebView, Deep Link OAuth
- Tech Stack: separate 'Inference Engine' section with Rust/Axum/ONNX Runtime bolded
- Prerequisites: Java 21 + Android SDK added
- Dev commands: tauri dev and tauri android dev included
- Cakupan updated: Web + Android (Tauri 2) now in-scope
Co-Authored-By: Claude <noreply@anthropic.com>
The intent:// URL in renderTauriDeepLinkPage was intent:/path (single slash),
producing zeavisedu:/login?token=xxx — a non-hierarchical URL that new URL()
cannot parse. Fixed to intent://login/path which produces a proper
hierarchical URI (zeavisedu://login/login?token=xxx).
Also hardened setupDeepLinkHandler to handle both double-slash (://) and
single-slash (:/) custom-scheme URLs as fallback.
Co-Authored-By: Claude <noreply@anthropic.com>
app.get_webview_window() needs tauri::Manager trait imported.
Removed the live URL redirect in setup for now — the bundled
frontend works fine. Can re-add later with proper imports.
- Add scripts/generate-icons.js using sharp to convert SVG to PNG
at all Android density buckets (mdpi 48→xxxhdpi 192)
- Add sharp as devDependency
- Update CI workflow to run icon generation after tauri android init
- Replaces Tauri's default icons with ZeaVis Edu logo
Co-Authored-By: Claude <noreply@anthropic.com>
On Android, the app navigates to the live production URL immediately
after setup. The APK becomes a thin shell — bundled frontend is only
a placeholder for the ~1 second before redirect. All web updates
(deploy web) take effect instantly on all installed APKs.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace custom zeavisedu:// scheme in callback HTML with Chrome's
native intent:// protocol which directly opens the target Android app
by package name. Includes browser_fallback_url for non-app scenarios.
Also updates the HTML page with better UX: auto-redirect via JS,
fallback button, and copyable URL for manual paste.
Co-Authored-By: Claude <noreply@anthropic.com>
Login-page won't auto-process token on deep link return because
the WebView stays on the page it was on. Added setupDeepLinkHandler()
which listens for zeavisedu:// scheme URLs and navigates the WebView
to the correct path+query.
Co-Authored-By: Claude <noreply@anthropic.com>
On Tauri Android, window.location.origin = http://tauri.localhost
which is the embedded dev server URL, not the API server.
Use VITE_API_BASE_URL env var which points to the production API.
Co-Authored-By: Claude <noreply@anthropic.com>
- Root README redesigned as landing page with 7 sub-chapters
- Each child README gets navigation header + footer linking back to root
- Cross-links between Machine_Learning, ml-service, and infra READMEs
- Reduced duplication: root summarizes, children provide full detail
- Net -207 lines, cleaner structure
Co-Authored-By: Claude <noreply@anthropic.com>
Background: Google blocks OAuth in embedded WebView (403 disallowed_useragent).
Solution: open Google login in the Android system browser, then deep-link
back to the Tauri app via custom scheme after callback.
Changes:
- Tauri: add tauri-plugin-opener + tauri-plugin-deep-link to Cargo.toml
- Tauri: register plugins in lib.rs, add capabilities
- Web: auth-form.tsx Google button uses openUrl() via @tauri-apps/plugin-opener
on Tauri (opens in system browser), falls back to window.location.href
- Web: add lib/tauri.ts for isTauri() detection + lazy opens
- API: /auth/google accepts ?platform=tauri → encodes into OAuth state param
- API: /auth/google/callback decodes state → if tauri, renders HTML page
that deep-links back via zeavisedu:// scheme; if web, 302 redirect
- Android: patch script adds deep link intent filter for zeavisedu:// scheme
Co-Authored-By: Claude <noreply@anthropic.com>
Inline SVG with official Google brand colors (blue, green, yellow, red)
placed before the label text with gap-2.5 spacing.
