mirror of
https://github.com/THU-MAIC/OpenMAIC.git
synced 2026-10-17 05:29:46 +08:00
@openmaic/generation@0.1.1
406
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 wyuc
|
7aba740a64 |
refactor(app): consume the contract's interactive and widget types (#1073)
Second of three PRs for #1061 (after #1070). WidgetType re-exports from @openmaic/dsl; the app's rich widget configs extend WidgetConfigBase; InteractiveContent aliases the contract generic; the write validator adopts the contract's html-or-url rule while staying lenient over historical widget shapes (with a primitive-config barrier matching the hydration crash class); widget-config extraction seeds the contract type; @openmaic/generation drops its WidgetType copy and gains the dsl dependency (0.1.1).@openmaic/generation@0.1.1 |
||
|
wyuc
|
587deb2bde |
feat(dsl): promote the interactive and pbl content kinds into the contract (#1070)
First of three PRs for #1061. InteractiveContent (generic widget-config extension, open schema surface) and PBLContent/PBLProject (design-time definition plus planner-seeded skeleton; opaque deprecated legacy payload; historical runtime-overlay fields tolerated) enter @openmaic/dsl with validators, normalizePBLProject, guards, and a four-kind scene schema. DSL_VERSION unchanged (additive); npm 0.6.3 -> 0.7.0.@openmaic/dsl@0.7.0 |
||
|
|
ceb05adb41 |
feat(media): allocate generated assets through the registry (#1007 part 2, step b) (#1039)
* feat(media): establish shared asset ownership primitives Introduce global browser asset-pool ownership, asset-reference collection, stage reclamation planning, and lease-based URL access. Carry allocated media identity through storage and generation boundaries with regression coverage. * fix(media): enforce safe resolution across every consumer Route image, video, thumbnail, presentation, and video-export consumers through one resolution state machine. Prevent opaque allocated or generated references from reaching render and export sinks, with fallback and ownership tests. * fix(media): protect document-owned assets across mutations Allocate pool bytes before compatibility writes and document commits, then roll back uncommitted generations safely. Preserve document ownership across edits, retries, imports, speech generation, scene changes, and stage deletion. * fix(media): scope retries and tighten ownership guard Scope retries to the target scene and slide and refuse ambiguous shared-reference mutations. Expand retry rendering coverage and keep direct pool URL resolution behind the shared lease owner. * fix(storage): avoid nested lock during stage cleanup Execute prepared reclamation plans against an explicitly deleted document so the compatibility cascade cannot re-enter the per-document lock. Cover deletion of stage-owned media rows even when the document has no references. * refactor(media): confine reclamation to stage deletion Remove inline pool and compatibility-row cleanup from element, speech, scene, and audio replacement flows. Keep whole-stage reclamation behind explicit stage ownership, preserve stage-less legacy audio rows, and document deferred document-truth sweeping. * fix(media): close retry and resolution gaps Restore shared source tasks after successful forks, scope retries across both whiteboard locations, and wait for parallel TTS workers before rollback. Resolve background media through import, rendering, and PPTX export paths while keeping retry controls visible over last-good bytes. * test(media): execute the consumer safety matrix Replace source-substring checks with resolver seam execution across all six UI consumers, stage hydration, and both exporters. Pin each rollback layer independently and harden the ownership guard against aliased pool imports. * chore(packages): publish the additive DSL field Bump the DSL patch version for the optional speech-action field. Keep the transitional reclamation policy app-owned and document the legitimate transaction rollback removals there. * fix(media): make retry rollback task-safe Delay allocation task re-keying until final document reconciliation succeeds, restore shared source tasks on failed forks, and require exact stage-whiteboard targets before falling through from a missed scene. * fix(media): clear private assets and refresh leases Delete the asset-pool database during the confirmed local-data wipe. Notify the app lease layer after same-id replacement so mounted consumers re-resolve current bytes without reaching into storage internals. * test(media): pin closure safety guards Exercise the CSS allocation boundary, unfiltered legacy-row ownership, delete-and-undo byte survival, and real distinct consumer seams. Restore the video-only manifest overwrite condition and share the direct video resolution hook across both element variants. * test(media): narrow rollback element assertion Narrow the reconciled slide element to an image before checking its source so the rollback regression remains type-safe under the full root compiler configuration. * fix(media): close lease refresh races Gate the first batch publication by unique resolved refs, then publish every replacement snapshot without mutating the prior React state object. Serialize invalidation behind pending releases, evict rejected refreshes, and register replacement observation at the pool boundary. * fix(media): reopen pool after clear failures Always evict the singleton once its store has been closed, including blocked and failed database deletion paths. Report blocked deletion as deferred and prove a later write uses a fresh live store. * fix(media): isolate shared retry progress Track forked regeneration under the selected element until it receives a fresh asset identity, leaving the shared source task and bytes untouched. Surface targeted failures through renderer task lookup and skip the redundant fork reconciliation lock. * fix(media): close final asset retry gaps Keep blocked asset clears fail-loud until a successful retry, with actionable settings guidance. Clear failed shared-fork state across durable and live key spaces, and pin renderer lookups, lease publication identity, and committed-ref rollback protection. * fix: preserve actionable retry failures Localize the blocked cache-clear recovery hint across every supported locale and pin the deferred-error mapping. Retain durable fork failure rows while retries run, deleting them only after successful generation so unstructured failures survive reload. * fix(media): hydrate legacy stored video thumbnails Home-page recent-video thumbnails regressed for legacy Dexie mediaFiles rows keyed by gen_vid placeholders: the reworked hydration resolved the row's bytes through the sealed resolver but never surfaced the stored blob (and its poster) as object URLs for the preview card, so the CI recent-video-thumbnail e2e specs found no visible element. Hydration now materializes legacy stored video rows into blob URLs for both the element src and poster while keeping the resolver invariants: opaque refs still never reach a DOM src, and concrete addresses are never blanked. Unit pins cover the seam so the vitest suite catches this class without a browser. * fix(media): resolve sole restored legacy video Classroom playback restored tasks by exact document media references. Legacy gen_vid references can outlive the key used by the one persisted video row, leaving the player on a placeholder even though bytes were restored. Select the sole completed stage video only for legacy sequential refs after exact and reconciled matches. Keep exact failures authoritative, refuse ambiguous candidates, and cover success, ambiguity, and failure precedence in unit tests. * fix(media): scope legacy video recovery Decide restored legacy video recovery once from the complete document and record it through the shared task lookup consumed by playback, editing, and resolved slides. Keep ambiguous documents as placeholders, apply the same decision to thumbnail hydration, and preserve exact failure precedence. * fix(media): exclude claimed video recovery tasks Model restored legacy recovery as a two-pass match across document video elements and task rows. Remove tasks claimed by exact, targeted, or placeholder lookup before applying the sole-candidate fallback, and cover the ownership/cardinality matrix. * fix(media): unify video element resolution Centralize source, task, poster, and legacy recovery decisions for every video consumer. Ensure direct URLs win over opaque refs and play_video waits on element-targeted retry tasks. * refactor(media): route legacy recovery through resolver Let document-aware consumers request legacy video recovery through the unified element binding API, keeping thumbnail hydration on a single decision path. * fix(media): preserve import refs and prefer pool bytes Recognize unambiguous extensionless relative media addresses during classroom import. Resolve allocated export and thumbnail assets from the shared pool before falling back to lagging compatibility rows. * fix(export): preserve concrete video sources Route PPTX video elements through the shared media binding resolver so an unresolved opaque reference cannot replace a playable source. Complete browser and persisted-store cleanup when asset-pool deletion is deferred, while retaining distinct hard-failure behavior. * fix(media): fork retries without exclusive ownership Enumerate logical asset owners across every persisted document before allowing global pool replacement. Thread explicit targets through fresh-id rewrites and cover cross-document aliases plus unreadable ownership. * fix(media): guard global asset reclamation Share a fail-closed persisted-document liveness check between stage deletion and retry replacement. Preserve cross-document pool aliases while deleting stage-owned compatibility rows and cover enumeration failures. * fix(media): cover complete slide asset references Route slide media traversal through a shared mutable slot contract so backgrounds participate in export, thumbnail hydration, collection, and rewrite lifecycles. Snapshot complete surviving-document refs once per reclamation and preserve manifest-only owners while retaining fail-closed behavior. * fix(media): preserve exclusive retry asset ids Allow targeted retries to replace exclusively owned pool assets in place. Keep shared and unprovable ownership paths on fresh allocations, and pin production-shaped retries plus compatibility-row cleanup. * fix(media): revalidate asset bindings at completion Recheck repository-wide ownership before replacing generated media and fork scoped retries when exclusivity changed. Route video export selection through the unified resolver and keep concrete posters independent of task state. * fix(media): count unflushed owners and broadcast replacements The completion-time exclusivity proof read only the persisted document, but slide duplication updates the Zustand aggregate synchronously and schedules persistence behind a debounce. A retry finishing inside that window saw a single persisted owner and replaced the bytes behind a reference the duplicate also held. The proof now also counts owners in the live stage snapshot when that snapshot represents the stage being retried, so an unflushed duplicate forks instead. Same-id replacement notifications were realm-local, so a second tab showing the same classroom kept its lease pinned to the superseded blob URL. The notification now travels over a BroadcastChannel; each receiving realm runs its own observers against its own pool, so a spoofed message can at most force a re-resolve. A missing or failing channel never fails the replacement. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): bind replacement listeners and spare shared audio rows A realm that only renders never sends a replacement, so binding the channel from the sender path left passive tabs deaf to peers. Binding now happens where the observer is registered, when the asset-pool module loads, and the receiving realm resolves its own pool lazily so a cleared or unavailable pool degrades to the next resolve instead of throwing. Observer notifications ran under Promise.all, so a rejection surfaced after BrowserAssetStore.replace had already committed and turned a durable success into a reported failure. They are settled individually now; the callback is wrapped because a synchronous throw would otherwise escape before allSettled sees the array. audioFiles rows are keyed globally by audioId, so deleting a stage removed the sole row for an id a surviving document still referenced — playback and both export paths read that table directly and cannot fall back to the preserved pool blob. Rows are now filtered against surviving references, while a failed enumeration still withholds only the irreversible pool removal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): serve replaced bytes from the pool everywhere Unknown survivor liveness deleted every planned audioFiles row. Those rows are keyed globally by audioId, and playback plus both export paths read the table directly, so losing one is as irreversible for them as removing the pool entry. Unknown liveness now preserves the rows too, leaving bounded garbage for a later pass that can prove exclusivity. The earlier pool-first change covered PPTX, video collection and thumbnail hydration but missed classroom ZIP export, which still serialized the stale compatibility row after a lagged same-id replacement, shipping media the classroom no longer renders. Auditing every direct reader of the media and audio tables surfaced the same gap in playback: speech regeneration also replaces bytes under a stable id and does not roll the pool back when the compatibility write fails, so the player kept serving superseded narration. It now resolves the pool first and falls back to stored rows for legacy and imported audio. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(audio): replace exclusively owned speech clips in place regenerateSpeechAudio accepted the action's audioId but always passed undefined as replaceAssetId, so regenerating an exclusively owned pool-backed clip allocated a new asset every time, rewrote the action and orphaned the previous pool entry and compatibility row until stage reclamation — contradicting the stable-id path generateAndStoreTTS already implements for media. Ownership is now established before synthesis, and the rule itself moved to the shared reference module so media retries, poster replacement and speech regeneration consume one implementation instead of restating it. An exclusively owned clip keeps its id and has its bytes replaced; a shared clip, a legacy id with no pool entry, or unprovable ownership still gets a fresh allocation so other holders keep their audio. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(media): drop the import left behind by the ownership move Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): resolve audio pool-first and fence peer realms Stable-id TTS regeneration commits replaced narration to the pool before the audioFiles mirror write, so a failed mirror leaves the row stale. AudioPlayer already resolved pool-first, but audioObjectUrl, collectAudioFiles and the video timeline dependencies still read Dexie directly and would serve the superseded clip. All allocated-audio readers now share one resolver, with Dexie kept as the fallback for legacy and imported rows. The exclusivity proof modelled unflushed owners in the active realm only, so another tab duplicating the same asset during its save debounce could still be observed as a single owner and have its bytes replaced globally. A peer's pending state cannot be read across realms, so presence is probed instead: any realm holding the stage forces the fork path. A deferred asset-pool deletion no longer reloads the page. The database is still on disk and the guidance asks the user to close the other tab and retry, which the reload discarded. The decision moved into a shared helper so the rule is pinned rather than living inline in the component. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): fail closed when presence cannot be probed The presence helper documented that an unanswerable probe must count as a peer, but every unavailable path — no BroadcastChannel, a constructor that threw, a send that failed, and the window before the pool's asynchronous binding completes — returned false, so the ownership proof cleared a single local owner and replaced globally shared bytes in place. Probing now returns present, absent or unknown, and only a probe that was actually sent and went unanswered is absent; the ownership decision treats unknown exactly like present. The pool declares its binding intent synchronously so a probe issued during the load-time window waits for the bind instead of concluding that presence is unavailable, and releases that gate if the import fails. Coverage reaches the write boundary: with presence unknown, a production-shaped targeted retry forks to a fresh id instead of calling replace, and the original bytes stay intact for a peer's unflushed owner. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(dsl): bump to 0.6.3 after the release dedupe took 0.6.2 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(i18n): add the deferred-clear guidance to fr-FR The locale landed on main after this branch added the key, so the alignment check flagged it as the one missing translation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>@openmaic/dsl@0.6.3 |
||
|
wyuc
|
3ca86aab95 |
test(pbl-v2): pin single-call prompt goldens and the loop planner's injection seam (#1071)
Follow-up to #1069: golden coverage for all four planner prompt variants (the single-call pair is production's first-priority path), an assertion pinning the loop's injected call contract (toolset, stopWhen, source label, thinking config), plus three review-identified cleanups. No production behavior changes. |
||
|
wyuc
|
3f5c51bdba |
refactor(pbl-v2): split the planner core from the loop; inject the LLM call path (#1069)
Implements #1062. Pure planner-core extracted from the loop's file; both planners receive their LLM entry as a parameter (call sites pass the real callLLM unchanged); operations/ split into kernel vs runtime with a lint-enforced boundary; planner prompts pinned byte-identical via fixtures generated from the pre-refactor implementation. |
||
|
|
9d2689439e |
feat(i18n): add French (fr-FR) locale (#1068)
Translate all 1,533 leaf keys with exact parity against en-US.json and register the locale in supportedLocales. Two extra files are required and could not be split out: LOCALE_RESOURCES in lib/video-export-app/cover-config.ts and the expected-labels map in its test are both typed Record<Locale, ...>. That file landed on 2026-08-04 via #995, nine days after #942 (es-MX) merged, so no previous locale PR had to touch it. Without these two edits tsc --noEmit fails with TS2741. Seven added lines outside lib/i18n, no logic change. Conventions: formal register (vous); French typography (typographic apostrophes, ellipsis, U+00A0 before : ; ! ? % and inside guillemets); all {{var}} and {var} markers preserved verbatim; settings.lang_* left in their native scripts, matching every existing locale. Co-authored-by: momo2lajoie <209366801+momo2lajoie@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
wyuc
|
9556a035b1 |
feat(generation): move outline generation into the package (#1065)
Part B of #1057. Outline primitives, buildOutlinePrompt (single-source prompt construction with golden snapshots), logger injection, JSON repair, and the bare-Node second-consumer smoke script with CI coverage. Shim-first: no app-side behavior changes; duplicated prompt assets guarded by a CI parity check until Part D.@openmaic/generation@0.1.0 |
||
|
wyuc
|
c0da724ec8 |
ci(skill): publish OpenMAIC skill to ClawHub (#1056)
* ci(skill): publish OpenMAIC skill to ClawHub * ci(skill): support manual ClawHub versions * ci(skill): validate manual ClawHub versions * ci(skill): normalize manual ClawHub versions * fix(skill): preserve build metadata in version checks * fix(skill): reject manual build metadata versions * refactor(skill): share ClawHub version validation * fix(skill): validate shared version checker inputs * test(skill): cover ClawHub version validation * test(skill): harden ClawHub version fixtures * test(skill): cover ClawHub checker edge cases * test(skill): cover ClawHub metadata contracts * ci(skill): harden ClawHub publish workflow * test(skill): cover ClawHub publish shell * test(skill): strengthen publish shell regressions * ci(skill): verify publish path on Bash 3.2 * ci(skill): harden ClawHub release guards * ci(skill): unify publish divergence handling * test(skill): bind publish divergence reasons * test(skill): bind stale tree inputs * test(skill): enforce stale guard ordering * test(skill): lock publish guard sequence * test(skill): enforce publish guard counts * test(skill): enforce publish job uniqueness |
||
|
wyuc
|
335180ec9c |
feat(generation): scaffold @openmaic/generation with pipeline types and packaged prompt assets (#1063)
Part A of #1057. Package skeleton (ESM, tsc, dsl/storage pattern), pipeline type contracts, prompt loader with package-relative asset resolution, 13 templates + 7 snippets byte-identical with golden tests, allowlist boundary lint, full publish/CI wiring, installed-tarball smoke coverage.@openmaic/generation@0.0.1 |
||
|
Percyandwyuc
|
d895b8959e |
feat(classroom): route generate-classroom per stage instead of one model (#1048)
The one-shot generateClassroom path (skill API) resolved the model once
with `resolveModel({ stage: 'generate-classroom' })` and bound that
single `languageModel` into one `sceneAiCall` closure shared by every
scene-content and scene-actions call (and the classroom `aiCall` shared
by outline + agent profiles). As a result, none of the `MODEL_ROUTES`
entries for `scene-content`, `scene-content:<type>`
(slide/quiz/interactive/pbl), `scene-actions`, or `agent-profiles` had
any effect on this path — the browser UI already routes each stage
independently via the /api/generate/* endpoints, but the one-shot API
did not.
Resolve the model per stage instead, mirroring the browser UI:
- scene-content routes via the composite key `scene-content:<type>`,
falling back to the base `scene-content` route (same resolution as
/api/generate/scene-content). Interactive widget sub-types are not
split, only the four core scene types.
- scene-actions routes via the `scene-actions` stage.
- agent-profiles routes via the `agent-profiles` stage (matches
/api/generate/agent-profiles).
- outline generation keeps using the classroom model, unchanged.
Each stage is resolved lazily and only when a route is actually
configured, so unrouted deployments reuse the classroom model at zero
extra cost. A route that fails to resolve (e.g. an unknown provider)
degrades to the classroom model with a warning, never aborting
generation — the same handling already used for
`web-search-query-rewrite`.
This also fixes a latent bug on this path: PBL scene content generation
needs the resolved `LanguageModel` object (generatePBLSceneContent
drives its own LLM calls through it, not the aiCall closure), but the
call never passed it, so PBL scenes silently returned null and were
skipped. The browser UI already passes it; now the one-shot path does
too — and it also forwards the route's thinking config, so a
`scene-content:pbl` route with a `thinking` block is honored (not just
the model).
The `generate-classroom-scene` telemetry/billing label is preserved on
all scene calls to avoid changing existing logging and accounting;
agent-profiles keeps the `generate-classroom` label.
