integrate completed September 6 product changes
This commit is contained in:
inman committed
1 parent
e069ec6294
commit
0fb1dac245
22 files changed
+314
-924
No files matched your search
@@ -10,10 +10,12 @@
|
||||
| Selected-model Web Search | Parent Pi turn with an explicitly supported selected model | `makelore_web_search` core tool → frozen model/provider/credential request with provider-native forced search → ordinary model response/usage | No Marketplace Release, Account Library, Admission, Hosted Web Search client, Plugin Charge, or `agent_browser` fallback participates. Unsupported selected models expose no tool; child workers receive none. |
|
||||
| Conversation-driven Device Package install | Agent tool inspects npm/Git/absolute local Plugin/loose Skill source | Main preview → distinct later user confirmation → immutable device-package generation → new/idle parent worker resources | Renderer has no install picker. Lifecycle scripts never run. Pi extensions and non-empty Skill `scripts/` are disclosed as desktop-user executable code before confirmation. Active workers retain their frozen generation until the turn settles; child workers remain empty. |
|
||||
| Effective Plugin worker snapshot | Installed trusted package or acquired official bundled definition + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. |
|
||||
| Plugin workspace navigation | Project Configuration `插件` ResourceCard or compatibility URL | `/project-config/plugins` → Project Configuration remains mounted → same-page wide Plugin sheet → unified Plugin stores/Main routes | Code sidebar has no standalone Plugin entry. `/plugins` and old Plugin URLs only preserve query/filter intent while redirecting; embedding does not merge acquisition, install, project enablement, assignment, runtime authorization, or billing lifecycles. |
|
||||
| Hosted Game Resource operation | Eligible parent `makelore.game-resource` tool call plus explicit confirmation | frozen Plugin adapter → capability Registry → Main `GameResourceClient` → fixed Works Square game-resource route → provider-neutral receipt/result | Server policy owns pricing, payer, Admission and receipt state. Stable logical operation identity survives response loss/Main restart; `submission_unknown` is not replayed as a fresh request. Result saving uses a bounded project-relative path and the existing project write lease. |
|
||||
| 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed |
|
||||
| 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 三布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；额外旧字段被忽略；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate |
|
||||
| 项目创建 | 新建项目对话框 | Host API → Main 项目初始化 | 固定 `interactive_ai_app` 或 `custom`，只生成 `.makelore/project.json` 与 `knowledge/`；历史双类型在读取边界归一，不因读取改写 |
|
||||
| 项目创建 | 新建项目对话框中的目录选择 | Renderer 内部默认 `interactive_ai_app` → Host API → Main 生成 UUID 并原子初始化 | 普通用户不选择类型、模板或项目身份；只生成 `.makelore/project.json` 与 `knowledge/`，随后直接进入 `/chat`。既有 `custom`/历史类型和底层兼容入口仍保留 |
|
||||
| 旧项目身份补齐 | 有效 `.makelore/project.json` 仅缺 `projectId` | Main serialized config read/repair → canonical UUID persisted once | 并发读取共享同一次修复；原始 UUID、bind/independent-copy 控件不进入普通 UI。其他缺失或无效 metadata 仍是配置错误；`initialized` 不阻断有效项目 |
|
||||
| 显式项目脚手架 | 用户为已获取、项目启用并分配给 Agent 的 Project Scaffold Plugin 明确要求初始化 | Pi `bash` + 项目 write lease → `MAKELORE_NODE_EXECUTABLE` → bundled `makelore-project-scaffold` 脚本 | 固定六文件目标；全量预检、不覆盖、受控失败只回滚本次路径；不安装依赖、不联网、不构建、不上传、不提审；下载 artifact 不参与 |
|
||||
| 一键提交 | `ProjectPublishAction` | Renderer capability → Host API → Main 本地 npm/Vite build → built snapshot preflight → source+built+contract 上传 | 只对规范交互式 AI 应用（含读取时归一的历史别名）开放；首次 create 通过单一 multipart 合同原子提交文字资料与必选 PNG/JPEG/WebP 封面，创建失败或冲突不上传版本；已有 draft/published 只提交版本并沿用云端资料/封面，不做无条件 metadata PATCH |
|
||||
| 构建产物预检 | Main-owned built snapshot | 一次性 loopback origin → fresh Electron WebContents/CDP（桌面、移动） | 检查错误、白屏和外域；不调用 Playwright，检查与上传归档相同字节，但不产生可信 receipt |
|
||||
@@ -28,14 +30,15 @@
|
||||
| AI 编程 Provider 错误 | Pi logical-thread Provider 请求 | selected thread-local credential store → Main AI proxy → Works 模型上游 → projector safe error | 确定性的 Works user-context 缺失使缓存 gateway credential 过期、返回非重试认证失败且不重放请求；Renderer 只看到固定 Provider-auth 提示，不能把它解释为 Pi 崩溃 |
|
||||
| AI 编程子 Agent | parent logical thread `subagent.v1` tool call | explicit extension → authenticated Main bridge → scheduler → independent ephemeral Pi child process | child 并发最多 4、单次最多 8、禁止递归；child 使用 FIFO 进程预算 8，shared parent 逻辑线程不各占一个 process lease；coding child 与 parent 共用项目 write lease，父 abort/crash/generation 失效必须清理 child 与 permit |
