chore(coding): record ML-05 integration

This commit is contained in:
2026-08-26 21:34:57 +08:00
parent e842dd42eb
commit 14fec70108
2 changed files with 48 additions and 124 deletions

View File

@@ -119,6 +119,18 @@
remains in `D:\Datas\OthersProjects\makelore-ml04-pi-data-tools-8d3c91a7`.
The ML-04 frontier is `f61990f3a7f5ea417ca3eecc6702e71398f77d7f` plus this
coordinator cleanup/record commit.
- Integrated ML-05 from source commit
`080b8801d29274b506700f94391339d98fb7aa0d` at the exact ML-04 frontier
`bec67082b3dade05e900911c13ad804e781309f6` as coordinator commit `e842dd4`
(`feat(coding): add preview data runtime session`), with no cherry-pick
conflict. The delivered scope is limited to the Main-owned ephemeral
preview session manager, exact `/api/runtime/data/v1` data-only routes,
early route precedence, trusted Data Service forwarding, lifecycle
invalidation wiring, and focused loopback coverage; ML-06 pre-document
injection was not included. The foreign ML-05 task record was removed from
this coordinator after cherry-pick; the source record remains in
`D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71`.
The ML-06 frontier is `e842dd4` plus this coordinator cleanup/record commit.
## Verification
@@ -206,13 +218,45 @@
- ML-04 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing
warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
- ML-04 `git diff --check`: passed after the foreign task-record cleanup.
- ML-05 source focused/loopback suite:
`pnpm exec vitest run tests/unit/preview-data-session.test.ts
tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts
tests/unit/agent-browser-core.test.ts
tests/unit/coding-attachments-routes.test.ts --maxWorkers=1` — 5 files /
107 tests passed.
- ML-05 adjacent Data Service/client regressions:
`pnpm exec vitest run tests/unit/data-service-client.test.ts
tests/unit/data-service-routes.test.ts
tests/unit/data-service-server-registration.test.ts
tests/unit/coding-conversation-contracts.test.ts
tests/unit/coding-conversation-timeline.test.tsx
tests/unit/coding-product-tools-facade.test.ts
tests/unit/pi-extension-ui-projector.test.ts tests/unit/pi-product-tools.test.ts
tests/unit/pi-extension-bundle.test.ts tests/unit/pi-extension-host.test.ts
--maxWorkers=1` — 10 files / 62 tests passed.
- ML-05 `pnpm typecheck`: passed.
- ML-05 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing
warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
- ML-05 `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS
packaging; the existing dynamic-import/chunk, optional dependency, and
absent optional packaged-resource warnings remained visible.
- ML-05 `pnpm test:electron:windows`: 2 files / 4 tests passed.
- ML-05 `git diff --check`: passed; the only coordinator deletion is the
foreign ML-05 task record, and the source worktree retains it.
- ML-05 exclusion scan over the merged diff found no
`injectProjectData`, `__MAKELORE_DATA__`,
`Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or navigation
injection markers.
## Follow-ups
- ML-02 identity choice and legacy/independent-copy UX plus ML-03 Main Data
Service and ML-04 Pi Data Service tools are integrated. ML-04 consumed the
`DataServiceOperations` seam from the recorded ML-03 frontier and preserves
its active-project identity and trusted project-path constraints.
- ML-02 identity choice and legacy/independent-copy UX, ML-03 Main Data
Service, ML-04 Pi Data Service tools, and ML-05 preview data sessions are
integrated. ML-04 consumed the `DataServiceOperations` seam from the
recorded ML-03 frontier and preserves its active-project identity and
trusted project-path constraints. ML-05 consumes that same trusted seam and
preserves the Main-owned credential boundary while leaving ML-06 injection
for the next ticket.
- The broader ML-00 through ML-09 coordinator task remains in progress; this
record does not claim full client-suite, build, review, or release proof.

