docs(integration): record native HTTP1 diagnostic package
This commit is contained in:
@@ -1,56 +0,0 @@
|
||||
# Task: Build HTTP2-disabled diagnostic package
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260819-disable-http2-package-b84c7e
|
||||
- Mode: Feature
|
||||
- Branch: codex/20260819-disable-http2-package-b84c7e-disable-http2-package
|
||||
- Worktree: D:\mk-disable-http2-b84c7e
|
||||
- Base commit: 9ff79e96813ebadade0aecb8f407edf5aee0144a
|
||||
- Owner: codex-root
|
||||
- Status: Completed
|
||||
|
||||
## Scope
|
||||
|
||||
- Build a Windows x64 diagnostic installer from local `main` base `9ff79e9` with Chromium HTTP/2 disabled globally so the user can A/B the observed request fan-out stall against HTTP/1.1.
|
||||
- Keep the source change limited to Electron Main startup and a focused ordering regression test; do not change Quote, authentication, retry, timeout, Renderer, or server behavior.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Apply Chromium's `disable-http2` command-line switch before `app.whenReady()`, window creation, or network initialization.
|
||||
- Treat the installer as diagnostic evidence, not a permanent protocol policy or a fix for the independent unbounded shared authentication flights.
|
||||
- Build with the exact pnpm version pinned by `packageManager`; do not commit generated packages, downloaded runtimes, caches, or secrets.
|
||||
- Keep all work in `D:\mk-disable-http2-b84c7e`; the main worktree remains owned by a superseded packaging record and is not modified.
|
||||
- The user previously prohibited sub-agents; implementation and validation are performed directly without delegated or reviewer agents.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Added `app.commandLine.appendSwitch('disable-http2')` at Electron Main bootstrap, before the single-instance lock and `app.whenReady()`.
|
||||
- Added a focused regression test that guards the switch and its startup ordering.
|
||||
- Built the Windows x64 diagnostic installer `release/Makelore-2.0.0-win-x64.exe` without installing it or interrupting the user's running client.
|
||||
- The package reuses the installed client's repository-validated, versioned Learning Player (`htmlSha256` `748d6d7c74d9d0ba444e0c051a50010f7070e7d6e46442b1e60f1e2be80fd020`) so the transport switch remains the intended A/B variable.
|
||||
|
||||
## Verification
|
||||
|
||||
- Red test: `pnpm exec vitest run tests/unit/http2-diagnostic-bootstrap.test.ts --reporter=verbose` failed before implementation because the switch was absent.
|
||||
- Green test: the same focused Vitest command passed after implementation (1 test).
|
||||
- `pnpm run typecheck` passed.
|
||||
- `pnpm exec eslint electron/main/index.ts tests/unit/http2-diagnostic-bootstrap.test.ts` passed.
|
||||
- `pnpm run build:vite` passed; only pre-existing Vite chunk/dynamic-import warnings were emitted.
|
||||
- Packaged Main inspection found `disable-http2` in `dist-electron/main/index-Cn0aQm66.js` at byte offset 500965, before `requestSingleInstanceLock` at 501868 and `whenReady` at 511598.
|
||||
- `pnpm run verify:publish-runtime` passed (`npm 11.6.2`).
|
||||
- `pnpm run verify:artifact:win -- --allow-dirty --installer .\\release\\Makelore-2.0.0-win-x64.exe` passed for Electron 43.4.0, Node 24.18.1, OpenCode 1.18.9, Python, uv 0.10.0, npm 11.6.2, native modules, and Unicode-copy proof.
|
||||
- Packaged `package.json` reports version `2.0.0`; installer FileVersion and ProductVersion are both `2.0.0`.
|
||||
- Installer size: 302,025,645 bytes; SHA-256: `1C4E4E67F29A58E81705CA258E171200576BE41B313B4CD794D49CD296B479EE`.
|
||||
- Authenticode status is `NotSigned`, consistent with the local unsigned packaging configuration.
|
||||
- `git diff --check` passed.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- The user should exit the currently running Makelore instance, install the diagnostic package, reproduce the same Quote PATCH flow, and compare whether global pending requests and `net::ERR_HTTP2_PROTOCOL_ERROR` disappear.
|
||||
- If the stall remains under forced HTTP/1.1, resume diagnosis at the shared authentication/request single-flight path rather than treating HTTP/2 as the root cause.