|
||||
| 客户端更新检查 | 设置页 | Renderer update store → IPC → Main AppUpdater → 目标 feed | Main 记录并重抛原始错误；Renderer 只显示去重、脱敏的单条提示，稳定源缺包不伪装为最新版 |
|
||||
| Design Workspace load | Canvas/Sidebar | Renderer Host API → Main-owned Works Square V2 adapter → current Workspace/Direction/Living Form projection | 一个 Workspace 公开一个 current Direction 与 persistent Agent Session；conversation timeline 是交互历史，不是独立 authority object |
|
||||
| Design Workspace load | Canvas 中央区与右侧 Works rail | Renderer Host API → Main-owned Works Square V2 adapter → current Workspace/Direction/Living Form projection | 一个 Workspace 公开一个 current Direction 与 persistent Agent Session；右 rail 只选择/创建/删除 Workspace，conversation timeline 是交互历史，不是独立 authority object |
|
||||
| Design input and reconciliation | Chat/direct edit/decision/proposal/lock/Asset binding/restore | Renderer draft → Main → `design.input.apply` → canonical Direction projection | 全部进入同一 reducer；accepted 前 draft 保持本地，revision conflict 刷新权威投影，unknown result 复用原 command/operation identity |
|
||||
| 设计有限请求生命周期 | Renderer Workspace JSON 调用 / shared Works token refresh | Main deadline → Electron transport → safe-read-only Node fallback → Host API timeout envelope | 包括取凭据、请求头和响应 body 的完整生命周期最多 30 秒；超时 abort transport 并稳定返回 `504 DESIGN_WORKSPACE_REQUEST_TIMEOUT`；透明 fallback 只允许 `GET`/`HEAD`/`OPTIONS`，mutation 不隐式重放 |
|
||||
| Design Asset binding | 当前 Workspace 已完成图片 / 本地上传 | canonical Asset → typed `asset_binding` input → Current Specification revision | 图片/视频用途由 Specification medium 和 binding role 决定；只提交真实 Workspace Asset identity，不使用本地路径或自然语言占位 |
|
||||
| Design reference alias editing | Active plan 的 final Prompt 与 binding-only reference row | `@图片N` token/add/replace/remove → typed field/collection operations → Current Specification revision | Prompt 决定图片如何参与生成；row 只管理稳定 reference/Asset identity。未绑定 alias 定点要求上传并阻止 Quote；删除时原子移除 binding 并重排后续 alias，既有 alias 不重复插入 |
|
||||
| Design Quote and confirmation | 当前 exact Specification revision | `design.quote.request` → immutable public Quote projection → `design.generation.confirm` with Quote ID | Renderer 只展示 output summary、warnings、expiry、Token Points；Provider Prompt/model/route/storage/internal billing 不下发或编辑 |
|
||||
| Design Task and Asset sync | Direction event stream / Workspace resource events / explicit refresh | Renderer Task/Asset projections | Task/Asset events独立于 Living Form；transport order 和 progress 不改写 Specification，也不授权新生成操作 |
|
||||
| 设计项目删除 | Canvas 侧栏精确项目名确认 | Renderer → Main Host API → Works Square Workspace DELETE | 删除成功后清理当前 Workspace/Direction/resources 并选择最近更新的剩余项目；结算与软删除语义由服务端负责 |
|
||||
| Prompt Museum 浏览与使用 | Canvas 侧栏“获取灵感” | Renderer → Main Host API → Works Square list/detail；选中 Prompt → 进程内 pending state → 当前 Canvas 输入框 | 只发送白名单筛选/游标；Works Token 留在 Main，Prompt 不自动发送，Museum 不包含客户端静态数据集 |
|
||||
| 历史 Prompt Museum URL | `/image-prompts/*` | App replace-redirect → `/image-canvas` | 当前 Canvas 无“获取灵感”入口，App 不挂载或 lazy-load Museum 页面；保留的 Main API/auth/media 与 shared DTO 是 dormant 兼容/安全基础设施 |
|
||||
| Robot 引导式热点配网 V1（已实现、默认开启） | Robot Binding 页面 | 用户选择引导配网 → 进入固件配网模式 → Renderer 经 Host API 请求 Main 扫描 → 用户选择短效候选 → Windows/macOS Adapter 连接并核验当前 SSID → Main 打开固定 Portal → 用户在 Portal 配置 Wi-Fi → 电脑恢复互联网 → 现有六位 Binding | 精确环境值 `0` 或 capability 读取失败回退直接六位码；系统 Wi-Fi 保留兜底，Makelore 不收集 Wi-Fi 密码、不修改固件，热点发现/`bound` 都不等于可信身份或 online/ready |
|
||||
|
||||
## State Ownership
|
||||
@@ -48,7 +51,7 @@
|
||||
- 旧 schema v1 `submitted` 记录迁移并保留；旧 `armed`、`waiting_for_package`、`waiting_for_login`、`uploading`、`failed` 归一为 `legacy_retired`，不再启动 watcher 或上传任务。
|
||||
- AI Design Current Specification 与 current Direction 是语义权威；conversation timeline 只保存交互历史，immutable Quote 绑定精确 Specification revision，Task/Asset 属于 Workspace resource projection。
|
||||
- AI 绘画 Main 持有 Workspace 请求 deadline、底层 transport fallback 和共享 Works token refresh flight。共同等待者必须在同一有限期限内 settle，refresh flight 结束后必须释放，后续刷新可重新发起；底层 mutation transport failure 不得自动产生第二次上游请求。
|
||||
- Prompt Museum pending Prompt 是 Renderer 进程内一次性导航状态；Canvas 消费后立即清除，不进入 Workspace/Specification，直到用户主动提交 Design input。
|
||||
- 旧 Prompt Museum Store/API 不参与当前 Renderer 导航或 Canvas 状态；保留代码不得被解释为可达产品流程。
|
||||
- Retired Learning data is outside the active client state model. Historical downloaded
|
||||
course data is not read, migrated, or automatically deleted.
