diff --git a/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md b/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md index ccfa5c7..d280fd3 100644 --- a/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md +++ b/.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md @@ -119,6 +119,18 @@ remains in `D:\Datas\OthersProjects\makelore-ml04-pi-data-tools-8d3c91a7`. The ML-04 frontier is `f61990f3a7f5ea417ca3eecc6702e71398f77d7f` plus this coordinator cleanup/record commit. +- Integrated ML-05 from source commit + `080b8801d29274b506700f94391339d98fb7aa0d` at the exact ML-04 frontier + `bec67082b3dade05e900911c13ad804e781309f6` as coordinator commit `e842dd4` + (`feat(coding): add preview data runtime session`), with no cherry-pick + conflict. The delivered scope is limited to the Main-owned ephemeral + preview session manager, exact `/api/runtime/data/v1` data-only routes, + early route precedence, trusted Data Service forwarding, lifecycle + invalidation wiring, and focused loopback coverage; ML-06 pre-document + injection was not included. The foreign ML-05 task record was removed from + this coordinator after cherry-pick; the source record remains in + `D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71`. + The ML-06 frontier is `e842dd4` plus this coordinator cleanup/record commit. ## Verification @@ -206,13 +218,45 @@ - ML-04 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. - ML-04 `git diff --check`: passed after the foreign task-record cleanup. +- ML-05 source focused/loopback suite: + `pnpm exec vitest run tests/unit/preview-data-session.test.ts + tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts + tests/unit/agent-browser-core.test.ts + tests/unit/coding-attachments-routes.test.ts --maxWorkers=1` — 5 files / + 107 tests passed. +- ML-05 adjacent Data Service/client regressions: + `pnpm exec vitest run tests/unit/data-service-client.test.ts + tests/unit/data-service-routes.test.ts + tests/unit/data-service-server-registration.test.ts + tests/unit/coding-conversation-contracts.test.ts + tests/unit/coding-conversation-timeline.test.tsx + tests/unit/coding-product-tools-facade.test.ts + tests/unit/pi-extension-ui-projector.test.ts tests/unit/pi-product-tools.test.ts + tests/unit/pi-extension-bundle.test.ts tests/unit/pi-extension-host.test.ts + --maxWorkers=1` — 10 files / 62 tests passed. +- ML-05 `pnpm typecheck`: passed. +- ML-05 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing + warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. +- ML-05 `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS + packaging; the existing dynamic-import/chunk, optional dependency, and + absent optional packaged-resource warnings remained visible. +- ML-05 `pnpm test:electron:windows`: 2 files / 4 tests passed. +- ML-05 `git diff --check`: passed; the only coordinator deletion is the + foreign ML-05 task record, and the source worktree retains it. +- ML-05 exclusion scan over the merged diff found no + `injectProjectData`, `__MAKELORE_DATA__`, + `Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or navigation + injection markers. ## Follow-ups -- ML-02 identity choice and legacy/independent-copy UX plus ML-03 Main Data - Service and ML-04 Pi Data Service tools are integrated. ML-04 consumed the - `DataServiceOperations` seam from the recorded ML-03 frontier and preserves - its active-project identity and trusted project-path constraints. +- ML-02 identity choice and legacy/independent-copy UX, ML-03 Main Data + Service, ML-04 Pi Data Service tools, and ML-05 preview data sessions are + integrated. ML-04 consumed the `DataServiceOperations` seam from the + recorded ML-03 frontier and preserves its active-project identity and + trusted project-path constraints. ML-05 consumes that same trusted seam and + preserves the Main-owned credential boundary while leaving ML-06 injection + for the next ticket. - The broader ML-00 through ML-09 coordinator task remains in progress; this record does not claim full client-suite, build, review, or release proof. diff --git a/.project-docs/30-worklog/tasks/20260826-ml05-preview-data-session-5c8e2a71.md b/.project-docs/30-worklog/tasks/20260826-ml05-preview-data-session-5c8e2a71.md deleted file mode 100644 index 3b226fd..0000000 --- a/.project-docs/30-worklog/tasks/20260826-ml05-preview-data-session-5c8e2a71.md +++ /dev/null @@ -1,120 +0,0 @@ -# Task: ML-05 preview session manager and local data routes - -## Identity - -- Task ID: 20260826-ml05-preview-data-session-5c8e2a71 -- Mode: Feature -- Branch: codex/20260826-ml05-preview-data-session-5c8e2a71-ml05-preview-data-session-5c8e2a71 -- Worktree: D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71 -- Base commit: bec67082b3dade05e900911c13ad804e781309f6 -- Owner: ml05_preview_session -- Status: Ready for integration - -## Scope - -- Implement the Main-owned ephemeral preview data-session manager and the - exact `/api/runtime/data/v1` local runtime routes from the ML-05 contract. -- Wire session creation and invalidation through Coding composition, Works - Square session lifecycle, active project/identity transitions, Agent Browser - lifecycle callbacks, and Main shutdown without implementing ML-06 injection. -- Add focused unit coverage and real loopback HTTP coverage for auth, Origin, - method/header, bounds, rate, route-precedence, forwarding, and invalidation - behavior. - -## Intent And Constraints - -- Keep the bearer capability ephemeral: 32 random bytes encoded base64url, - bound to the active real project path, canonical durable project ID, exact - preview Origin, and browser generation. Never persist or log it. -- Expose only