From 93fba75f7493d21cffc28847ceae26fee52a00a8 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Mon, 31 Aug 2026 14:56:40 +0800 Subject: [PATCH] docs: record remote main integration --- .project-docs/20-architecture/data-flow.md | 1 + .project-docs/20-architecture/module-map.md | 3 + .project-docs/30-worklog/current-state.md | 31 +++++++- ...20260831-integrate-remote-main-6b3d9e1a.md | 79 +++++++++++++++++++ .project-docs/40-domain/business-rules.md | 19 ++++- 5 files changed, 128 insertions(+), 5 deletions(-) create mode 100644 .project-docs/30-worklog/tasks/20260831-integrate-remote-main-6b3d9e1a.md diff --git a/.project-docs/20-architecture/data-flow.md b/.project-docs/20-architecture/data-flow.md index 8f31df1..fdd296e 100644 --- a/.project-docs/20-architecture/data-flow.md +++ b/.project-docs/20-architecture/data-flow.md @@ -7,6 +7,7 @@ | Marketplace catalog and Account Library | Signed-in Renderer intent | bounded Host API → Main Marketplace client/cache → Works Square catalog, Library, resolve, Admission, and download APIs | Main binds requests to the current Account and response generation. Free acquisition changes only Account Library; it does not install, enable a project, assign an Agent Skill, or authorize runtime execution. | | Marketplace device installation | Account Library entry and explicit channel | Main resolve/Admission/download → descriptor/signature/archive/client compatibility verification → immutable Package Store index switch | Stable and explicit Beta remain distinct even when they resolve to the same immutable Release. Failed install/update retains the previous current release; explicit uninstall waits only for protecting worker/account references and completes after the final worker exits. | | Effective Plugin worker snapshot | Installed trusted package + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. | +| Hosted Game Resource operation | Eligible parent `makelore.game-resource` tool call plus explicit confirmation | frozen Plugin adapter → capability Registry → Main `GameResourceClient` → fixed Works Square game-resource route → provider-neutral receipt/result | Server policy owns pricing, payer, Admission and receipt state. Stable logical operation identity survives response loss/Main restart; `submission_unknown` is not replayed as a fresh request. Result saving uses a bounded project-relative path and the existing project write lease. | | 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed | | 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 四布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate | | 项目创建 | 新建项目对话框 | Host API → Main 项目初始化 | 创建时固定 `ProjectType`；小游戏/小程序原子生成受控模板，自定义只生成项目空间 | diff --git a/.project-docs/20-architecture/module-map.md b/.project-docs/20-architecture/module-map.md index 36e8da3..1c2a94e 100644 --- a/.project-docs/20-architecture/module-map.md +++ b/.project-docs/20-architecture/module-map.md @@ -7,6 +7,7 @@ | `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, compatibility checks, canonical archive validation, and Ed25519 trust | Schema 1 bundled compatibility and schema 2 `skill_only`/declarative `platform_hosted` are parsed fail closed. The production trust store accepts no Marketplace package until the official public key is built in. | | `electron/coding-plugins/account-plugin-cache.ts`, `marketplace-client.ts`, and `package-store.ts` | Main-owned Account Library cache, authenticated server client, and atomic immutable device installation store | Account acquisition and device installation are separate. Package bytes switch atomically only after descriptor, signature, archive, client-range, and provenance checks; failed updates preserve the prior current release. | | `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent logical thread; child workers remain empty and active threads retain frozen bytes until disposal. | +| `electron/coding-plugins/adapters/game-resource.ts` and `electron/services/game-resource-client.ts` | Provider-neutral `makelore.game-resource` hosted tool adapter and Main-owned Works Square transport | Tools materialize only from an eligible frozen `platform_hosted` parent snapshot. Metered mutations require explicit confirmation and stable logical operation identity; Renderer/Pi never receive Provider URLs, credentials, balances, raw responses, or Provider job IDs. | | `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, and `src/pages/ProjectPlugins/` | Bounded Main routes and Renderer projections for catalog, Library, device, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, or signed download URL. