Merge branch 'main' of https://git.nianxx.cn/wangxuming/makelore
# Conflicts: # electron/coding-runtime/pi/extensions/makelore-runtime.ts
This commit is contained in:
@@ -19,10 +19,10 @@
|
||||
- 用户模块入口策略必须由 Electron Main 将 Works `/api/auth/me` 安全投影为四个布尔值；缺失对象/字段默认开启，`design` 映射 `painting`，Renderer 不获得 Token 或原始 profile。
|
||||
- 被关闭模块必须在卡片和根/深层/别名路由两层均无法进入，且在 `MainLayout`/模块初始化前阻断；Code provider 等待 policy hydration，全局 `/settings` 仍可访问，终止性 `401` 清理 Main/Renderer 会话。该客户端入口策略不能代替 API 授权。
|
||||
- Makelore Code 必须只使用精确 pin 的 Pi `0.84.2` production runtime；产品源码、安装包和资源根不得保留 OpenCode runtime/package/plugin/fallback/双路径。上游 Pi Provider adapter 的精确静态文件例外必须单列，不能误报为产品旧 runtime。
|
||||
- 新 project/Agent/Conversation 必须本地原子创建，Composer 在 worker 准备期间仍可编辑。每条 active/warm Conversation 独立绑定 persistent worker/session；Snapshot/Patch、model/thinking、queue、interaction、subagent 和 recovery 不得跨 Conversation 泄漏。
|
||||
- 新 project/Agent/Conversation 必须在 `.makelore` 中本地原子创建，不读取或迁移 `.niancode` / `.opencode` 项目元数据；Composer 在逻辑线程准备期间仍可编辑。每条 active/warm Conversation 在单一父 Agent Server 内独立绑定 Runtime/Session/channel/credential/extension context；Snapshot/Patch、model/thinking、queue、interaction、subagent 和 recovery 不得跨 Conversation 泄漏。
|
||||
- prompt/compact 的 `202` acceptance 与 uncertain 状态必须保持 request/run/process/background ownership，禁止自动重放；迟到 terminal 事件必须 exactly-once 收敛并重新解锁 Composer。手动 compact 在 Pi `0.84.2` 缺少 `agent_settled` 时必须由 correlated RPC 结果正确结束。
|
||||
- Provider secret 只能进入目标 worker env。未解析 Conversation 必须 validate → persist resolved model → prepare；确定性 Works user-context 缺失必须失效缓存凭据、停止 Pi 自动重试并投影固定 Provider-auth 错误，而不是表现为 runtime crash、永久 submitting 或不可恢复的 Conversation。
|
||||
- top-level worker 并发 4、child 并发 4、warm idle LRU 4、parent/child 总进程预算 8 与同项目 write lease 必须在正常、abort、crash、timeout、rebuild 和 app quit 路径全部归零；运行中的 Conversation 不得因页面隐藏而被停止。
|
||||
- Provider secret 只能进入目标父逻辑线程的内存 credential store 或目标 child 进程。未解析 Conversation 必须 validate → persist resolved model → prepare；确定性 Works user-context 缺失必须失效缓存凭据、停止 Pi 自动重试并投影固定 Provider-auth 错误，而不是表现为 runtime crash、永久 submitting 或不可恢复的 Conversation。
|
||||
- top-level 逻辑 turn 并发 4、child 进程并发 4、warm idle logical-thread LRU 8、child FIFO 进程预算 8 与同项目 write lease 必须在正常、abort、crash、timeout、rebuild 和 app quit 路径全部归零；运行中的 Conversation 不得因页面隐藏而被停止。Agent Server 退出必须使所有旧 channel 失效、保持 Main/Renderer 存活，并在恢复时只创建一个新 Server。
|
||||
|
||||
## Quality Checks
|
||||
|
||||
@@ -32,9 +32,9 @@
|
||||
- Learning 上线前必须部署 Works Square 项目管理、对象存储、README HTTPS URL 校验和 list/detail/media/archive API，并使用真实账号和正式安装包验证发布/下架、分页、README 图片、下载取消、缺失或错误 `Content-Length`、损坏/摘要不匹配 ZIP，以及 Windows 与签名 macOS 保存行为。
|
||||
- Robot 默认引导路径必须通过聚焦 Renderer/Main/native 测试并保留 `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` 回滚。真实 Host API/native seam Electron E2E、Windows Robot 真机、签名 macOS x64/arm64、指定固件镜像与六位码发行契约未完成前，不得宣称完整双平台硬件兼容或端到端配网已经验收。
|
||||
- 四模块入口策略发布前必须部署 Works migration/API、重新打包客户端，并以真实账号对 Code、Canvas、Learning、Robot 分别执行关闭 smoke；客户端自动化不得代替服务端 API 授权验收。
|
||||
- Windows 最终安装包必须通过 Pi production closure、最终 `app.asar` Main、真实 extension/ephemeral child、4 parent + 4 child live-PID、prompt/compact uncertainty、late-settle 和零残留进程验证。loopback/provider-shaped smoke 只能证明协议序列化与本地隔离，`realTurnVerified=false` 时不得宣称真实 Provider Pass。
|
||||
- Windows 最终安装包必须通过 Pi production closure、最终 `app.asar` Main、真实 extension/ephemeral child、单一父 Agent Server 内 4 条重叠 Conversation 逻辑线程 + 4 个 child live-PID、单线程关闭、Server 崩溃重启、prompt/compact uncertainty、late-settle 和零残留进程验证。loopback/provider-shaped smoke 只能证明协议序列化与本地隔离，`realTurnVerified=false` 时不得宣称真实 Provider Pass。
|
||||
- macOS x64/arm64 与 native non-WSL Linux desktop/compositor 的最终安装产物仍是 cross-platform release gate；Windows 或 WSL2/WSLg 通过不能替代这些平台证据。
|
||||
|
||||
## Last Reviewed
|
||||
|
||||
2026-08-26
|
||||
2026-08-31
|
||||
|
||||
@@ -2,7 +2,8 @@
|
||||
|
||||
## Status
|
||||
|
||||
Accepted and implemented on 2026-08-26.
|
||||
Accepted and implemented on 2026-08-26; amended on 2026-08-31 for the shared
|
||||
parent Agent Server topology and `.makelore`-only project ownership.
|
||||
|
||||
## Context
|
||||
|
||||
@@ -12,18 +13,20 @@ The former OpenCode integration coupled Renderer state, a shared runtime lifecyc
|
||||
|
||||
- Pin `@earendil-works/pi-coding-agent` `0.84.2` as the sole Makelore Code production runtime. Do not maintain OpenCode fallback, dual execution, RPC/SDK alternatives, or Renderer access to runtime HTTP/RPC/event types.
|
||||
- Use product-owned schema-v2 project, Agent, Conversation, model, Snapshot/Patch, command, interaction, attachment, file and subagent contracts. Pi wire and Provider details remain private to Electron Main.
|
||||
- Electron Main owns the single `/api/coding/*` composition, project storage, Provider credentials, managed Prompt/Skill/extension resources, persistent per-Conversation worker/session registry, recovery, event projection, background lifecycle, process budget, subagent scheduler and same-project write lease.
|
||||
- Keep one persistent worker/session per active or warm Conversation. Limit top-level running workers to 4, warm idle workers to 4, child concurrency to 4, and all parent/child processes to a shared FIFO budget of 8. A coding child shares its parent's project write lease and cannot recursively dispatch subagents.
