fix(plugins): close R2 workspace gaps

This commit is contained in:
2026-09-03 15:07:29 +08:00
parent c5020ae22c
commit 0bfabc0df2
10 changed files with 405 additions and 15 deletions

View File

@@ -0,0 +1,125 @@
# Task: Plugin navigation R2 remediation
## Identity
- Task ID: 20260903-plugin-navigation-remediation-r2-b8e4d317
- Mode: Feature
- Branch: codex/20260903-plugin-navigation-remediation-r2-b8e4d317-plugin-navigation-remediation-r2
- Worktree: C:\Users\7brot\.codex\worktrees\plugin-nav-remediation-r2-b8e4d317\makelore
- Base commit: c5020ae22c9bef1b5bc8190469998127842c4513
- Owner: codex-01a0656d
- Status: Ready for Integration
## Scope
- Remediate the three R2 Spec findings against product base
`c5020ae22c9bef1b5bc8190469998127842c4513`.
- Preserve the exact canonical `/plugins?...` route through a successful login,
while accepting only safe internal return paths and retaining `/module-select`
as the default.
- Pass device/project refresh-failure provenance into the pure plugin workspace
projection so retained snapshots stay visible and are labelled as cached.
- Surface `CodingPluginProject.policyStatus` (`stale` or `unavailable`) beside
affected project policy/pricing; leave `current` unmarked.
- Add focused projection, page, controller, login/route regressions and run the
required unit, typecheck, lint, Vite, and relevant Electron verification.
- Produce one remediation commit and a clean READY_FOR_INTEGRATION handoff.
## Intent And Constraints
- Follow the authoritative unified plugin workspace Spec and the exact three
findings recorded by R2 review commit
`a698c41b39f11b4ebe15fd0f74b5fb8457ae3514`.
- Work test-first through public projection, page, controller, and router seams.
- Keep Catalog, Library, Package Store, Device Packages, project enablement,
Agent Skill assignment, runtime admission, and billing authorities unchanged.
- Do not modify stores, Electron Main, server/runtime/billing contracts, or add
a new cache/authority, compatibility layer, feature flag, or wrapper layer.
- Limit product edits to `src/pages/Plugins/**` and `src/pages/Login/index.tsx`;
a minimal existing route seam is permitted only if required by the login
regression. Corresponding unit/page/route tests and this task record are owned.
- Keep original R1 fixes covered and unchanged in semantics.
- Do not merge main, push, create a PR, deploy, publish, or install to a user
machine. Do not modify or clean any other worktree or the repository root.
## Project Context Loaded
- Product goal: finish ML-PLUGIN-NAV-001 R2 remediation without merging existing
backend or runtime authorities into the Renderer projection.
- Current state: base `c5020ae22c9bef1b5bc8190469998127842c4513`
contains the initial implementation and R1 remediation; R2 Standards passed
with zero findings and R2 Spec reported exactly three Medium roots.
- Relevant decisions: `/plugins` is the canonical Code-owned, initialization-safe
route; auth return uses router state; source-qualified identities and
fail-closed partial-source behavior remain intact; Renderer displays but does
not calculate or authorize project policy/billing state.
- Evidence: the authoritative Spec, R2 review record, current App/Login/Plugins
composition, device-package and coding-plugin snapshot-preservation stores,
and existing unit/Electron fixtures were inspected.
- Likely modules: `src/pages/Plugins/plugin-workspace-controller.ts`,
`src/pages/Plugins/plugin-workspace-model.ts`, `src/pages/Plugins/index.tsx`,
`src/pages/Plugins/PluginDetails.tsx`, `src/pages/Login/index.tsx`, and focused
tests under `tests/unit` (plus relevant existing Electron coverage if needed).
- Unknowns/risks: dependency availability in the fresh worktree must be checked;
the stable public route unit seam may be more appropriate than expanding the
Electron fixture for the login-return contract.
- Concurrent task assessment: the authoritative task owner exactly matches this
managed worktree, branch, and base. Same-topic implementation/remediation/review
tasks are READY_FOR_INTEGRATION; remaining planning peers declare no overlapping
ownership of the scoped Plugin/Login files or semantics.
- Concurrent Task Gate: Passed.
- Planning Gate: Passed.
## Outcome
- Plugin acquisition sign-in now carries the exact canonical workspace path
(including scope/source/state/search/selected-plugin query) in router state.
Login returns to that same path after successful credential and model sync.
- Login accepts only supported same-app absolute return paths with one leading
slash. Absolute external and protocol-relative targets fall back to
`/module-select`; the existing no-return default is unchanged.
- The pure workspace projection now receives bounded device/project refresh
failure provenance. Preserved local package, project-backed official, and
retained unknown rows stay visible and render as cached; project failure does
not mark catalog-only official rows.
- Project policy status is projected verbatim onto project-associated official
and retained rows. Details explain `stale` and `unavailable` beside billing,
while `current` remains unmarked. No status changes commands, admission, or
client-side pricing.
- No stores, Electron Main, server, runtime, billing authority, dependencies,
legacy routes, or unrelated product files were changed.
## Verification
- TDD login/controller RED: 2 expected failures (bare `/login`, fixed
`/module-select`); GREEN: 2 files, 18 tests passed.
- TDD refresh provenance RED: 2 expected failures (`stale=false` in model/page);
GREEN: 2 files, 26 tests passed.
- TDD policy status RED: 5 expected failures (missing projection and copy);
GREEN: 2 files, 32 tests passed.
- Focused plugin/login/route suite: 6 files, 58 tests passed.
- `pnpm run typecheck`: passed.
- `pnpm run lint:check`: passed with 0 errors and 5 pre-existing warnings in
`src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`, outside this diff.
- `pnpm test`: 225 files / 1841 tests passed / 2 skipped, plus the isolated
coding-chat pressure file 1/1 passed.
- `pnpm run build:vite`: passed. Existing Browserslist age, mixed static/dynamic
import, and chunk-size warnings remained non-failing.
- Targeted Electron E2E (`plugin-marketplace.spec.ts` and
`project-plugins.spec.ts`): final combined rerun 4/4 passed. The first combined
run was 3/4: one case timed out waiting for the test fixture to observe
`/api/auth/me` before any plugin assertion. Playwright trace showed successful
Electron launch and reload with no console/renderer crash; the isolated rerun
passed 1/1, then the full targeted rerun passed 4/4.
- Public router Login regression covers exact canonical return plus rejected
external/protocol-relative targets and unchanged default behavior.
## Follow-ups
- Source task will run a fresh fixed-range Standards + Spec acceptance review.
- Do not merge to main before that independent acceptance.
## Promotion Candidates
- None. The changes implement the already-authoritative ML-PLUGIN-NAV-001 Spec
and do not introduce a new shared architecture or product decision.