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
|
||
|
|
ff8885505c |
docs(skill): improve description accuracy, unify Live Demo naming, and fix provider-keys pitfalls (#1047)
* docs(skill): improve description accuracy, unify Live Demo naming, and fix provider-keys pitfalls - Rewrite description: drop 'from OpenClaw' binding, add Live Demo cloud path and 'generate a multi-agent interactive classroom' trigger, strengthen education semantics for marketplace categorization - Rename hosted-mode.md → live-demo.md; unify all 'hosted/托管' wording to 'Live Demo' with a note that it is the cloud edition (officially deployed version) - Add exact access code acquisition path (sign in → top-right account → 访问码设置 → generate) to SKILL.md and live-demo.md - provider-keys.md: warn that the gpt-4o-mini fallback requires an OpenAI key (fixes #433); add disclaimer that model IDs are examples and may change; merge three redundant sections into one Interaction Flow Closes #1046 * docs(skill): fix incorrect fallback claim and update stale model IDs - Remove the false 'gpt-4o-mini fallback' claim: resolveModel has no hardcoded fallback and throws if DEFAULT_MODEL is unset — state this clearly so users do not assume generation works without DEFAULT_MODEL - Update stale model IDs to match the current codebase: gpt-4o-mini → gpt-5.4-mini, gemini-3-flash-preview → gemini-2.5-flash, claude-3-5-haiku-20241022 → claude-sonnet-4 --------- Co-authored-by: Percy <percy@PercydeMacBook-Pro.local> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyuc
|
ad30061b6e |
fix(chat): harden runtime sync, legacy migration, and record validation (#1050)
* fix(chat): harden runtime sync and legacy migration * fix(storage): validate HTTP runtime appends client-side * fix(storage): harden runtime validation and legacy guards * fix(chat): skip malformed legacy messages@openmaic/storage@0.2.2 |
||
|
zhifu gaoandLauraGPT
|
2b3f2eaa37 |
feat(asr): add local FunASR provider (#1044)
Signed-off-by: LauraGPT <199134975+LauraGPT@users.noreply.github.com> Co-authored-by: LauraGPT <199134975+LauraGPT@users.noreply.github.com> |
||
|
xppcnnandwyuc
|
378579e9df |
fix(slide-renderer): keep arrowheads visible when toggling thumbnails… (#1045)
* fix(slide-renderer): keep arrowheads visible when toggling thumbnails or fullscreen * fix(renderer): bump version to 0.0.5 --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>@openmaic/renderer@0.0.5 |
||
|
杨慎
|
e9d8a33b56 |
fix(render-service): make parallel capture effective (#1042)
* fix(render-service): make parallel capture effective * fix(render-service): preserve adaptive workers and beginframe * fix(render-service): restore adaptive compose sizing |
||
|
|
4efd881a97 |
feat(video-export): deterministic Quiz/PBL cover cards (#985) (#995)
* feat(video-export): add deterministic Quiz/PBL cover cards Replace unsupported placeholders with authored-metadata cover cards that stay independent of learner progress, and pin dense-layout evidence for 720p/480p. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(video-export): add configurable localized cover CTA Replace the inert Start Quiz affordance with a destination-configurable CTA (NEXT_PUBLIC_VIDEO_EXPORT_CTA_DESTINATION), including Unicode/bidi display guards. Co-authored-by: Cursor <cursoragent@cursor.com> * test(ci): require Hyperframes video-export gates Lock CI/Docker contracts so cover materialization and Hyperframes sample lint stay required for export changes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): move HF_E2E_DIR onto e2e steps GitHub rejects runner.* in job-level env, which aborted the CI workflow with zero jobs. Keep the sample dir on the materialize/lint steps only. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(video-export): tidy CI invoke and panel-box export Run the Hyperframes materialize step through pnpm exec vitest like the cover-card guardrail above it; the e2e job already pins Node 22. Stop re-exporting PBL_PANEL_DESIGN_BOX from the public barrel — only the layout browser test needs it, and it can import the emitter module directly. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
de95350516 |
feat(video-export): deterministic Quiz/PBL cover cards (#985) (#995)
* feat(video-export): add deterministic Quiz/PBL cover cards Replace unsupported placeholders with authored-metadata cover cards that stay independent of learner progress, and pin dense-layout evidence for 720p/480p. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(video-export): add configurable localized cover CTA Replace the inert Start Quiz affordance with a destination-configurable CTA (NEXT_PUBLIC_VIDEO_EXPORT_CTA_DESTINATION), including Unicode/bidi display guards. Co-authored-by: Cursor <cursoragent@cursor.com> * test(ci): require Hyperframes video-export gates Lock CI/Docker contracts so cover materialization and Hyperframes sample lint stay required for export changes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): move HF_E2E_DIR onto e2e steps GitHub rejects runner.* in job-level env, which aborted the CI workflow with zero jobs. Keep the sample dir on the materialize/lint steps only. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(video-export): tidy CI invoke and panel-box export Run the Hyperframes materialize step through pnpm exec vitest like the cover-card guardrail above it; the e2e job already pins Node 22. Stop re-exporting PBL_PANEL_DESIGN_BOX from the public barrel — only the layout browser test needs it, and it can import the emitter module directly. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
54f959bb45 |
fix: render whiteboard math via KaTeX instead of raw LaTeX text (#938)
* fix: render whiteboard math via KaTeX instead of raw LaTeX text
* fix: recognize single-command LaTeX with a braced argument
The fallback missed valid single-command expressions (\vec{v}, \hat{x},
\overline{x}) whose command is not in COMMON_LATEX_COMMAND, because
commands.length < 2 returned null and they rendered as raw text. Now a
single command counts as math when it carries a braced argument, while
path-like prose (C:\temp) still has no braced argument and stays text.
Add regression tests for both cases.
* fix: exclude Windows drive paths before the common-LaTeX-command check
COMMON_LATEX_COMMAND.test() ran before any path-like check, so C:\alpha,
C:\theta and C:\pi were classified as LaTeX and rendered through KaTeX.
Return early for text starting with a drive letter, and add C:\alpha to the
Windows-path regression cases so a path whose segment matches
COMMON_LATEX_COMMAND is covered.
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
|
||
|
littlebullGitandwyuc
|
3d85525665 |
[codex] Add Amazon Bedrock LLM provider support (#538)
* Enable AWS-hosted text models without exposing ambient credentials Rebase the Bedrock provider onto current main and close the review-requested security, credential lifecycle, usage attribution, configuration, and metadata gaps. Constraint: Bedrock may use ambient AWS credentials only when explicitly enabled by the server operator Rejected: Trust client-supplied provider types | permits built-in keyless IDs to reach Bedrock credentials Confidence: high Scope-risk: moderate Directive: Keep provider ID/type validation at both request resolution and model construction boundaries Tested: targeted Bedrock/resolver/config/usage tests; TypeScript; ESLint; i18n alignment; production build Not-tested: Full suite has 27 failures in unchanged quiz/runtime and runtime/chat-storage tests * Give Bedrock a recognizable provider identity Use the official AWS architecture service icon so Bedrock no longer falls back to the generic provider cube in settings and model selection. Constraint: Preserve the AWS-provided artwork without redesigning the service mark Confidence: high Scope-risk: narrow Tested: SVG XML validation; provider unit test; TypeScript; ESLint; production build --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
12ccd315ea |
Add Atlas Cloud LLM provider (#948)
* Add Atlas Cloud provider * Account for Atlas Cloud non-thinking model metadata * test: verify Atlas Cloud thinking payloads * style: format Atlas Cloud payload test * test: type Atlas Cloud fetch mock --------- Co-authored-by: binyangzhu000-sudo <224954946+binyangzhu000-sudo@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
yipwingtimandwyuc
|
c556100999 |
fix: keep vocational mode toggle thumb within track (#1032)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
Nguyễn Lê TrườngandClaude Opus 5
|
4f20c5151a |
fix(i18n): translate ASR provider names in the generation toolbar (#1028)
The provider dropdown in the media popover rendered `p.name` straight from
`ASR_PROVIDERS`. That field is a registry label, not a UI string, and
several entries are written in Chinese:
browser-native → 浏览器原生 ASR (Web Speech API)
qwen-asr → Qwen ASR (阿里云百炼)
So a user on any non-Chinese locale saw Chinese in the toolbar, while the
settings dialog showed the same providers correctly — it resolves the name
through `t('settings.providerBrowserNative')` and friends.
The id→i18n-key tables move to `lib/audio/provider-display.ts` and both
surfaces use them, so they cannot drift apart again. The settings dialog
keeps its own handling of custom providers, which carry a user-supplied
name rather than an i18n key.
TTS is included in the shared module for symmetry (`doubao-tts` and
`qwen-tts` have the same problem), though the popover's TTS tab is
currently a toggle with no provider list.
Image and video groups in the same popover also render `p.name`, but those
registry labels are already English, so no user-visible string changes;
left alone to keep this focused.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
||
|
Nguyễn Lê TrườngandClaude Opus 5
|
bbcea8a227 |
fix(render-service): keep the entrypoint LF so the image starts on Windows (#1027)
Cloning on Windows with Git's default `core.autocrlf=true` rewrites
`render-service/docker-entrypoint.sh` to CRLF. COPY-ing it into the Linux
image leaves the shebang as `#!/bin/sh\r`, so the kernel looks for an
interpreter whose name ends in a carriage return. The container then exits
immediately with
exec /usr/local/bin/docker-entrypoint.sh: no such file or directory
which points at the script — a file that plainly exists and is
executable — rather than at the interpreter, so the cause is far from
obvious.
Two changes, because they cover different cases:
- `.gitattributes` marks `*.sh` as `text eol=lf`, so fresh checkouts stop
being rewritten. This is the root-cause fix, and it also covers
`render-service/scripts/egress-smoke.sh`.
- The Dockerfile strips CR before `chmod`. `.gitattributes` does nothing
for clones that already hold a CRLF copy, and re-normalizing an
existing tree is a manual step; this makes the build work regardless of
how the tree was checked out.
Verified by building the image from a CRLF checkout and starting the
container: it comes up and `/health` returns `{"ok":true}`.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
||
|
Nguyễn Lê TrườngandClaude Opus 5
|
36d6c14a3d |
fix(i18n): load every Inter subset so non-Latin text keeps the UI font (#1026)
`app/layout.tsx` pointed next/font at a single subset file, `inter-latin-wght-normal.woff2`. Only the stylesheets shipped by @fontsource carry the per-subset `unicode-range` declarations, so nothing requested the other subsets and every character outside Latin fell back to an arbitrary OS font — rendering in a different typeface, weight and metrics from the surrounding text, often mid-word. This already affects a shipped locale: `ru-RU` is Cyrillic, and `inter-cyrillic-wght-normal.woff2` was never loaded. `pt-BR` and `es-MX` lose the accented characters that live in `latin-ext`. Declaring the remaining subset files as sibling faces of the same family does not fix it. Faces with identical descriptors and no `unicode-range` are not tried per glyph — the browser picks one — and next/font/local has no way to express `unicode-range`. Importing the @fontsource stylesheet does, so that is what this switches to. `--font-sans` moves to `globals.css` because the family no longer comes from next/font's generated class. The typeface is unchanged: still Inter, now with all seven subsets it already shipped in node_modules. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
louis brilliantandwyuc
|
297e405d63 |
fix(ai): omit zero SiliconFlow thinking budget (#1035)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyuc
|
30dd236057 |
Publish validated package tarballs (#1040)
* Publish validated package tarballs * Format artifact verification scripts * Handle pnpm smoke-test arguments * Harden validated package publication * Make digest anchoring shell-portable * Upload release artifacts before tests * Anchor release integrity checks to GitHub SHA |
||
|
wyuc
|
90f5f3942b |
fix(release): dedupe the published dsl, close two release-path blind spots (#1019)
* fix(release): dedupe the published dsl, close two release-path blind spots
Three independent defects on the release path.
