diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 6ed7c99..83db085 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -4,6 +4,15 @@ This file is the integrated default-branch snapshot. Feature tasks record progre ## Integrated Through +- Bash tool-bridge source `49112b6` from task + `20260902-fix-bash-tool-bridge-9c4e7a12` is integrated through merge + `55bf80e` by task `20260902-integrate-bash-tool-bridge-e81a5c6d`. + Pi's prepare-all behavior can no longer deadlock two tools against Makelore's + same-project write lease before either tool starts: built-in `bash`, `edit`, + and `write`, plus dynamically declared product tools that acquire that lease, + execute sequentially within an assistant tool batch. Read-only batches retain + parallel execution, and Bash command timeout remains authoritative once its + child process starts. - Coding terminal-settlement source `f1fd13a` from task `20260901-fix-session-settlement-a47d2e91` is integrated through merge `e76a1e1` by task `20260902-integrate-session-settlement-6e41c8b2`. @@ -243,7 +252,7 @@ Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/ap AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。 -AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。 +AI 编程已经硬切到精确 pin 的 Pi `0.84.2`，不存在 OpenCode fallback 或双 runtime。project、Agent 与 Conversation 只在 `.makelore/project.json` 和 `.makelore/conversations.json` 使用本地 schema v2；当前客户端不从 `.niancode` 或 `.opencode` 读取、迁移或删除项目元数据。Electron Main 按需启动一个长驻父 Agent Server，每条 active/warm Conversation 在其中拥有独立 Runtime/Session/channel、credential store、extension context、generation/seq、Snapshot/Patch、model/thinking、队列、interaction 与错误状态，Composer 在 lazy prepare 期间仍可编辑。Renderer 只通过 `/api/coding/*` 和 Snapshot-first/`patch-batch` SSE 消费产品中立合同；gap/reconnect 只恢复目标 Conversation，accepted/uncertain mutation 不自动重放。Session hydration 沿完整 active branch 投影可见历史，Pi compaction 只改变模型上下文并保持 summary 私有；Renderer 首次挂载最近 120 个节点，向上滚动时按 100 个节点追加更早内容并补偿新增高度以保持阅读锚点。折叠的 thinking、助手过程说明与工具输出固定展示第一条可见内容和首个非空行，横向偏移保持为零，展开后仍显示完整内容。未解析 Conversation 第一次选模先 validate 并持久化 resolved metadata，再 prepare；同账号模型切换使用 target `set_model`，跨账号只重建目标逻辑线程。top-level 逻辑 turn 并发为 4，warm idle logical-thread LRU 为 8；independent child 进程并发为 4 并使用 FIFO 进程预算 8；coding child 与 parent 共用项目 write lease。同一助手工具批次内，内置 `bash`/`edit`/`write` 与声明需要该 write lease 的动态产品工具按顺序执行，避免 Pi 在批量 prepare 阶段形成租约自锁；纯只读工具批次仍可并行。prompt/compact confirmation timeout 后仍保留 run/Agent-Server-or-child-process/background ownership，迟到 success/failure/exit/abort 单调且 exactly-once 收敛，页面隐藏不会停止 active/uncertain run。线程级替换只使目标 generation 失效；整个 Agent Server 退出会统一使所有旧 channel 失效，但 Main/Renderer 存活且下次恢复只重启一个 Server。Pi `0.84.2` 手动 compact 不发 `agent_settled`，由 correlated compact RPC 结果终结。父 Provider credential 只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；确定性的 Works user-context 缺失会失效 gateway credential、fail fast、不重放并投影固定 Provider-auth 错误，不归类为 Pi crash。精确的 `403 token_point_balance_exhausted` / `词元点数余额不足` 上游响应会在 Main 内归类为不可重试的配额耗尽，Renderer 只收到稳定 `CODING_PROVIDER_QUOTA_EXHAUSTED` 与安全中文提示；重开会话仍保留该提示，不暴露上游 request id 或原始错误正文。真实 Provider 验证仍为用户明确接受的未验证风险，macOS x64/arm64 与 native non-WSL Linux 也未通过平台发布门禁。 Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。 @@ -251,6 +260,12 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选 ## Recently Completed +- 2026-09-02: Integrated the Pi write-leased tool-batch correction. Multiple + Bash/edit/write or lease-requiring product tools emitted by one assistant + response now execute sequentially instead of waiting on a lease before any + command can start; read-only batches remain parallel. A real Agent Server + regression covers two Bash calls, a command-level timeout, and rejection of + the former HTTP-idle-timeout `fetch failed` path. - 2026-09-02: Integrated bounded recovery for a missing Pi prompt settlement. A final persisted assistant response can no longer leave the Composer permanently processing merely because `agent_settled` was lost: Main waits for the normal diff --git a/.project-docs/30-worklog/tasks/20260902-fix-bash-tool-bridge-9c4e7a12.md b/.project-docs/30-worklog/tasks/20260902-fix-bash-tool-bridge-9c4e7a12.md deleted file mode 100644 index 0128b53..0000000 --- a/.project-docs/30-worklog/tasks/20260902-fix-bash-tool-bridge-9c4e7a12.md +++ /dev/null @@ -1,84 +0,0 @@ -# Task: Fix Bash tool execution bridge - -## Identity - -- Task ID: 20260902-fix-bash-tool-bridge-9c4e7a12 -- Mode: Feature -- Branch: codex/20260902-fix-bash-tool-bridge-9c4e7a12-fix-bash-tool-bridge -- Worktree: /Users/inmanx/Documents/makelore-fix-bash-tool-bridge-9c4e7a12 -- Base commit: 6073bd6f4ce269b067b13e1eed0371b38dc2c054 -- Owner: codex -- Status: Completed - -## Scope - -- Reproduce and fix the Makelore-managed Pi tool-batch deadlock that delays - parallel Bash calls until the five-minute HTTP idle timeout. -- Preserve project-scoped write-lease isolation while making Bash/edit/write - tools execute sequentially inside one assistant tool batch. -- Add real Agent Server coverage for two Bash calls, including a command-level - timeout, and verify the same resource path used by packaged builds. - -## Intent And Constraints - -- Keep Pi `0.84.2` as the sole runtime and keep Renderer isolated from Pi wire. -- Do not replay an accepted mutation or weaken the cross-Conversation/project - write lease; only remove the same-batch pre-execution self-deadlock. -- Retain parallel execution for batches containing only read-only tools where - Pi supports it. -- Treat packaging as a verification path, not as a substitute for the source - correction. - -## Outcome - -- Reproduced the stall with the real Pi Agent Server process. Pi `0.84.2` - prepares every tool in a parallel batch before it executes any of them, while - Makelore acquires the project write lease in `tool_call` and releases it in - `tool_result`. Two Bash calls in one assistant response therefore self-deadlocked: - the first held the lease without starting and the second waited for that lease. -- Confirmed that the apparent five-minute Bash hang came from the Agent Server - HTTP idle timeout around the managed-extension request, not from a missing - shell dependency or the Bash command timeout. Packaging alone would retain the - same behavior because it ships this Agent Server resource and extension bundle. -- Marked built-in `bash`, `edit`, and `write` tools as sequential whenever an - Agent thread is rebound. Marked dynamically declared product tools that require - the same project write lease as sequential in the generated Makelore extension. - Read-only tool batches keep Pi's parallel behavior. -- Advanced the managed extension artifact from v4 to v5 and synchronized the - release proof and worker-opening expectations. -- Added a real-process regression that emits two Bash calls in one assistant - response. The first exercises its explicit command timeout and the second must - still run successfully without waiting for the HTTP idle timeout. - -## Verification - -- Pre-fix regression: the new real-process test failed with the second Bash result - equal to `fetch failed`, reproducing the production failure under a 250 ms HTTP - idle timeout. -- Focused regression: `pnpm