|
||||
- 图生图参考图与视频首帧都先归一为当前 Workspace Asset，再通过 typed binding 写入 Specification；本地路径不会进入 canonical contract。
|
||||
@@ -74,9 +77,9 @@
|
||||
- Main-owned electron-updater IPC 与 Works Square 平台/架构稳定 feed；正式安装产物发布不由 Renderer 控制。
|
||||
- 服务端安全投影后的公共 `play_url`；只接受同源 HTTPS、精确 App 路径和可信版本状态。
|
||||
- Works Square Design V2 Workspace/Direction/Living Form API、持久 Agent Gateway Session、Direction event stream，以及 `design.input.apply`、`design.quote.request`、`design.generation.confirm` stable-operation contract。
|
||||
- Works Square Prompt Museum list/detail API；Main 添加当前账号 Bearer Token，Renderer 只使用 Host API 投影。
|
||||
- Dormant Works Square Prompt Museum list/detail/media compatibility API；Main 继续持有 Bearer 与媒体校验，当前 App 没有可达 Renderer 消费者。
|
||||
- 已实现的本机 Robot provisioning capability、固定 portal-open 与 hotspot scan/connect Host API。它们是本地 Main 操作，不读取 Works access token、不调用上游，也不接受任意 URL/SSID/BSSID/interface/profile。
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-09-04
|
||||
2026-09-07
|
||||
@@ -10,9 +10,9 @@
|
||||
| `electron/coding-runtime/pi/model-tools/**` and `shared/model-tools.ts` | Closed selected-model tool registry and provider-specific Web Search request shaping | The frozen selected model capability controls whether `makelore_web_search` exists. The tool uses that model/provider/credential and normal model billing; no Hosted Plugin adapter, Admission, Plugin Charge, or browser fallback exists. |
|
||||
| `electron/coding-packages/**`, `electron/api/routes/device-packages.ts`, `shared/device-packages.ts`, and `src/stores/device-packages.ts` | Main-owned conversation install preview/confirmation/commit, immutable local package generations, safe Renderer projection, and parent-worker refresh | Sources are npm, Git, absolute local Plugin directories, or loose `SKILL.md`. Lifecycle scripts are disabled; executable extensions and non-empty Skill `scripts/` run with desktop-user authority after disclosure and explicit confirmation. Every generation projects all explicitly installed and currently enabled Skills/extensions; Device Packages never join Account Library, Marketplace Package Store, Release, Channel, or Admission state. |
|
||||
| `electron/coding-plugins/adapters/game-resource.ts` and `electron/services/game-resource-client.ts` | Provider-neutral `makelore.game-resource` hosted tool adapter and Main-owned Works Square transport | Tools materialize only from an eligible frozen `platform_hosted` parent snapshot. Metered mutations require explicit confirmation and stable logical operation identity; Renderer/Pi never receive Provider URLs, credentials, balances, raw responses, or Provider job IDs. |
|
||||
| `electron/api/routes/plugin-marketplace.ts`, `src/stores/{plugin-marketplace,device-packages,coding-plugins}.ts`, and `src/pages/Plugins/` | Existing Main/store authorities plus the pure unified Renderer projection for official catalog, Account Library, official package-device state, local Device Packages, retained IDs, and current-project actions | `/plugins` is the sole canonical surface; legacy Plugin routes only replace-redirect into deterministic filters. `official:`, `local:`, and `retained:` identities stay separate, source failures are isolated, and no Account token, filesystem path, Admission, package bytes, signed URL, or visible install-source picker enters Renderer. |
|
||||
| `electron/api/routes/plugin-marketplace.ts`, `src/stores/{plugin-marketplace,device-packages,coding-plugins}.ts`, `src/pages/Plugins/`, and `src/pages/ProjectConfiguration/index.tsx` | Existing Main/store authorities plus the unified Renderer projection embedded in Project Configuration | `/project-config/plugins` is the canonical same-page sheet state. `/plugins` and legacy Plugin routes only replace-redirect while preserving deterministic filters. `official:`, `local:`, and `retained:` identities stay separate, source failures are isolated, and no Account token, filesystem path, Admission, package bytes, signed URL, or visible install-source picker enters Renderer. |
|
||||
| `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 |
|
||||
| `shared/project-config.ts` and `electron/coding-projects/project-config.ts` | 规范 `ProjectType` 归一与最小项目创建 | 新写入只使用 `interactive_ai_app` / `custom`；历史 `mini_game` / `mini_program` 只读归一，项目创建只生成 metadata 与 `knowledge/` |