Co-Authored-By: Claude <noreply@anthropic.com>
- useSearchParams can lose params during re-renders, causing blank page
- Use native window.location.search + URLSearchParams instead (always accessible)
- Add oauthProcessing spinner state so user sees 'Menyelesaikan login...'
instead of blank page while /auth/me is being called
Co-Authored-By: Claude <noreply@anthropic.com>
Elysia's set.redirect returns 200 OK instead of 302 redirect on the
current version. Use set.status = 302 + set.headers['Location'] instead
for both /auth/google (Google OAuth redirect) and /auth/google/callback
(all redirect paths: errors, success token delivery).
Co-Authored-By: Claude <noreply@anthropic.com>
Add GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_REDIRECT_URI
to the deploy workflow so the API can use Google OAuth on production.
Co-Authored-By: Claude <noreply@anthropic.com>
API (apps/api/src/routes/auth.ts):
- Exchange authorization code for tokens via Google's token endpoint
- Decode id_token payload (JWT) to extract sub, email, name
- Find user by googleId → fall back to email match (link accounts)
- Auto-create user if neither found (role: 'user', no password)
- Create session + set cookie, redirect to /login?token=<token>
Web (apps/web/src/pages/login-page.tsx):
- Consume ?token= query param from OAuth redirect
- Store token in localStorage for future API calls
- Fetch /auth/me to hydrate Zustand store, then navigate to dashboard
- Show OAuth errors from ?error= query param
Co-Authored-By: Claude <noreply@anthropic.com>
- Add CameraCapture component with live viewfinder via getUserMedia
- Support rear/environment camera (default) with switch to front/user
- Capture to JPEG 92% quality via canvas, reuse existing upload flow
- Toggle between 'Unggah' (file upload) and 'Kamera' (live capture) modes
- Error handling for denied/not found/not readable in Bahasa Indonesia
- Add patch script for AndroidManifest CAMERA permission (gen/ is gitignored)
Co-Authored-By: Claude <noreply@anthropic.com>
Android WebView blocks third-party cookies by default. This patch:
- Returns session token in login/register response body
- Stores token in localStorage, sends via Authorization: Bearer header
- Backend getCurrentUser supports Authorization header fallback
Co-Authored-By: Claude <noreply@anthropic.com>
- Cookie SameSite now dynamic: None;Secure when behind HTTPS proxy, Lax otherwise
- AuthGuard useEffect no longer overwrites Zustand store with null from background refetch
- AuthInitializer: add staleTime 30s
Co-Authored-By: Claude <noreply@anthropic.com>
- Set VITE_API_BASE_URL default to production API URL in api-client.ts
so fetch() uses absolute URLs instead of relative paths that fail on Tauri
- Add tauri://localhost and https://tauri.localhost to API CORS allowed origins
- Also fix .env WEB_APP_URL from stale .tech to .my.id
Co-Authored-By: Claude <noreply@anthropic.com>
All services route through Traefik via internal network labels.
No ports need to be exposed on the host.
Co-Authored-By: Claude <noreply@anthropic.com>
Containers need time to start after docker compose up -d. Replaced
instant grep check with up-to-60s retry loop.
Co-Authored-By: Claude <noreply@anthropic.com>
packages/shared has only devDependencies (typescript). After
bun install --production, packages/shared/node_modules does not
exist. Root node_modules contains all hoisted deps.
Co-Authored-By: Claude <noreply@anthropic.com>
Build and Deploy: workspace has 4 members (api/web/shared/tauri) but
Dockerfiles only copied 3 package.json files. Missing tauri workspace
member caused bun install --production to fail with frozen lockfile
error.
Build Android APK:
- Remove explicit NDK 28 install (runner has NDK 29 pre-installed, dual
NDK presence broke ANDROID_NDK_HOME resolution)
- Auto-pin NDK version from runner's SDK
- rm -rf gen/android before tauri android init (stale cache recovery)
- Remove gen/android/.gradle from Gradle cache (causes stale state)
- Use --apk flag for faster APK-only build
Co-Authored-By: Claude <noreply@anthropic.com>
Bun workspace symlinks (apps/api/node_modules/*) pointed to root
.bun cache but were never copied from deps→runner. Added bun.lock,
apps/api/node_modules, and packages/shared/node_modules to the
runner COPY chain so and resolve at runtime.