|
||||
- Electron Main owns the single `/api/coding/*` composition, project storage, Provider credentials, managed Prompt/Skill/extension resources, the persistent per-Conversation logical Runtime/Session registry, the long-lived parent Agent Server, recovery, event projection, background lifecycle, process budget, subagent scheduler and same-project write lease.
|
||||
- Run one long-lived parent Pi Agent Server per Coding composition. Each active or warm Conversation receives an isolated logical Runtime, Session, generation, credential store, extension context and JSONL channel inside that process. Limit running parent turns to 4 and warm idle logical threads to 8. An Agent Server exit invalidates every old parent channel and the next recovery starts exactly one replacement Server; it must not exit Electron Main or replay accepted work.
|
||||
- Keep child Agents as independent short-lived processes. Limit child concurrency to 4 and retain the FIFO child-process budget of 8; shared parent logical threads do not each consume a process lease. A coding child shares its parent's project write lease and cannot recursively dispatch subagents.
|
||||
- Public streaming is Snapshot-first plus bounded `patch-batch` SSE. Generation/sequence recovery is target-only; accepted or uncertain mutations are never replayed automatically.
|
||||
- A prompt or compact confirmation timeout preserves target run permit, process ownership and Main background lease until authoritative success, failure, exit or abort converges exactly once. Page hiding cannot stop an active or uncertain run. Pi `0.84.2` manual compact may terminalize through its correlated RPC result because it does not emit `agent_settled`.
|
||||
- A new unresolved Conversation validates and persists its resolved model before first worker prepare. Same-account model changes may use target `set_model`; cross-account changes rebuild only the target worker after an active run settles.
|
||||
- Provider secrets enter only the selected worker environment. The deterministic Works missing user-context response expires the cached gateway credential, fails without replay and projects as a fixed Provider-auth error; it is not a Pi crash.
|
||||
- Back up v1 metadata and old OpenCode sessions during migration but do not continue them. Remove only exact generated legacy Agent files; preserve unknown or modified files in the migration backup and leave unrelated `.opencode` content alone.
|
||||
- A new unresolved Conversation validates and persists its resolved model before first logical-thread prepare. Same-account model changes may use target `set_model`; cross-account changes rebuild only the target logical thread after an active run settles.
|
||||
- Parent Provider secrets enter only the selected logical thread's in-memory credential store; independently spawned child credentials remain scoped to that child process. Secrets never enter argv, catalogs, Renderer state or sibling threads. The deterministic Works missing user-context response expires the cached gateway credential, fails without replay and projects as a fixed Provider-auth error; it is not a Pi crash.
|
||||
- `.makelore/project.json` and `.makelore/conversations.json` are the only project-owned Coding configuration stores. Do not read, migrate or delete project metadata from `.niancode` or `.opencode`; legacy content remains inert and user-owned.
|
||||
|
||||
## Consequences
|
||||
|
||||
- Makelore Code has one runtime architecture and one product contract instead of a long-lived compatibility seam.
|
||||
- A single Conversation can recover or rebuild without invalidating siblings, while process and write budgets provide bounded real concurrency.
|
||||
- A target logical thread can normally recover or rebuild without invalidating siblings. A whole Agent Server exit is deliberately process-wide: all old parent channels fail closed together, then one replacement Server is created on demand while Conversation generations still prevent stale events from returning.
|
||||
- Parent process startup and Pi module loading are amortized across Conversation threads, while logical-turn, child-process and write budgets preserve bounded concurrency.
|
||||
- Installed-package regressions must be verified against the final `app.asar` and `resources/pi-runtime`, not only workspace tests.
|
||||
- Provider-shaped loopback proves serialization and local isolation only. The user explicitly waived real Provider account testing and accepted authentication, endpoint/proxy/rate-limit, protocol variation, real concurrency and credential-isolation risk; `realTurnVerified=false` must remain visible and is not Pass.
|
||||
- Windows x64 final-package evidence is available. macOS x64/arm64 and native non-WSL Linux desktop/compositor remain release evidence gaps, so the product is not yet cross-platform release-ready.
|
||||
@@ -39,6 +42,9 @@ The former OpenCode integration coupled Renderer state, a shared runtime lifecyc
|
||||
- Release proof and resilience chain: `a795e0c` through `9f05e2d`
|
||||
- Provider-context correction implementation: `a098266`
|
||||
- Integrated delivery: `48a9189`
|
||||
- Local shared-Agent-Server source snapshot: `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1`
|
||||
- Upstream integration base: `62304dc85b3c1069cd656dfacb61ee820e216fa2`
|
||||
- Integration task: `20260831-merge-upstream-main-7c3a91f2`
|
||||
- Runtime release runbook: `docs/pi-runtime-release-runbook.md`
|
||||
|
||||
## Related
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
| ADR-003 | Robot 配网页内扫描并连接 Windows/macOS 热点 | Accepted / implemented with physical release gates pending | 2026-08-16 | Robot Renderer、Host API、Electron Main、Windows WLAN、macOS CoreWLAN/CoreLocation | `adr-003-robot-in-app-hotspot-connection.md` |
|
||||
| ADR-004 | Works Square 统一拥有桌面认证生命周期边界 | Accepted / implemented | 2026-08-19 | Renderer、Host API、Electron Main、Works Square auth facade | `adr-004-square-auth-lifecycle-boundary.md` |
|
||||
| ADR-005 | Learning 采用运营精选项目目录、直接渲染经校验的 HTTPS README 图片、下载不做大小校验并退役课程运行时 | Accepted / implemented, amended 2026-08-20 | 2026-08-20 | Learning Renderer、Host API、Electron Main、Works Square operations/API | `adr-005-learning-project-catalog.md` |
|
||||
| ADR-006 | Makelore Code 以 Pi `0.84.2` 为唯一 runtime，Main 独占 worker/session/provider/lease，产品只暴露 Snapshot/Patch 合同 | Accepted / implemented | 2026-08-26 | Code Renderer、Host API、Electron Main、Pi runtime、Provider/resource、packaging | `adr-006-pi-runtime-hard-cutover.md` |