|
||||
| `shared/project-config.ts`, `electron/coding-projects/{project-config,project-service}.ts`, and `src/components/layout/Sidebar.tsx` | 规范 `ProjectType`、Main-owned UUID 与目录式最小项目创建 | 普通新建只要求目录，内部默认 `interactive_ai_app`，Main 自动生成 UUID；有效旧配置仅缺 `projectId` 时串行修复。既有 `custom` 和历史类型仍兼容，`initialized` 不再是导航 gate |
|
||||
| `resources/coding-plugins/project-scaffold/` and `tests/project-scaffold/` | 官方 bundled Scaffold Plugin、固定六文件模板、确定性 Node 脚本、发布要求参考与回归测试 | 通过既有 Pi `bash` write lease 和 `MAKELORE_NODE_EXECUTABLE` 显式运行；脚本信任来自固定客户端资源，而非下载 artifact；不覆盖、不安装依赖、不联网，也不复制 build/upload/review 实现 |
|
||||
| `src/lib/works-square.ts` | Renderer 侧 Works Square Host API 契约与安全错误映射 | 不接触 Token、ZIP、本地绝对路径或自动部署状态 |
|
||||
| `electron/api/routes/works.ts` | Works Host API、Renderer capability 门禁、上游安全投影 | 发布凭据、打包、上传与本地绑定均在 Main 内完成 |
|
||||
@@ -39,11 +39,10 @@
|
||||
| `electron/api/routes/image-workspace.ts` | AI 绘画 Host API 与本地事件流投影 | Renderer 只通过该路由访问 Main-owned workspace adapter |
|
||||
| `electron/image-workspace/works-square-workspace.ts` | Works Square V2 adapter、stable command/operation IDs 与 Direction event mapping | unknown transport result 保留精确命令；Main 持有 token、ticket、WebSocket、retry classification 与 safe errors |
|
||||
| `src/stores/image-workspace.ts` | Current Workspace/Direction/Living Form、local drafts、pending operations 与 Workspace resources | revision conflict 刷新 canonical state；event order/Task progress 不成为 Specification authority |
|
||||
| `src/pages/ImageCanvas/{index,DesignConversationPane,DesignFormPane,DesignProductionPanel}.tsx` | 持久双栏 Canvas、conversation、Living Form、immutable Quote confirmation、Tasks 与 Assets | chat/direct edits/decisions/locks/bindings 使用同一 V2 reducer；确认只提交 Quote ID |
|
||||
| `src/components/layout/ImageWorkspaceSidebar.tsx` | Workspace 选择、创建与 Prompt Museum 入口 | 不再创建或选择嵌套 Conversation |
|
||||
| `shared/image-prompt-museum.ts` | Prompt Museum 列表、分类、详情、署名与分页共享 DTO | 客户端不包含内容数据集，只定义服务端字段契约 |
|
||||
| `electron/api/routes/image-prompt-museum.ts` | Main-owned Museum 列表/详情代理与 Works 登录态 | 仅 GET 固定路径和白名单查询；Renderer 不获得 Bearer Token |
|
||||
| `src/pages/ImagePromptMuseum/index.tsx` / `src/lib/image-prompt-museum.ts` / `src/stores/image-prompt-museum.ts` | Museum 搜索/筛选/详情与一次性 Prompt 回填 | 原 Prompt 只带回 Canvas 输入框，不自动发送；页面不接受投稿或互动 |
|
||||
| `src/pages/ImageCanvas/{index,DesignConversationPane,DesignProductionPanel,DesignWorksRail,YouthCreationCard}.tsx` | 中央 conversation/active 制作方案、右侧 Works rail、immutable Quote confirmation、历史 Tasks 与 Assets | active 方案留在时间线；已提交状态折叠为历史。最终 Prompt、reference binding 与直接参数编辑继续通过同一 V2 reducer，确认只提交 Quote ID |
|
||||
| `src/pages/ImageCanvas/reference-tokens.ts` and `src/pages/ImageCanvas/youth-form-projection.ts` | `@图片N` alias、缺失 binding 检测与青少年可读方案投影 | Prompt 是 reference 用途的唯一可见表达；binding row 只管理真实 Asset/token identity。缺失 token 对应图片时提供定点上传并阻止 Quote，新增/删除/替换保持稳定 reference ID 与连续 alias |
|
||||
| `src/pages/ImageCanvas/DesignWorksRail.tsx` | 全高右侧 Workspace 选择、创建和删除 | 桌面为 320–340 px 右 rail，紧凑布局复用右侧 Sheet；无“获取灵感”入口，不创建嵌套 Conversation |
|
||||
| `shared/image-prompt-museum.ts` and `electron/api/routes/image-prompt-museum.ts` | Dormant Museum DTO 与 Main-owned 列表/详情/auth/media 安全边界 | 当前 App 不挂载 Museum Renderer 页面；历史路由回到 Canvas。仅保留固定 GET/媒体校验兼容，不代表可见模块 |
|
||||
| `src/pages/AiHardware/index.tsx` | Robot 管理、现有六位 Binding，以及已实现的 default-on 引导式热点配网状态机 | 只编排非敏感步骤；不接收 Wi-Fi 密码，不把 `bound` 展示为在线证明 |
|
||||
| `src/lib/ai-hardware.ts` | Renderer 侧 Robot Host API 类型、安全错误映射和稳定 Binding/hotspot facade | 读取 Main-owned capability，调用固定 portal-open，并只传递短效 hotspot candidate ID；不添加任意 URL、SSID 或 Renderer IPC |
|
||||
| `electron/api/routes/ai-hardware.ts` | Main-owned Robot 云端代理，以及本地 capability/portal/hotspot actions | 默认开启、精确环境值 `0` 回滚；所有本地操作必须在 Works token/上游访问前返回，且只投影稳定安全错误 |
|
||||
@@ -55,13 +54,13 @@
|
||||
## Dependency Direction
|
||||
|
||||
- Renderer UI → Renderer API contract → Main Host routes → Main services → Works Square；Renderer 不反向读取 Main 凭据、文件系统或归档。
|
||||
- Plugin sidebar/legacy links → canonical `/plugins` projection → existing Renderer stores → bounded Main Marketplace and Device Package routes. Compatibility routes replace-redirect into deterministic filters and do not create a second lifecycle.