|
||||
- If the stall disappears, capture server/proxy and Chromium NetLog evidence before deciding whether to keep a protocol workaround or repair the HTTP/2 path.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- Keep the startup switch temporary until the A/B result is known; do not promote it as a permanent release policy without evidence.
|
||||
@@ -1,128 +0,0 @@
|
||||
# Task: Implement Makelore native password and SMS login
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260819-makelore-native-login-1f3a9c
|
||||
- Mode: Feature
|
||||
- Branch: codex/20260819-makelore-native-login-1f3a9c-makelore-native-login
|
||||
- Worktree: D:\w\makelore-native-login-1f3a9c
|
||||
- Base commit: abece81fdb178711d4dcbe1f87b987f54d71d6dd
|
||||
- Owner: codex-root
|
||||
- Status: Ready for integration
|
||||
|
||||
## Scope
|
||||
|
||||
- Replace the renderer-triggered browser authorization flow with native password
|
||||
and SMS-code login that uses the existing Works Square authentication facade.
|
||||
- Preserve Main-owned session persistence, runtime cleanup, token refresh,
|
||||
logout, and module-access projection behavior.
|
||||
- Add focused Main, store, and login-page regression coverage; keep README's
|
||||
current-product description aligned with the new login surface.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Renderer must use the existing Host API abstraction and never receive a
|
||||
refresh token or call Works Square directly.
|
||||
- Password and SMS initial login must go through Works Square `/api/auth/*`,
|
||||
so server-owned OAuth credentials, encryption, and SMS client configuration
|
||||
remain server-side.
|
||||
- Retain the existing fail-closed cross-account runtime cleanup before a new
|
||||
login; do not weaken the seven-day inactivity/session ownership model.
|
||||
- Do not change the established Main refresh/logout protocol until the
|
||||
OneFeel-facing Works Square proxy contract has been separately verified.
|
||||
- Browser authorization routes may be retired only after code search confirms
|
||||
there is no remaining client dependency; Works Square desktop broker APIs
|
||||
are outside this task.
|
||||
|
||||
## Plan
|
||||
|
||||
1. Replace Main's legacy direct OneFeel password flow with bounded proxies for
|
||||
password login, captcha image, SMS send, and SMS login, committing the
|
||||
managed session through the existing session service.
|
||||
2. Replace the Renderer browser-login action with password and SMS actions
|
||||
that consume only the safe Host API response and retain module-access
|
||||
hydration semantics.
|
||||
3. Replace the browser-login page with the Web-aligned password/SMS tabs,
|
||||
agreement gate, captcha lifecycle, SMS cooldown, safe error display, and
|
||||
controlled help links.
|
||||
4. Run focused tests, typecheck, lint/build, a final independent review, and
|
||||
task-scoped documentation checks.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Replaced the retired browser-authorization entry point with native password
|
||||
and SMS-code login in the Makelore client.
|
||||
- The Renderer now uses only Host API routes. Main proxies initial-login,
|
||||
captcha, SMS, and public-link requests through Works Square, commits the
|
||||
refresh token only to Main-owned secure persistence, and returns only the
|
||||
safe token/session projection to the Renderer.
|
||||
- Preserved the existing managed-runtime cleanup, module-access hydration,
|
||||
refresh, logout, and seven-day inactivity behaviors. The Main refresh/logout
|
||||
transport remains on its existing direct protocol pending separately verified
|
||||
Works Square lifecycle proxy support.
|
||||
- Retired the local browser-start route and UI. The native page implements
|
||||
password/SMS tabs, agreement and configured help links, UUID/no-store PNG
|
||||
captcha handling, stale-response rejection, fresh captcha on every SMS-tab
|
||||
entry, SMS cooldown, and model-config synchronization rollback on failure.
|
||||
- Removed the Renderer-controlled logout gateway after independent review found
|
||||
that it could leak the Main-held bearer token. Logout now accepts only an
|
||||
access-token field and always targets the configured trusted gateway.
|
||||
- Produced the requested local Windows x64 installer from this native-login
|
||||
worktree: `release\\Makelore-2.0.0-win-x64.exe`. It is intentionally
|
||||
unsigned and unpublished; no workstation release credential was included.