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. | | `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 | | `src/lib/works-square.ts` | Renderer 侧 Works Square Host API 契约与安全错误映射 | 不接触 Token、ZIP、本地绝对路径或自动部署状态 | @@ -53,6 +54,7 @@ ## Dependency Direction - Renderer UI → Renderer API contract → Main Host routes → Main services → Works Square；Renderer 不反向读取 Main 凭据、文件系统或归档。 +- Hosted Plugin parent tool → frozen Registry adapter → Main `GameResourceClient` → fixed Works Square game-resource routes. Stable logical operation identity survives response loss and Main restart; ambiguous submission remains reviewable and is never converted into an automatic fresh mutation. Saving a result uses the existing bounded project path and project write lease. - AI 编程 Renderer product Snapshot/commands → typed `/api/coding/*` Host API → Main Coding composition → target `CodingConversationRuntime` → shared Agent Server 内的目标 Pi 逻辑线程；Pi Provider 请求再经 Main AI proxy 访问模型上游。Renderer 不持有 Pi wire、凭据或本地 runtime URL。 - Project configuration 决定产品分流；Main release builder 生成 source/built/contract，服务端独立重算和校验决定发布安全，本地 `ProjectType` 不是授权结论。 - Built artifact preflight 检查最终上传的同字节快照，但客户端可被绕过且不产生可信 receipt；服务端仍是合同、摘要和不可变 Release 安全权威。 @@ -63,6 +65,7 @@ ## Risky Or Sensitive Areas - `electron/api/routes/works.ts` 同时承担发布 capability、上游安全投影和错误脱敏，变更时必须验证未在拒绝前读取凭据或项目文件。 +- `platform_hosted` mutation eligibility, explicit confirmation, stable identity, Admission and receipt status form one authority chain. `submission_unknown` cannot create a new request, and a billing `pending_review` receipt cannot be inferred from transport ambiguity. Production remains fail closed until the official Marketplace signing key and server-side activation gates are ready. - `project-release-builder.ts` 执行受信本地项目的 Vite config/plugins，拥有桌面用户权限；必须保持路径、环境、时间、输出、进程树和临时目录限制，不得包装为 sandbox。 - `electron/agent-browser/module.ts` 的预检必须继续拒绝外域访问、隔离临时 partition 并清理所有 view/listener；不能因本地通过而跳过服务端逐字节校验。生产 opaque-origin 行为不由该 loopback 检查覆盖。 - `works-cloud-deploy.json` 是兼容文件名；不得因名称重新引入自动部署协调语义。 diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 754c279..0088114 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -4,6 +4,22 @@ This file is the integrated default-branch snapshot. Feature tasks record progre ## Integrated Through +- Hosted Game Resource Plugin source `fe656dd865f1941f1dc2d369ce3bb09efb955fd8` + and verification record `421c8254d51318355faec3ae94f8e1cfd4d054c5` + from task `20260831-meowa-hosted-plugin-client-8d3a5b72` are integrated with + fetched `origin/main` `38f85f6b5e4dc4e2c5e5b9f8f4506554cfd578f5` + in merge `372b5345dae57ce19d2630b24277596db284194c` by task + `20260831-integrate-remote-main-6b3d9e1a`. MakeLore now supports generic + schema-2 `platform_hosted` Marketplace packages and a provider-neutral + `makelore.game-resource` adapter. Its Skill and tools enter only an installed, + enabled, assigned, admitted parent Pi logical thread; child and ineligible + threads receive no projection. Hosted mutations require explicit confirmation, + keep stable logical operation identity across uncertain results, and travel only + through Electron Main to fixed Works Square routes. The old always-mounted Meowa + tools, direct proxy, local credential configuration, and package-time credential + path are removed. Production activation remains held until the official signing + key, rotated server credential, positive Token Point pricing, and server Admission + gates are ready and verified. - Local source snapshot `33fb31fb285b5cfb00d194a036aaf6e21cf8c5a1`, based on the prior local delivery `48a9189`, is integrated over fetched upstream `62304dc85b3c1069cd656dfacb61ee820e216fa2` in merge commit @@ -26,9 +42,10 @@ This file is the integrated default-branch snapshot. Feature tasks record progre projections without receiving credentials, paths, Admissions, or signed URLs. Data Service remains system-included and consumes zero Token Points. R7 Standards and Spec reviews passed with zero findings, and XMA-01 passed all twelve live groups - against real PostgreSQL and a signed-in packaged Windows client. Production trust - activation remains HOLD until the official Ed25519 public key is built in; Release B - and hosted Provider runtime remain closed. + against real PostgreSQL and a signed-in packaged Windows client. The later + `platform_hosted` client runtime is integrated above; production package trust and + real Provider activation remain held behind the official signing key and the + separate server, pricing, credential-rotation, and Admission