|
||||
- Project Configuration `插件` card → canonical `/project-config/plugins` same-page sheet → unified Renderer stores → bounded Main Marketplace and Device Package routes. `/plugins` and legacy URLs replace-redirect into deterministic filters and do not create a second lifecycle.
|
||||
- Hosted Plugin parent tool → frozen Registry adapter → Main `GameResourceClient` → fixed Works Square game-resource routes. Stable logical operation identity survives response loss and Main restart; ambiguous submission remains reviewable and is never converted into an automatic fresh mutation. Saving a result uses the existing bounded project path and project write lease.
|
||||
- AI 编程 Renderer product Snapshot/commands → typed `/api/coding/*` Host API → Main Coding composition → target `CodingConversationRuntime` → shared Agent Server 内的目标 Pi 逻辑线程；Pi Provider 请求再经 Main AI proxy 访问模型上游。Renderer 不持有 Pi wire、凭据或本地 runtime URL。
|
||||
- Project configuration 只决定产品身份与分流；用户显式调用 Scaffold Skill 才生成固定起步文件；Main release builder 生成 source/built/contract，服务端独立重算和校验决定发布安全。本地 `ProjectType` 或 Skill 准备度结论都不是授权结论。
|
||||
- 普通项目创建只收集目录并使用内部 `interactive_ai_app` 默认与 Main-owned UUID；既有 Project Configuration 继续管理 Agent/Skill/知识/插件。用户可选地显式调用 Scaffold Skill 生成固定起步文件；Main release builder 生成 source/built/contract，服务端独立重算和校验决定发布安全。本地 `ProjectType` 或 Skill 准备度结论都不是授权结论。
|
||||
- Built artifact preflight 检查最终上传的同字节快照，但客户端可被绕过且不产生可信 receipt；服务端仍是合同、摘要和不可变 Release 安全权威。
|
||||
- Robot Renderer → typed AI hardware API → Main Host route → Robot Hotspot Module → Windows/macOS Adapter。云端 Binding 仍由 Main 代理；热点选择/连接移入页面，但家庭 Wi-Fi 凭据输入仍只留在固件 Portal，系统 Wi-Fi 保留为兜底。
|
||||
- Prompt Museum Renderer → typed Host API facade → Main fixed list/detail route → Works Square。Museum 只把用户明确选择的 Prompt 原文暂存到进程内 Store 并导航回当前 Canvas；不会直接触发 Agent 命令或生成任务。
|
||||
- 历史 `/image-prompts` → App replace-redirect → `/image-canvas`。Museum Main API/DTO 保持 dormant；当前 Renderer 没有可达的 Museum 数据流或 pending-Prompt 导航。
|
||||
|
||||
## Risky Or Sensitive Areas
|
||||
|
||||
@@ -80,7 +79,7 @@
|
||||
- `electron/main/updater.ts` 的稳定源错误归一化必须保持窄化：只识别 Works Square 对应 manifest 的 404，不得吞掉其他 feed/网络/签名错误；Renderer 的脱敏边界不能取代 Main 原始日志。
|
||||
- Design V2 事件处理必须区分 Direction projection 与 Workspace Task/Asset projection；不得用 transport sequence 或 Task progress 推进 Specification revision。
|
||||
- 输入、Quote request、confirmation 和项目切换跨 Renderer/Main/Works Square。异步结果必须核对 Workspace、Direction、revision 与 operation identity；unknown write 复用原 identity，不能生成新业务意图。
|
||||
- Prompt Museum 图片和来源 URL 来自服务端数据。服务端必须完成内容授权/署名审核；若未来需要凭据化素材，应新增 Main-owned 媒体代理，不能把对象存储凭据放进 Renderer URL。
|
||||
- Dormant Prompt Museum API/media 代码仍必须保持 Main-owned Bearer、固定路径、可信 raster MIME、10 MiB 上限和错误脱敏；如未来重新启用产品面，需新的明确产品决策与端到端授权/署名审核。
|
||||
- Design command replay requires the original stable command and semantic operation IDs; business rejection never authorizes a retry with a fresh identity. Resource reconciliation cannot overwrite the Living Form.
