wangxuming/makelore
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
a5fc8bf596145ffe6294a4d1f45ed099ad2d7d56
makelore/.project-docs/30-worklog/current-state.md

35 KiB
Raw Blame History

Current State

This file is the integrated default-branch snapshot. Feature tasks record progress in 30-worklog/tasks/{task_id}.md and propose canonical changes for the Integration Gate. Feature tasks must not rewrite this file; it changes only in integration mode.

Integrated Through

  • Learning project-catalog source commit 38db158 from feature task 20260819-learning-project-catalog-impl-4e9c71a2 was merged as d967b0f by integration task 20260820-integrate-learning-catalog-a73e91c4. Learning keeps its login and module_access.learning gate but now contains only a server-driven project list, safe README detail, controlled mirrored raster media, and a Main-owned verified native ZIP save path. Course generation, progress, local library, OpenMAIC player, Agent/ASR/classroom runtime, Learning IPC and player-artifact packaging were removed without a compatibility read path. Historical course data is left untouched. The matching Works Square operations/admin/API implementation and real-account package smoke remain pending.
  • Square-auth lifecycle source commit dc776ff from feature task 20260819-square-auth-proxy-client-8c4f2a was merged as f52c2c8 and promoted from verified candidate e7ec12d to local main by integration task 20260819-promote-square-auth-client-73e4c1. Desktop login, refresh, and logout now use fixed Works Square endpoints; Electron Main remains the sole token owner, persists rotated credentials before exposing the refreshed session, and keeps the existing seven-day inactivity boundary. The client no longer embeds a confidential OAuth client secret or refreshes directly against the custom identity service. The matching Square service change must be deployed first.
  • AI Design request-freeze source commit 87e4140 from feature task 20260819-design-freeze-live-6e2c is integrated on main through 5bff5d3 by promotion task 20260819-promote-design-freeze-main-91c2e4. Main-owned Workspace JSON requests and shared Works token refreshes now have a complete 30-second lifecycle deadline, including response-body consumption. Timeout settles as stable 504 DESIGN_WORKSPACE_REQUEST_TIMEOUT; low-level Electron-to-Node fetch fallback is limited to GET/HEAD/OPTIONS, so mutation failures are not implicitly replayed. The native password/SMS login and temporary disable-http2 diagnostic bootstrap remain included. Automated client verification does not yet prove the installed-client freeze is resolved or establish HTTP/2 as the root cause.
  • AI Design history source commit bf0b805 from feature task 20260819-history-load-stall-a92d is integrated on local main. Conversation reads start with the newest ten messages and fetch older pages through opaque cursors; the Canvas keeps its scroll position while prepending. A selected Conversation renders before generation-task reconciliation finishes, rapid A → B → A switching reuses an in-flight event-stream open, and a pending relay/open has bounded cleanup. This is a local source integration only; no packaged-client or deployed-service smoke is claimed.
  • 6478591 / 3a6d388: AI Canvas task-stream reconciliation now reuses an in-flight connecting Conversation stream instead of opening a duplicate; rapid Conversation-switching regression coverage is present. Canonical main promotion is pending release of the occupied main worktree, and real slow-handshake Electron smoke remains pending.
  • ce897f1 / 6504073: AI Programming now isolates prompt lifecycle, loading and errors by OpenCode Session. Main serializes only runtime/configuration acceptance, verifies project Agent content against an owned fresh runtime generation before execution, and returns typed terminal pending responses without automatically restarting, reloading or disposing the shared runtime. A run that receives no explicit busy/assistant/terminal acknowledgement within 10 seconds ends only that Session and is never replayed automatically. The application-side isolation is verified; real bundled OpenCode/provider two-Session execution concurrency is not claimed.
  • Project-cover source commit 145a6ce571d646325092d1e722282babea503954 from feature task 20260817-project-cover-upload-a6a98e56, integrated by task 20260813-sync-push-main-9c2f71. First submission now requires a bounded PNG/JPEG/WebP cover, shows preview/file/reselect feedback, and sends metadata plus cover through Main-owned POST /api/projects/with-cover; conflicts stop before version upload and existing draft/published projects remain version-only. The matching Works Square server source is 407c883 (local merge 0cedfc4). No client package, production deployment, or real-account smoke occurred.
