chore(coding): record ML-06 integration

.project-docs/30-worklog/tasks/20260826-makelore-data-service-client-b72e4c19.md

@@ -131,6 +131,18 @@
   this coordinator after cherry-pick; the source record remains in
   `D:\Datas\OthersProjects\makelore-ml05-preview-data-session-5c8e2a71`.
   The ML-06 frontier is `e842dd4` plus this coordinator cleanup/record commit.
+- Integrated ML-06 from source commit
+  `992a0a68d743f766f19bc34c245adca4431ba321` at the exact ML-05 frontier
+  `14fec701086f60d78466b8e1cc3fb57ca8d7e200` as coordinator commit `38d63a9`
+  (`feat(agent-browser): add opt-in preview data injection`), with no
+  cherry-pick conflict. The delivered scope is limited to the explicit Agent
+  Browser preview-data opt-in, exact-Origin CDP pre-document script lifecycle,
+  child-session tracking/cleanup, and Main/session invalidation wiring; the
+  ordinary arbitrary-URL path remains data-free and no second BrowserWindow or
+  preload was added. The foreign ML-06 task record was removed from this
+  coordinator after cherry-pick; the source record remains in
+  `D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4`.
+  The ML-07 frontier is `38d63a9` plus this coordinator cleanup/record commit.
 
 ## Verification
 
@@ -247,16 +259,55 @@
   `injectProjectData`, `__MAKELORE_DATA__`,
   `Page.addScriptToEvaluateOnNewDocument`, script-ID tracking, or navigation
   injection markers.
+- ML-06 was integrated from source commit
+  `992a0a68d743f766f19bc34c245adca4431ba321` at the exact ML-05 frontier
+  `14fec701086f60d78466b8e1cc3fb57ca8d7e200` as coordinator commit `38d63a9`
+  (`feat(agent-browser): add opt-in preview data injection`), with no
+  cherry-pick conflict. The change adds only the explicit Agent Browser
+  preview-data opt-in, exact-Origin CDP pre-document script lifecycle,
+  child-session tracking/cleanup, and Main/session invalidation wiring. The
+  foreign ML-06 task record was removed from this coordinator after
+  cherry-pick; the source record remains in
+  `D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4`.
+  The ML-07 frontier is `38d63a9` plus this coordinator cleanup/record commit.
+- ML-06 focused Vitest:
+  `pnpm exec vitest run tests/unit/agent-browser-core.test.ts
+  tests/unit/agent-browser-routes.test.ts tests/unit/pi-product-tools.test.ts
+  tests/unit/coding-core-routes.test.ts --maxWorkers=1` — 4 files / 122 tests
+  passed.
+- ML-05 preview regressions after ML-06:
+  `pnpm exec vitest run tests/unit/preview-data-session.test.ts
+  tests/unit/data-service-routes.test.ts tests/unit/coding-core-routes.test.ts
+  tests/unit/agent-browser-core.test.ts
+  tests/unit/coding-attachments-routes.test.ts --maxWorkers=1` — 5 files /
+  120 tests passed.
+- ML-06 `pnpm test:electron:windows`: 2 files / 4 tests passed.
+- ML-06 `pnpm typecheck`: passed.
+- ML-06 `pnpm lint:check`: passed with 0 errors and the same 5 pre-existing
+  warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
+- ML-06 `pnpm build:vite`: passed for renderer, Main, preload, and utility
+  worker; existing dynamic-import and large-chunk warnings remained visible.
+- ML-06 full E2E `pnpm test:e2e`: 25 tests passed and 1 existing test failed
+  at `tests/e2e/pi-coding-first-chat.spec.ts:575` because the `当前对话模型`
+  combobox remained disabled until timeout. A direct rerun of that test
+  reproduced the same timeout; this is not an ML-06 injection path and is not
+  counted as an E2E pass.
+- ML-06 boundary checks passed: no new `BrowserWindow` or preload was added,
+  the ordinary arbitrary-URL path remains data-free, and the expected changed
+  path list contains only Agent Browser/session wiring, route/Pi propagation,
+  focused tests, and the task record.
+- ML-06 `git diff --check`: passed after foreign task-record cleanup.
 
 ## Follow-ups
 
 - ML-02 identity choice and legacy/independent-copy UX, ML-03 Main Data
-  Service, ML-04 Pi Data Service tools, and ML-05 preview data sessions are
+  Service, ML-04 Pi Data Service tools, ML-05 preview data sessions, and ML-06
-  integrated. ML-04 consumed the `DataServiceOperations` seam from the
+  Agent Browser pre-document injection are integrated. ML-04 consumed the
-  recorded ML-03 frontier and preserves its active-project identity and
+  `DataServiceOperations` seam from the recorded ML-03 frontier and preserves
-  trusted project-path constraints. ML-05 consumes that same trusted seam and
+  its active-project identity and trusted project-path constraints. ML-05 and
-  preserves the Main-owned credential boundary while leaving ML-06 injection
+  ML-06 preserve the Main-owned credential boundary; ML-06 adds the narrow
-  for the next ticket.
+  exact-Origin injection seam for ML-07 while keeping ordinary arbitrary URL
+  opens data-free.
 - The broader ML-00 through ML-09 coordinator task remains in progress; this
   record does not claim full client-suite, build, review, or release proof.
 