|
||||
| ADR-006 | Makelore Code 以 Pi `0.84.2` 为唯一 runtime，父 Conversation 复用一个 Main-owned Agent Server 并隔离逻辑 Runtime/Session/provider/lease，产品只暴露 Snapshot/Patch 合同 | Accepted / implemented, amended 2026-08-31 | 2026-08-26 | Code Renderer、Host API、Electron Main、Pi runtime、Provider/resource、packaging | `adr-006-pi-runtime-hard-cutover.md` |
|
||||
|
||||
## Superseded Decisions
|
||||
|
||||
|
||||
@@ -15,12 +15,12 @@
|
||||
| 提交绑定 | 云端成功上传响应 | Main → submission binding v2 | 只持久化成功的 app/version/review/hash；落盘失败返回固定告警但不反转提交 |
|
||||
| 运营发布 | Works Square 审核与交付 | 公共 `play_url` | 客户端只消费服务端发布结果；真实合同校验 → OSS/CDN 生产链仍待整链验收 |
|
||||
| 可信发布门禁 | source+built+artifact contract | 服务端逐字节重算/合同校验 → 不可变 Release 固化 → 人工审核 | 服务端不运行项目 Vite；仍是不可绕过权威，未来 runtime 强门禁需可信 verifier |
|
||||
| AI 编程 Conversation 创建与准备 | 当前 project / Agent / 本地 Conversation | Renderer 本地创建 → `/api/coding/*` → Main schema-v2 store → target Pi worker/session lazy prepare | Composer 与 worker 准备解耦；首次 Conversation 可立即编辑。未解析模型必须先验证并持久化，再打开首个 worker；旧 OpenCode 会话只备份，不继续运行 |
|
||||
| AI 编程 prompt 与流式投影 | 当前 Conversation draft / attachment refs | Renderer mutation → Host `202` acceptance/dedupe → Main target worker → Pi events → Snapshot + `patch-batch` SSE → Renderer reducer | 每个 Conversation 独立 generation/seq；gap 只恢复目标 Conversation。accepted/uncertain mutation 不自动重放，权威 Snapshot 到达前保留相同 optimistic node identity |
|
||||
| AI 编程模型与思考强度切换 | 当前 Conversation | Renderer → `/api/coding/conversations/{id}` → Main validate/persist → target runtime | 同账号已解析模型复用 `set_model`；跨账号模型等 active run settled 后只重建目标 worker，旧凭据不会进入新 generation；切换失败不销毁可继续使用的旧 worker |
|
||||
| AI 编程 Conversation 创建与准备 | 当前 project / Agent / 本地 Conversation | Renderer 本地创建 → `/api/coding/*` → Main `.makelore` schema-v2 store → shared Agent Server 内 target logical Runtime/Session lazy prepare | Composer 与逻辑线程准备解耦；首次 Conversation 可立即编辑。未解析模型必须先验证并持久化，再打开首个逻辑线程；`.niancode` / `.opencode` 项目元数据不读取、不迁移 |
|
||||
| AI 编程 prompt 与流式投影 | 当前 Conversation draft / attachment refs | Renderer mutation → Host `202` acceptance/dedupe → Main target Agent Server channel → Pi events → Snapshot + `patch-batch` SSE → Renderer reducer | 每个 Conversation 独立 Runtime/Session/credential/extension context/generation/seq；gap 只恢复目标 Conversation。accepted/uncertain mutation 不自动重放，权威 Snapshot 到达前保留相同 optimistic node identity |
|
||||
| AI 编程模型与思考强度切换 | 当前 Conversation | Renderer → `/api/coding/conversations/{id}` → Main validate/persist → target logical Runtime | 同账号已解析模型复用 `set_model`；跨账号模型等 active run settled 后只重建目标逻辑线程，旧凭据不会进入新 generation；切换失败不销毁可继续使用的旧线程 |
|
||||
| AI 编程上下文压缩 | Renderer compact action / Pi compaction events | correlated compact RPC → target projector → Snapshot/Patch timeline | Pi `0.84.2` 的手动 compact 不发 `agent_settled`；RPC success 或权威 compaction failure 终结 compact 并 exactly-once 释放对应 ownership，不提前结算普通 prompt |
|
||||
| AI 编程 Provider 错误 | Pi worker Provider 请求 | selected worker env → Main AI proxy → Works 模型上游 → projector safe error | 确定性的 Works user-context 缺失使缓存 gateway credential 过期、返回非重试认证失败且不重放请求；Renderer 只看到固定 Provider-auth 提示，不能把它解释为 Pi 崩溃 |
|
||||
| AI 编程子 Agent | parent `subagent.v1` tool call | explicit extension → authenticated Main bridge → scheduler → ephemeral Pi child | child 并发最多 4、单次最多 8、禁止递归；父子共享总进程预算 8，coding child 与 parent 共用项目 write lease，父 abort/crash/generation 失效必须清理 child 与 permit |
|
||||
| AI 编程 Provider 错误 | Pi logical-thread Provider 请求 | selected thread-local credential store → Main AI proxy → Works 模型上游 → projector safe error | 确定性的 Works user-context 缺失使缓存 gateway credential 过期、返回非重试认证失败且不重放请求；Renderer 只看到固定 Provider-auth 提示，不能把它解释为 Pi 崩溃 |
|
||||
| AI 编程子 Agent | parent logical thread `subagent.v1` tool call | explicit extension → authenticated Main bridge → scheduler → independent ephemeral Pi child process | child 并发最多 4、单次最多 8、禁止递归；child 使用 FIFO 进程预算 8，shared parent 逻辑线程不各占一个 process lease；coding child 与 parent 共用项目 write lease，父 abort/crash/generation 失效必须清理 child 与 permit |
|
||||
| 客户端更新检查 | 设置页 | Renderer update store → IPC → Main AppUpdater → 目标 feed | Main 记录并重抛原始错误；Renderer 只显示去重、脱敏的单条提示，稳定源缺包不伪装为最新版 |
|
||||
| Design Workspace load | Canvas/Sidebar | Renderer Host API → Main-owned Works Square V2 adapter → current Workspace/Direction/Living Form projection | 一个 Workspace 公开一个 current Direction 与 persistent Agent Session；conversation timeline 是交互历史，不是独立 authority object |
|
||||
| Design input and reconciliation | Chat/direct edit/decision/proposal/lock/Asset binding/restore | Renderer draft → Main → `design.input.apply` → canonical Direction projection | 全部进入同一 reducer；accepted 前 draft 保持本地，revision conflict 刷新权威投影，unknown result 复用原 command/operation identity |
|
||||
@@ -37,7 +37,7 @@
|
||||
## State Ownership
|
||||
|
||||
- Main 持有刷新凭据、发布 Token、固定 npm runtime、源码/构建归档、临时目录、幂等键和 submission binding v2；Renderer 不持有归档路径、构建 origin 或自动部署状态。
|
||||
- 项目内 `.niancode/project.json` 保存 `ProjectType`；Main 在配置写入和目录复用时保持其不可变，并在打包时重新读取校验。
|
||||
- 项目内 `.makelore/project.json` 是 `ProjectType`、Agent 与 Coding 项目配置的唯一权威；Main 在配置写入和目录复用时保持 `ProjectType` 不可变，并在打包时重新读取校验。
|
||||
- Renderer 仅持有短效公开会话状态和提交展示状态。
|
||||
- Renderer 可持久化当前账号的四布尔模块入口策略，但不持有原始 Works profile 或 Token。新账号不继承上一账号缓存；网络/暂时上游失败可保留同会话已知策略，终止性 `401` 不得回退到默认开启。
|
||||
- 本地构建临时目录、HTTP origin 和预检 WebContents/partition 只属于一次调用；预检读取与 `built_archive` 相同的内存字节，但结果不写为可信上传 receipt，也不覆盖生产 opaque-origin。
|
||||
@@ -49,13 +49,13 @@
|
||||
- 图生图参考图与视频首帧都先归一为当前 Workspace Asset，再通过 typed binding 写入 Specification；本地路径不会进入 canonical contract。
|
||||
- Development 与 packaged Canvas 都使用 Main-owned Works Square V2 adapter。V1 DTO/local semantic adapter 与 local/cloud mode switches 已删除，不存在失败回退。
|
||||
- 注销和退出关闭本地 event stream、清除 drafts/pending state 和凭据；服务端 current Direction Session 与 semantic history 保持持久化。
|
||||
- project、Agent、Conversation schema v2 与每条 Conversation 的 opaque Pi session binding 由 Main 原子持久化。旧 v1 先做时间戳备份再迁移；旧 OpenCode Session 不进入新 runtime，也不删除无关 `.opencode` 内容。
|
||||
- project、Agent、Conversation schema v2 与每条 Conversation 的 opaque Pi session binding 由 Main 在 `.makelore/project.json` 和 `.makelore/conversations.json` 原子持久化。当前客户端不读取、迁移或删除 `.niancode` / `.opencode` 项目元数据。
|
||||
- Renderer Store 只拥有产品中立 Snapshot、Patch、optimistic request 与 project-scoped metadata。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect 只为目标 Conversation 取 Snapshot 并重放严格连续的缓冲 tail，不重放 mutation。