gates. - AI Design Living Form V2 client source `b0b5a602b501308a23eb27e2f51a5169b9e46b1e` is integrated with matching Works Square server source `b5351d54f595ce8eb873593e462e4a556bea0b05` by task @@ -198,6 +215,14 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选 ## Recently Completed +- 2026-08-31: Integrated the provider-neutral `makelore.game-resource` hosted Plugin + client with fetched `origin/main`. Generic schema-2 `platform_hosted` packages now + materialize frozen Skill/tool snapshots only for eligible parent Pi logical threads; + paid operations require explicit confirmation and stable logical identity, while + Electron Main alone owns the fixed Works transport. Legacy always-mounted Meowa + tools and client credential paths are removed. Focused/full unit tests, typecheck, + lint and Vite/Electron builds passed; production signing, pricing, credential + rotation, real Provider acceptance, push, deployment, and publication remain open. - 2026-08-31: Integrated the occupied local source snapshot over upstream Marketplace Release A and AI Design Living Form V2. Makelore Code now amortizes parent Pi startup through one long-lived Agent Server while preserving isolated per-Conversation logical runtimes, sessions, credentials, extensions and channels; child Agents remain independent processes. ADR-006 and current architecture now use `.makelore` as the sole project configuration source and explicitly reject legacy metadata reads or migration. - 2026-08-26: Fast-forwarded the complete Pi hard-cutover and installed-package resilience chain into local `main`, including per-Conversation workers/Snapshot projection, extension/subagents, bounded process/write/background ownership and the deterministic Works user-context Provider-auth correction. The final Windows installer, packaged Pi runtime, extension/child, 4+4 pressure, uncertainty/late-settle and zero-lingering-process proofs passed. Real Provider turns are explicitly waived rather than passed; macOS and native non-WSL Linux remain release evidence gaps. - 2026-08-20: Replaced AI Learning's course generation/player stack with the curated project catalog defined by ADR-005. The authenticated/module-gated client now renders project cards and safe README detail, loads validated credential-free HTTPS Markdown images directly, and saves verified ZIP archives through the native dialog. Old course/runtime/player packaging was removed; server/client regressions and full suites passed, while production deployment and real-account package smoke remain pending. diff --git a/.project-docs/30-worklog/tasks/20260831-integrate-remote-main-6b3d9e1a.md b/.project-docs/30-worklog/tasks/20260831-integrate-remote-main-6b3d9e1a.md new file mode 100644 index 0000000..0debe1f --- /dev/null +++ b/.project-docs/30-worklog/tasks/20260831-integrate-remote-main-6b3d9e1a.md @@ -0,0 +1,79 @@ +# Task: Integrate fetched origin main with local hosted plugin delivery + +## Identity + +- Task ID: 20260831-integrate-remote-main-6b3d9e1a +- Mode: Integration +- Branch: codex/20260831-pull-remote-merge-4a91c7e2-pull-remote-merge +- Worktree: D:\Datas\OthersProjects\makelore-pull-remote-merge-4a91c7e2 +- Base commit: 372b5345dae57ce19d2630b24277596db284194c +- Owner: codex +- Status: Ready for Integration + +## Scope + +- Own the sole Integration Gate for the fetched `origin/main` merge and its canonical + project-memory promotion. +- Verify that merge `372b5345dae57ce19d2630b24277596db284194c` preserves both the + remote shared Pi Agent Server architecture and the local hosted Game Resource Plugin + lifecycle without restoring always-mounted game-resource tools. +- Record the resulting Git topology, verification evidence, and the occupied local + `main` promotion constraint without modifying or releasing another task's ownership. + +## Intent And Constraints + +- Concurrent Task Gate: PASS. This task owns the sole Integration lock in isolated + worktree `D:\Datas\OthersProjects\makelore-pull-remote-merge-4a91c7e2`; the original + `main` worktree remains owned by task `20260831-meowa-hosted-plugin-client-8d3a5b72`. +- Planning Gate: PASS after reading the required startup set, all 196 peer task scopes, + the complete local hosted-plugin and remote integration source records, and the + canonical architecture/domain targets. Thirty-two peer tasks remained in planning and + 164 were ready for integration; no peer owned this isolated branch or semantic merge. +- Preserve both parent histories with an ordinary merge. Do not rebase, force-update, + stash, clean, push, deploy, or move