merge: 集成 AI 设计生成任务修复

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- `22378efcee07e7fb80b651e65e3202f1a1dfea1d`: AI Canvas bidirectional Agent WebSocket commands, idempotent transport fallback, and Quote-based generation-task recovery.
 - `aba5cae286807093cf4ef643fe9f498050985c31`: Robot / AI hardware module, Main-owned Works Square proxy, and cross-repository wire contract.
 - `86ece3a` / `4dde8f3`：客户端登录七天滑动续期及集成提交。
 - `724290e` / `dcc92fc`：Main-owned 一键打包提交审核及集成提交。
@@ -21,7 +22,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 `npm ci --ignore-scripts`，再显式调用项目 `package-lock.json` 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 `built_archive` 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 `play_url`，`runtime_url` 仅保留一个客户端版本的兼容回退。
 
-AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quote 和 `turnRevision` 随 Conversation 隔离；生成任务和资产保持 Workspace 级共享。图片 Brief 支持文生图，以及从当前项目已完成作品或本地上传中选择一张参考图继续生成；视频复用同一选择器绑定首帧。两条路径都通过现有 Workspace Asset 契约提交一个真实 Asset ID。每条 Conversation 使用服务端持久 Agent Gateway Session，切换会话只重连对应事件流。
+AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quote 和 `turnRevision` 随 Conversation 隔离；生成任务和资产保持 Workspace 级共享。图片 Brief 支持文生图，以及从当前项目已完成作品或本地上传中选择一张参考图继续生成；视频复用同一选择器绑定首帧。两条路径都通过现有 Workspace Asset 契约提交一个真实 Asset ID。每条 Conversation 使用服务端持久 Agent Gateway Session；连接正常时命令、Run 与设计事件共用双向 WebSocket，只有发送、断连或 ACK 超时等传输故障才以同一 `client_command_id` 回退 REST，结构化业务错误不重复提交且未知上游文本由 Main 脱敏。确认生成会按 Quote 对账 Workspace 任务；任务已经落库但 Run 随后失败时仍恢复任务列表，内部对账失败不覆盖当前 UI 错误，同时 Conversation 写入继续受 Workspace-load 与 Conversation-selection generation 保护。
 
 AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗余历史读取，prompt 可直接进入 Host API；普通历史会话仍刷新消息。Main AI proxy 只把明确的上游分组饱和投影为当前 OpenCode 的终止状态，配额耗尽保持独立终止态，通用限速继续保留 `429`。
 
@@ -29,6 +30,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Recently Completed
 
+- 2026-08-14: AI Canvas Agent 命令与流式事件改为共用双向 Conversation WebSocket，并保留仅面向传输故障的幂等 REST 回退；结构化 Gateway 错误不重试且未知文本脱敏；确认生成按 Quote 恢复已落库任务，切换 Conversation 后仍同步 Workspace 任务且不覆盖新会话状态或错误。
 - 2026-08-13: Integrated the enabled `Makelore Robot` top-level module at `/ai-hardware`. Renderer uses typed safe DTOs while Electron Main owns Works Square authentication, idempotency identities, ETag/If-Match forwarding, response projection, limits, timeouts, and credential recovery. Robot and Canvas routes no longer initialize AI Programming projects/providers. No production deployment or real activation-code smoke is claimed.
 - 2026-08-08：合并登录续期和一键发布；发布成功后保存精确 app/version/review 映射，Renderer 不接触 Token、ZIP 或本地路径。
 - 2026-08-08：补齐跨平台 Electron E2E fixture、Windows ZIP 预检和异常成功响应安全投影。
@@ -66,6 +68,7 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 - 本地构建必须使用安装版 Electron Node、固定 npm 11.6.2 和项目 `package-lock.json` 锁定的 Vite，不得回退到全局 PATH、已有 `node_modules` 或未验证的 npm 闭包；依赖安装需要网络。
 - 项目 Vite config/plugins 以桌面用户权限执行，不能称为 sandbox；此风险边界必须在发布说明中保留。
 - AI 绘画消息、Brief、Quote 和 `turnRevision` 必须按 Workspace + Conversation 隔离；任务事件仍按 Workspace 归并，迟到的异步结果不得污染已切换的会话。
+- AI 绘画 WebSocket 命令只能在传输发送、连接关闭或 ACK 超时时回退到 REST，并必须复用原 `client_command_id`；Gateway 结构化业务错误不得触发重复提交，未知错误文本不得进入 Renderer。确认后的任务恢复必须按不可变 Quote 身份归并到 Workspace，不能用任务恢复放宽 Conversation generation 门禁或覆盖新会话错误。
 - 服务端持久 Conversation Session 不由客户端在注销或退出时删除；Main 只关闭本地流、清除本机缓存并撤销本地凭据。
 - 客户端对最终构建字节的 loopback 检查没有可信 receipt，且不复刻生产 opaque-origin；服务端必须独立重算 source/built/contract、校验不可变 Release，人工审核仍不可绕过。如未来需要不可绕过的 runtime gate，必须引入可信 verifier 并绑定精确构建产物。
 - AI proxy 的明确饱和 `429 → 400` 是与当前 OpenCode 重试契约匹配的内部投影；升级 OpenCode 或上游饱和错误文案变化时必须复核。不得把通用 `429` 或仅含 `rate_limit_exceeded` 的响应误分类为终止饱和。
@@ -74,4 +77,4 @@ Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失
 