|
||||
- Main 为每条 active/warm Conversation 持有一个 persistent Pi worker/session、Provider/resource revision 和 selected-account secret env。运行中 stale revision 保留本 run snapshot，settled 后重建；其他 Conversation 不受影响。
|
||||
- top-level worker 并发上限 4、warm idle LRU 上限 4、child 并发上限 4，parent/child 共用 FIFO process budget 8。同项目 coding mutation 共用 write lease；read-only child 可旁路写锁。
|
||||
- Main 以一个长驻 Agent Server 承载每条 active/warm Conversation 的隔离 Pi Runtime/Session/channel、Provider/resource revision 和 thread-local credential store。运行中 stale revision 保留本 run snapshot，settled 后只重建目标逻辑线程；整个 Server 退出则使所有旧 channel 失效，下次恢复只启动一个新 Server。
|
||||
- top-level 逻辑 turn 并发上限 4、warm idle logical-thread LRU 上限 8、child 并发上限 4，child 使用 FIFO process budget 8；shared parent 线程不各占一个 process lease。同项目 coding mutation 共用 write lease；read-only child 可旁路写锁。
|
||||
- prompt/compact 的 RPC confirmation timeout 只进入 uncertain，不能释放 run permit、process ownership 或 Main background lease。迟到 success/failure/exit/abort 必须单调且 exactly-once 收敛；隐藏页面超过 grace 也不得停止 active/uncertain run。
|
||||
- AI 编程压缩状态属于目标 Conversation Snapshot。Pi `0.84.2` 手动 compact 的 correlated RPC success 可代替缺失的 `agent_settled` 终结 compact；普通 prompt 仍只由权威 terminal/settled 结束。
|
||||
- Main Host AI proxy 持有凭据刷新和错误分类。确定性 Works user-context 缺失必须失效缓存 credential 并 fail fast；真实认证、endpoint/proxy/rate-limit、Provider variation、真实并发与跨 worker 凭据隔离仍是用户明确接受但未验证的风险。
|
||||
- Main Host AI proxy 持有凭据刷新和错误分类。确定性 Works user-context 缺失必须失效缓存 credential 并 fail fast；真实认证、endpoint/proxy/rate-limit、Provider variation、真实并发与共享 Agent Server 内的跨线程凭据隔离仍是用户明确接受但未验证的风险。
|
||||
- Main AppUpdater 持有 feed、原始异常、下载和安装状态；设置页只消费状态投影。一次 electron-updater `error` 事件覆盖的并发检查不会在 Renderer 重复发错，但独立的后续检查仍有自己的报告生命周期。
|
||||
- Robot V1 引导状态只在 Renderer 当前进程内保存，不持久化 Wi-Fi 凭据、activation code 或 Binding operation ID。相同进程内的模糊 Binding 重试复用 operation ID；无效码或重启后必须取得新码并使用新 operation ID。
|
||||
- Robot Hotspot Module 只在 Main 内保存最近一次扫描的短效、不透明候选快照。新的扫描、clear、60 秒过期或进程重启使旧 candidate ID 失效；Renderer 关闭/重开向导以 generation 防止旧扫描/连接结果回写。
|
||||
@@ -75,4 +75,4 @@
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-08-30
|
||||
2026-08-31
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|---|---|---|
|
||||
| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, compatibility checks, canonical archive validation, and Ed25519 trust | Schema 1 bundled compatibility and schema 2 `skill_only`/declarative `platform_hosted` are parsed fail closed. The production trust store accepts no Marketplace package until the official public key is built in. |
|
||||
| `electron/coding-plugins/account-plugin-cache.ts`, `marketplace-client.ts`, and `package-store.ts` | Main-owned Account Library cache, authenticated server client, and atomic immutable device installation store | Account acquisition and device installation are separate. Package bytes switch atomically only after descriptor, signature, archive, client-range, and provenance checks; failed updates preserve the prior current release. |
|
||||
| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent-worker runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent worker; child workers remain empty and active workers retain frozen bytes until disposal. |
|
||||
| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent logical thread; child workers remain empty and active threads retain frozen bytes until disposal. |
|
||||
| `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, and `src/pages/ProjectPlugins/` | Bounded Main routes and Renderer projections for catalog, Library, device, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, or signed download URL. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. |
|
||||
| `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 |
|
||||
| `src/lib/works-square.ts` | Renderer 侧 Works Square Host API 契约与安全错误映射 | 不接触 Token、ZIP、本地绝对路径或自动部署状态 |
|
||||
@@ -23,9 +23,9 @@
|
||||
| `src/stores/coding-conversations.ts` / `coding-workspace.ts` | per-Conversation Snapshot/Patch、乐观提交、gap recovery 与项目级元数据 | generation/seq 严格递增；只恢复目标 Conversation，SSE 重连不重放 mutation |
|
||||
| `shared/coding-conversation-*.ts` / `coding-project-contracts.ts` | Main/Renderer 共用的产品中立 Conversation、project tool、subagent 与 reducer 合同 | 这是唯一公共实现；Pi 事件、RPC 与 Provider 形状保持 Main-private |
|
||||
| `electron/api/coding-composition.ts` / `electron/api/routes/coding-*.ts` | 唯一 Main-owned Coding composition 与 `/api/coding/*` Host API | 管理 project/Agent/Conversation、SSE、附件、文件、命令、交互和安全诊断；mutation 返回 202 acceptance 且按 request id 去重 |
|
||||
| `electron/coding-projects/` | schema-v2 项目/Agent/Conversation 数据、原子持久化、旧 v1 备份迁移与项目文件能力 | 旧 OpenCode 会话只备份不续写；modified/unknown legacy Agent 文件先备份，valid v2 不读取旧 runtime 数据 |
|
||||
| `electron/coding-projects/` | `.makelore/project.json` 与 `.makelore/conversations.json` schema-v2 项目/Agent/Conversation 数据、原子持久化与项目文件能力 | 不读取或迁移 `.niancode` / `.opencode` 项目元数据；legacy 内容保持 inert 且不删除 |
|
||||
| `electron/coding-runtime/conversation-service.ts` | 产品级 Conversation orchestration、模型/思考强度、fork/archive/recover 与运行时门禁 | unresolved Conversation 先验证并持久化模型再首次 prepare；已解析 Conversation 的模型切换复用 target runtime seam |
|
||||
| `electron/coding-runtime/pi/{worker-pool,worker-process,rpc-client,session-registry,event-projector}.ts` | 一 Conversation 一 persistent Pi worker/session、严格 LF JSONL RPC、generation recovery 与 Snapshot/Patch 投影 | top-level cap 4、共享总进程预算 8、warm idle LRU 4；worker 替换只使目标 generation 失效 |
|
||||
| `electron/coding-runtime/pi/{agent-server-process,worker-pool,worker-process,rpc-client,session-registry,event-projector}.ts` / `resources/pi-agent-server.mjs` | 一个长驻父 Agent Server 内的 per-Conversation 逻辑 Runtime/Session/channel、严格 LF JSONL RPC、generation recovery 与 Snapshot/Patch 投影 | top-level logical-turn cap 4、warm idle LRU 8；线程级替换只使目标 generation 失效，Server 退出使所有旧 channel 失效并在下次恢复时只重启一个 Server |
|
||||
| `electron/coding-runtime/pi/{provider-config,provider-refresh,resource-loader}.ts` / `electron/api/routes/ai-proxy.ts` | Main-owned Provider catalog、secret/env 投影、资源 revision、一次凭据刷新与上游错误分类 | secret 不进入 argv/catalog/Renderer；确定性的 Works user-context 缺失使缓存凭据过期并 fail fast，不自动重放 mutation |
|
||||
| `electron/coding-runtime/pi/{extension-host,subagent,write-lease}.ts` / `electron/main/background-lifecycle.ts` | 唯一显式 Makelore extension、交互、子 Agent、同项目写租约与后台运行租约 | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或确认超时被回收，所有 stop/replacement 必须有原因 |
|
||||