  • 3b37ac3 / 55e61b7: macOS Robot hotspot discovery performs one bounded worker-thread rescan after an empty or SSID-redacted CoreWLAN result; persistent SSID redaction maps to the existing permission error instead of a misleading empty-device state, while firmware and the open Xiaozhi-* contract remain unchanged.
  • f5d47c8 / b6148a5: AI Programming voice capture is available after an Agent is selected but before the lazy first OpenCode session exists; transcription fills the composer draft without creating an empty session, while runtime, loading, transcribing, busy, and recording guards remain unchanged.
  • 4013edc / 3b799af: integrated per-user Code/Canvas/Learning/Robot entry policy from Works Square, projected by Electron Main as four booleans and enforced before disabled module routes initialize.
  • 01bee31: historically enabled the AI Learning course catalog/generation/download/playback architecture. Its Learning course/runtime behavior is superseded by 38db158 above; its unrelated game-engine removal and project-root planning-with-files behavior remain historical context.
  • 26b52d7: Canvas Prompt Museum, editable server-priced generation Quotes, project deletion/task-detail workflow, cloud-default Canvas development entry, and Chinese-only UI consolidation from the authoritative remote main. Its transient bundled game-engine Skill is superseded by 01bee31.
  • f8d82e6: Prompt Museum media rendering now accepts only the server-controlled relative media route, fetches it through a Main-owned bounded Works-authenticated proxy with one refresh retry, and keeps credential-free HTTPS CDN media direct. Renderer-side validation and card-local placeholders cover invalid or failed media; attribution URLs remain optional.
  • c1326a2: Guided Hotspot Binding now scans bounded open Xiaozhi-* candidates and connects the user-selected hotspot inside the page through Main-owned Windows WLAN and macOS CoreWLAN/CoreLocation adapters; system Wi-Fi remains fallback, exact =0 rollback and firmware/cloud contracts are unchanged.
  • b78fc07: Guided Hotspot Binding is enabled by default in Electron Main, with exact environment value 0 as rollback and direct six-digit fallback on capability-read failure; firmware and Host/cloud contracts are unchanged.
  • b7a1590 / 14afe4a: initial firmware-zero-change Guided Hotspot Binding V1 implementation and decision used a Main-owned default-off capability, fixed portal action, in-memory Renderer journey, and existing six-digit Binding contract; b78fc07 above supersedes only that default.
  • ea75b06: Robot configuration reads accept canonical weak numeric response ETags introduced by public response compression only when the numeric revision exactly matches the strictly projected DTO; configuration and assignment writes continue to emit strong If-Match.
  • fe55dee: Robot configuration editing uses the safe Xiaozhi/Works catalog for model, language, and voice selections, with bounded sliders for TTS numeric controls and no-store catalog responses.
  • fd9b5b46a913c515e94e4e26f185d43866c2581f / 7a811590c4943b7b1b7ea5f3b4d3ce3ce05622a5: Codex-style persistent AI Programming context-compaction timeline, run-lifecycle separation, polling-idle completion, and cold-hydration hardening.
  • 22378efcee07e7fb80b651e65e3202f1a1dfea1d: AI Canvas bidirectional Agent WebSocket commands, idempotent transport fallback, and Quote-based generation-task recovery.
  • aba5cae286807093cf4ef643fe9f498050985c31: Robot / AI hardware module, Main-owned Works Square proxy, and cross-repository wire contract.
  • 86ece3a / 4dde8f3：客户端登录七天滑动续期及集成提交。
  • 724290e / dcc92fc：Main-owned 一键打包提交审核及集成提交。
  • 493b31c：客户端三类 ProjectType、小游戏/小程序受控发布模板与自定义项目发布隔离。
  • 4df0477 / 8dd99c1：客户端静态发布唯一链路、旧 Compose 协调链退役及安全边界补强。
  • 4980894 / 03dae62：AI 绘画 Enter 发送及同一 Workspace 下的多 Conversation 客户端模型。
  • 926056a：Makelore 内置 Electron WebContents/CDP 发布前本地预览检查。
  • 5b44864：Main-owned 本地 npm/Vite 构建、同字节 Electron 双视口预检、source+built 双归档与 artifact contract 上传。
  • 08da976 / 0ee5254：AI 编程首次发送已知空 session 快速路径与明确上游饱和终止态投影。
  • 809364e / 88281b8 / 7a807a2：AI 绘画单参考图图生图选择/上传交互、最新客户端主线集成及旧版 Brief medium 缺失兼容。
  • f05b9d4 / e221374：Updater 稳定源缺包诊断与用户错误脱敏修复，以及当前 main 上的图生图最终合并提交。
  • f4113a8：远程主线客户端收口，包含启动预热、课程 Skill、项目 Agent 模型配置、浅色界面整合，并移除独立真机预览与内置 Superpowers。