exec vitest run - tests/unit/pi-agent-server-process-real.test.ts - tests/unit/pi-extension-bundle.test.ts - tests/unit/pi-managed-worker-opener.test.ts --maxWorkers=2` passed 3 files and - 9 tests. -- `pnpm run typecheck` passed. -- `pnpm test` passed 213 files and 1,733 tests; 3 tests were skipped. -- `pnpm run lint:check` passed with 0 errors and 5 existing warnings in - `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`. -- `pnpm run build:vite` passed for Renderer, Electron Main, Preload, and the - release utility worker, proving the fixed Agent Server resource is included by - the production build path. -- `git diff --check` passed. - -## Follow-ups - -- Integrate this feature branch into local `main`, update the canonical current - state/README, restart Makelore, and use the real-process regression as the - non-destructive smoke check instead of replaying the user's accepted turn. - -## Promotion Candidates - -- Promote the write-lease batch rule to README/current state: write-leased Pi - tools are serialized within one assistant batch, while read-only tools may - remain parallel. -- Record the full-suite, production-build, and real-process regression results in - the evidence index during integration. diff --git a/.project-docs/30-worklog/tasks/20260902-integrate-bash-tool-bridge-e81a5c6d.md b/.project-docs/30-worklog/tasks/20260902-integrate-bash-tool-bridge-e81a5c6d.md new file mode 100644 index 0000000..7453106 --- /dev/null +++ b/.project-docs/30-worklog/tasks/20260902-integrate-bash-tool-bridge-e81a5c6d.md @@ -0,0 +1,70 @@ +# Task: Integrate Bash tool bridge fix + +## Identity + +- Task ID: 20260902-integrate-bash-tool-bridge-e81a5c6d +- Mode: Integration +- Branch: main +- Worktree: /Users/inmanx/Documents/makelore +- Base commit: 6073bd6f4ce269b067b13e1eed0371b38dc2c054 +- Owner: codex +- Status: Completed + +## Scope + +- Merge completed feature task `20260902-fix-bash-tool-bridge-9c4e7a12` + (`49112b6`) into local `main`. +- Reconcile the write-leased Pi tool-batch rule with README, canonical current + state, and the evidence index. +- Re-run focused real-process coverage, typecheck, and the production Vite build + on the integrated tree, then restart the local Makelore platform. + +## Intent And Constraints + +- Preserve the feature task's bounded semantics: only tools that acquire the + project write lease are serialized; read-only Pi tool batches remain parallel. +- Do not replay or mutate the user's accepted, currently stuck Conversation as a + smoke test. Use the disposable real-process regression instead. +- Merge only to local `main`; do not push, package, deploy, or alter unrelated + user changes. +- Treat production build success as proof that packaging consumes the fixed + resources, not as permission to claim an installer artifact was produced. + +## Outcome + +- Merged source commit `49112b6` into local `main` as merge commit `55bf80e`. +- Integrated the bounded Pi tool-batch correction: built-in `bash`, `edit`, and + `write`, plus dynamic product tools that acquire the project write lease, are + sequential within one assistant response. Read-only batches retain parallel + execution. +- Updated README, canonical current state, and the evidence index with the exact + failure mechanism and verification boundary. A production build was verified; + no installer was created, pushed, deployed, or published. +- Stopped the old development process cleanly so its already-open Agent Server + could not keep serving the pre-fix resource. The platform restart is the final + operational handoff after