 ## Last Updated
 
-2026-08-13
+2026-08-14

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-14, resume the existing Integration owner to merge reviewed AI Canvas source commit `22378efcee07e7fb80b651e65e3202f1a1dfea1d` into local `main` and promote its accepted project-memory candidates.
 - Resume the existing integration owner to fast-forward the completed Robot / AI hardware source commit into local `main` after verifying the current remote `main` tip.
 - Fetch the authoritative remote `main`, inspect all commits not present in the
   local branch, and merge them into the reviewed local `main` without rewriting
@@ -35,6 +36,7 @@
   semantic reconciliation.
 - Push only after the merge result is clean, verified, and independently
   reviewed. Never use `--force`.
+- The 2026-08-14 user request authorizes the local `main` merge only. It does not expand this resumption into a remote push; the existing authentication blocker remains a separate follow-up.
 
 ## Project Context Loaded
 
@@ -82,16 +84,22 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-14 AI Canvas Integration Resume
+
+- Reused the same Integration owner because it still exclusively owns `main` and the repository integration lock; `task_context.py touch` refreshed the existing reservation.
+- Verified the main worktree was clean at `88f9ee8708beeb1ab45ca741807f6cca0f075ac9` before merging.
+- `git fetch origin main --prune` confirmed `origin/main` is also `88f9ee8708beeb1ab45ca741807f6cca0f075ac9`.
+- Source `22378efcee07e7fb80b651e65e3202f1a1dfea1d` is exactly one commit ahead of `main`, with `88f9ee8` as merge base; no remote-only or unrelated main commit exists.
+- Read the source task, ADR-001, canonical AI Canvas architecture/domain memory, and all registry-owned peer task Scope / Intent / Promotion Candidate sections. The source preserves Workspace-owned tasks and Conversation-owned state; no semantic conflict requires human resolution.
+- Gate result: Passed for the local AI Canvas merge. Remote push remains outside this resumption.
+
 ## Plan
 
-1. Commit this integration ownership record, fetch `origin/main`, and inspect
-   remote-only commits, paths, and topology.
-2. Merge `origin/main` normally with local `main` as first parent; resolve any
-   conflict semantically and inspect the combined tree.
-3. Run focused/full checks required by the fetched changes plus project-document
-   gates, then obtain a final independent Sol PASS/FAIL review.
-4. Complete documentation, push `main` without force, verify local/remote tip
-   equality, and release the clean integration task.
+1. Fetch `origin/main` and verify local `main`, the remote tip, and reviewed AI Canvas source commit topology.
+2. Merge `22378ef` normally into local `main` without rebase/reset, and retain the source commit as a dedicated second parent.
+3. Promote the bidirectional Gateway and Quote-reconciliation facts into canonical project memory.
+4. Re-run focused/full checks, production build, project-document gates, and independent Sol review.
+5. Commit the verified local merge; do not push unless the user separately requests it and authentication is available.
 