Current Focus

客户端面向非专业用户提供“创建小游戏或小程序 → 项目配置中一键提交 → Main 本地 npm/Vite 构建 → Electron 双视口预检最终产物 → 上传 source+built 双归档与 contract → 运营审核”的唯一创建者链路。Main 对安全源码快照运行安装包内固定 npm 11.6.2 的 npm ci --ignore-scripts，再显式调用项目 package-lock.json 锁定的 Vite；Vite config/plugins 以当前桌面用户权限执行，因此只适用于用户信任的本地项目，不是 sandbox。预检由 Main 以临时 loopback origin 和 Electron WebContents/CDP 检查与最终 built_archive 相同的内存文件字节，覆盖桌面/移动视口、运行错误、白屏和外域访问；不使用 Playwright。该检查仍可由非官方客户端绕过，不产生可信 receipt，也不复刻生产 opaque-origin。服务端不再替客户端运行项目 Vite，而是把源码、构建归档和 contract 视为不可信输入，逐字节重算与校验并固化不可变 Release；人工审核仍不可绕过。自定义和缺少类型字段的旧项目不提供该入口。已发布作品优先使用安全投影后的 play_url，runtime_url 仅保留一个客户端版本的兼容回退。

AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quote 和 turnRevision 随 Conversation 隔离；生成任务和资产保持 Workspace 级共享。图片 Brief 支持文生图，以及从当前项目已完成作品或本地上传中选择一张参考图继续生成；视频复用同一选择器绑定首帧。两条路径都通过现有 Workspace Asset 契约提交一个真实 Asset ID。每条 Conversation 使用服务端持久 Agent Gateway Session；连接正常时命令、Run 与设计事件共用双向 WebSocket，只有发送、断连或 ACK 超时等传输故障才以同一 client_command_id 回退 REST，结构化业务错误不重复提交且未知上游文本由 Main 脱敏。Main-owned Workspace JSON 请求与共享 Works token refresh 的完整生命周期均限制为 30 秒，超时稳定投影为 504 DESIGN_WORKSPACE_REQUEST_TIMEOUT；底层 Electron-to-Node fetch 回退只允许 GET、HEAD、OPTIONS，PATCH/POST 等变更请求失败时不得隐式二次发送。确认栏允许编辑服务端最终 Prompt 与 generation options，每次修改都由服务端 Quote 重算设计点，确认时提交最新原值；客户端不推算供应商或积分价格。任务详情可预览/下载结果。侧栏删除项目要求完整输入项目名，删除当前项目后切换到最近更新的剩余项目；服务端删除/结算语义仍由 Works Square 契约负责。确认生成会按 Quote 对账 Workspace 任务；任务已经落库但 Run 随后失败时仍恢复任务列表，内部对账失败不覆盖当前 UI 错误，同时 Conversation 写入继续受 Workspace-load 与 Conversation-selection generation 保护。

Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；服务端相对媒体只允许固定 /api/image-prompt-museum/{entry}/media/{thumbnail|number} 形状，并由 Main 注入 Works Bearer、执行一次 401 刷新、可信 raster MIME 与 10 MiB 上限后转为 Renderer data URL；credential-free HTTPS CDN 图片保持直连。图片失败只显示卡片内占位，不阻断卡片或详情；缺少来源 URL 时显示纯文本。“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。pnpm run dev 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。

Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works /api/auth/me，Renderer 只获得 Code、Canvas、Learning、Robot 四个布尔权限。缺失 module_access 或任一字段时默认开启；服务端 design 显式映射客户端 painting。被关闭的模块卡片置灰且不可点击，根路由、深层路由和别名路由均在 MainLayout 或模块初始化前阻断。Code provider 等待认证权限加载完成；权限查询返回终止性 401 时同时清理 Main 和 Renderer 会话。/settings 是全局设置，不受 Code 入口策略阻断。该机制只是客户端入口策略，不代替服务端 API 授权。

AI 学习现在是已启用的运营精选项目目录，并继续受登录和 module_access.learning 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML，服务端发布时把通过 SSRF/重定向/大小/MIME 校验的远程 HTTPS raster 图片镜像并改写为固定项目媒体路径，Main 再以 Bearer、可信 MIME 和 10 MiB 上限代理。详情页的下载按钮打开系统保存对话框；Main 将最大 512 MiB 的 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，校验声明字节数、SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 saved 或 cancelled。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。客户端契约已完成，不代表 Works Square 运营后台/API 或生产内容已经部署。

AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗余历史读取，prompt 可直接进入 Host API；普通历史会话仍刷新消息。每个 Session 独立持有 run、loading、error 与内部队列；一个 Session 的回复或终止不会锁住、改写或重放另一个 Session。Host 接受或用户消息落库不算启动确认，只有明确 busy/retry、assistant、question、permission 或 typed terminal event 才确认/终结启动；独立的 10 秒 watchdog 到期时仅以 SESSION_START_UNCONFIRMED 终止该 Session。Main 以 runtime generation provenance、Agent 内容 fingerprint 和 live registry id 共同验证项目 Agent，provider/runtime 或 Agent 未应用时在执行前返回 typed 409 且 promptSent:false。普通 message、command、summarize 和后台 provider sync 不自动重启、reload 或 dispose 共享 runtime；只有显式用户 apply/lifecycle 操作可以推进运行时刷新。Main AI proxy 只把明确的上游分组饱和投影为当前 OpenCode 的终止状态，配额耗尽保持独立终止态，通用限速继续保留 429。上下文压缩以每个 Session 的持久时间线事件呈现：自动与手动压缩使用不同文案，运行态原位弱化显示，完成后静态保留并可从历史恢复；session.compacted 只完成对应事件，只有真实 idle 才结束 run 和释放排队消息。

Updater 仍由 Electron Main 选择目标 feed、记录原始诊断并保持失败语义。正式稳定源缺少对应平台 manifest 时，设置页只显示一条简洁中文提示并允许重试，不把缺包误报为已是最新版，也不向普通界面暴露堆栈、URL、路径或错误码；签名产物发布和真实升级安装仍属于外部 Release Gate。

Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选择。引导路径在页面内扫描附近符合条件的开放 Xiaozhi-* 热点，要求用户明确选择后由 Main-owned Windows/macOS 原生适配器连接并核验当前 SSID；失败时保留系统 Wi-Fi 兜底。macOS 在首次 CoreWLAN 结果为空或 SSID 全不可见时只进行一次 250 ms worker-thread 延迟重扫；第二次仍有网络但没有可读 SSID 时显示定位权限错误，不再冒充“没有发现设备热点”。后续继续使用固定 http://192.168.4.1/ 系统浏览器页面、恢复互联网和现有六位 Binding；精确环境值 0 可回滚为直接六位码。Makelore 不接收 Wi-Fi 密码、不修改固件，也不把热点发现或 Binding 成功等同于可信身份/在线。签名 macOS、Windows 真机、指定固件/发行契约和完整整链仍未完成验证。