| `electron/main/updater.ts` | 目标 feed 解析、electron-updater 生命周期与原始诊断 | 缺少稳定 manifest 保持错误；事件/Promise 重复失败按检查实例去重 |
|
||||
@@ -53,7 +53,7 @@
|
||||
## Dependency Direction
|
||||
|
||||
- Renderer UI → Renderer API contract → Main Host routes → Main services → Works Square；Renderer 不反向读取 Main 凭据、文件系统或归档。
|
||||
- AI 编程 Renderer product Snapshot/commands → typed `/api/coding/*` Host API → Main Coding composition → target `CodingConversationRuntime` → persistent Pi worker；Pi Provider 请求再经 Main AI proxy 访问模型上游。Renderer 不持有 Pi wire、凭据或本地 runtime URL。
|
||||
- AI 编程 Renderer product Snapshot/commands → typed `/api/coding/*` Host API → Main Coding composition → target `CodingConversationRuntime` → shared Agent Server 内的目标 Pi 逻辑线程；Pi Provider 请求再经 Main AI proxy 访问模型上游。Renderer 不持有 Pi wire、凭据或本地 runtime URL。
|
||||
- Project configuration 决定产品分流；Main release builder 生成 source/built/contract，服务端独立重算和校验决定发布安全，本地 `ProjectType` 不是授权结论。
|
||||
- Built artifact preflight 检查最终上传的同字节快照，但客户端可被绕过且不产生可信 receipt；服务端仍是合同、摘要和不可变 Release 安全权威。
|
||||
- Robot Renderer → typed AI hardware API → Main Host route → Robot Hotspot Module → Windows/macOS Adapter。云端 Binding 仍由 Main 代理；热点选择/连接移入页面，但家庭 Wi-Fi 凭据输入仍只留在固件 Portal，系统 Wi-Fi 保留为兜底。
|
||||
@@ -69,8 +69,8 @@
|
||||
- `runtime_url` 是一个客户端版本的迁移回退；删除前必须确认服务端和存量数据稳定提供 `play_url`。
|
||||
- Pi RPC confirmation timeout is an uncertainty boundary, not permission to release run/process/background ownership. Late success/failure/exit/abort must converge monotonically and exactly once; no accepted or uncertain mutation may be replayed automatically.
|
||||
- Pi manual compaction in locked `0.84.2` does not emit `agent_settled`; correlated compact RPC success or an authoritative compaction failure must terminalize the compact operation without prematurely settling an ordinary prompt.
|
||||
- Parent and child workers share one FIFO process budget of 8. Child reservation may reclaim ready/idle or queued parent capacity without losing FIFO order, session binding, or generation ownership; stop/reclaim failure must release leases in `finally`.
|
||||
- Provider/resource revisions apply before the next prompt for idle workers and after `agent_settled` for active runs. Same-account model changes may use `set_model`; cross-account changes rebuild only the target Conversation so old credentials never enter the new worker.
|
||||
- Shared parent logical threads do not consume one process lease each. Independent child Agents remain capped at 4 against the FIFO process budget of 8; stop failure must release child leases in `finally`.
|
||||
- Provider/resource revisions apply before the next prompt for idle logical threads and after `agent_settled` for active runs. Same-account model changes may use `set_model`; cross-account changes rebuild only the target Conversation thread so old credentials never enter the new credential store.
|
||||
- `electron/main/updater.ts` 的稳定源错误归一化必须保持窄化：只识别 Works Square 对应 manifest 的 404，不得吞掉其他 feed/网络/签名错误；Renderer 的脱敏边界不能取代 Main 原始日志。
|
||||
- Design V2 事件处理必须区分 Direction projection 与 Workspace Task/Asset projection；不得用 transport sequence 或 Task progress 推进 Specification revision。
|
||||
- 输入、Quote request、confirmation 和项目切换跨 Renderer/Main/Works Square。异步结果必须核对 Workspace、Direction、revision 与 operation identity；unknown write 复用原 identity，不能生成新业务意图。
|
||||
@@ -83,4 +83,4 @@
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-08-30
|
||||
2026-08-31
|
||||
|
||||
@@ -20,8 +20,8 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
| App Updater | Main 选择平台/架构 feed、驱动 electron-updater 并记录原始诊断 | Renderer 只接收状态和脱敏后的单条用户提示；稳定源缺包保持错误 |
|
||||
| Makelore Code Workspace | project/Agent/Conversation schema v2、产品中立 Snapshot/Patch、Composer 与时间线 | Conversation 本地创建且不等待 worker；旧 OpenCode 会话备份后不再继续，Renderer 不导入 Pi RPC/event 类型 |
|
||||
| Coding Host API & Composition | 唯一 `/api/coding/*` composition、202 acceptance/dedupe、SSE、附件/文件/交互/诊断 | Electron Main 拥有 project/Conversation 服务、选中目标、认证和错误脱敏；SSE 公开面只有 Snapshot 与 `patch-batch` |
|
||||
| Pi Conversation Runtime | 每条 active/warm Conversation 一个 persistent Pi `0.84.2` worker/session | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 并发 4、warm idle LRU 4、总进程预算 8 |
|
||||
| Pi Provider & Managed Resources | Provider catalog、secret/env 投影、model/resource revision、Prompt/Skill/extension materialization | 凭据只进入选中 worker env；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 放进 argv、catalog 或 Renderer |
|
||||
| Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
|
||||
| Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 放进 argv、catalog 或 Renderer |
|
||||
| Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
|
||||
| AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | Living Form 是服务端 Current Specification 的投影；Renderer 只持有草稿和已接受投影 |
|
||||
| AI Design Input & Reconciliation | Chat、字段/集合编辑、decision、proposal、lock、Asset binding 与 restore | 全部进入同一 `design.input.apply` reducer；稳定 command/operation ID 支持 unknown-result 重放，revision conflict 刷新权威状态 |
|
||||
@@ -55,7 +55,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
- Makelore Code 的唯一 production runtime 是精确 pin 的 Pi `0.84.2`；不得恢复 OpenCode fallback、双 runtime、兼容执行路径或 Renderer 直连本地 runtime。上游 `@earendil-works/pi-ai` 内名称含 `opencode` 的静态 Provider adapter 不属于产品旧 runtime。
|
||||
- Renderer 只消费共享的产品中立 project/Conversation/Snapshot/Patch DTO，并经 `src/lib/host-api.ts` 或 `src/lib/api-client.ts` 访问 Main。Pi RPC、event、Provider credential 和本地 runtime 路径保持 Main-private。
|
||||
- accepted/uncertain Coding mutation 不得自动重放；RPC confirmation timeout 后仍保留 target run permit、process ownership 和 background lease，直到迟到 success/failure/exit/abort 权威收敛。其他 Conversation 必须继续可用。
|
||||
- selected Provider credential 只投影到目标 worker env；跨账号模型变化必须重建目标 worker。确定性 Works user-context 缺失是 Provider-auth failure：失效缓存 credential、fail fast、固定脱敏提示，不得归类为 Pi worker crash。
|
||||
- selected Provider credential 只投影到目标父逻辑线程的内存 credential store 或目标 child 进程；跨账号模型变化必须重建目标逻辑线程。确定性 Works user-context 缺失是 Provider-auth failure：失效缓存 credential、fail fast、固定脱敏提示，不得归类为 Pi crash。
|
||||
- Guided Hotspot Binding is implemented behind a Main-owned capability that is true by default; exact `NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0` disables it, while capability-read failure falls back to direct six-digit Binding. The guided state is process-local, opener failures expose only the same fixed address for manual copy, and Binding conflicts refresh the safe account overview.