|
||||
- Canvas cleanup only closes the local stream/buffers. The server-owned Direction Session and semantic history remain durable.
|
||||
- Image/video references use typed Asset binding and Specification medium; display text is never an action protocol.
|
||||
@@ -88,4 +87,4 @@
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-09-04
|
||||
2026-09-07
|
||||
@@ -10,7 +10,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
|---|---|---|
|
||||
| Renderer | 项目配置、一键提交状态 | 不接触账号 Token、ZIP、幂等键或本地绝对路径 |
|
||||
| Host API | 校验本地项目请求并投影安全响应 | 发布 mutation 还必须通过 Renderer capability；Host token/base 不能单独触发发布 |
|
||||
| Project Configuration | 保存不可变 `ProjectType`，原子创建最小项目空间 | 只生成 `.makelore/project.json` 与 `knowledge/`；规范类型为 `interactive_ai_app` / `custom`，历史双类型只在读取边界归一 |
|
||||
| Project Configuration | 目录选择式创建、Agent/Skill/知识与项目资源配置 | 新建流程不暴露类型、模板或身份选择：Renderer 写入内部默认 `interactive_ai_app`，Main 生成 UUID，并只创建 `.makelore/project.json` 与 `knowledge/`；既有 `custom` 与历史类型继续兼容 |
|
||||
| Project Scaffold Skill | 显式生成固定版本的交互式 AI 应用起步文件，并提供发布准备度指导 | 官方 `makelore.project-scaffold` bundled Marketplace Plugin；完整预检、不覆盖、受控回滚，不安装依赖、不联网、不构建、不上传、不提审 |
|
||||
| Project Release Builder | Main-owned 安全快照、本地 npm/Vite 构建、双归档与 artifact contract | 固定 npm 11.6.2；Vite 由项目 lockfile 锁定；产物与预检使用同一内存字节 |
|
||||
| Works Session & Remembered Password | Main-owned 登录、刷新、注销、七天真实活动滑动续期与可选密码回填 | 登录、刷新、注销统一经过 Works Square；轮换凭据由 Main 安全持有和持久化。记住密码使用独立的 packaged-only OS 加密记录，不进入 Renderer 持久状态或 Works Square；客户端不携带 OAuth client secret |
|
||||
@@ -26,12 +26,13 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
| Pi Extension, Subagents & Lifecycle | 必需的生成式 Makelore extension、Main 显式选定的已安装 extensions、UI interaction、ephemeral child、write lease 与 background run lease | Makelore bridge 固定为首个 extension，其余选定 extension 全部经 Pi 的 explicit additional paths 加载且 ambient discovery 关闭；child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
|
||||
| Official Bundled Plugins | Acquired code-owned bundled Game Resource / Project Scaffold package → project enablement and Agent assignment → effective parent snapshot | 两者都不经过设备下载、更新、Beta 或 artifact 签名。Game Resource 进入固定 Works Square hosted route；Project Scaffold 仅提供 Skill，其 `.mjs` 来自签名客户端固定资源。Marketplace 下载包仍只接受 P0 文本/图片资源。child 不继承 Plugin。 |
|
||||
| Device Packages | Conversation install tools → Main-owned inspect/preview/confirm/commit → immutable local generation → parent Skill/Pi-extension resources | 支持 npm、Git、绝对本地 Plugin 目录与 loose `SKILL.md`；没有可见安装入口、Account Library、Release、Admission 或 Marketplace Package Store。可执行 extension 与非空 Skill `scripts/` 拥有桌面用户权限，必须披露并独立确认；生命周期脚本禁用。每个 generation 包含所有显式安装且当前启用的 Skill/extension；新/idle parent 自动刷新，active parent 在 turn settled 后刷新，child 始终为空。 |
|
||||
| AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | 自然对话是主创作面；Living Form 仅以“AI 已理解”的紧凑辅助摘要与可选手动调整投影服务端 Current Specification，Renderer 只持有草稿和已接受投影 |
|
||||
| Unified Plugin Workspace | Project Configuration 的 `插件` ResourceCard → `/project-config/plugins` same-page wide sheet | 复用统一 Plugin controller 与生命周期；Project Configuration 保持挂载，Code 侧栏不再提供独立入口；`/plugins` 和旧 Plugin URL 仅做保留查询条件的兼容重定向 |
|
||||
| AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | 中央区域承载对话和唯一 active 制作方案，320–340 px 右侧 Works rail 承载 Workspace 导航；紧凑布局使用同一右侧 Sheet。Renderer 只持有草稿和已接受投影 |
|
||||
| AI Design Input & Reconciliation | Chat、字段/集合编辑、decision、proposal、lock、Asset binding 与 restore | 全部进入同一 `design.input.apply` reducer；稳定 command/operation ID 支持 unknown-result 重放，revision conflict 刷新权威状态；待提交 chat 从同一 pending operation 临时投影，assistant delta 只能在匹配该 operation 的一个未完成助手气泡中临时绘制且不生成独立整理进度栏 |