Recently Completed

  • 2026-08-20: Replaced AI Learning's course generation/player stack with the curated project catalog defined by ADR-005. The authenticated/module-gated client now renders project cards and safe README detail, proxies publish-time mirrored media through Main, and saves verified ZIP archives through the native dialog. Old course/runtime/player packaging was removed; full client verification passed before main promotion, while the external operations backend and real-account package smoke remain pending.
  • 2026-08-19: Integrated native password/SMS login, the temporary HTTP/2-disabled diagnostic bootstrap, and the AI Design freeze fix. Workspace JSON calls and shared token refresh now settle within 30 seconds, transport abort is paired with deterministic rejection, and implicit Electron-to-Node fallback no longer replays mutation requests. Installed-client Quote retry/confirm smoke and the final HTTP/2 policy decision remain pending.
  • 2026-08-17: Integrated application-side multi-Session isolation for AI Programming. Session A may remain busy while Session B is independently accepted or terminally rejected; errors, startup deadlines and uncertain-failure cleanup stay Session-scoped. Main now fail-closes stale Agent/provider runtime state before execution, applies bounded manager/project FIFO acceptance with revocable timeouts, and never refreshes the shared runtime automatically from ordinary execution paths. Full unit, typecheck, lint, build, focused Electron E2E and independent Sol review passed; a real paid-provider/bundled-runtime concurrency smoke remains pending.
  • 2026-08-17: Replaced the temporary coverless-first-create fallback with a required PNG/JPEG/WebP picker, preview, file name, reselect action, Renderer/Main signature and size validation, and one Main-owned multipart metadata-plus-cover create request. Create conflicts fail before version upload; existing project metadata and covers remain unchanged.
  • 2026-08-17: Corrected macOS Robot hotspot discovery after a system-visible Xiaozhi-* report. CoreWLAN now gets one bounded retry when its first result is empty or all SSIDs are unavailable; a persistent non-empty redacted result becomes the existing safe permission state. Open-only filtering, firmware, Host/Renderer contracts, exact-current-SSID verification, and the system-Wi-Fi fallback are unchanged; signed-package physical smoke remains pending.
  • 2026-08-17: Created merge commit 4013edc for the reviewed per-user module-entry policy source tip 3b799af. Main exposes only four booleans from /api/auth/me; missing fields remain enabled, design maps to painting, disabled root/deep/alias routes stop before module initialization, Code provider startup waits for policy hydration, terminal 401 clears both session layers, and global settings remains reachable.
  • 2026-08-17: Integrated remote 01bee31, which at that checkpoint introduced Learning course browsing/generation/install/playback and its OpenMAIC runtime boundary alongside unrelated repository consolidation. ADR-005 and source 38db158 supersede and remove that Learning course/runtime behavior; historical downloaded data remains untouched. The unrelated game-engine removal and project-root planning-with-files behavior remain current.
  • 2026-08-16: Integrated remote 26b52d7: Canvas now has server-backed Prompt Museum navigation, editable server-repriced generation Quotes, task result details/downloads, guarded project deletion, cloud-default development, and Chinese-only UI. That tip briefly bundled game-engine; authoritative successor 01bee31 removed it. Client integration is verified separately from production Prompt Museum data/backend deployment.