Also added bun.lock to web Dockerfile for deterministic installs.
Co-Authored-By: Claude <noreply@anthropic.com>
Cache Bun dependencies (install cache + node_modules) and Gradle caches
(wrapper, dependencies, build artifacts) to dramatically speed up CI builds.
Gradle key uses Cargo.lock since gradle files don't exist at checkout time.
Co-Authored-By: Claude <noreply@anthropic.com>
PostCSS plugin needs tailwindcss package available in node_modules
at build time. Adding it as a direct dependency ensures consistent
resolution.
Co-Authored-By: Claude <noreply@anthropic.com>
bun auto-enables --frozen-lockfile in CI by default. Use env var
BUN_INSTALL_FROZEN_LOCKFILE=0 to override this behavior. Also
regenerate lockfile fresh to ensure it is compatible with bun 1.3.14.
Co-Authored-By: Claude <noreply@anthropic.com>
bun defaults to --frozen-lockfile in CI environments, causing failures
when the lockfile format differs from the version used at build time.
Co-Authored-By: Claude <noreply@anthropic.com>
CI uses bun 1.3.14 (stable) but local dev uses canary. Lockfile
format can differ between versions causing spurious failures.
Co-Authored-By: Claude <noreply@anthropic.com>
Tag created by softprops/action-gh-release is the single source of truth.
Version bump in tauri.conf.json + Cargo.toml is local to the build only.
Co-Authored-By: Claude <noreply@anthropic.com>
- Compute version from latest git tag (bump patch)
- Update tauri.conf.json and Cargo.toml with new version
- Create GitHub Release with signed APK + AAB via softprops/action-gh-release
- Release name: v{version}, APK filename: zeavis-edu-v{version}.apk
Co-Authored-By: Claude <noreply@anthropic.com>
- Trigger on push to main (web/tauri/shared changes), PR, and manual
- Builds Vite frontend + Tauri Rust for 4 Android arches
- Signs APK with keystore from GitHub secrets
- Uploads signed APK + AAB as artifact
Co-Authored-By: Claude <noreply@anthropic.com>
- calibrate_probs_selects_top_label: use logits that produce confidence >= 0.70
- prediction_response: forward status from Prediction struct instead of hardcode
Co-Authored-By: Claude <noreply@anthropic.com>
- PredictionResponse::status was missing in prediction_response()
- Prefix preprocess_start with underscore for unused variable warning
Co-Authored-By: Claude <noreply@anthropic.com>
Files on HF hub sit at repo root (model.onnx, etc.),
not in model/ subfolder. Fix download script to copy
each file to the correct subdirectory expected by Docker.
Co-Authored-By: Claude <noreply@anthropic.com>
- Integrate Convolutional Block Attention Module (CBAM) for improved feature focus
- Implement temperature scaling and confidence-based status reporting
- Automate dataset acquisition using kagglehub
- Update ONNX opset to 18 and refine preprocessing validation
- No need to install TensorFlow (3GB) — just pip install huggingface_hub
- Download pre-built model.onnx directly (saved from notebook export)
- Cuts CI time from ~10 min to ~30 seconds
Co-Authored-By: Claude <noreply@anthropic.com>
- Verify HF_TOKEN exists before attempting download
- Group CI log output for readability
- Use os.environ['HF_TOKEN'] instead of .get() to fail fast
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove binary model artifacts tracked in repo (.tflite, saved_model, tfjs model.json)
- CI now downloads best_model.keras from Hugging Face Hub (MythEclipse2737/corn-leaf-disease-classifier)
- Add save_model.py step before convert_onnx.py in CI pipeline
- Remove LFS patterns from .gitattributes (no longer needed)
- Remove lfs:true from checkout action
The model is fetched at CI time using HF_TOKEN secret — no large
binary files stored in git.