 ## Outcome
 
@@ -149,6 +157,13 @@ Gate result:
 - Completion is blocked only on the user authenticating this machine for
   `git.nianxx.cn`. Keep this integration task owned and do not release it until
   a normal push succeeds and `origin/main` is verified equal to local `HEAD`.
+- On 2026-08-14, the user requested a local-main merge of reviewed AI Canvas source `22378ef`. A fresh fetch verified local and remote `main` were both `88f9ee8`, and the source was exactly one descendant commit with no unrelated overlap.
+- Started a normal `--no-ff --no-commit` merge of `22378ef`; Git reported no textual conflict. The source task record remains intact on source commit `22378ef` and its feature branch, and is excluded from the `main` result to preserve task-document ownership boundaries.
+- Promoted the accepted source facts into canonical current-state, architecture, data-flow, business-rule, evidence, and commitment records: connected Conversation commands/events are bidirectional over WebSocket; REST fallback is transport-only and idempotent; Quote task recovery remains Workspace-owned while Conversation writes retain generation guards.
+- Merge validation exposed a pre-existing AI Hardware test race: the edit button is rendered disabled while configuration loads, but four tests clicked it after waiting only for existence. Under full-suite load the browser correctly ignored the disabled click. The tests now wait for the button to become enabled and for the dialog heading; production Robot behavior is unchanged.
+- The first independent AI Canvas merge review returned `FAIL` on two integration gaps and one safety subfinding: stale confirmation task-refresh errors could overwrite a newer Conversation error, top-level structured WebSocket command errors lacked focused coverage, and unknown Gateway messages could expose upstream details. Confirmation reconciliation now uses an internal task refresh without UI-error side effects; explicit user refreshes retain their error behavior. Matching WebSocket errors are tested as non-retryable, and unknown codes project a fixed Chinese fallback instead of the server message.
+- The second independent Sol review returned `PASS` with no blocking findings after those corrections. The verified no-ff merge is ready to commit with `88f9ee8` as first parent and `22378ef` as second parent.
+- This resumption intentionally does not push. The previous remote authentication follow-up remains unchanged and does not block completion of the user's requested local merge.
 
 ## Verification
 
@@ -172,6 +187,19 @@ Gate result:
 - Merge topology — verified first parent `1c85bc0`, second parent `f4113a8`.
 - Push — attempted normally, rejected before ref update because remote
   authentication is unavailable on this machine.
+- 2026-08-14 AI Canvas focused selection — 3 files / 74 tests passed on the merged `main` tree.
+- AI Hardware readiness regression — full `ai-hardware-page.test.tsx` passed 24/24 after replacing existence-only clicks with enabled/dialog readiness waits.
+- `pnpm test` — the original full-suite loop failed twice at the same disabled-button race before the test hardening; the post-fix run passed 156 files / 1687 tests.
+- `pnpm run typecheck` — passed after the integration test hardening.
+- `pnpm run lint:check` — passed with 0 errors and 6 unchanged warnings outside the merge paths.
+- `pnpm run build:vite` — Renderer, Electron Main, and Preload production builds passed; existing chunk-size and mixed-import warnings remain.
+- Post-review focused checks — Works Square adapter 27/27 and Image Workspace Store coverage passed, including top-level WebSocket errors, unknown-message redaction, A→B task-refresh failure isolation, and explicit-refresh error reporting.
+- Final post-review `pnpm test` — 156 files / 1691 tests passed.
+- Final post-review `pnpm run typecheck` — passed.
+- Final post-review `pnpm run lint:check` — passed with 0 errors and the same 6 warnings outside the merge paths.
+- Final post-review `pnpm run build:vite` — Renderer, Electron Main, and Preload passed; only the existing mixed-import and chunk-size warnings remain.
+- Second independent final review — `PASS`; it re-ran 4 files / 102 tests plus typecheck, found no unmerged entries or unstaged changes, and confirmed the previous state-isolation, structured-error coverage, and redaction findings are closed.
+- Final project-document ownership drift, structure checks, and staged/unstaged whitespace checks — passed before the merge commit.
 
 ## Follow-ups