|
||||
- The package includes a validated local OpenMAIC learner-player artifact built
|
||||
in a separate disposable worktree at commit
|
||||
`58d1ddc2644f4c8631d62eb0e5423365af95ef66`. Its HTML checksum is
|
||||
`748d6d7c74d9d0ba444e0c051a50010f7070e7d6e46442b1e60f1e2be80fd020`.
|
||||
- GitHub repeatedly timed out while fetching the pinned uv `0.10.0` archive.
|
||||
The local package therefore uses an already installed, version-verified
|
||||
Windows `uv 0.10.9`; the resulting runtime was checked in the package
|
||||
verifier and this is not a formal release substitute.
|
||||
|
||||
## Verification
|
||||
|
||||
- `pnpm exec vitest run --reporter=dot` — passed: 183 files, 2,177 tests.
|
||||
- Focused login/session suite — passed: 5 files, 95 tests.
|
||||
- `pnpm run typecheck` — passed.
|
||||
- `pnpm run lint:check` — passed with 7 pre-existing warnings and no errors.
|
||||
- `pnpm run build:vite` — passed (existing chunk-size and mixed-import notices
|
||||
only).
|
||||
- `node ./node_modules/@playwright/test/cli.js test app-smoke.spec.ts --grep
|
||||
"can skip setup and open the native login surface" --reporter=line` — passed:
|
||||
1 desktop Electron smoke test.
|
||||
- Independent final review — PASS after the logout-target security fix;
|
||||
reviewer traced Renderer-to-Works login/session/logout flows and verified the
|
||||
attacker-controlled `authBase` regression.
|
||||
- `git diff --check` — passed.
|
||||
- `pnpm run package:stage:win-x64` with
|
||||
`MAKELORE_LEARNING_PLAYER_ARTIFACT` set to the isolated artifact — passed;
|
||||
Makelore accepted and copied the verified player resource.
|
||||
- `node scripts/run-electron-builder.mjs --win --publish never` — passed and
|
||||
produced `release\\Makelore-2.0.0-win-x64.exe`.
|
||||
- `pnpm run verify:artifact:win -- --allow-dirty --installer
|
||||
release\\Makelore-2.0.0-win-x64.exe` — passed. It verified Electron 43.4.0,
|
||||
Node 24.18.1, OpenCode 1.18.9, Python, uv 0.10.9, npm 11.6.2, the bundled
|
||||
player, and required native modules.
|
||||
- Installer SHA-256:
|
||||
`EFA94BAED02A89A2BFCD8BB74B1B914C481419FBD10302D4606EDC5183ED67B7`
|
||||
(302,496,674 bytes / 288.48 MiB). Authenticode status: `NotSigned`.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Before release, perform a staging/production smoke test using real password
|
||||
and SMS login: captcha load/refresh, SMS send/cooldown, login, `/me`, app
|
||||
restart/session refresh, logout, and all configured legal/recovery links.
|
||||
- Verify and then migrate Main refresh/logout traffic to a Works Square proxy
|
||||
only after the OneFeel lifecycle contract is confirmed. Do not alter the
|
||||
current direct Main-owned path speculatively.
|
||||
- Retire the legacy Works Square `/api/auth/desktop/*` broker only in a
|
||||
separately planned compatibility window for older desktop clients.
|
||||
- A signed or published release must rebuild using the release-controlled
|
||||
pinned uv input and a retained/versioned OpenMAIC player artifact, then pass
|
||||
the normal signing, provenance, and production smoke-test gates.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- No canonical project-document promotion is needed. The current product
|
||||
boundary is reflected in README; the full Works Square refresh/logout proxy
|
||||
decision remains pending protocol evidence.
|
||||
@@ -0,0 +1,60 @@
|
||||
# Task: Integrate native login and HTTP2-disabled diagnostic package
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260819-native-http1-package-c7e4
|
||||
- Mode: Integration
|
||||
- Branch: codex/20260819-native-http1-package-c7e4-native-http1-package
|
||||
- Worktree: D:\mk-native-http1-package-c7e4
|
||||
- Base commit: 9ff79e96813ebadade0aecb8f407edf5aee0144a
|
||||
- Owner: codex-root
|
||||
- Status: Completed
|
||||
|
||||
## Scope
|
||||
|
||||
- Integrate the completed native password/mobile-code login change from commit `5a048da8a615792dee9e0c76b6fda814aaa1b854`.