View File

@@ -1,120 +0,0 @@
# Task: ML-05 preview session manager and local data routes
## Identity
- Task ID: 20260826-ml05-preview-data-session-5c8e2a71
- Mode: Feature
- Branch: codex/20260826-ml05-preview-data-session-5c8e2a71-ml05-preview-data-session-5c8e2a71
- Worktree: D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71
- Base commit: bec67082b3dade05e900911c13ad804e781309f6
- Owner: ml05_preview_session
- Status: Ready for integration
## Scope
- Implement the Main-owned ephemeral preview data-session manager and the
exact `/api/runtime/data/v1` local runtime routes from the ML-05 contract.
- Wire session creation and invalidation through Coding composition, Works
Square session lifecycle, active project/identity transitions, Agent Browser
lifecycle callbacks, and Main shutdown without implementing ML-06 injection.
- Add focused unit coverage and real loopback HTTP coverage for auth, Origin,
method/header, bounds, rate, route-precedence, forwarding, and invalidation
behavior.
## Intent And Constraints
- Keep the bearer capability ephemeral: 32 random bytes encoded base64url,
bound to the active real project path, canonical durable project ID, exact
preview Origin, and browser generation. Never persist or log it.
- Expose only data-plane GET/list/PUT/DELETE plus OPTIONS. Require exact-Origin
CORS and `Authorization` on non-OPTIONS requests, enforce 96 KiB request and
1.25 MiB response bounds, and charge one token per authorized non-OPTIONS
operation using a 5/s, capacity-30 bucket; OPTIONS is free.
- Insert the trusted project path through the existing ML-03/ML-04
`DataServiceOperations` seam. Do not accept project/owner/path authority
from the local URL or request body and do not reach lifecycle/general Host
routes, `/api/me/*`, or the Renderer in-process dispatcher.
- Dispatch the exact `/api/runtime/data/v1` branch in `electron/api/server.ts`
before global Host-token, generic CORS, OPTIONS, or content-type gates.
- Invalidate synchronously on logout/session clear, project deactivation or
identity change, browser close/detach/crash/generation replacement or
cross-Origin main-frame navigation, and Main shutdown. Same-Origin preview
navigation may retain the session.
- Preserve existing Works session observer behavior; change
`works-square-session.ts` only when its public observer seam is insufficient.
- Keep changes limited to ML-05 ownership paths and do not edit Agent Browser
injection or ML-06-specific contracts.
## Planning Gate
- Result: Passed on 2026-08-26.
- Concurrent Task Gate passed after creating the isolated worktree from exact
base `bec67082b3dade05e900911c13ad804e781309f6`; owner/status matched this
task ID, branch, and absolute worktree.
- Read the required MakeLore entry documents, integrated state, accepted auth
and Pi decisions, architecture/domain/evidence/commitment/stale indexes,
cross-repository ML-05 plan/spec/canonical contract/ADR, and every peer task
record's required scope sections. Nine planning peers remain placeholders;
the coordinator is the only semantically overlapping peer and explicitly
delegates ML-05 to this isolated worktree. No unresolved conflict blocks
implementation.
## Implementation Plan
1. Inspect the integrated ML-03/ML-04 interfaces and current Host server,
Coding composition, Works session, project lifecycle, and browser callback
seams; keep the session API narrow and Main-private.
2. Implement session binding, token/Origin/method/header checks, bounds,
token-bucket accounting, CORS, cloud forwarding, and exact early route
dispatch.
3. Wire creation and every required invalidation source, including shutdown,
while preserving observer snapshot/unsubscribe semantics.
4. Add focused unit and real loopback HTTP tests proving successful data
operations, rejection/isolation, limits, rate behavior, and invalidation.
5. Run focused tests, typecheck/lint/build where affected, diff checks, and
task-aware documentation gates before producing one commit.
## Outcome
- Added `electron/services/preview-data-session.ts` with a Main-owned in-memory
32-byte base64url bearer, active real-project/durable-identity binding, exact
Origin and browser-generation binding, Works Square account observation, a
continuous 5/s capacity-30 bucket, and synchronous invalidation/disposal.
- Added `electron/api/routes/runtime-data.ts` for direct data-only document/list
DTOs, exact-Origin CORS, request-header/method checks, bounded JSON bodies and
responses, strong ETags, conditional writes/deletes, trusted project-path
forwarding, and no lifecycle/project-management/general Host operations.
- Added the exact early `/api/runtime/data/v1` branch in `electron/api/server.ts`
and wired composition/Main project, Works session, Agent Browser lifecycle,
and shutdown invalidation. The Agent Browser change is limited to a narrow
lifecycle observer; it contains no ML-06 data injection, CDP new-document
script, script-ID, or navigation-injection behavior.
- Added focused manager and real loopback HTTP coverage for successful
GET/list/PUT/DELETE/OPTIONS operations, route precedence and general Host
isolation, trusted path forwarding, CORS/auth/header rejection, limits, rate
accounting, ETags, response validation, and all session invalidation paths.
## Verification
- `pnpm exec vitest run tests/unit/preview-data-session.test.ts tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts tests/unit/agent-browser-core.test.ts tests/unit/coding-attachments-routes.test.ts`: 5 files / 107 tests passed, including real loopback HTTP.
- `pnpm typecheck`: passed.
- `pnpm exec eslint` on all changed production/test files: passed.
- `pnpm lint:check`: passed with 0 errors and 5 pre-existing warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
- `pnpm test`: 187 files / 1,581 passed / 2 skipped, plus the single pressure test passed.
- `pnpm test:electron:windows`: 2 files / 4 tests passed.
- `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS packaging; only existing chunk/dynamic-import, optional-platform-dependency, and absent optional packaged-resource warnings were reported.
- `git diff --check`: passed (only Git LF/CRLF normalization warnings).
- ML-06 exclusion scan: no `injectProjectData`, `__MAKELORE_DATA__`, `Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or loopback-target navigation injection was added.
## Follow-ups
- ML-06 must consume the narrow session/injection-value interface and implement
opt-in pre-document injection, script cleanup, and its own browser-open
acceptance tests after integrating this task; those behaviors are
intentionally absent here.
- Cross-repository signed-in PostgreSQL acceptance and the full Electron
preview write/read flow remain integration-stage work.
## Promotion Candidates
- None recorded.