data-plane GET/list/PUT/DELETE plus OPTIONS. Require exact-Origin - CORS and `Authorization` on non-OPTIONS requests, enforce 96 KiB request and - 1.25 MiB response bounds, and charge one token per authorized non-OPTIONS - operation using a 5/s, capacity-30 bucket; OPTIONS is free. -- Insert the trusted project path through the existing ML-03/ML-04 - `DataServiceOperations` seam. Do not accept project/owner/path authority - from the local URL or request body and do not reach lifecycle/general Host - routes, `/api/me/*`, or the Renderer in-process dispatcher. -- Dispatch the exact `/api/runtime/data/v1` branch in `electron/api/server.ts` - before global Host-token, generic CORS, OPTIONS, or content-type gates. -- Invalidate synchronously on logout/session clear, project deactivation or - identity change, browser close/detach/crash/generation replacement or - cross-Origin main-frame navigation, and Main shutdown. Same-Origin preview - navigation may retain the session. -- Preserve existing Works session observer behavior; change - `works-square-session.ts` only when its public observer seam is insufficient. -- Keep changes limited to ML-05 ownership paths and do not edit Agent Browser - injection or ML-06-specific contracts. - -## Planning Gate - -- Result: Passed on 2026-08-26. -- Concurrent Task Gate passed after creating the isolated worktree from exact - base `bec67082b3dade05e900911c13ad804e781309f6`; owner/status matched this - task ID, branch, and absolute worktree. -- Read the required MakeLore entry documents, integrated state, accepted auth - and Pi decisions, architecture/domain/evidence/commitment/stale indexes, - cross-repository ML-05 plan/spec/canonical contract/ADR, and every peer task - record's required scope sections. Nine planning peers remain placeholders; - the coordinator is the only semantically overlapping peer and explicitly - delegates ML-05 to this isolated worktree. No unresolved conflict blocks - implementation. - -## Implementation Plan - -1. Inspect the integrated ML-03/ML-04 interfaces and current Host server, - Coding composition, Works session, project lifecycle, and browser callback - seams; keep the session API narrow and Main-private. -2. Implement session binding, token/Origin/method/header checks, bounds, - token-bucket accounting, CORS, cloud forwarding, and exact early route - dispatch. -3. Wire creation and every required invalidation source, including shutdown, - while preserving observer snapshot/unsubscribe semantics. -4. Add focused unit and real loopback HTTP tests proving successful data - operations, rejection/isolation, limits, rate behavior, and invalidation. -5. Run focused tests, typecheck/lint/build where affected, diff checks, and - task-aware documentation gates before producing one commit. - -## Outcome - -- Added `electron/services/preview-data-session.ts` with a Main-owned in-memory - 32-byte base64url bearer, active real-project/durable-identity binding, exact - Origin and browser-generation binding, Works Square account observation, a - continuous 5/s capacity-30 bucket, and synchronous invalidation/disposal. -- Added `electron/api/routes/runtime-data.ts` for direct data-only document/list - DTOs, exact-Origin CORS, request-header/method checks, bounded JSON bodies and - responses, strong ETags, conditional writes/deletes, trusted project-path - forwarding, and no lifecycle/project-management/general Host operations. -- Added the exact early `/api/runtime/data/v1` branch in `electron/api/server.ts` - and wired composition/Main project, Works session, Agent Browser lifecycle, - and shutdown invalidation. The Agent Browser change is limited to a narrow - lifecycle observer; it contains no ML-06 data injection, CDP new-document - script, script-ID, or navigation-injection behavior. -- Added focused manager and real loopback HTTP coverage for successful - GET/list/PUT/DELETE/OPTIONS operations, route precedence and general Host - isolation, trusted path forwarding, CORS/auth/header rejection, limits, rate - accounting, ETags, response validation, and all session invalidation paths. - -## Verification - -- `pnpm exec vitest run tests/unit/preview-data-session.test.ts tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts tests/unit/agent-browser-core.test.ts tests/unit/coding-attachments-routes.test.ts`: 5 files / 107 tests passed, including real loopback HTTP. -- `pnpm typecheck`: passed. -- `pnpm exec eslint` on all changed production/test files: passed. -- `pnpm lint:check`: passed with 0 errors and 5 pre-existing warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `pnpm test`: 187 files / 1,581 passed / 2 skipped, plus the single pressure test passed. -- `pnpm test:electron:windows`: 2 files / 4 tests passed. -- `pnpm build`: passed Vite, Electron, Pi runtime, and Windows NSIS packaging; only existing chunk/dynamic-import, optional-platform-dependency, and absent optional packaged-resource warnings were reported. -- `git diff --check`: passed (only Git LF/CRLF normalization warnings). -- ML-06 exclusion scan: no `injectProjectData`, `__MAKELORE_DATA__`, `Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or loopback-target navigation injection was added. - -## Follow-ups - -- ML-06 must consume the narrow session/injection-value interface and implement - opt-in pre-document injection, script cleanup, and its own browser-open - acceptance tests after integrating this task; those behaviors are - intentionally absent here. -- Cross-repository signed-in PostgreSQL acceptance and the full Electron - preview write/read flow remain integration-stage work. - -## Promotion Candidates - -- None recorded.