1. `@openmaic/storage`, `@openmaic/renderer` and `@openmaic/importer`
declared `"@openmaic/dsl": "workspace:*"`, which pnpm publishes as an
EXACT pin. The tarballs on the registry today say storage@0.1.1 needs
dsl 0.5.0, renderer@0.0.3 needs dsl 0.4.0 and importer@0.1.1 needs dsl
0.4.0, so installing storage together with renderer yields two copies
of the dsl. The dsl carries the schema, the validators and the version
constants, so a document produced against one copy can be validated by
the other's schema revision.
`workspace:^` publishes as `^0.5.0`. Under 0.x that admits 0.5.x, so a
dsl patch reaches dependents without republishing them while a dsl
minor still requires a deliberate dependent release. All three
packages take a patch version increase, both because
check-package-version-bumps.mjs requires one and because the corrected
range only reaches consumers through a new release.
The tarball smoke test now asserts the packed range, so an exact pin
cannot come back unnoticed.
2. The publish workflow's build-integrity guard ran `git diff --quiet --
packages/@openmaic`, which compares the worktree to the INDEX. The
steps before it run third-party package code, which needs no
credential to rewrite a tracked file and `git add` it, after which the
guard reported clean and the rewritten bytes were packed and
published. Both copies of the guard now compare against HEAD, the
commit actually being released.
3. `@openmaic/storage`'s PostgreSQL contract suites refuse to skip when
STORAGE_PG_CONTRACT_REQUIRED=1, but that refusal is a `throw` inside
the test modules, so it never fires if vitest stops collecting them.
Collection is decided by `packages/@openmaic/storage/vitest.config.ts`,
which is on the ignore list of publishable inputs, so excluding
`*.pg.test.ts` there turns both PostgreSQL backends off with a green
run and no version bump.
scripts/assert-pg-contract-suites.mjs reads vitest's json results and
requires both suite files to be present, passed and non-empty, keyed
on the file names rather than on a count. It runs in the publish
workflow's validate job and in the storage PostgreSQL contract
workflow.
Merging this publishes @openmaic/storage@0.1.2, @openmaic/renderer@0.0.4
and @openmaic/importer@0.1.2. That republish is the fix for (1), not a
side effect of it: the corrected dependency range exists only in a
tarball that has not been cut yet.
* fix(release): audit the contract database, pin the format version to a minor
Follow-up on cross-vendor review of the three release-path fixes.
1. The PostgreSQL assertion proved far less than it claimed. Vitest's
`assertionResults` are test CASES, not `expect()` calls, so one
`test('x', () => {})` per required filename satisfied it — and the
whole surface is reachable without a version bump, because `test/` is
on the same ignore list as `vitest.config.ts`. A `vi.mock('pg', ...)`
in the already-wired `test/setup.ts`, or a stubbed suite body, made it
print "ran against a real database" having checked nothing of the
sort.
The script now runs in two phases. Phase 1 keeps the file/status
checks. Phase 2 connects to PG_CONTRACT_URL from outside the vitest
process and requires all five tables the two backends own to exist and
to show inserts in pg_stat_user_tables. Nothing inside `test/` can
forge that. Cumulative insert counters rather than surviving rows,
because the suites clean up after themselves. The success message now
states only what was checked.
2. Validation packed with lifecycle scripts while publishing runs
`--ignore-scripts`, so committing `workspace:*` plus a `prepack` that
rewrites it to `workspace:^` passed the tarball assertion and then
published the exact pin. Both the smoke test and the workflow's
dry-run pack now pass `--config.ignore-scripts=true`, so validation
and publication have identical lifecycle semantics.
3. `workspace:^` unpins the serialized-format version that the exact pin
was silently holding. DSL_VERSION and RUNTIME_DSL_VERSION are
decoupled from the npm version by design, and storage compares them by
value across the package boundary. Under `^0.5.0` a dsl PATCH could
therefore hand a new format to an already-published storage: one
install resolves it and stamps the new version into document_stages,
another install pinned to the older patch reads that row and hard-
fails. Two installs of one published storage version, data-
incompatible.
check-package-version-bumps.mjs now requires a change to either
constant to carry at least a MINOR increase of the dsl package
version, since a caret does not cross a 0.x minor. The rule is
documented next to both constants. That doc edit is itself a
publishable change, so dsl takes a patch bump to 0.5.1.
4. The range and build-integrity guards ran only in the publish workflow,
so a pull request restoring `workspace:*` or leaving a stale generated
file failed at release time, after a version number had been spent.
ci.yml gains a cheap source-level range check
(scripts/check-internal-dependency-ranges.mjs) and the
`git diff --quiet HEAD` integrity check after its install step. The
tarball assertion stays where it is as the release-time proof of
actual published behaviour.
Merging this now publishes @openmaic/dsl@0.5.1 as well as
@openmaic/storage@0.1.2, @openmaic/renderer@0.0.4 and
@openmaic/importer@0.1.2.
* fix(release): fail the gates closed, and state what they actually prove
Confirmation round on the release-path fixes.
1. The format-version rule failed open if version.ts moved. It hard-coded
one source path and returned successfully when either revision lacked
it, so renaming the file, changing DSL_VERSION and bumping dsl by a
patch passed both checks. It now reports an error whenever the file is
absent at either revision while dsl has any publishable change. The
constant regex is anchored to the start of a line, so a commented-out
declaration cannot be read as the value, and a duplicate declaration is
an error rather than a coin flip.
2. "At least a MINOR" was wrong past 1.0.0: `^1.0.0` admits minors, so a
format change shipped as a minor would float into published dependents
exactly as the rule exists to prevent. The rule is now stated as what
it needs to be — an increase the dependents' caret range will NOT admit
— computed from the pre-change version: a minor while dsl is 0.x, a
major once it reaches 1.0.0. The error message and the docs in
version.ts say the same thing.
3. Internal declarations outside `dependencies` bypassed both range
checks. Keeping `dependencies` at `workspace:^` while adding an exact
`peerDependencies` or `optionalDependencies` entry published a second,
tighter constraint and passed. An owned package must now appear exactly
once, in `dependencies`; entries in the peer and optional fields are
rejected outright, in the source check and in the packed-manifest
assertion. The global count test is replaced by naming the three
dependents that must be present.
4. The format rule compared against the base tip, so an un-rebased branch
produced an inverted message. It now uses the merge base, matching the
`base...HEAD` form the rest of diff mode uses. Deliberately not applied
to the version comparison, where the tip is the correct reference.
5. Phase 2 had no baseline, so cumulative counters from an earlier run
satisfied it forever against a non-ephemeral database. It now captures
the counters before the vitest step and requires a positive delta.
Both workflows gained the capture step.
6. Phase 2 overclaimed. It proves rows were inserted into those five
tables during the run, not that the built PgDocumentStore and
PgRuntimeStore inserted them — `test/` is on the publishable-input
ignore list, so test code could write directly. The success message now
says exactly that, and the script documents the threat model: this
catches accidental silencing, which is the defect it was written for;
it is not a defence against someone who can merge changes to `test/`,
who can alter production code just as easily.
Also: scripts/openmaic-packages.mjs is now the single source for the
owned package list, consumed by all three checking scripts, and it
cross-checks itself against both the packages directory and
publish-packages.yml so a package added in one place and forgotten in
another fails rather than going quietly exempt. The workflow's own YAML
lists cannot import it, which is why they are cross-checked instead.
* fix(release): let the format-version source move without opening the gate
Failing closed on a missing version.ts is right, but on its own it made a
rename impossible to merge: the new path does not exist at the base
revision either, so the check refused both before and after the move.
DSL_VERSION_SOURCES is now an ordered candidate list, resolved per
revision against the first path that exists there. A rename lands by
prepending the new path in the same change, and the comparison still
happens across the move. Absent everywhere at either revision, while dsl
has any publishable change, remains an error.
* fix(release): report package-list drift instead of crashing on it
Every check in check-internal-dependency-ranges.mjs reads the shared
package list, so a list naming a package that does not exist threw an
ENOENT out of readManifest before any finding was printed. It failed
closed, but unreadably. The list is now validated first and fatally, with
its own headline.
* fix(release): anchor the caret to the base branch, and check the gates' own inputs
Final confirmation round.
1. The caret escape was computed from the merge base, which is the wrong
reference for it. With merge base dsl 0.5.1, an ordinary minor landing
on main taking the tip to 0.6.0, and HEAD at 0.6.1 with a changed
DSL_VERSION, the rule computed the escape from 0.5.1, got 0.6.0, and
accepted 0.6.1 — but dependents released against 0.6.0 publish
`^0.6.0`, which admits 0.6.1, so the new format reached them anyway.
0.6.1 is also the minimum the ordinary version check allows, making
that the default outcome rather than an unlucky one.
The escape is now computed from the HIGHEST dsl version reachable on
the base branch. Whether the format moved still comes from the merge
base, because that is a question about the branch. The comment on
mergeBaseWithHead now records that it is a no-op in both current CI
invocations (checkout uses the merge ref on pull_request, and the
before-SHA is an ancestor on push) rather than claiming a case that is
not exercised there.