the integration commit. + +## Verification + +- Source branch: the pre-fix real-process regression reproduced the second Bash + result as `fetch failed` under a 250 ms managed-extension HTTP idle timeout. +- Source branch: 3 focused files / 9 tests, 213 full files / 1,733 tests with 3 + skipped, typecheck, lint with 0 errors / 5 existing warnings, and the full + Renderer/Main/Preload/utility Vite production build passed. +- Integrated `main`: the 3 focused Pi process/extension/worker files passed all + 9 tests, `pnpm run typecheck` passed, and `pnpm run build:vite` passed for all + four production targets. +- The regression verifies that a timed-out first Bash does not block the second + Bash, the second returns `SECOND_OK`, and neither result contains `fetch failed`. + +## Follow-ups + +- A signed installer is unnecessary to correct this source-level deadlock. Build + an installer only when release validation or distribution is requested; the + normal packaged resource path already consumes the corrected Agent Server and + v5 extension bundle. + +## Promotion Candidates + +- None; the relevant runtime contract and evidence were promoted during this + integration task. diff --git a/.project-docs/50-evidence/evidence-index.md b/.project-docs/50-evidence/evidence-index.md index a75c25b..cbe0b03 100644 --- a/.project-docs/50-evidence/evidence-index.md +++ b/.project-docs/50-evidence/evidence-index.md @@ -4,6 +4,7 @@ Use this index for searchable, traceable evidence records. | Date | Topic | Status | Source | Detail | |---|---|---|---|---| +| 2026-09-02 | Makelore Code Pi write-leased tool-batch deadlock fix | Integrated locally; source and production-build verification passed; no installer produced | Source `49112b6`, merge `55bf80e`, source task `20260902-fix-bash-tool-bridge-9c4e7a12`, integration task `20260902-integrate-bash-tool-bridge-e81a5c6d` | Live evidence showed every assistant response emitting two Bash calls; Pi prepared both hooks before execution, so the first acquired the project write lease and the second waited before the first could run or release it. The five-minute delay was the managed-extension HTTP idle timeout, not a missing dependency. Built-in `bash`/`edit`/`write` and dynamically declared lease-requiring tools are now sequential within a batch while read-only batches remain parallel. The pre-fix real-process regression reproduced `fetch failed`; the source passed 3 focused files / 9 tests, 213 full files / 1,733 tests with 3 skipped, typecheck, lint with 0 errors / 5 existing warnings, and the Renderer/Main/Preload/utility production build. | | 2026-09-02 | Makelore Code missing terminal-settlement recovery | Integrated locally; live pre-fix stall diagnosed and automated regression coverage passed | Source `f1fd13a`, merge `e76a1e1`, source task `20260901-fix-session-settlement-a47d2e91`, integration task `20260902-integrate-session-settlement-6e41c8b2` | Live evidence showed Pi had persisted its final assistant response while Main retained run ownership because no effective `agent_settled` arrived. The fix preserves normal settlement authority and no-replay semantics, reports post-accept prompt rejection, and after a bounded grace period probes only the target thread: exact idle evidence hydrates and settles once; contradictory state fails that target explicitly. The source passed 68 focused tests, 1,732 full tests / 3 skipped, typecheck, lint, and Vite build; the integrated tree repeated focused runtime/process tests, typecheck, and Vite build. | | 2026-08-30 | MakeLore AI Design Living Form V2 hard