|
||||
- Robot hotspot scanning and connection are local Main operations that return before Works credentials/upstream access. Renderer may submit only an opaque candidate ID from the latest bounded scan; Main alone filters open printable `Xiaozhi-*` SSIDs, performs platform association, and verifies the exact current SSID.
|
||||
- Hotspot discovery and connection do not authenticate a Robot. BSSID, interface/profile details, native diagnostics, location data, and Wi-Fi credentials never cross the Main boundary; permission or platform failure keeps the system-settings/manual path available.
|
||||
@@ -91,4 +91,4 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-08-30
|
||||
2026-08-31
|
||||
|
||||
@@ -4,6 +4,18 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
|
||||
|
||||
## Integrated Through
|
||||
|
||||
- Local source snapshot `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1`,
|
||||
based on the prior local delivery `48a9189`, is integrated over fetched upstream
|
||||
`62304dc85b3c1069cd656dfacb61ee820e216fa2` in merge commit
|
||||
`28897cd4a2b7179d9ccb444218a1d74a2bbc004b` by task
|
||||
`20260831-merge-upstream-main-7c3a91f2`. The integration preserves Plugin
|
||||
Marketplace Release A and AI Design Living Form V2 while adopting one long-lived
|
||||
parent Pi Agent Server with isolated per-Conversation logical Runtime, Session,
|
||||
credential store, extension context, generation and JSONL channel. Parent logical
|
||||
turns remain capped at 4, warm idle threads at 8, and independent child processes
|
||||
at 4 against the FIFO process budget of 8. `.makelore/project.json` and
|
||||
`.makelore/conversations.json` are authoritative; current code does not read or
|
||||
migrate project metadata from `.niancode` or `.opencode`.
|
||||
- MakeLore curated Plugin Marketplace Release A source
|
||||
`40df677a31ff7651f962151eb84b925987781c03` from task
|
||||
`20260828-plugin-marketplace-client-5f8b3d72` is integrated by task
|
||||
@@ -38,13 +50,15 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
|
||||
`20260826-integrate-pi-provider-fix-6e4c2a91`. The strict 101-commit
|
||||
fast-forward replaces OpenCode with pinned Pi `0.84.2` as Makelore Code's
|
||||
sole production runtime, adds schema-v2 project/Agent/Conversation storage,
|
||||
persistent per-Conversation workers, product Snapshot/Patch contracts,
|
||||
the predecessor persistent per-Conversation worker topology, product Snapshot/Patch contracts,
|
||||
`/api/coding/*`, Provider/resource isolation, extension/subagents, process
|
||||
and write budgets, and background-run uncertainty ownership. Implementation
|
||||
`a098266` additionally validates/persists an unresolved Conversation model
|
||||
before first prepare and converts the exact Works missing user-context
|
||||
response into a non-replayed Provider-auth failure after expiring the cached
|
||||
gateway credential. The final Windows installer and final packaged Pi proof
|
||||
gateway credential. Task `20260831-merge-upstream-main-7c3a91f2` supersedes
|
||||
only that parent-process topology with the shared Agent Server described above.
|
||||
The final Windows installer and final packaged Pi proof
|
||||
passed; real Provider turns remain explicitly waived with
|
||||
`realTurnVerified=false`, while macOS x64/arm64 and native non-WSL Linux
|
||||
remain unverified. Older OpenCode entries below are retained only as
|
||||
@@ -176,7 +190,7 @@ Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/ap
|
||||
|
||||
AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
|
||||
|
||||
AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 采用本地 schema v2；旧 OpenCode 会话只做备份，不继续执行。每条 active/warm Conversation 拥有独立 persistent worker/session、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标 worker。top-level/child 并发分别为 4，共享总进程预算 8，warm idle LRU 4；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。Provider credential 只进入选中 worker env；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi worker crash。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
|
||||
AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。
|
||||
|
||||
Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。
|
||||
|
||||
@@ -184,6 +198,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
|
||||
|
||||
## Recently Completed
|
||||
|
||||
- 2026-08-31: Integrated the occupied local source snapshot over upstream Marketplace Release A and AI Design Living Form V2. Makelore Code now amortizes parent Pi startup through one long-lived Agent Server while preserving isolated per-Conversation logical runtimes, sessions, credentials, extensions and channels; child Agents remain independent processes. ADR-006 and current architecture now use `.makelore` as the sole project configuration source and explicitly reject legacy metadata reads or migration.
|
||||
- 2026-08-26: Fast-forwarded the complete Pi hard-cutover and installed-package resilience chain into local `main`, including per-Conversation workers/Snapshot projection, extension/subagents, bounded process/write/background ownership and the deterministic Works user-context Provider-auth correction. The final Windows installer, packaged Pi runtime, extension/child, 4+4 pressure, uncertainty/late-settle and zero-lingering-process proofs passed. Real Provider turns are explicitly waived rather than passed; macOS and native non-WSL Linux remain release evidence gaps.
|
||||
- 2026-08-20: Replaced AI Learning's course generation/player stack with the curated project catalog defined by ADR-005. The authenticated/module-gated client now renders project cards and safe README detail, loads validated credential-free HTTPS Markdown images directly, and saves verified ZIP archives through the native dialog. Old course/runtime/player packaging was removed; server/client regressions and full suites passed, while production deployment and real-account package smoke remain pending.
|
||||
- 2026-08-19: Integrated native password/SMS login, the temporary HTTP/2-disabled diagnostic bootstrap, and the AI Design freeze fix. Workspace JSON calls and shared token refresh now settle within 30 seconds, transport abort is paired with deterministic rejection, and implicit Electron-to-Node fallback no longer replays mutation requests. Installed-client Quote retry/confirm smoke and the final HTTP/2 policy decision remain pending.