2. The workflow cross-check matched raw text, so a commented-out trigger
path still satisfied it while silently disabling that package's
release. Full-line comments are now stripped first; the `on.push.paths`
list and every `for pkg in ...` loop are compared as exact sets, so an
unexpected entry fails as well as a missing one; and `--filter` usage
is checked more loosely, because individual steps legitimately filter
subsets. The limits of a textual check are stated where it lives.
3. `locate()` returned the first candidate format-version source that
existed, so during a half-finished rename the gate could compare a file
that is no longer the exported one. It now resolves every candidate per
revision and fails unless exactly one declares the constants.
4. INTERNAL_DEPENDENTS was checked in one direction only, so deleting an
entry exempted that package from the source check and from the packed
assertion that iterates the same map. It is now cross-checked both
ways, an owned package in another owned package's devDependencies is
rejected outright, and multiple owned dependencies no longer collapse
to whichever was declared last.
5. assertPackageListIsComplete() now also runs in release mode, which is
the gate that decides what gets published; and the PostgreSQL script
consumes flag values properly instead of treating the first non-flag
argument as the results path.
Also documents, in openmaic-packages.mjs, the threat model these gates
share: they catch mistakes, and anyone who can merge edits to scripts/
can edit production code directly, so deliberate subversion is out of
scope and cannot be closed by adding further checks.
@openmaic/importer@0.1.2
@openmaic/dsl@0.6.2
@openmaic/renderer@0.0.4
@openmaic/storage@0.2.1
|
||
|
wyuc
|
84876ef723 |
feat(dsl): unify media asset reference types (#1007 part 2, step a) (#1038)
* feat(dsl): unify media asset reference types * fix(document-store): migrate verification baseline * fix(dsl): address asset reference review findings * fix(dsl): close asset reference review gaps@openmaic/dsl@0.6.1 |
||
|
wyuc
|
3204051d09 | chore(storage): address asset registry review follow-ups (#1037) | ||
|
wyuc
|
ee1bd6bbee |
feat(storage): asset registry — allocated ids over the content-addressed blob layer (#1007 part 1) (#1024)
* refactor(dsl): restate the asset seam as allocated, non-disclosing refs The asset seam's docstrings described a ref as a handle whose scheme was the backend's business, and recommended content-addressed hashing so identical bytes de-duplicate. Both are now wrong in the same place: a content-addressed ref *is* a statement about the bytes, so returning one from `put` tells the caller whether those bytes were already stored — an existence oracle over data the caller never wrote. State the contract the global asset pool needs instead: `put` allocates, every call returns a new ref, and nothing the caller receives reveals whether the bytes pre-existed. A provider may still de-duplicate internally; that is a property of its storage layer, not of the ref. Also spell out that the ref domain is unconstrained, so an unrecognized ref is a miss rather than an error. Comments only — no interface signature changes. * feat(storage): add the asset registry — allocated ids over the blob layer Part 1 of the global asset pool (#1007): the browser registry core. `BrowserAssetStore` is now the package's asset backend. It maps an allocated `AssetId` to a registry entry (`contentHash`, `mime`, `meta`), and the registry maps that hash to bytes, giving three properties at once: - an id survives the bytes behind it being regenerated or replaced, and one set of bytes can back several ids with different metadata; - identical bytes occupy one row however many ids name them; - the content hash never leaves the package, so "whoever knows the hash can reach the bytes" — the threat pure content-addressing has to defend against — structurally does not arise, and the blob layer beneath can stay global and metadata-free without being an isolation hole. `put` always allocates a new id and always writes the blob unconditionally, so the first-store and de-duplication-hit paths run the same statements, issue the same requests, and return the same shape. The caller cannot infer that someone else's bytes are already present. Both stores live in one IndexedDB database, so reference counting on `remove` happens inside the transaction that deletes the entry, over an index on `contentHash`. IndexedDB serializes readwrite transactions over the same stores, so a last-reference removal can never reclaim bytes a concurrent `put` has just adopted. Images, audio and video share one id space; the medium is a `mime` column, not a partition. There is no `principal` column: a principal is derived server-side from an authenticated session, and a value the client supplies about itself authorizes nothing — the column arrives with the server backend. The id domain is opaque and unvalidated, taking the KV key domain's conclusion as its starting point. `toAssetId` brands without checking; an id this store never issued is a miss, never an error. `BrowserAssetProvider` is demoted to an internal blob backend and dropped from the public exports (0.x, and it had no consumers): its content-addressed ref is precisely the de-duplication signal an outward API must not emit. Tests split along the same seam. `runAssetStoreContract` pins the outward semantics — allocation, an existence-disclosure matrix compared facet by facet rather than asserted in prose, reference-counted release, and a table of foreign ids that must all miss without throwing — while `runBlobStoreContract` keeps the content-addressed semantics for the layer underneath. Facts the outward API must not disclose (one blob row per byte string, reclamation at the last reference, the put/remove race) are asserted against the rows. * chore(packages): bump @openmaic/dsl to 0.5.1 and @openmaic/storage to 0.2.0 `storage` takes a minor bump rather than a patch: `BrowserAssetProvider` is no longer exported from the package entry point, which is breaking under 0.x convention even though nothing consumed it. * fix(storage): address asset registry review findings * fix(storage): complete asset registry lifecycle * fix(storage): harden asset cache coherence and lifecycle * fix(storage): close pending asset mint edges * refactor(storage): adopt immutable asset URL snapshots * fix(storage): close asset snapshot lifecycle gaps * test(storage): pin asset lifecycle contracts * docs(storage): document 0.1.x asset upgrade * fix(storage): reject incompatible asset database schemas * fix(storage): enforce asset allocation independence * fix(storage): instrument production asset allocation * test(storage): cover allocation ordinals across histories * refactor(storage): remove standalone blob backend seam@openmaic/storage@0.2.0 @openmaic/dsl@0.6.0 |
||
|
杨慎
|
6f6b6eca07 |
fix(editor): localize Pro mode right rail labels (#1023)
* fix(editor): localize pro mode right rail labels * fix(i18n): translate AI editor title * fix(i18n): localize Korean roster classmate label |
||
|
wyuc
|
091989c48b |
feat(storage): promote KV HTTP contract + clients to main (Part A of #1000) (#1020)
* feat(storage): KV HTTP contract and clients (#1000 Part A) (#1002) * feat(storage): KV + Asset HTTP contracts and clients Adds the client half of the server backends for the two components in the storage RFC that still had a browser backend only. Asset contract: the ref is `sha256-<hex>` over the bytes, computed by one shared rule both backends call, and it *is* the address bytes are written to (`PUT /assets/{ref}`). The server re-hashes what it received and refuses a mismatch, so content addressing is enforced end to end rather than assumed, and uploads become idempotent. `resolve` returns a URL per call, either an absolute signed URL passed through untouched or a root-relative proxied path joined to the base origin — the document never stores a raw URL either way. KV contract: account scope only, with no scope path segment, query parameter or body field anywhere on the wire. `HttpAccountKV` is the only object that can reach it and none of its methods takes a scope, so a device value is not a request the transport can express; `HttpKVStore` routes `device` to a local backend it requires at construction. Tests assert the invariant both ways — `@ts-expect-error` on every scope-passing call (unused directives fail the build if a scope is ever added) and a fetch spy proving device traffic does not exist. Both clients pass the existing `runKVStoreContract` and `runStorageProviderContract` suites against an in-memory conformance server, the asset one in both the proxied and signed URL shapes. * fix(storage): close the review findings on the KV + asset HTTP clients Cross-review found the device-scope guarantee resting on its weakest layer, and several places where the contract promised more than the code or the conformance server could deliver. deviceStore: the two type-level layers only documented intent — the barrier that actually kept device values off the wire was the injected store, typed as `KVStore`, which `HttpAccountKV` satisfies structurally (its methods are the same methods minus an optional parameter). Injecting the transport as the device backend type-checked and put device values on the network. The device scope now requires a branded `LocalKVStore`, the transport declares itself not to be one, and a runtime check refuses what a cast smuggles past. resolve URLs: a media `src` carries cookies, never the client's headers hook, so the proxied shape is only sound for cookie-authenticated deployments — the contract now says so instead of claiming the content route sits behind "the same authentication", and the conformance reader uses a cookie rather than a header no browser could send. The client also validates what it resolves: http(s) schemes only, and no `//host` or `/\host` slipping through the relative branch to another origin. Identifiers: refs and keys arrive percent-decoded, so `..%2F..%2F` was a traversal waiting for the first backend to join it to a path. Both are now constrained on both sides, and the contract states the MUST that keeps a storage layer from being the first to look. Also: the JSON gate runs before anything reads the value (a `JSON.stringify` pre-flight ran caller code first and reclassified `{ toJSON: () => undefined }` as a delete); scope routing fails closed; an upload's Content-Type can no longer be relabelled by the headers hook; a mutation invalidates in-flight resolution; unparseable 2xx bodies become typed errors rather than native SyntaxErrors; signed tokens are validated rather than merely present; and the contracts settle the per-principal claim model, the media-type allowlist, the literal prefix rule, and the identifier charset that Part B would otherwise have had to guess at. * fix(storage): close the second review round on the KV + asset HTTP clients The device-scope guard was in one place and needed to be in three. The transport is exported and structurally a `KVStore`, so `kvPersistStorage(new HttpAccountKV(...), 'device')` and a plain `KVStore`-typed reference both compiled without a cast, dropped the scope argument on the floor, and put a device value on the wire. The transport now takes the scope it was pretending not to have — typed as `'account'`, refused at runtime for anything else, since bivariant method parameters mean the type alone cannot hold — and the persist adapter requires a `LocalKVStore` when paired with `'device'`. The resolved-URL checks were text tests where only parsing works. The URL parser strips ASCII tab, LF and CR before parsing, so `/<tab>/evil/x` walked past the `//` prefix check and loaded cross-origin — in the app-mounted shape, where a path-only base URL leaves that check as the only guard. The absolute branch let through `https://` with no host and `https:host/x`, which names one place standalone and another when a browser resolves it against a same-scheme page. Both branches are now decided by the parser: control characters refused