cutover | Integrated locally with matching server source; production data cutover and Provider activation pending | Client source `b0b5a602b501308a23eb27e2f51a5169b9e46b1e`, server source `b5351d54f595ce8eb873593e462e4a556bea0b05`, integration task `20260830-integrate-marketplace-design-client-main-9d5f3b82`, ADR-007 | Replaces nested V1 Conversations, Briefs, editable provider Prompt, mutable Quote PATCH, and local semantic fallback with one current Direction, one Living Form/Specification authority, stable operations, immutable Quote confirmation, and Main-owned V2 transport. Client source passed typecheck, lint with zero errors, 1,425 unit tests, Vite/Electron build, and 2 Electron E2E tests. Server source passed 2,626 tests / 31 skipped under UTF-8 mode. No production database cutover, real paid Provider request, deployment, or publication occurred. | | 2026-08-30 | MakeLore curated Plugin Marketplace Release A | Integrated locally; XMA-01 live acceptance PASS; production trust activation HOLD | Source `40df677a31ff7651f962151eb84b925987781c03`, source task `20260828-plugin-marketplace-client-5f8b3d72`, integration task `20260830-integrate-plugin-marketplace-client-6e3b9d82` | R7 Standards/Spec passed with zero findings. XMA-01 passed 12/12 using real PostgreSQL, signed-in packaged MakeLore, Operations-published temporary-key packages, A/B account isolation, immutable install/update/freeze/rollback, project/Agent/Pi materialization, lifecycle invalidation, pricing-only ETag change, Data Service 10 tools/14 operations and zero Token Point transactions. Final Windows installer was 208,235,670 bytes with SHA-256 `738A2F6573C502281787F418EA666C6E62C287CA0EC13C6EB22369DAB0B3FFFA`. The official Ed25519 public key was not supplied, so the production trust store correctly remains fail closed; no deployment or production publication occurred. | diff --git a/README.md b/README.md index 39e190c..db1135c 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ Makelore 是一个面向软件、视觉创作、互动学习与智能机器人 ## 当前产品状态 - 桌面技术栈：Electron、React 19、Vite、TypeScript、Zustand、Tailwind CSS。 -- AI 编程核心对话运行时：Electron Main 按需启动一个长驻 Pi Agent Server，同一进程内为每条 Conversation 建立独立的 Runtime、Session、凭证视图、扩展上下文和 JSONL 通道，同时复用 Pi 模块与进程启动成本；Server 异常退出时所有旧通道统一失效，下一次恢复只重启一个 Server。Renderer 不直接启动或调用 Pi，也不读取其 wire 类型。项目与 Conversation 元数据先从本地读取，选中对话后才按需准备对应逻辑线程；输入框不等待运行时准备完成。子 Agent 仍使用独立的短生命周期进程，以保留并发配额、故障和写入边界；macOS 上两类后台进程都使用 Electron 自带的 Helper，不在 Dock 中创建额外应用图标。 +- AI 编程核心对话运行时：Electron Main 按需启动一个长驻 Pi Agent Server，同一进程内为每条 Conversation 建立独立的 Runtime、Session、凭证视图、扩展上下文和 JSONL 通道，同时复用 Pi 模块与进程启动成本；Server 异常退出时所有旧通道统一失效，下一次恢复只重启一个 Server。Renderer 不直接启动或调用 Pi，也不读取其 wire 类型。项目与 Conversation 元数据先从本地读取，选中对话后才按需准备对应逻辑线程；输入框不等待运行时准备完成。同一助手工具批次中，会取得项目写租约的 `bash`、`edit`、`write` 与动态产品工具按顺序执行，避免批次在命令启动前自锁；纯只读工具仍可并行。子 Agent 仍使用独立的短生命周期进程，以保留并发配额、故障和写入边界；macOS 上两类后台进程都使用 Electron 自带的 Helper，不在 Dock 中创建额外应用图标。 - AI 编程历史与配额反馈：Pi 上下文压缩不删除用户可见的 active-branch 历史，压缩摘要保持 Main-private；Renderer 首次渲染最近 120 个节点，向上滚动时按 100 个节点追加更早内容并保持阅读位置。Main 精确识别 `token_point_balance_exhausted` / `词元点数余额不足`，只向 Renderer 投影不可重试的稳定配额错误和安全中文提示，重开会话后仍可见且不暴露上游原始错误或 request id。 - 桌面性能策略：应用窗口使用不透明浅色表面并默认保留硬件合成；仅在显式安全模式或短时间内重复 GPU 进程崩溃时启用软件渲染，并把故障原因保存在用户数据目录。启动关键路径只创建本地应用壳，认证、代理、同步、更新和遥测在首帧后延迟初始化；开发版可通过 `app:performance` 快照观察 GPU、进程、WebContents、事件循环与 Renderer Long Task 聚合指标。 - 后台生命周期：Main 统一维护模块活动状态与任务租约。隐藏窗口、离开模块和关闭开发浏览器会释放非必要连接；生成、Code 执行、下载与发布构建持有租约并在完成后释放。已写入 Pi 的 prompt 或上下文整理即使确认超过 10 秒，也会继续持有运行所有权与后台租约，直到迟到响应、权威事件、明确失败或用户清理使其收敛；此时同一 Conversation 不接受重叠 mutation，其他 Conversation 不受影响。各模块的后台连接、轮询和子进程必须通过同一生命周期入口登记。