Co-Authored-By: Claude <noreply@anthropic.com>
- Add dep to requirements.txt
- Non-Colab path: download dataset_jagung.zip from Drive using file ID
if not present locally, then extract as usual
- Keeps Colab path unchanged (drive.mount)
Co-Authored-By: Claude <noreply@anthropic.com>
Notable changes:
- Add .gitattributes for LFS tracking on ML model artifacts
- Add AuthGuard to all protected routes + login/register/logout flow
- Add collapsible Sidebar replacing old Navbar
- Redesign MainLayout with sidebar + mobile header
- Add password show/hide toggle to AuthForm
- Add Logout button to MobileNav
- Update footer credit to ATLAS Project - Pijak x IBM SkillsBuild
- Update deploy.yml: generate ONNX in CI (vs HuggingFace download)
- Remove deprecated ML scripts (download/upload model .sh, .gitignore)
- Remove stale MEMORY.md
- Add ML model artifacts (TFLite, SavedModel, TFJS)
- Update notebook.ipynb training pipeline
Co-Authored-By: Claude <noreply@anthropic.com>
Introduce a `valueFormatter` prop to the `ChartCard` component to allow
customized data presentation in tooltips. This enables more readable
units for specific metrics, such as converting bytes to MiB or
seconds to milliseconds.
Rewrite the telemetry page logic to bypass the custom proxy API in
favor of direct Prometheus queries.
- Implement `queryRange` and `queryInstant` helpers for Prometheus API
- Replace `TelemetryAPI` client with direct fetch calls to Prometheus
- Update data fetching logic to use standard Prometheus query parameters
- Simplify state management and data transformation for charts
Add a comprehensive telemetry dashboard page featuring real-time
system statistics and metric visualization using recharts.
- Integrate recharts for area and bar chart rendering
- Implement TelemetryAPI client for stats, discovery, and chart data
- Add dashboard UI with stat cards and responsive charts
- Remove legacy nginx sub_filter proxy configuration in favor of
direct API communication to telemetry.imrnes.team
Update the sub_filter pattern for fetch requests to include escaped
double quotes. This ensures that path rewriting correctly handles
JavaScript fetch calls that use double-quoted strings, preventing
broken resource paths in the telemetry dashboard.
Migrate the web runner stage from the official nginx alpine image to a
standard alpine image with the nginx package installed. This ensures
the presence of the `http_sub_module` required for path rewriting in
the telemetry proxy configuration.
- Replace `nginx:1.27-alpine` with `alpine:3.20` and `apk add nginx`
- Update Nginx configuration file path to `/etc/nginx/http.d/default.conf`
- Update web asset root directory to `/var/lib/nginx/html`
- Add `X-Forwarded-For` and `X-Forwarded-Proto` headers to proxy locations
Transition telemetry dashboard integration from an external URL approach to a local reverse proxy via Nginx. This simplifies client-side connectivity by routing all telemetry requests through the existing web server's domain.
- Configure Nginx to proxy `/telemetry/` sub-paths to the internal telemetry service
- Implement `sub_filter` in Nginx to rewrite root-relative paths for the SPA
- Remove `VITE_TELEMETRY_URL` build arguments and environment variable dependencies
- Simplify `TelemetryPage` to use a relative `/telemetry` base path
- Clean up deployment workflows and Dockerfile by removing unused telemetry build args
Replace the hardcoded Nginx proxy configuration with a dynamic environment variable approach. This allows the telemetry dashboard to be loaded via a public URL instead of relying on a local Tailscale proxy.
- Add `VITE_TELEMETRY_URL` build argument to Dockerfile
- Pass `VITE_TELEMETRY_URL` through GitHub Actions deployment workflow
- Remove `/telemetry/` location block from nginx.conf
- Update `TelemetryPage` to use the new environment variable and improve iframe loading state management
App services reference telemetry-net as external, but telemetry runs
on a separate VPS. Creating the network as empty on the app VPS so
docker compose up doesn't fail.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Switches from git pull --ff-only to git fetch + git reset --hard
origin/main to avoid failing when VPS has uncommitted local changes
to tracked files (apps/ml-service/Dockerfile, docker-compose.yml).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The lockfile was out of sync causing Docker builds to fail with
'lockfile had changes, but lockfile is frozen' on CI.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