  • 2026-08-18: Integrated Prompt Museum media rendering from f8d82e6: relative protected media is fetched through Main with bounded trusted-raster validation and one 401 refresh, HTTPS media remains direct, invalid/failed images are card-local placeholders, and missing attribution URLs render without broken links. Focused unit/Electron E2E, typecheck, scoped lint, and Vite build passed; real Works/CDN production smoke remains pending.
  • 2026-08-16: Integrated Windows/macOS in-page Robot hotspot discovery, explicit selection, connection, and exact-current-SSID verification behind the existing default-on guided capability. Candidate IDs are bounded and short-lived, native diagnostics stay in Main, system settings remain fallback, and firmware/Portal/Binding contracts are unchanged.
  • 2026-08-16: Enabled the existing Guided Hotspot Binding journey by default after explicit product confirmation. Exact NIANCODE_AI_HARDWARE_GUIDED_HOTSPOT_BINDING=0 remains the operational rollback; fixed portal ownership, direct-code fallback, security warnings, firmware-zero-change, and Binding-without-online semantics are preserved.
  • 2026-08-16: Initially implemented ADR-002's Robot onboarding V1 without changing firmware, behind a default-off Main capability and fixed portal opener. The later b78fc07 decision above changes only the default; the same firmware/issuer/native-opener/physical evidence remains outstanding.
  • 2026-08-15: Corrected the deployed Robot configuration-read contract after the compressed public Works response was observed with ETag: W/\"0\" and matching numeric config_revision: 0. Electron Main now accepts only canonical strong or weak numeric response tags, still requires exact DTO revision equality, and always sends strong If-Match for mutations. No production client rollout is claimed.
  • 2026-08-16: Integrated selection-oriented Robot configuration editing. Enabled model and caller-safe voice metadata now flows from Xiaozhi through Works Square and Electron Main without exposing provider secrets; unavailable current values and clear_fields semantics remain intact. Production deployment of the matching service endpoints is still required.
  • 2026-08-15：AI 编程上下文压缩改为 Codex 风格的会话内时间线事件；手动与自动压缩原位展示并持久保留，历史回放去重且状态只允许从 running 单调进入 completed，压缩完成不再冒充整个 run idle。
  • 2026-08-14: AI Canvas Agent 命令与流式事件改为共用双向 Conversation WebSocket，并保留仅面向传输故障的幂等 REST 回退；结构化 Gateway 错误不重试且未知文本脱敏；确认生成按 Quote 恢复已落库任务，切换 Conversation 后仍同步 Workspace 任务且不覆盖新会话状态或错误。
  • 2026-08-13: Integrated the enabled Makelore Robot top-level module at /ai-hardware. Renderer uses typed safe DTOs while Electron Main owns Works Square authentication, idempotency identities, ETag/If-Match forwarding, response projection, limits, timeouts, and credential recovery. Robot and Canvas routes no longer initialize AI Programming projects/providers. No production deployment or real activation-code smoke is claimed.
  • 2026-08-08：合并登录续期和一键发布；发布成功后保存精确 app/version/review 映射，Renderer 不接触 Token、ZIP 或本地路径。
  • 2026-08-08：补齐跨平台 Electron E2E fixture、Windows ZIP 预检和异常成功响应安全投影。
  • 2026-08-09：新建项目支持小游戏、小程序和自定义三类不可变产品类型；前两类生成固定 Vite 发布模板，自定义及缺少类型字段的旧项目不显示一键提交入口。
  • 2026-08-10：删除客户端旧 Compose deploy-check、watcher/arm/upload 协调和手工 ZIP 路由；submission binding v2 保留旧 submitted 绑定并把旧中间态归一为 legacy_retired，同时补齐 Renderer capability、play_url 安全投影和本机绑定失败告警。
  • 2026-08-11：AI 绘画支持在同一设计项目内创建和切换多条独立 Conversation；保留项目级任务/资产，并使用 Workspace + Conversation 身份保护异步与流式更新。退出时关闭本地流并清除本地 Session-id 缓存，不删除服务端持久 Conversation Session。
  • 2026-08-12：一键提交前复用当前项目的内置浏览器 loopback preview，以 fresh 临时 Electron WebContents/CDP 执行桌面/移动 UX 预检；服务端仍执行唯一受控构建、不可变 Release 安全门禁和人工审核。
  • 2026-08-12：发布架构反转为 Main-owned 本地构建；固定 npm 11.6.2 按项目 lockfile 安装并执行项目 Vite，Electron 预检最终上传同字节产物，再上传 source+built 双归档和严格 contract。服务端仅校验并固化不可信字节，不再承担项目 Vite 构建。
  • 2026-08-12：AI 编程新 session 的首条 prompt 不再被已知空历史读取阻塞；明确上游分组饱和会快速终止，通用 429 仍保持原有限速语义。
  • 2026-08-13：AI 绘画把原视频首帧选择器泛化为单图来源选择器；图片 Brief 可选择项目作品或上传本地图作为图生图参考图，视频及未决 medium 保持历史首帧行为，成功提交后关闭弹窗。
  • 2026-08-13：Updater 对 Works Square 稳定源缺少 Windows/macOS manifest 保持错误状态，在 Main 日志保留原始诊断，并在设置页去重、脱敏为可操作的中文提示；未发布任何新安装包。