|
||||
@@ -251,11 +266,11 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
|
||||
- 客户端对最终构建字节的 loopback 检查没有可信 receipt，且不复刻生产 opaque-origin；服务端必须独立重算 source/built/contract、校验不可变 Release，人工审核仍不可绕过。如未来需要不可绕过的 runtime gate，必须引入可信 verifier 并绑定精确构建产物。
|
||||
- Pi RPC confirmation timeout 是不确定性边界，不是释放 run permit、process ownership 或 Main background lease 的依据；accepted/uncertain mutation 不得自动重放，迟到 terminal 必须 exactly-once 收敛。隐藏/显示、abort、recover、replacement 与 app quit 都必须保留可解释 reason 并最终清零 ownership。
|
||||
- Pi `0.84.2` 手动 compact 不发 `agent_settled`。只有 correlated compact RPC success 或权威 compaction failure 可以结束 compact；普通 prompt 仍需自己的 terminal/settled 语义，不能相互释放 lease。
|
||||
- 本地 provider-shaped loopback 和 4+4 process proof 证明客户端序列化、调度与隔离 seam，不证明真实 Provider 会并发、不会限流或正确隔离账号凭据。真实认证、endpoint/proxy/rate-limit、协议和图片差异仍为 `Explicitly Waived / Accepted Risk`，`realTurnVerified=false`。
|
||||
- Provider/resource freshness 属于目标 Conversation worker generation。idle stale 在下一 prompt 前重建，running stale 在 settled 后重建；同账号 refresh single-flight 且最多一次 reopen。确定性 Works user-context 缺失必须失效缓存凭据并 fail fast，不能触发无限 Pi 重试、自动 replay 或把 Provider 故障写成 runtime crash。
|
||||
- 本地 provider-shaped loopback 和单一 Agent Server 内 4 条重叠父逻辑线程 + 4 child process proof 证明客户端序列化、调度与隔离 seam，不证明真实 Provider 会并发、不会限流或正确隔离账号凭据。真实认证、endpoint/proxy/rate-limit、协议和图片差异仍为 `Explicitly Waived / Accepted Risk`，`realTurnVerified=false`。
|
||||
- Provider/resource freshness 属于目标 Conversation logical-thread generation。idle stale 在下一 prompt 前重建，running stale 在 settled 后重建；同账号 refresh single-flight 且最多一次 reopen。确定性 Works user-context 缺失必须失效缓存凭据并 fail fast，不能触发无限 Pi 重试、自动 replay 或把 Provider 故障写成 runtime crash。
|
||||
- AI Design 图片/视频引用必须以 typed Asset binding 写入 Specification，不能从本地化 quick reply、V1 Brief 或本地路径推断 action/purpose。
|
||||
- Updater 源码错误提示不能代替发布正式签名产物；稳定 feed 缺 manifest 必须保持失败，Renderer 不得展示原始堆栈、URL、路径或错误码。升级链只有在旧版本完成发现、下载、重启和安装 smoke 后才可视为生产就绪。
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-08-30
|
||||
2026-08-31
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
# Task: Merge upstream updates into main
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260831-merge-upstream-main-7c3a91f2
|
||||
- Mode: Integration
|
||||
- Branch: codex/20260831-merge-upstream-main-7c3a91f2-merge-upstream-main
|
||||
- Worktree: /Users/inmanx/Documents/makelore-merge-upstream-main-7c3a91f2
|
||||
- Base commit: 62304dc85b3c1069cd656dfacb61ee820e216fa2
|
||||
- Owner: codex
|
||||
- Status: Completed
|
||||
|
||||
## Scope
|
||||
|
||||
- Integrate the occupied local `main` worktree's tracked source changes and intentional source/test additions, based on `48a9189`, onto fetched `origin/main` at `62304dc`.
|
||||
- Preserve the upstream Plugin Marketplace Release A and AI Design Living Form V2 integrations while resolving overlapping local Code, auth, navigation, Canvas utility, project-data, and documentation changes semantically.
|
||||
- Exclude the untracked generated `resources/learning-player/` artifact from Git without deleting it locally.
|
||||
- Promote the verified integration result to the local `main` branch; do not push to the remote.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Capture the dirty source work as a non-destructive snapshot commit before attempting a three-way merge.
|
||||
- Do not overwrite the tree with either side wholesale. Preserve Main-owned runtime, authentication, project-data, cloud Canvas, Marketplace trust, and packaging boundaries.
|
||||
- Treat the user's explicit instruction to merge the local changes into `main` as confirmation to adopt the local single-Agent-Server parent-process topology and reconcile ADR-006/current architecture accordingly.
|
||||
- Keep source task records read-only. Record integration decisions and verification only in this integration task record and canonical Integration-Gate documents.
|
||||
- Do not commit dependencies, downloaded runtimes, generated build output, reports, caches, secrets, or local user data.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Captured the occupied local source tree without mutating it as commit
|
||||
`33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1` on
|
||||
`codex/local-main-snapshot-20260831-7c3a91f2`. The generated 93 MiB
|
||||
`resources/learning-player/` directory was deliberately excluded from Git and
|
||||
remains in the original worktree.
|
||||
- Merged that snapshot into upstream `62304dc85b3c1069cd656dfacb61ee820e216fa2`
|
||||
with semantic conflict resolution. Plugin Marketplace Release A, Data Service,
|
||||
AI Design Living Form V2, cloud-only Canvas, project identity, module access,
|
||||
local voice input, conversation navigation, and the local `.makelore`-only
|
||||
project-data boundary are all retained.
|
||||
- Adopted one long-lived parent Pi Agent Server with isolated per-Conversation
|
||||
Runtime, Session, credential store, extension context, generation and JSONL
|
||||
channel. Thread configuration is supplied by a per-thread extension factory
|
||||
closure rather than process-global environment mutation or late CLI flag
|
||||
injection. Child Agents remain independent short-lived processes.
|
||||
- Reconciled ADR-006, the decision index, architecture maps, domain rules, success
|
||||
criteria, current-state memory, README, release runbook and tests with the new
|
||||
topology and `.makelore` authority. Plugin selection now persists at
|
||||
`.makelore/plugins.json`; no project metadata is read or migrated from
|
||||
`.niancode` or `.opencode`.
|
||||
- Promoted the streaming-preview behavior into the canonical README while leaving
|
||||
its source task record unchanged on source snapshot `33fb31fb`; the Integration
|
||||
Gate intentionally does not copy task-owned source records into the integration
|
||||
result.
|
||||
- Created two-parent merge commit
|
||||
`28897cd4a2b7179d9ccb444218a1d74a2bbc004b` and fast-forwarded the occupied
|
||||
local `main` to it. The original tracked source tree was hash-verified against
|
||||
snapshot tree `925e515a` before moving the branch. The generated Learning player
|
||||
remains locally present and ignored only through repository-local Git metadata;
|
||||
no remote push was performed.
|
||||
|
||||
## Verification
|
||||
|
||||
- `pnpm install --frozen-lockfile` with exact `pnpm@10.33.4`: passed.
|
||||
- `pnpm run typecheck`: passed.
|
||||
- Merge-focused Vitest set: 14 files / 121 tests passed.
|
||||
- `pnpm test`: 212 files / 1,726 tests passed; 3 staged-runtime-only tests skipped.
|
||||
- `pnpm run lint:check`: passed with zero errors and five existing warnings
|
||||
(`Home/index.tsx` hook dependency and four `Makelore/index.tsx` Fast Refresh warnings).
|
||||
- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload and utility worker;
|
||||
existing dynamic-import and large-chunk warnings remain non-fatal.
|
||||
- Focused `pnpm run test:e2e` for app smoke, main navigation, Pi first chat,
|
||||
project configuration Skills and Coding project identity: 13/13 passed.
|
||||
- `git diff --check`: passed; unresolved merge path count is zero.