outright, relative references validated against a probe origin, absolute ones required to parse as `scheme://host` with an http(s) scheme — and still returned byte-for-byte, so signatures survive. The media-type MUST had no implementation and contradicted itself: the conformance server stored and served `text/html` verbatim, and a metadata-less upload became `application/octet-stream`, which cannot be on a renderable allowlist. The server now implements the allowlist, serves everything else as an opaque attachment, and the contract scopes its "usable as an img src" promise to allowlisted types. The KV key domain was HTTP-only, which made "the same suite proves the backends equivalent" untrue: `a/b`, an empty key and a 600-byte key all passed in the browser and would have become unreachable on a server. An audit of the app's keys (learner key, storage generation, current-scene and migration markers, persist names) found none in violation, so the rules are lifted to the primitive and both backends enforce them, with the shared suite asserting it. Also: the claim model the last round wrote into the contract is now implemented and covered case by case; malformed percent-escapes are a 400 rather than a 500; the in-flight identity guard has a test that can fail; and the Content-Type conflict raises a typed error. * fix(storage): final review round — backend parity, URL probe, credentials Four small things the final pass found, plus the contract patches Part B would otherwise inherit. The `toJSON` delete semantics were documented backwards. `BrowserKVStore.set` was the trial-serialize the KV contract said no backend does, so `{ toJSON: () => undefined }` was a silent delete there and a rejection over HTTP — opposite answers to the same call. The browser backend now validates scope and key before anything can run caller code, recognizes the delete case by type, and refuses a value that still fails to serialize. Both cases are in the shared suite, so the two backends cannot drift apart again. The probe-origin check could not vouch for a URL naming the probe host itself: `//asset-url-probe.invalid/x` resolves onto the probe origin and passed, then resolves somewhere else entirely against a real base. Any authority-bearing form is refused outright, so the check no longer depends on the probe host being unguessable. Cross-origin cookie deployments had no way to send a cookie: `fetch` omits them cross-origin by default and the headers hook cannot help, since `Cookie` is a forbidden header name. Both clients accept `credentials` and pass it to `fetch`; the contract records the CORS obligations that come with it. Rather than restricting cookie deployments to same-origin, which the asset contract explicitly does not require. The conformance server's dot-segment check was reading a path the URL parser had already normalized, so `/assets/%2e%2e/x` arrived as `/x` and the documented 400 was really post-routing behaviour. It now validates the raw request target, and the injected transport preserves it instead of handing over a normalized one. Contract: the prefix rule names backslash (PostgreSQL's default LIKE escape, and the one an implementer skips because a legal key cannot contain it, though a prefix can), and acquiring a claim MUST leave the bytes present — a de-duplicating server that inserts only the claim can race reclamation of the last previous claim and leave a document resolving to a 404. Also: base URLs are checked for an http(s) scheme at construction, the ref domain moved next to the KV key domain and is enforced by both asset backends with shared suite coverage, the KV client refuses a hook-supplied Content-Type like the asset one, and CI runs the package typecheck that makes the `@ts-expect-error` guards mean something. * fix(storage): probe guard spelling, prefix validator, base url shape Three one-line-level holes from the closing review. The probe-host guard was spelled `startsWith('//')`, so the backslash forms `/\host/x` and `/\/host/x` reached the origin comparison, passed it by naming the probe host, and were stopped only by that host failing to resolve. It now refuses any second character that can open an authority — which is also what makes the comment true rather than aspirational: a path-absolute reference always inherits the base's origin, so with no authority expressible the comparison cannot be satisfied cross-origin, whatever the probe host is. The conformance server validated `?prefix` with the path-segment validator, rejecting `keys('.')` and `keys('..')` — legitimate prefixes of keys like `.hidden`, which the client rightly allows. A prefix travels in the query string and is never a path segment, so it now has its own validator: the key rules minus the non-empty and dot-segment requirements. The contract says the same, and the shared suite pins both backends to it. Base URL validation moved into one shared helper both clients call, since two copies of a security rule is how they drift. It now also refuses `https:host/path` — which parses standalone to that host but is resolved against the current document by `fetch`, sending requests and their credentials somewhere the operator never wrote — and a base carrying a query or fragment, which silently swallows the path concatenated onto it. * fix(storage): close two holes in the shared base-url check The path-only branch returned its input unexamined, so `//evil.example` and `/\evil.example` were accepted as paths. A browser reads both as an authority, which means every request built on such a base — and every credential the headers hook attaches — leaves the origin. A base is now required to be a single `/` followed by something that is not `/` or `\`, the same refusal the resolved-URL check already makes, for the same reason. Control characters are refused first: the parser strips or re-encodes them, and `/<tab>/evil.example` becomes `//evil.example` after it does. The query/fragment check read the parsed `search` and `hash`, which are empty strings for a base ending in a bare `?` or `#` — so exactly the inputs that swallow the concatenated path into a query or fragment were the ones that got through. It reads the raw string now, which also makes the post-parse check redundant rather than merely unreachable. * fix(storage): bypass HTTP caches on reads, and require a 404 for not-found Two mechanisms the clients were missing, on both sides. Reads are marked `cache: 'no-store'`. The asset resolve request answers two mutable questions — does this principal hold a claim, and which URL is valid now — so a cached answer returns an expired signed URL or replays a negatively cached 404 for an asset written since; the in-flight coalescing that would otherwise cover this lives in the client and cannot reach the HTTP cache layer. KV reads have the same problem for a different reason: `account` is by definition the scope another device may have just written, and nothing here can invalidate a cached copy when it does. The contracts now require `no-store` on those responses. Asset content is left cacheable — bytes at a content-addressed ref never change — and writes are unmarked, having nothing to read from a cache. The not-found mappings now require the status as well as the code. A proxy or gateway answering 401, 403 or 500 while echoing the body's error code was being read as "this does not exist", and `null` is indistinguishable from a real miss — so an outage reached the caller as data loss. * fix(storage): reject unusable base urls, and make the harness meet the contract Two configuration checks and two harness gaps. A base URL carrying userinfo built a client that threw a native TypeError on every operation, because Fetch refuses to construct a request from a URL with embedded credentials — one legible error where the deployment is configured beats a per-call failure with no explanation. A base with surrounding whitespace was worse than useless: `new URL` strips it, so validation passed, and then concatenation moved the space inside the URL where it is no longer trailing and no longer stripped, breaking every request. The conformance server now sends `Cache-Control: no-store` on the three reads the contracts require it on. The requirement landed last round with nothing asserting it, so the suite would have passed against exactly the implementation it exists to catch. And `DELETE /kv/entries/{key}` refuses a request body outright: the query and the header were already checked for a smuggled scope, leaving the body as the one channel through which a delete could still describe one. * fix(storage): allow a device-routing composite to persist device-scoped state cosarah found kvPersistStorage(httpKVStore, "device") wrongly rejected. An HttpKVStore is a full dual-scope composite: it routes device operations to the LocalKVStore it requires at construction and only reaches the network for account, so device values never leave the machine. The guard tested isLocalKVStore — "is the whole store local" — and so turned away a store that is safe for device precisely because it is not fully local. The guard now turns on the capability that actually matters: does the device scope stay local. A new DeviceSafeKVStore brand (servesDeviceScopeLocally: true) marks a store whose device writes never leave the device — held by a fully-local LocalKVStore (which extends it) and by HttpKVStore, and declared false by HttpAccountKV, the pure account transport with no local device backend. The persist device overload requires DeviceSafeKVStore; the account overload is unchanged. The security boundary the red team opened this whole line on is untouched: HttpAccountKV used for device is still doubly refused — its false brand is not assignable to the true DeviceSafeKVStore requires (type), and the runtime check rejects the cast that would erase it. The brand is structurally unforgeable, not a flag the transport could set; and the injected device backend of a composite still demands the stronger, fully-local LocalKVStore, so composites cannot nest into a router loop with no local floor. Regression test (cosarah's ask): kvPersistStorage(httpKVStore, "device") set/get/remove reach the injected device backend, land device-scoped there, and make zero HTTP requests. Mutation-checked: widening the brand so HttpAccountKV is accepted, or neutering the guard, turns the device-out reject test red. * refactor(storage): scope #1002 down to KV — remove the asset HTTP backend Per the maintainer decision, the AssetProvider server design moves to the global-resource-pool RFC (#1007), where AssetRef changes from content-addressed to an allocated global id and the contract model itself changes. Continuing to harden the content-addressed asset client here would be work on code that is being replaced, so the asset half of #1002 is withdrawn and the PR is pure KV. Removed (all introduced by #1002): - docs/asset-http-contract.md - src/asset/http.ts (HttpAssetProvider) and its index / package.json exports - src/asset/content-ref.ts (assertAssetRef / computeAssetRef / the ref shape) - test/http-asset-provider.test.ts and the asset half of the conformance server Reverted to the #858 baseline, untouched: - src/asset/browser.ts — back to opaque resolve/remove, no assertAssetRef guard. This directly removes cosarah's latest asset finding: an opaque ref such as `bucket/path` no longer throws, restoring the DSL AssetRef-opaque contract. - test/asset-contract.ts, test/asset-browser.test.ts — 0-diff from origin/main. Kept (all KV): kv-http-contract.md, src/kv/* (HttpKVStore / HttpAccountKV / the DeviceSafeKVStore brand), the KV tests, and the KV conformance server — renamed kv-conformance-server.ts and reduced to KV routing over the shared harness framework (body caps, no-store, scope-channel and dot-segment guards, auth hooks). base-url.ts stays; KV still uses it. * fix(storage): treat KV keys as opaque; document account-sync prerequisites cosarah found the key validation we added for traversal defense breaks legitimate callers: DSL identifiers (stageId/sceneId/learnerKey) are unconstrained strings — verified, the DSL only requires typeof === 'string' — and app callers compose keys like `editor-current-scene:<stageId>`, so a valid stage id `stage/one` now throws in BrowserKVStore before localStorage. Fix, matching the asset-opaque precedent: a KV key is an opaque string again. The `/` and `\` rejection is removed from assertKVKey / assertKVKeyPrefix and from the conformance server. Traversal is defended by encoding, not rejection — the HTTP client already percent-encodes the whole key into one path segment, so a separator never opens a new segment on the wire, and the server stores the decoded key as a plain map key (bound value), never a path. `a%2F..