In Progress

  • 成组集成服务端 source+built+contract 校验、OSS immutable Release、CDN/Edge 与 App 消费链后，使用真实账号和生产配置执行客户端提交到作品播放的整链验收。

Next Recommended Steps

  1. 用包含本次修复的安装包和真实 Works 账号重复执行 Quote PATCH、重试报价与继续调整，确认任一超时在 30 秒内释放 UI、其他请求可继续、服务端不收到隐式重复 mutation；确认后单独恢复 HTTP/2 再对照 smoke，决定是否移除临时 disable-http2。
  2. 部署 Works module_access migration 与 /api/auth/me 权限 API，打包新 Makelore 客户端，再用真实账号分别关闭 Code、Canvas、Learning、Robot 执行卡片、根/深层/别名路由 smoke；同时独立验证模块 API 服务端授权。
  3. 实现并部署 Works Square Learning 项目管理、对象存储、远程图片镜像和 list/detail/media/archive API，再使用真实账号验证发布/下架、分页、README 图片、ZIP 校验/保存以及 Windows 与签名 macOS 安装包。
  4. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐 Windows 真机热点连接、签名 macOS x64/arm64 CoreWLAN/CoreLocation/worker 打包验证、真实 Host API/native seam Electron E2E 和完整真机 smoke；发布支持保留精确 =0 回滚，不把缺失证据表述为已验收。
  5. 成组核对客户端 source+built+contract 上传 → 服务端逐字节校验 → OSS immutable Release → CDN/Edge 的发布契约与客户端 play_url 消费契约。

Open Questions / Blockers

  • 客户端与模拟上游回归已完成；真实服务端新协议、OSS/CDN、运营审核、App 播放、生产账号和环境变量仍待部署环境确认，不能据此宣称生产发布链已经验收。当前已验证的 Windows 安装器未上传或发布。