|
||||
- `check_project_docs.py` and task-aware `check_doc_drift.py`: passed after the
|
||||
source task record remained on its source snapshot instead of being promoted.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Existing release gates remain unchanged: official Marketplace Ed25519 trust-key
|
||||
activation, real Provider validation, macOS x64/arm64 and native non-WSL Linux
|
||||
packaged evidence are not promoted to Pass by this merge.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- Merge commit `28897cd4a2b7179d9ccb444218a1d74a2bbc004b` is present on local
|
||||
`main`; no remote promotion was requested or performed.
|
||||
@@ -46,13 +46,13 @@
|
||||
- 关闭的模块卡片必须置灰且无法点击；其根路由、深层路由和别名路由必须在 `MainLayout` 或模块初始化前阻断。Code provider 只能在 auth policy hydration 完成且 Code 已开启时初始化；`/settings` 是全局设置，不得随 Code 关闭而失去访问。
|
||||
- 模块置灰/路由阻断不是 API 授权边界。每个 Works/模块服务端 API 仍必须独立执行身份与权限检查；`/api/auth/me` 返回终止性 `401` 时必须清理 Main 和 Renderer 会话，不得以默认全开继续。
|
||||
- Makelore Code 的唯一 production runtime 是精确 pin 的 Pi `0.84.2`。不得恢复 OpenCode fallback、RPC/SDK 双轨、兼容执行路径或 Renderer runtime 直连；产品公共合同必须保持 project/Agent/Conversation/Snapshot/Patch 中立，Pi wire 只属于 Main。
|
||||
- project、Agent、Conversation 使用 schema v2。Agent id、名称、原始 prompt、Skills 与 archive 状态必须稳定保存；旧 v1 在写入前做时间戳备份，旧 OpenCode 会话迁为本地空 Conversation 且不继续运行。只处理 exact generated legacy Agent 文件，modified/unknown 文件先进入备份，其他 `.opencode` 内容不得被迁移顺带删除。
|
||||
- 每条 active/warm Conversation 绑定一个 persistent Pi worker/session。首次本地 Conversation 创建和 Composer 编辑不得等待 worker；未解析 Conversation 第一次选模必须先验证模型、持久化 resolved metadata，再 prepare。已解析且同账号的模型变化复用 target `set_model`，跨账号变化等 active run settled 后只重建目标 worker。
|
||||
- prompt、steer、follow-up、compact 等 mutation 必须先获得目标 Conversation 的 `202` acceptance/dedupe 结果。confirmation timeout 只表示 uncertain，不得自动重发，也不得释放 run permit、process ownership 或 Main background lease；迟到 success/failure/exit/abort 必须单调、exactly-once 收敛，并且 sibling Conversation 继续独立工作。
|
||||
- project、Agent、Conversation 使用 `.makelore/project.json` 与 `.makelore/conversations.json` schema v2。Agent id、名称、原始 prompt、Skills 与 archive 状态必须稳定保存；不得从 `.niancode` 或 `.opencode` 读取或迁移项目元数据，也不得作为顺带清理删除这些用户内容。
|
||||
- 每条 active/warm Conversation 在同一个长驻父 Agent Server 内绑定独立 Pi Runtime/Session/channel。首次本地 Conversation 创建和 Composer 编辑不得等待逻辑线程；未解析 Conversation 第一次选模必须先验证模型、持久化 resolved metadata，再 prepare。已解析且同账号的模型变化复用 target `set_model`，跨账号变化等 active run settled 后只重建目标逻辑线程。
|
||||
- prompt、steer、follow-up、compact 等 mutation 必须先获得目标 Conversation 的 `202` acceptance/dedupe 结果。confirmation timeout 只表示 uncertain，不得自动重发，也不得释放 run permit、Agent Server/child process ownership 或 Main background lease；迟到 success/failure/exit/abort 必须单调、exactly-once 收敛。线程级失败只影响目标 Conversation；整个 Agent Server 退出时所有旧父 channel 一起 fail closed，但 Main/Renderer 继续存活且下次恢复只启动一个新 Server。
|
||||
- Renderer 只消费 Snapshot-first 与 `patch-batch` SSE。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect 只恢复目标 Snapshot 并应用严格连续的缓冲 tail，不重放 mutation，也不改变乐观消息的 UI identity。
|
||||
- top-level worker 并发上限 4、warm idle LRU 上限 4、child 并发上限 4，parent/child 共用 FIFO process budget 8。单次 subagent dispatch 最多 8 个 child 且禁止递归；coding child 与 parent 共用同项目 write lease，父 abort/crash/generation 失效必须清理所有 child、permit 与 process lease。
|
||||
- Provider Account、credential、custom header 和 proxy token 只可投影到选中 worker env，不能进入 argv、catalog、Renderer 或未选中 worker。确定性的 Works user-context 缺失必须使缓存 gateway credential 过期、fail fast 且不重放 mutation，并向产品投影固定的 `CODING_PROVIDER_AUTH_REQUIRED`；不能把它解释为 Pi worker 崩溃。
|
||||
- Provider/resource revision 在 idle worker 下一 prompt 前应用；running worker 使用当前 run snapshot，settled 后重建。同账号 refresh single-flight 且最多一次 auth refresh/reopen。真实 Provider 认证、endpoint/proxy/rate-limit、协议差异、真实并发和跨 worker 凭据隔离由用户明确豁免并接受风险，`realTurnVerified=false`，不得写成 Pass。
|
||||
- top-level 逻辑 turn 并发上限 4、warm idle logical-thread LRU 上限 8、child 并发上限 4，child 使用 FIFO process budget 8；shared parent 逻辑线程不各占一个 process lease。单次 subagent dispatch 最多 8 个 child 且禁止递归；coding child 与 parent 共用同项目 write lease，父 abort/crash/generation 失效必须清理所有 child、permit 与 process lease。
|
||||
- Provider Account、credential、custom header 和 proxy token 只可投影到选中父逻辑线程的内存 credential store 或选中 child 进程，不能进入 argv、catalog、Renderer 或 sibling thread。确定性的 Works user-context 缺失必须使缓存 gateway credential 过期、fail fast 且不重放 mutation，并向产品投影固定的 `CODING_PROVIDER_AUTH_REQUIRED`；不能把它解释为 Pi 崩溃。
|
||||
- Provider/resource revision 在 idle 逻辑线程下一 prompt 前应用；running 线程使用当前 run snapshot，settled 后重建。同账号 refresh single-flight 且最多一次 auth refresh/reopen。真实 Provider 认证、endpoint/proxy/rate-limit、协议差异、真实并发和共享 Agent Server 内跨线程凭据隔离由用户明确豁免并接受风险，`realTurnVerified=false`，不得写成 Pass。
|
||||
- 客户端更新检查由 Electron Main 持有。缺少当前平台正式稳定 manifest 必须保持错误并提示稍后重试或从官网下载，不得宣称“已是最新版”；设置页只显示一条中文用户提示，原始堆栈、URL、路径和错误码只保留在 Main 日志。
|
||||
- 一个 AI Design Workspace 公开一个 current Direction、一个 persistent Agent Session 和一个 Current Specification；conversation timeline 不是独立创建或选择的权威对象。
|
||||
- Living Form 只能投影服务端 Current Specification。Chat、direct edit、decision、proposal、lock、Asset binding 与 restore 必须通过同一 V2 reducer；Renderer drafts 在 accepted 前保持本地。
|
||||
@@ -102,4 +102,4 @@
|
||||
|
||||
## Last Reviewed
|
||||
|
||||
2026-08-26
|
||||
2026-08-31
|
||||
|
||||
Reference in New Issue
Block a user