.project-docs/30-worklog/tasks/20260826-ml06-agent-browser-injection-2c7e91a4.md

@@ -1,113 +0,0 @@
-# Task: Implement ML-06 Agent Browser pre-document injection
-
-## Identity
-
-- Task ID: 20260826-ml06-agent-browser-injection-2c7e91a4
-- Mode: Feature
-- Branch: codex/20260826-ml06-agent-browser-injection-2c7e91a4-ml06-agent-browser-injection
-- Worktree: D:\Datas\OthersProjects\makelore-ml06-agent-browser-injection-2c7e91a4
-- Base commit: 14fec701086f60d78466b8e1cc3fb57ca8d7e200
-- Owner: codex
-- Status: Ready for Integration
-
-## Scope
-
-- Implement ticket ML-06 against the exact ML-05 frontier
-  `14fec701086f60d78466b8e1cc3fb57ca8d7e200`.
-- Extend Agent Browser open inputs and the Pi `agent_browser` adapter with the
-  opt-in `injectProjectData` capability, without changing ordinary arbitrary-URL
-  opens.
-- Bind the accepted open to the ML-05 preview data session and install a
-  serialized exact-Origin CDP new-document script after debugger attach and
-  before the first target document load; track and remove every installed script.
-- Wire synchronous session invalidation and cleanup across cross-Origin
-  navigation/redirect, browser close/crash/detach/generation replacement,
-  project transitions, logout, and Main teardown, with focused unit/Electron/
-  E2E coverage where the repository prerequisites permit.
-
-## Intent And Constraints
-
-- Follow spec sections 10.1 and 10.4, ticket ML-06, the canonical Data Service
-  contract, and ADR-2026-08-26-makelore-development-data-service.md. Preserve the existing Agent Browser
-  abstraction, attach-before-load lifecycle, child-session handling, and single
-  BrowserWindow/view design.
-- Use only a narrow structural preview-session interface. Main remains the sole
-  Works credential owner; injected data contains only the local endpoint,
-  ephemeral token, and contract version. Do not add a generic dispatcher,
-  compatibility layer, preload, retry, cache, Firebase behavior, or ML-07 SDK /
-  Skill work.
-- The exact Origin guard is mandatory even while asynchronous CDP cleanup is in
-  flight. Data-enabled non-loopback targets must fail before any target page
-  load; failed session creation or script installation must tear down the view
-  before the target application can execute.
-
-## Planning Gate
-
-- Result: Passed on 2026-08-26.
-- Concurrent ownership is isolated from the occupied client coordinator and
-  matches this task ID, branch, absolute worktree, and exact base commit.
-- Loaded MakeLore AGENTS.md, required project-memory entry documents, active
-  coordinator task scope, accepted Data Service ADR, canonical contract, and
-  spec/plan sections 10.1 and 10.4. Active planning peers are either unrelated
-  or have placeholder scopes; no unresolved semantic conflict overlaps the ML-06
-  files. The coordinator owns the integration frontier and will cherry-pick this
-  task's single commit.
-
-## Implementation Plan
-
-1. Add red tests for opt-in propagation/rejection, attach-before-load script
-   installation and serialization, child target sessions, invalidation/removal,
-   and ordinary-open preservation.
-2. Add the narrow preview-session invalidation subscription and Agent Browser
-   capability state; install root/child scripts with tracked CDP IDs and strict
-   pre-load failure cleanup.
-3. Wire route/Pi input validation and Main/composition lifecycle subscription;
-   extend focused route/preview regressions without touching SDK/Skill work.
-4. Run focused tests, ML-05 regressions, typecheck/lint/build/Electron checks
-   available in this environment, inspect diff boundaries, update this record,
-   and run task-aware doc drift before returning one clean commit.
-
-## Outcome
-
-- Implemented ML-06 on the exact ML-05 frontier. Agent Browser now accepts an
-  explicit `injectProjectData` opt-in, rejects non-loopback targets before view
-  creation, opens a narrow preview session, and installs a serialized
-  exact-Origin `__MAKELORE_DATA__` new-document script after debugger attach
-  and before the target load. Root and document-child CDP sessions track script
-  identifiers; invalidation removes them and synchronously makes the token
-  unusable across navigation/redirect, close, project transitions, logout,
-  generation replacement, debugger detach, renderer crash, and Main shutdown.
-  Ordinary arbitrary-URL opens remain data-free, and route/Pi input propagation
-  is literal-true only. The child-target race is covered so a paused target is
-  released only after invalidation cleanup completes.
-
-## Verification
-
-- Focused Vitest: `pnpm exec vitest run tests/unit/agent-browser-core.test.ts
-  tests/unit/agent-browser-routes.test.ts tests/unit/pi-product-tools.test.ts
-  tests/unit/coding-core-routes.test.ts` — 4 files, 122 tests passed.
-- Full repository tests: `pnpm test` — 187 files, 1,596 passed, 2 skipped;
-  pressure test — 1 passed.
-- Electron smoke: `pnpm test:electron:windows` — 2 files, 4 tests passed.
-- TypeScript: `pnpm typecheck` passed.
-- Lint: `pnpm lint:check` passed with 0 errors and 5 pre-existing warnings in
-  `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
-- Build: `pnpm build:vite` passed for renderer, Main, preload, and utility
-  worker; existing dynamic-import and large-chunk warnings remain.
-- E2E: `pnpm test:e2e` reached 25 passing tests and 1 unrelated failure in
-  `tests/e2e/pi-coding-first-chat.spec.ts:575`, where the existing
-  `当前对话模型` combobox remained disabled until timeout. Re-running that
-  test alone reproduced the same timeout; no ML-06 injection path was involved.
-- Diff hygiene: `git diff --check` passed; no files outside the ML-06 ownership
-  boundary were changed.
-
-## Follow-ups
-
-- Parent integration must cherry-pick this commit into the client frontier,
-  then perform the repository review/remediation and X-01 real PostgreSQL plus
-  signed-in MakeLore preview acceptance. The E2E prerequisite failure above
-  remains an integration-environment deviation, not a claimed pass.
-
-## Promotion Candidates
-
-- None recorded.