Risky Areas

  • 四模块权限只控制 Makelore 客户端入口和初始化，不是 API 授权边界。不得因卡片置灰或路由阻断而放宽 Works/模块服务端的身份与权限校验；旧服务端缺少对象/字段时默认开启是显式兼容策略。
  • Prompt Museum 相对媒体必须保持固定的服务端路径并由 Main 处理；如果服务端增加媒体变体，需同步维护 entry/path 语法、Works Bearer 所有权、单次刷新、10 MiB 限制、可信 raster MIME 白名单与 Renderer data URL 校验。HTTPS 直连媒体必须继续无凭据，图片失败必须局限在卡片/详情视图。
  • Learning 项目目录依赖真实 Works 运营发布和固定 API 契约；README 远程图片必须在发布时镜像为固定媒体路径，客户端不得接受任意媒体/下载代理。Main 必须保持 Bearer 所有权、一次 401 refresh、可信 raster MIME、10 MiB 图片上限、同源最多五跳、512 MiB ZIP、声明大小/SHA-256/ZIP 签名和原子保存；不得把上游错误、Token、对象存储 URL 或本地路径投影到 Renderer。历史课程数据不再读取但也不得被隐式删除。
  • Works Project 首次封面已由服务端源 407c883（本地 merge 0cedfc4）提供单请求原子绑定与失败补偿，客户端源 145a6ce 因此要求首次发布上传 PNG/JPEG/WebP 封面；部署、安装包和真实账号/对象存储 smoke 仍未完成。服务端仍没有已有 metadata 的 revision/ETag 与 draft-only 条件写，因此已有 draft/published 继续只允许 version-only，客户端不得以无条件 PATCH 替代。
  • Guided Hotspot Binding 默认开启并提供未经认证的热点扫描/显式连接，但当前 Hotspot/portal 仍是开放 SoftAP + 明文 HTTP，且精确出货镜像、激活码发行契约、签名 macOS、Windows 真机与完整整链尚未验证。界面必须保留环境警告，异常发布可用精确环境值 0 回滚；不得把 SSID 前缀宣称为可信设备发现、自动认领或在线证明。
  • 一键提交已成功但本机 submission binding 落盘失败时必须保持提交成功、显示固定 binding_warning 并继续轮询，避免用户误判上传失败。
  • 公共 play_url 必须满足 Works Square 同源 HTTPS、无 userinfo/loopback、精确 /apps/{app_id}/ 路径、无 query/fragment、版本非空且上游标记可播放。
  • /api/works/projects/publish-source 必须在读取凭据和项目文件前校验 Renderer capability；Host token/base 不能替代该 UI 边界。
  • works-cloud-deploy.json 仅是已安装数据的兼容文件名，不代表客户端仍拥有自动部署协调器；旧中间态不得恢复为后台任务。
  • 刷新凭据、发布 Token、ZIP、幂等键和重试只能由 Electron Main 持有。
  • 本地 projectType 只决定产品分流和模板选择，不得作为授权依据或替代 Main/服务端的包体校验。
  • 本地构建必须使用安装版 Electron Node、固定 npm 11.6.2 和项目 package-lock.json 锁定的 Vite，不得回退到全局 PATH、已有 node_modules 或未验证的 npm 闭包；依赖安装需要网络。
  • 项目 Vite config/plugins 以桌面用户权限执行，不能称为 sandbox；此风险边界必须在发布说明中保留。
  • AI 绘画消息、Brief、Quote 和 turnRevision 必须按 Workspace + Conversation 隔离；任务事件仍按 Workspace 归并，迟到的异步结果不得污染已切换的会话。
  • AI 绘画 WebSocket 命令只能在传输发送、连接关闭或 ACK 超时时回退到 REST，并必须复用原 client_command_id；Gateway 结构化业务错误不得触发重复提交，未知错误文本不得进入 Renderer。确认后的任务恢复必须按不可变 Quote 身份归并到 Workspace，不能用任务恢复放宽 Conversation generation 门禁或覆盖新会话错误。
  • AI 绘画 Main-owned Workspace JSON 请求和共享 Works token refresh 必须在 30 秒内结束并释放共同等待者；只允许 GET/HEAD/OPTIONS 在 Electron transport 失败后透明改走 Node fetch，PATCH/POST 等 mutation 必须由具有显式幂等身份的上层协议决定是否重试。临时 disable-http2 只用于安装包诊断，不能替代该有限生命周期与非重放边界。
  • 服务端持久 Conversation Session 不由客户端在注销或退出时删除；Main 只关闭本地流、清除本机缓存并撤销本地凭据。
  • 客户端对最终构建字节的 loopback 检查没有可信 receipt，且不复刻生产 opaque-origin；服务端必须独立重算 source/built/contract、校验不可变 Release，人工审核仍不可绕过。如未来需要不可绕过的 runtime gate，必须引入可信 verifier 并绑定精确构建产物。
  • AI proxy 的明确饱和 429 → 400 是与当前 OpenCode 重试契约匹配的内部投影；升级 OpenCode 或上游饱和错误文案变化时必须复核。不得把通用 429 或仅含 rate_limit_exceeded 的响应误分类为终止饱和。
  • AI 编程压缩事件必须按 Session、run token、runtime generation 与 native Part/event identity 关联；session.compacted 不等于 session.idle，历史 hydration 不得把 completed 降回 running，失败或中止必须清理本 run 的未完成事件。
  • AI 编程多 Session 隔离只证明应用提交、状态、错误、超时和队列互不污染，不证明 bundled OpenCode 或真实 provider 会并行执行两个模型 turn。任何产品或性能结论都必须保留上游可能串行、限流或拒绝的边界。
  • 项目 Agent 与 provider/runtime freshness 必须在 Main 的 bounded acceptance 临界区内验证。普通 message、command、summarize 和后台同步不得自动重启、reload 或 dispose 共享 runtime；同 id 不能证明同内容已经加载，attached/unknown runtime generation 必须 fail closed。
  • AI 绘画单图选择器仍精确匹配 quick reply 从作品列表选择图片，用途再从当前 Brief medium 推断；本地化或协议文案变化可能破坏入口。扩展更多素材输入前应升级为结构化 action/purpose。
  • Updater 源码错误提示不能代替发布正式签名产物；稳定 feed 缺 manifest 必须保持失败，Renderer 不得展示原始堆栈、URL、路径或错误码。升级链只有在旧版本完成发现、下载、重启和安装 smoke 后才可视为生产就绪。

Last Updated

2026-08-20