|
||||
- Integrate the temporary Electron HTTP/2 diagnostic bootstrap from commit `411cd9cedfeb14df0c839e6e1cbf1110826ad0e6`.
|
||||
- Produce and verify a Windows x64 diagnostic installer without promoting either change to the default branch.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Preserve the Main-owned authentication boundary: Renderer login requests continue through Host API routes.
|
||||
- Replace the failing browser desktop-auth flow with the already completed password and mobile verification-code surfaces.
|
||||
- Keep `app.commandLine.appendSwitch('disable-http2')` before the single-instance lock and `app.whenReady()` so every Electron network context inherits the diagnostic switch.
|
||||
- Treat this as an isolated diagnostic package. The default branch and canonical current-state snapshot are not advanced by this task.
|
||||
- Use the project-pinned Python runtime and verified `uv 0.10.0`; do not reuse the earlier native-login package's temporary `uv 0.10.9` substitution.
|
||||
- The user explicitly requested direct execution without sub-agents, so verification was performed in the primary task.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Merged native login as integration commit `3ba90af` and HTTP/2 disablement as integration commit `c1548e6` with no conflicts.
|
||||
- Generated `D:\mk-native-http1-package-c7e4\release\Makelore-2.0.0-win-x64.exe`.
|
||||
- Installer size: `302025649` bytes.
|
||||
- Installer SHA-256: `2A81ECC39A55E3F01ED90A8D1D564E020E82671779E72B50EB76282197D31EC2`.
|
||||
- Authenticode status: `NotSigned`, consistent with the local diagnostic-package environment.
|
||||
- Final `app.asar` contains the password login, mobile login, SMS-code and image-code routes and native login UI, while `/api/auth/browser/start` is absent.
|
||||
- Final `app.asar` contains `disable-http2` before both `requestSingleInstanceLock` and `whenReady` in the packaged Main bootstrap.
|
||||
|
||||
## Verification
|
||||
|
||||
- `pnpm exec vitest run tests/unit/http2-diagnostic-bootstrap.test.ts tests/unit/auth-routes.test.ts tests/unit/auth-store.test.ts tests/unit/login-page.test.tsx tests/unit/works-square-session.test.ts tests/unit/works-square-session-persistence.test.ts tests/unit/works-square-session-persistence-policy.test.ts --reporter=dot` — PASS, 7 files / 98 tests.
|
||||
- `pnpm run typecheck` — PASS.
|
||||
- Scoped ESLint over the changed Main, Renderer, E2E and unit-test files — PASS.
|
||||
- `pnpm test` — PASS, 184 files / 2185 tests.
|
||||
- `pnpm run build:vite` — PASS.
|
||||
- Electron smoke test `can skip setup and open the native login surface` — PASS, 1 test.
|
||||
- `pnpm run package:stage:win-x64` with the verified Learning Player artifact — PASS.
|
||||
- `node scripts/run-electron-builder.mjs --win --publish never` — PASS.
|
||||
- `pnpm run verify:publish-runtime` — PASS, npm `11.6.2`.
|
||||
- `pnpm run verify:artifact:win -- --allow-dirty --installer .\release\Makelore-2.0.0-win-x64.exe` — PASS; Electron `43.4.0`, Node `24.18.1`, OpenCode `1.18.9`, Python runtime present, `uv 0.10.0`, native addons present.
|
||||
- `node scripts/verify-learning-player-artifact.mjs release\win-unpacked\resources\resources\learning-player` — PASS, SHA-256 `748d6d7c74d9d0ba444e0c051a50010f7070e7d6e46442b1e60f1e2be80fd020`.
|
||||
- Direct packaged `app.asar` assertions for the HTTP/2 switch ordering, native auth routes/UI and removal of the legacy browser-start route — PASS.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Install this diagnostic package and confirm that password/mobile-code authorization succeeds against the live Works service.
|
||||
- Reproduce the generation-quote request sequence. If the global loading freeze still occurs, the result rules out HTTP/2 as the sole cause and request ownership/cancellation in the quote flow should be instrumented next.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- None from this packaging task. Promotion of native login or temporary HTTP/2 disablement remains an explicit default-branch integration decision after live validation.
|
||||
Reference in New Issue
Block a user