release: 0.0.40

Version, changelog and the local/1helm-channel-machine:0.0.40 pins, plus the
offline release fallback pointed at 0.0.40 with fail-closed placeholder
digests until this commit's artifacts exist.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gitcommit90

CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.40] - 2026-08-03
+
+### Fixed
+
+- Clicking a channel or a thread no longer takes seconds. The server made
+  subprocess calls synchronously on the only thread that serves HTTP, so every
+  request queued behind them. Sampling a trivial endpoint that normally answers
+  in 1 ms recorded stalls of 2.9 s, 3.2 s and 21.2 s while the interface was in
+  use — the click was never slow, it was waiting in line.
+  - Durable memory shelled out to its Python bridge with `execFileSync`,
+    blocking the event loop for the whole call: a 20-second timeout for most
+    operations, 120 seconds for transcript sync, and a 771 ms floor just to
+    import the embedding libraries. The 21.2 s stall was that timeout. It is now
+    asynchronous, along with the runtime probes it depends on, which turned out
+    to be reachable from the first memory operation on a request path rather
+    than only at setup.
+  - Runtime readiness ran a synchronous container-image check on request
+    handlers including `/api/computers`, costing 53–73 ms of blocked event loop
+    every time. Readiness is now cached with a short time-to-live and refreshed
+    out of band, with one shared refresh so concurrent requests cannot cause a
+    subprocess storm. Endpoints that act on readiness — setup completion and
+    runtime start or prepare — await a fresh check rather than trusting the
+    cache, and image preparation updates it directly so a stale result cannot
+    persist.
+  - A channel interaction inspected the same container twice in a row; the
+    redundant call is gone.
+
+  This was the same defect that froze the Windows interface before 0.0.39. That
+  release removed the boundary those calls crossed without removing the
+  blocking, so Linux and macOS kept paying it.
+
+
 ## [0.0.39] - 2026-08-03
 
 ### Changed
@@ -1099,6 +1131,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Application Support, and isolated Apple container machines.
 
 [Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.36...HEAD
+[0.0.40]: https://github.com/gitcommit90/1Helm/compare/v0.0.39...v0.0.40
 [0.0.39]: https://github.com/gitcommit90/1Helm/compare/v0.0.30...v0.0.39
 [0.0.38]: https://github.com/gitcommit90/1Helm/compare/v0.0.30...v0.0.38
 [0.0.37]: https://github.com/gitcommit90/1Helm/compare/v0.0.30...v0.0.37

README.md

@@ -415,7 +415,7 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and non-OCI development/Apple workspace mirrors. |
 | `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `oci` on Linux and Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.39` | Versioned channel-machine image contract. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.40` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "1helm",
   "productName": "1Helm",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-only",

package.json

@@ -40,15 +40,16 @@ const RELEASE_CACHE_MS = 10 * 60_000;
 // 64 hex characters, so latestLinuxRelease() rejects it and
 // /api/releases/linux/latest answers 503 - failing closed rather than handing
 // an installer a digest that cannot match what it downloads.
-const RELEASE_FALLBACK_TAG = "v0.0.39";
+const PENDING_DIGEST = "pending-release-digest";
+const RELEASE_FALLBACK_TAG = "v0.0.40";
 const RELEASE_FALLBACK = {
   tag_name: RELEASE_FALLBACK_TAG,
   draft: false,
   prerelease: false,
   assets: [
-    ["1Helm-0.0.39-arm64.dmg", "de381468a61edc6b5c4d84525792be84f7575ba36777d35119f5878a4298fd0b"],
-    ["1Helm-0.0.39-mac-arm64.zip", "a35ba43a5136592977acfde4e7ba97d1399b4916ff0c90fd192e312a88414547"],
-    ["1Helm-0.0.39-linux-node.tgz", "ac54f11c153e89b8534417b4bfaa8aed22ceb5f0a4b10f164902483ae180b077"],
+    ["1Helm-0.0.40-arm64.dmg", PENDING_DIGEST],
+    ["1Helm-0.0.40-mac-arm64.zip", PENDING_DIGEST],
+    ["1Helm-0.0.40-linux-node.tgz", PENDING_DIGEST],
   ].map(([name, digest]) => ({
     name,
     digest: `sha256:${digest}`,

site/server.mjs

@@ -68,7 +68,7 @@ const APPLE_RUNTIME_VERSION = "1.1.0";
 export const APPLE_RUNTIME_PACKAGE = `container-${APPLE_RUNTIME_VERSION}-installer-signed.pkg`;
 export const APPLE_RUNTIME_URL = `https://github.com/apple/container/releases/download/${APPLE_RUNTIME_VERSION}/${APPLE_RUNTIME_PACKAGE}`;
 export const APPLE_RUNTIME_SHA256 = "0ca1c42a2269c2557efb1d82b1b38ac553e6a3a3da1b1179c439bcee1e7d6714";
-export const DEFAULT_CHANNEL_IMAGE = process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.39";
+export const DEFAULT_CHANNEL_IMAGE = process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.40";
 const CONTAINER_CANDIDATES = [process.env.HELM_CONTAINER_CLI, "/usr/local/bin/container", "/opt/homebrew/bin/container", "container"].filter(Boolean) as string[];
 const OCI_RUNTIME_VERSION = "1helm-oci-runtime-v1";
 const OCI_HELPER_CANDIDATES = [

src/server/channel-computers.ts

@@ -939,7 +939,7 @@ export function migrate(): void {
     const platformBackend = process.platform === "darwin" ? "apple" : "oci";
     const configuredBackend = String(process.env.HELM_CHANNEL_COMPUTER_BACKEND || platformBackend);
     const backend = ["apple", "oci", "native", "mock"].includes(configuredBackend) ? configuredBackend : platformBackend;
-    const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.39");
+    const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.40");
     for (const channel of q(`SELECT c.id FROM channels c JOIN agent_channels ac ON ac.channel_id=c.id
       WHERE c.kind='channel' AND c.status<>'deleted'`)) {
       const channelId = Number(channel.id);

src/server/db.ts

@@ -181,7 +181,7 @@ test("Apple channel-computer contract preserves isolation, files, wakes, archive
 test("runtime digest and packaged image recipe stay pinned", async () => {
   assert.equal(computers.APPLE_RUNTIME_SHA256, "0ca1c42a2269c2557efb1d82b1b38ac553e6a3a3da1b1179c439bcee1e7d6714");
   assert.match(computers.APPLE_RUNTIME_URL, /\/1\.1\.0\/container-1\.1\.0-installer-signed\.pkg$/);
-  assert.equal(computers.DEFAULT_CHANNEL_IMAGE, "local/1helm-channel-machine:0.0.39");
+  assert.equal(computers.DEFAULT_CHANNEL_IMAGE, "local/1helm-channel-machine:0.0.40");
   const packaging = await readFile(join(root, "scripts", "package-mac-dmg.cjs"), "utf8");
   assert.match(packaging, /container\(\?:\$\|\\\/\)/, "release packaging includes container/ image assets");
   const image = await readFile(join(root, "container", "Containerfile"), "utf8");