%2F..%2Fb` decodes to the single opaque key `a/../../b`, which addresses one entry and traverses nothing; a raw unencoded `..` path produces extra segments that match no route (404). The rules that remain are only what encoding cannot cover and the transport cannot carry (empty, whole-key `.`/`..`, NUL, lone surrogate, length) — none producible by `prefix + id`. Tests: the shared suite now round-trips keys with `/`, `\`, `%`, `:`, spaces across both backends; a `stage/one` key round-trips through the real conformance server; the traversal input is proven to store as one opaque key and the raw path to 404. Mutation-checked: re-adding the `/` rejection reddens exactly the round-trip cases. Docs (kv-http-contract.md): - "A key is an opaque string" replaces the identifier-shape section — keys may contain separators; traversal is an encoding + server-bound-value duty. - Account settings sync now documents its security prerequisite next to the account scope: a deployment MUST provide real per-user isolation of stored rows and encryption at rest before enabling sync; the reference server is not that posture. - kvPersistStorage(device) doc corrected from LocalKVStore to DeviceSafeKVStore (the device-safe brand accepts the HttpKVStore composite; HttpAccountKV stays double-rejected). * fix(storage): close the scope/key/prefix contract gaps with a coverage matrix Three completeness gaps, nailed by an executable matrix so an untested channel/shape can't slip through the next pass rather than patched one by one. 1. Scope via a GET body was not rejected. `assertNoScopeChannel` covered the query and header, but the bodyless GET routes never read their body, so `GET /kv/keys` with `{"scope":"device"}` returned 200 []. Bodyless methods (GET, DELETE) now reject any request body up front — that is the channel a scope would hide in — and only `set` reads a body, checking it for a scope field. The DELETE route's own body check folds into the shared one. 2. The 512-byte key bound wrongly rejected legitimate keys. A DSL id is an unconstrained string (verified: the DSL requires only typeof === 'string'), and `editor-current-scene:` + a 500-char stage id is 521 bytes, which BrowserKVStore rejected before localStorage. Keys are length-unconstrained; the bound is raised to a generous 8 KiB DoS ceiling and documented as a resource guard, not part of the key domain — not a derived/hashed key, which would break the literal-prefix semantics of keys(prefix). Both backends and the conformance server move in lockstep. 3. The prefix contract text contradicted itself: it claimed a legal key can never contain a backslash, while the key section (correctly) makes keys opaque, backslash included. Reworded — a prefix is opaque like a key — and the shared literal-prefix matrix now covers `\` (PostgreSQL's LIKE escape), which it had skipped, alongside `%`, `_`, and combinations. Coverage matrix (CI-executable): - scope-rejection: {get,set,remove,keys} × {query,header,body}. query/header run in-process; the body cells use a raw HTTP client (fetch cannot put a body on a GET — exactly the non-conforming client the finding described) against a loopback listener, skipped where the sandbox forbids binding. - key-validity: `/ \ % _ : .` space, BMP + astral Unicode, `%2F`, a 500-char composed key, and all-at-once — each round-trips (set/get, keys(prefix) match, remove) on both browser and HTTP backends via the shared suite. - prefix-charset: `%`, `_`, `\`, and combinations match literally, both backends. - Boundaries still rejected: whole-key `.`/`..`, NUL, lone surrogate, empty, and the DoS ceiling. Mutation-checked: removing the bodyless-body rejection reddens the three GET/ DELETE body cells; lowering the ceiling back to 512 reddens the long-key round-trip on both backends. Bumps @openmaic/storage to 0.1.2 (src/kv/* changed). * fix(storage): bound the KV key DoS ceiling by encoded size, not UTF-8 bytes Follow-up to the 8 KiB ceiling: measuring it in UTF-8 bytes ignored percent-encoding expansion and reopened a backend-parity break. A non-ASCII key is small in bytes but large on the wire — `€` is 3 UTF-8 bytes and `%E2%82%AC`, 9, encoded — so `'€'.repeat(2730)` (8190 bytes, under the old cap) encoded to ~24.6 KB, which the Node HTTP server rejects with 431 before routing while `BrowserKVStore`, which never builds a URL, accepted it. The ceiling is now measured on `encodeURIComponent(key).length` — the size the key occupies as a request target — at 4096, far above any real id (a 500-char id under `editor-current-scene:` encodes to ~523) and well below Node's default 16 KiB `maxHeaderSize` (empirically the 431 trigger on Node 22), so no key that passes validation can reach a 431. Both backends and the conformance server use the same encoded-size limit, so a key is accepted iff its encoded form fits, whichever backend it reaches — parity restored. `MAX_KV_KEY_BYTES` becomes `MAX_KV_KEY_ENCODED_LENGTH`. Tests, against a real node:http server for the 431 boundary: - the max-legal non-ASCII key (455×€, encoded 4095) round-trips over real HTTP with no 431, and the browser accepts the same key — parity on accept; - one code point over (456×€, encoded 4104) is rejected by both backends at validation, before any request — the exact parity case a byte bound missed (1368 bytes, would have passed, then 431'd over HTTP); - a raw client bypassing client validation with an over-ceiling (under 16 KiB) encoded key gets a clean 400, not a 431. Shared suite's key-domain matrix now bounds by encoded size on both backends. Mutation-checked: reverting the ceiling to UTF-8 bytes reddens the three encoded-length parity tests. Bumps @openmaic/storage to 0.1.3 (src/kv/* changed). * fix(storage): make the KV key domain truly opaque; keep transport limits out The recurring key-limit findings (512 → 8 KiB → 4096, each patch exposing the next) shared one root cause: transport-driven rules kept being added to the key domain — the browser primitive included — breaking the "opaque unconstrained string key" contract. This is the structural fix, per cosarah: "keep HTTP transport limits out of the browser primitive and preserve the existing string key domain." Approach (a), the minimal one: a KV key is any string, validated nowhere. The browser primitive is a Map/Storage that stores any key; the HTTP backend carries the key as a URL path segment and inherits that transport's limits, documented as HTTP-deployment concerns that never constrain the key domain. Every real key (a `prefix:id` from an unconstrained DSL string) round-trips on both backends; only pathological keys hit a transport limit, and none of those are keys a caller produces. (b) — keys in the request body for accept-parity — was unnecessary: verified that no real key needs it. Removed from the key domain (browser + HTTP + conformance server): - the encoded-size / length ceiling entirely — there is no key-length limit; - the NUL exclusion — NUL percent-encodes to %00, is preserved end to end, and is a legitimate Map/Storage key (a false "cannot represent" premise); - the `.`/`..`/empty/`/`/`\` rejections — all opaque, all round-trip. `assertKVKey` / `assertKVKeyPrefix` / `MAX_KV_KEY_*` are gone. Kept, at the transport layer only (HttpAccountKV), never reaching the primitive: - an unpaired UTF-16 surrogate genuinely has no percent-encoding, so the HTTP client surfaces a clear transport error (KEY_NOT_ENCODABLE) while the browser stores the same key — verified: encodeURIComponent throws on it. Scope completeness (P2): the "reject scope in every channel" guarantee had two holes — a scope path segment (`/kv/device/keys`) 404'd instead of 400, and only `x-scope` was checked among header spellings. The server now rejects a scope path segment and the whole prohibited header set (scope, x-scope, kv-scope, x-kv-scope). The coverage matrix is {get,set,remove,keys} × {path, query, each header spelling, body}. Coverage matrix reworked to verify arbitrary opaque keys (empty, NUL, control chars, separators, long, Unicode) round-trip on both backends — not to verify a limit. A real node:http test proves NUL and long keys round-trip end to end, and that a lone surrogate is a transport limit (browser accepts, HTTP client errors). Mutation-checked: re-adding a NUL rejection, removing the path-segment check, or dropping a header spelling each reddens the matching cells. Cleanup: package.json description updated (KV HTTP delivered, not "later"); network-server bind/skip/close lifecycle deduped into one helper. Bumps @openmaic/storage to 0.1.4 (src/kv/* changed). * fix(storage): reject whole-key "."/".." in the HTTP client — they alias entries Follow-up to making the key domain opaque: removing the `.`/`..` key-domain rejection was right (the browser stores them fine), but the HTTP client then let them reach `fetch`, where URL path normalization silently rewrites the target before it is sent. `encodeURIComponent('.')` is `.`, so `/kv/entries/.` collapses to `/kv/entries/` (the empty key) and `/kv/entries/..` walks up a level — so `get`/`set`/`remove` on a whole-key `.` or `..` silently read, overwrite, or delete a *different* entry, with no error. A data-correctness bug. Fix, same pattern as the unpaired-surrogate limit already handled: a whole-key `.`/`..` is something the URL-path transport structurally cannot carry, so the client's path-segment encoder refuses it with `KEY_NOT_ENCODABLE` before a request is built. Split the encoder in two: `encodeKeyPathSegment` (key → path segment, rejects whole-key `.`/`..`) and `encodeComponent` (the `keys()` prefix → query value, where `.`/`..` are legitimate and untouched). A key that merely *contains* a dot (`a.b`, `prefix:id`) is unaffected and round-trips. The browser primitive still stores `.`/`..` opaquely. The HTTP transport's limits are now complete — three cases, all fail-loud at the transport layer, all storable on the browser: (1) an unpaired surrogate (no percent-encoding), (2) a whole-key `.`/`..` (URL normalization aliases it), and (3) an over-long key (deployment request-target ceiling). The contract lists all three as HTTP-deployment limits, not key-domain constraints. Tests: whole-key `.`/`..` — browser stores and round-trips (distinct from the empty key); HTTP client throws `KEY_NOT_ENCODABLE` and builds no request; and a real-server test asserts the empty-key entry is never read, overwritten, or deleted by a `.`/`..` operation. A dot-containing key (`a.b`) round-trips. Mutation-checked: dropping the whole-key check reddens the alias tests. Bumps @openmaic/storage to 0.1.5 (src/kv/* changed). * fix(storage): reconcile the settings/profile persist consumer with the KV API The integration merge (#1002 KV into main) surfaced two things the merge itself could not resolve mechanically: - `lib/store/kv-persist.ts` (added on main by #1001) called `kvPersistStorage(kv, scope)` with a *variable* scope, which #1002's overloads deliberately reject — `'device'` must be paired with a device-safe store, so the overloads take the scope as a literal. Branch on the scope: `'account'` takes any `KVStore`; `'device'` narrows the backend to `DeviceSafeKVStore` via its brand (the adapter re-checks at runtime) and otherwise fails loud. The app wires only `'account'` today; the `'device'` arm keeps the generic helper honest. `ControllableKV` in the persist test wraps a local `BrowserKVStore`, so it is genuinely device-safe and now declares the brand. - `packages/@openmaic/storage` version bumped 0.1.5 → 0.1.6: the merge changed storage inputs (README + a pg-schema test carried from main) relative to the previous integration tip, so the version-bump guard requires an increase above #1002's 0.1.5. Still ahead of main's 0.1.1. Verified: root `tsc --noEmit` clean, the persist test green (40 passed), and the storage package suite green on Node 22.@openmaic/storage@0.1.6 |