the occupied `main` ref. +- Canonical documentation may be updated only under this Integration ownership; source + task records remain immutable. + +## Outcome + +- Fetched `origin/main` at `38f85f6b5e4dc4e2c5e5b9f8f4506554cfd578f5` and + merged it with local tip `421c8254d51318355faec3ae94f8e1cfd4d054c5` in + `372b5345dae57ce19d2630b24277596db284194c`. +- Resolved the sole conflict in + `electron/coding-runtime/pi/extensions/makelore-runtime.ts` by retaining the remote + `createMakeloreRuntime(runtimeDefaults)`/runtime-flag Agent Server architecture while + retaining local dynamic Plugin registration and removal of the obsolete static + `game_asset_browser` and `game_asset_review` registrations. +- Promoted the hosted Plugin facts into `current-state.md`, `module-map.md`, + `data-flow.md`, and `business-rules.md`: generic schema-2 `platform_hosted` execution + and `makelore.game-resource` are implemented, while production signature, pricing, + rotated credential, Admission, and real Provider gates remain closed. +- The verified result remains on branch + `codex/20260831-pull-remote-merge-4a91c7e2-pull-remote-merge`. The occupied original + `main` worktree/ref was not modified, and no push or deployment was performed. + +## Verification + +- Repository-pinned `pnpm@10.33.4` installation with `--frozen-lockfile`: passed. +- Merge-focused suite: 12 files, 145 passed, 2 skipped. +- `pnpm run typecheck`: passed. +- `pnpm test`: 212 files, 1,721 passed, 2 skipped. +- `pnpm run lint:check`: passed with 0 errors and 5 existing warnings. +- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload, and utility worker. +- Unresolved merge paths: 0. Staged and unstaged `git diff --check`: passed before the + merge commit. + +## Follow-ups + +- Promote this verified branch to local `main` only after task + `20260831-meowa-hosted-plugin-client-8d3a5b72` releases its ownership; do not bypass + that gate. +- Revoke the historical client-exposed Meowa credential externally, then complete the + official signing-key, rotated server credential, positive pricing, production + Admission, packaged install/update/rollback, uncertain-result, and real Provider + acceptance gates before production activation. + +## Promotion Candidates + +- None. The accepted hosted Plugin candidates were promoted into canonical memory by + this Integration task. diff --git a/.project-docs/40-domain/business-rules.md b/.project-docs/40-domain/business-rules.md index 171904b..b9630a2 100644 --- a/.project-docs/40-domain/business-rules.md +++ b/.project-docs/40-domain/business-rules.md @@ -21,8 +21,23 @@ per project and assign its Skill to an Agent. - Production Marketplace trust fails closed while the official Ed25519 public key is absent. Test-only/integration keys and packaged unknown-key rejection are evidence, - not authority to activate production. Release B hosted Provider runtime remains - closed behind its separate Provider gate. + not authority to activate production. Generic `platform_hosted` client execution is + implemented, but production package trust and real Provider activation remain closed + until the official key and separate server pricing, credential, Admission, and + acceptance gates are ready. +- A `platform_hosted` Skill or tool may enter only an installed, enabled, assigned, + trusted, compatible, policy-admitted parent Pi logical thread. Unknown, disabled, or + ineligible assignments stay inert; child workers receive no hosted Plugin projection. +- A metered hosted mutation requires explicit client confirmation before resolve, + Admission, or charging. Works Square owns price, payer, Token Point policy, and receipt + state. Stable logical operation identity survives response loss and Main restart; + `submission_unknown` must not become a fresh request or be conflated with a billing + `pending_review` receipt. +- Electron Main to fixed Works Square routes is the only hosted Plugin transport. + Packages, Renderer state, Pi arguments/results, logs, and saved project metadata must + not expose Provider credentials, URLs, credit balances, raw responses, or Provider job + IDs. Saving a hosted result must use bounded project-relative paths and the existing + project write lease. - 面向用户的 AI 编程新建流程必须在 `mini_game`、`mini_program`、`custom` 中选择；`ProjectType` 是产品类型，创建后不能通过 UI 或 Host API 修改，未传类型的兼容 API 调用按 `custom` 处理。 - 新建小游戏和小程序会生成平台固定版本的受控 Vite 发布模板，并可使用项目配置中的单一“提交审核”入口；`custom` 和缺少类型字段的旧项目不提供一键发布。 - `ProjectType` 不等于 `BuildPreset`：第一期两个可发布产品类型都映射到内部受控 Vite preset；本地 `projectType` 不是授权边界，Main-owned 安全打包、Host API 和服务端包体校验仍必须执行。