|
||||
| AI Design Gateway Routing | Main-owned Works Square V2 adapter 与 Direction event stream | Main 持有 Works Token、stream ticket、WebSocket、重试分类和错误脱敏；事件顺序与 Task progress 不构成 Specification 真值 |
|
||||
| AI Design Quote & Task Controls | 精确 Specification revision 编译出的不可变 Quote 与 Workspace Tasks | 客户端只展示 public output summary、warnings、expiry 与 Token Points，并以 Quote ID 确认；Provider Prompt/model/route/storage/billing atoms 不下发 |
|
||||
| AI Design Assets | Workspace 已完成作品或本地上传的真实 Asset | Asset 通过 typed binding 写入 Specification；生成结果经 Main-owned asset download 保存 |
|
||||
| Prompt Museum | Canvas “获取灵感”页面 → Main Host API → Works Square | 服务端驱动的审核内容、筛选和分页；Renderer 不持有 Works Token 或内置数据集，“使用此 Prompt”只回填输入框 |
|
||||
| Dormant Prompt Museum compatibility | Retained Main Host API/auth/media validation/shared DTO → Works Square | 当前 App 不挂载或打包 Museum 页面，Canvas 无“获取灵感”入口，历史 `/image-prompts` 重定向到 `/image-canvas`；保留代码不是可见产品模块 |
|
||||
| Robot Workspace | Account-scoped agent configuration, device activation/binding, assignment, and credential-recovery UI | Renderer receives only safe Works Square projections. Configuration choices come from the USER-scoped safe catalog; unavailable current values remain editable without exposing provider credentials or configuration internals. |
|
||||
| AI Hardware Main Route | Fixed `/api/works/ai-hardware` Host API to Works Square proxy | Main owns Bearer auth, stable operation IDs, bounded retry, ETag/If-Match, request/response limits, error redaction, and the fixed no-store configuration-catalog proxy. Versioned responses accept only canonical strong or weak numeric ETags that equal the DTO revision; mutations always emit strong `If-Match`. It never forwards Renderer authorization headers. |
|
||||
| Robot Hotspot Module | Main-owned bounded scan/connect/verify interface with Windows WLAN and macOS CoreWLAN/CoreLocation adapters | Accepts only short-lived opaque candidates from the latest scan, exposes no BSSID/interface/profile/native diagnostic, and retains the system-Wi-Fi fallback. |
|
||||
@@ -46,7 +47,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
- 模块入口策略是用户交互与客户端初始化边界，不是服务端 API 授权。终止性 `/api/auth/me` `401` 必须清理 Main 和 Renderer 会话；各模块 API 仍须独立强制认证与授权。
|
||||
- Product UI language is Chinese-only. Unsupported system or persisted language values normalize to `zh`; removed locale files are not runtime fallbacks.
|
||||
- Canvas is cloud-only in development and packaged builds. The removed local Workspace adapter and V1 DTOs are not fallback paths.
|
||||
- Prompt Museum is a read-only curated inspiration surface, not a user-content community. Main owns Works authentication and forwards only the bounded list/detail routes; the client never bundles museum content or automatically submits a selected Prompt.
|
||||
- Prompt Museum 不属于当前可见产品面。不得恢复“获取灵感”入口或挂载 Museum Renderer 页面；历史 `/image-prompts` 只重定向到 Canvas。保留的 Main-owned 认证、媒体校验、固定 API 与共享 DTO 是 dormant 兼容/安全基础设施。
|
||||
- Learning is retired. No Learning route, Renderer surface, Main Host API, download service,
|
||||
shared DTO, packaging asset, or fallback remains. Historical downloaded course data is
|
||||
not read, migrated, or automatically deleted.
|
||||
@@ -77,8 +78,9 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
- release builder 对 Main-owned 安全快照运行安装包内固定 npm 11.6.2 的 `ci --ignore-scripts`，并显式调用项目 `package-lock.json` 锁定的 Vite。不得使用全局 PATH、预存 `node_modules` 或 Renderer 提供的路径/origin。项目 Vite config/plugins 以桌面用户权限执行，该边界不是 sandbox。
|
||||
