From e74b59a67479a32619a9e3dbef476a65a6ad071f Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Mon, 24 Aug 2026 22:22:46 +0800 Subject: [PATCH] docs(project): record Pi proxy hotfix qualification --- ...-pi-runtime-unavailable-hotfix-4e9c7a31.md | 76 +++++++++++++++++-- 1 file changed, 69 insertions(+), 7 deletions(-) diff --git a/.project-docs/30-worklog/tasks/20260824-pi-runtime-unavailable-hotfix-4e9c7a31.md b/.project-docs/30-worklog/tasks/20260824-pi-runtime-unavailable-hotfix-4e9c7a31.md index 66bad91..0a513a2 100644 --- a/.project-docs/30-worklog/tasks/20260824-pi-runtime-unavailable-hotfix-4e9c7a31.md +++ b/.project-docs/30-worklog/tasks/20260824-pi-runtime-unavailable-hotfix-4e9c7a31.md @@ -8,7 +8,7 @@ - Worktree: D:\Datas\OthersProjects\makelore-pi-runtime-unavailable-hotfix-4e9c7a31 - Base commit: fa510c49761485cbd323801923dbe2472d6981bb - Owner: codex-root -- Status: In Progress +- Status: Ready for Integration ## Scope @@ -103,16 +103,52 @@ binding, accept input, dispatch a real packaged parent and child, and verify argv/models/log/diagnostic token non-disclosure. Its upstream is controlled loopback and the report remains `realTurnVerified=false`. -- Implementation and repository verification are complete. Formal Windows NSIS - packaging and final-artifact proof remain pending from the clean candidate. +- The first packaged proxy run additionally proved that Host authentication was + accepted but exposed a second Windows release blocker: Pi's Node fetch adds + `sec-fetch-mode: cors`, and forwarding that transport-owned header into + Electron `net.fetch` fails with `net::ERR_INVALID_ARGUMENT` before the + upstream receives the request. The Host proxy now drops only that header; + direct API-key/OAuth/local Provider behavior and the no-mutation-replay rule + are unchanged. +- Generated and verified the final Windows x64 NSIS from clean candidate + `34a4434cfb3b6d083259f27dde065e78d4e0054f`. The final packaged global-Main + proxy proof passed and all proof Electron/Pi processes exited. + +## Commits + +- `f902edefd0026fc8b003d4769c4eb1c064243880` — lazy Main Host token, + typed Provider auth mapping, retryable recovery state, focused regressions, + and the packaged global-Main proxy proof path. +- `34a4434cfb3b6d083259f27dde065e78d4e0054f` — drop Pi/Undici's + `sec-fetch-mode` transport header before Electron upstream forwarding and use + an actionable real-UI send in the packaged proof harness. + +## Changed Files + +- `.project-docs/30-worklog/tasks/20260824-pi-runtime-unavailable-hotfix-4e9c7a31.md` +- `electron/api/coding-composition.ts` +- `electron/api/coding-provider-auth.ts` +- `electron/api/routes/ai-proxy.ts` +- `electron/coding-runtime/pi/release-proof.ts` +- `electron/main/index.ts` +- `scripts/run-pi-subagent-packaged-smoke.mjs` +- `src/stores/coding-conversations.ts` +- `tests/unit/ai-proxy-routes.test.ts` +- `tests/unit/coding-conversations-store.test.tsx` +- `tests/unit/coding-core-routes.test.ts` +- `tests/unit/coding-provider-auth.test.ts` +- `tests/unit/pi-managed-worker-opener.test.ts` +- `tests/unit/pi-runtime-auth-recovery.test.ts` +- `tests/unit/pi-subagent-child.test.ts` ## Verification - `corepack pnpm install --frozen-lockfile` with pinned pnpm `10.33.4`: passed, 997 packages linked from the existing store and the lockfile remained unchanged. -- Focused Vitest run for composition, auth, Renderer recovery, parent opener, - child opener, and auth recovery: 6 files / 55 tests passed. The preceding red +- Focused Vitest run for proxy forwarding, composition, auth, Renderer recovery, + parent opener, child opener, and auth recovery: 7 files / 66 tests passed. + The initial hotfix red run failed exactly on typed auth classification, auth-required projection, and permanent `recovering` state. - `corepack pnpm run typecheck`: passed after the final proof changes. @@ -123,8 +159,34 @@ - `corepack pnpm run build:vite`: passed; Renderer, Main, Preload, and release utility bundles built. Existing dynamic-import and large-chunk warnings remain. - `corepack pnpm run test:electron:windows`: passed; 2 files / 4 tests. -- `corepack pnpm run package:win`, final artifact/closure verifier, and final - packaged global-Main proxy proof: pending the clean implementation commit. +- `corepack pnpm run package:win`: passed from clean candidate + `34a4434cfb3b6d083259f27dde065e78d4e0054f`; produced + `Makelore-2.0.0-win-x64.exe`, 211,888,141 bytes, SHA-256 + `3A1335A6DEFDEBE53A84EA558E6A000DBD538C568EB9AFB202893AA4D82858B2`. +- `corepack pnpm run verify:artifact:win`: passed. The unpacked product runs + Electron `43.4.0` / Node `24.18.1`; bundled Python, pip, sqlite3, SSL, + `uv 0.10.0`, npm `11.6.2`, msgpackr, and x64 canvas load from the product. +- `corepack pnpm run verify:artifact:pi -- --samples 2`: passed. Final + `app.asar`, Pi `0.84.2` CLI, all 130 expected production packages, 6 runtime + assets, 5 native assets outside ASAR, 4 managed Skills, and the materialized + extension/subagent contract are present and executable. The nested runtime + report remains `partial-pass` only for the pre-existing explicit real- + Provider/macOS/Linux waivers; the artifact verifier result is `pass`. +- `corepack pnpm run test:pi-subagent:packaged`: passed against the final + unpacked executable. The actual packaged `app.asar` Main composition used + `works_square_ai_gateway_proxy`, created exactly one first Conversation, + established its Pi binding, projected the submitted user input and + `REAL_PARENT_COMPLETE`, and settled at worker `ready` / run `idle`. + Parent and child each reached the controlled upstream through the current + authenticated Host proxy; the token was absent from argv, `models.json`, + logs, and diagnostics. The UI remained editable with neither runtime- + unavailable nor permanent-recovering state. Cleanup reported zero retained + workers, and an independent Windows process query found zero proof Electron/ + Pi processes. +- Pre-final packaged attempts were not counted as passes: the first used an + unsupported optional embedded-commit assertion, and the real proxy run then + failed on `net::ERR_INVALID_ARGUMENT`; that failure directly produced the + `sec-fetch-mode` regression and the final package/proof rerun above. ## Follow-ups