- `preflightStaticArtifact` 以临时 HTTP loopback origin 提供最终 `built_archive` 的同一内存文件快照，并用 fresh 非持久、未挂载的 Electron WebContents/CDP 检查桌面/移动视口、错误、白屏及外域访问；不安装/调用 Playwright。
|
||||
- 客户端预检是可绕过的 UX fail-fast：没有可信 receipt，也不复刻生产 opaque-origin。服务端不执行项目 Vite，而是独立重算和校验 source/built/contract 字节、固化不可变 Release；人工审核仍不可绕过。未来若要求 runtime 强门禁，需由可信 verifier 绑定精确构建产物。
|
||||
- `ProjectType` 由创建请求写入项目配置，UI 与 Host API 不提供类型变更。新项目只写 `interactive_ai_app` 或 `custom`；历史 `mini_game` / `mini_program` 在读取边界归一为 `interactive_ai_app` 且不因读取被改写，缺少类型的旧配置归一为 `custom`。
|
||||
- 项目创建只拥有 `.makelore/project.json` 和 `knowledge/`。交互式 AI 应用起步树由用户明确调用 Scaffold Skill 生成；Skill 的发布准备度结论不执行也不替代 Main build/preflight/package/upload 或 Works Square 校验与审核。
|
||||
- `ProjectType` 仍由项目配置持有且 UI/Host API 不提供类型变更。普通新建流程只要求目录并写入内部默认 `interactive_ai_app`；不向用户暴露类型、模板或项目 ID 选择。既有 `custom` 项目继续打开，历史 `mini_game` / `mini_program` 在读取边界归一为 `interactive_ai_app` 且不因读取被改写，缺少类型的旧配置归一为 `custom`。
|
||||
- Main 为新项目自动生成 UUID，并为仅缺 `projectId` 的有效旧配置串行补齐；原始 ID、绑定/独立副本选择和 `initialized` gate 不属于普通界面。缺失或无效的其他 metadata 仍进入 Project Configuration。
|
||||
- 项目创建只拥有 `.makelore/project.json` 和 `knowledge/`。交互式 AI 应用起步树由用户可选地明确调用 Scaffold Skill 生成；Skill 不是创建或进入聊天的前置条件，其发布准备度结论不执行也不替代 Main build/preflight/package/upload 或 Works Square 校验与审核。
|
||||
- `makelore.project-scaffold` 是代码所有的 bundled `skill_only` Marketplace Plugin。其官方 `.mjs` 只从固定客户端资源根加载；下载 artifact 的扩展名/资产校验没有放宽，仍拒绝 `.mjs`。
|
||||
- 本地 `projectType` 只选择显式脚手架和内部构建路径，不是可信授权声明；Main 仍需安全打包，服务端仍需独立校验清单和包体。
|
||||
- 云端确认上传成功后，本机 submission binding 失败只能产生固定、无路径的 `binding_warning`，不能把请求改判为失败；Renderer 仍继续轮询服务端校验与 Release 固化状态。
|
||||
@@ -92,7 +94,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
- Main-owned Canvas Workspace JSON 请求和 shared Works token refresh 的完整生命周期最多 30 秒，超时 abort transport 并以固定 `504 DESIGN_WORKSPACE_REQUEST_TIMEOUT` 结束 Renderer 等待。Electron `net.fetch` 失败后的 Node fetch 透明回退只允许 `GET`、`HEAD`、`OPTIONS`；PATCH/POST 等 mutation 只允许由持有显式幂等身份的上层协议决定重试，不能由底层 transport 隐式重放。该边界不改变上面的 WebSocket→REST 幂等 fallback。
|
||||
- Renderer 的异步与流式结果必须核对 Workspace、Direction、revision 和 operation identity；Direction snapshot 是 Specification 真值，Task/Asset 事件只更新 Workspace resource projection。
|
||||
- 待提交 chat 可以从现有 pending operation 立即投影为明确标注“发送中/正在确认”的用户气泡，但只有服务端 canonical turn 能进入对话历史；确定失败必须恢复原草稿，不能另建一套消息状态或新业务意图。
|
||||
- `design.assistant.delta` 是未完成的传输状态，不是 canonical assistant turn。Renderer 只能把它临时绘制为与同一 pending chat identity 绑定的单个未完成助手气泡，并在该 operation 确定收敛后由 canonical turn 替换；不得持久化为第二条消息、伪装为已完成回复或创建独立整理进度栏。unknown outcome 保留原 identity 与已有片段，其他 operation 的更新不得全局清除它；右侧 Current Specification 继续呈现 AI 当前整理出的设计理解。重叠连接与重放 chunk 必须按连接 generation 和 `chunkIndex` 收敛。
|
||||
- `design.assistant.delta` 是未完成的传输状态，不是 canonical assistant turn。Renderer 只能把它临时绘制为与同一 pending chat identity 绑定的单个未完成助手气泡，并在该 operation 确定收敛后由 canonical turn 替换；不得持久化为第二条消息、伪装为已完成回复或创建独立整理进度栏。unknown outcome 保留原 identity 与已有片段，其他 operation 的更新不得全局清除它；中央 active 制作方案继续呈现 AI 当前整理出的设计理解。重叠连接与重放 chunk 必须按连接 generation 和 `chunkIndex` 收敛。
|
||||
- 确认生成只提交不可变 Quote ID。Task 事务已提交但事件迟到时可刷新 Workspace projection；Task progress 不得改写 Living Form 或授权新的生成操作。
|
||||
- Updater feed 选择、原始错误日志、下载和安装生命周期只属于 Electron Main。Renderer 不得把缺失稳定 manifest 投影为“已是最新版”，也不得显示原始堆栈、URL、路径或错误码；并发检查共享同一错误事件时只发送一次错误状态，后续独立重试仍可重新报告。
|
||||
- 图片与视频复用同一个单图来源选择器。图片 Brief 可从当前 Workspace 的已完成作品或本地上传中选择一张参考图继续生成；视频 Brief 使用同一入口绑定首帧。两条路径都必须通过现有 Workspace Asset 上传/选择契约提交一个真实 `attachmentAssetIds`，不得用本地路径或自然语言描述代替资产身份。
|
||||
@@ -106,4 +108,4 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
|
||||
## Last Updated
|
||||
|
||||
2026-09-05
|
||||
2026-09-07
|
||||
Reference in new issue
Block a user