||
|
|
f378c25a53 |
feat(storage): route settings/user-profile persist through KVStore (no legacy migration) (#1001)
* feat(storage): route zustand persist through KVStore The settings and user-profile stores persisted through zustand's default `localStorage` storage, while the rest of the app's small keyed values had already moved to `@openmaic/storage`'s `KVStore` — two unrelated mechanisms over the same browser API, which is the split-brain the storage RFC set out to remove. `kvPersistStorage` shipped with the package but had no importer. Add `lib/store/kv-persist.ts`, the app seam that adapts a `KVStore` into a zustand `PersistStorage`, and wire both stores to it under an explicit `account` scope. Store logic is unchanged: `version` / `migrate` / `merge` still belong to the stores, only the bytes' destination moves. Existing installs are adopted rather than orphaned. On first read the seam moves the raw `localStorage` entry into the KV scope — write first, then drop the raw key, so an interrupted migration leaves the value readable from one side or the other but never from neither. Once KV holds the entry it is authoritative, so a stale raw entry reappearing cannot roll back newer state, and re-running can neither duplicate nor resurrect anything. An entry that is not a readable persist envelope is left exactly where it is. Hydration is now asynchronous, because a `KVStore` may be remote. The browser backend resolves within a few microtasks of the store module being evaluated, so nothing user-visible changes, but tests that assert on persisted state now await `persist.rehydrate()` instead of relying on a synchronous read. The four pre-persist keys (`llmModel` / `providersConfig` / `ttsModel` / `selectedAgentIds`) are deliberately untouched: they are read-only inputs to a migration that never owned them, and `providersConfig` is still read independently by `lib/ai/providers.ts`. Part of #857. * fix(storage): close the async-storage failure modes in the KV persist seam Cross-review found that routing `persist` through an asynchronous store opens failure modes a synchronous `localStorage` never had. Each one below is now covered by a test that fails without its fix. Data loss on a failed or empty hydration. A KV read that threw was indistinguishable from an empty scope, so the store stayed on defaults while an always-on initializer's `set()` persisted those defaults; the next load then read them as a completed migration and deleted the raw original, leaving nothing. Reads now separate "nothing there" from "the backend could not answer": a failed read serves the raw entry read-only, adopts nothing and deletes nothing, and leaves the key unwritable for the session so no un-hydrated state can be persisted over an original. Raw entries are additionally only dropped against a recorded completion marker, so a KV entry of unknown provenance can never authorize deleting the only copy of the user's data. Lost adoption across tabs. A reader whose KV read answered before another tab's adoption write, and whose localStorage read landed after that tab's delete, saw nothing in either place and hydrated defaults. Against a remote backend that interleaving is ordinary rather than rare, so an apparent "nothing anywhere" is now re-checked before it is believed. Out-of-order writes. Two rapid `setItem`s could complete in either order and let the older value win. Reads and writes are serialized per key. Pre-persist migration resurrecting on every load. `migrateFromOldStorage` was guarded by the existence of the raw `settings-storage` key — the very key the migration removes — so once the blob moved into the KVStore it ran on every load and republished whatever the pre-persist keys still held, including API keys the user had since deleted, into first-frame state. It is now the persist layer's last-resort source instead of a synchronous read in the store initializer: its result is adopted like any other migration, so the adopted entry is the marker that stops it. Initial state is plain defaults, and nothing stored reaches observable state before the storage layer has vouched for it. The source keys are still only read, never deleted, since `lib/ai/providers.ts` remains a reader. Also: KV reads and writes are guarded so a corrupt entry surfaces instead of throwing through zustand's silent catch; clearing the cache now clears the migrated stores through their own storage, which a server-backed scope would need and a blanket `localStorage.clear()` would only appear to do; `removeItem` drops the KV copy before the raw one; and the e2e suite gains post-migration steady-state coverage, which every existing spec missed by seeding the pre-cutover key. Part of #857. * fix(storage): scope migration bookkeeping to the device, gate writes on call Second review round. The findings shared one root cause: two of the three sentinels recorded a fact about *this machine's* files but were stored beside the data, in the store's own scope. Under a syncing `account` backend that is a category error with teeth — one device's history would travel to another and authorize deleting files it says nothing about. Sentinels are now always `device`-scoped and carry a reserved `__` prefix, whatever scope the store uses. The worst combination this closes: device A migrates, its marker syncs, device B — which has never run this build — loads and deletes the raw entry that is still the only copy of its own settings. A test drives exactly that sequence against two devices sharing one account scope and nothing else. The pre-persist fallback gains a device sentinel of its own. Its source keys are device-local and deliberately left in place, so "KV and raw are both empty" was not a safe trigger: clearing the account entry, from the cache button or a server-side wipe, let any device re-read those keys and republish credentials the user had rotated. It is now consulted at most once per device, and `removeItem` deliberately does not clear that sentinel — clearing the entry is precisely the case it exists for. The fallback also no longer writes the adoption marker: that marker is a licence to delete a raw persist entry, and the fallback has adopted no such thing. Were it written, a raw entry later restored by an older bundle would be deleted unread. The write gate is now read when `setItem` is called rather than when its queued turn arrives. Evaluated inside the queue, a write issued during hydration waited behind `getItem`, found the gate opened by the very read it raced, and persisted its pre-hydration snapshot on top of the stored value. Refused writes are no longer a dead end: the first one asks the store to rehydrate, since the backend may have recovered, and if that does not work the user is told through a durable notice rather than losing every change on reload. Each refusal is logged, not just the first — a once-per-session warning hides how long a session has been silently unsaved. `removeItem` now propagates backend failures, so clearing the cache cannot report success for a clear that did not happen, and that flow reloads immediately instead of leaving a window in which a background `set()` re-persists the credentials just deleted. Also: the recovery hook is bound after each store is constructed, because naming the store inside its own definition made its type circular and silently widened every selector to `any`; the `serial` comment no longer claims an unreachable rejection handler; and the pre-persist version stamp documents that it skips `migrate`'s unversioned normalization too, which `merge` redoes anyway. Part of #857. * refactor(storage): make the KV persist seam a per-key state machine Three review rounds kept turning up the same defect class in new places: a backend failure read as "there is nothing there", and the result of an operation that nobody looked at. Patching instances of it was not working, because both are possible whenever a call site is free to decide for itself what a failed operation meant. This makes that decision unavailable to call sites. Every backend call now returns an `Outcome` whose payload is a private field and whose only reader demands a `KeyState`. Feeding the machine is not a convention to remember; it is the only way to get the value out. What comes back is the value or `UNAVAILABLE` — deliberately not `null`, so "the backend could not answer" is not spellable as "nothing is there". The machine then decides, in one place, what failure means: any read failure is unavailability, any write failure closes the key, and either raises the health signal and asks for recovery. The scattered closure flags (a settled set, a warned set, a recovery latch) become one explicit phase per key — unhydrated, settled, unavailable, clearing — with the transition table written out in the docstring and a test per row. What that consumes: - A write failing after the key settled used to be ignored; its outcome now closes the key, signals, and the value is remembered for replay. - `removeItem` enters `clearing` synchronously at call time, so a `set()` racing a clear cannot be admitted, queue behind the delete, and write the just-deleted value back. Nothing is replayed across a clear. - The pre-persist sentinel is recorded by *every* settling path, not only the one that consults the old keys. A device that had only ever loaded an already-populated account entry recorded nothing, and so stayed eligible to republish its own stale credentials the moment that entry was cleared — which the docstring already claimed it would not. - Two places treated a failed read as an answer: the sentinel read that decides whether the fallback runs, and the confirming re-read before adopting. Both now stop. - An adoption whose marker did not land no longer settles, and never deletes the raw entry: no proof, no licence. - Refused and failed writes are remembered and replayed once storage recovers, but only when the store was holding real data at the time — replaying a snapshot taken over defaults would overwrite the stored value, which is the failure this seam exists to prevent. When a snapshot cannot be replayed the user is told, because rehydration is about to discard those edits. - Health notices publish on a later task, so a recovery that lands moments later cancels a warning nobody should have seen, and a subscriber mounting after the failure is caught up once its toast host exists. `StorageHealthNotice` now sits after the `Toaster` for the same reason. Also: adoption re-reads before committing so a concurrent write is not rolled back; a shadowed raw entry is only deleted if it parses, matching the promise never to delete bytes we could not read; the unavailable copy points at the control that resolves it rather than suggesting a reload that cannot; and the version pin, the pre-persist retention rationale, and the cache-clear comment say what is actually true. Part of #857. * fix(storage): separate the contexts settle() was conflating Convergence round on the state machine. The findings share a root: settle() treated every read that concluded as licence to open the key, without asking what else was true at the time. - A read finishing while a clear is outstanding no longer settles. Under a remote backend a recovery rehydrate in flight during a clear is ordinary, and opening the gate there admits a write that queues behind the pending delete and restores the credentials just removed. Only finishClear opens a cleared key. - The raw entry served read-only after a failed read no longer counts as the authoritative value. A shadowed raw entry is by construction the older copy — long-term coexistence with a newer KV value is a designed state — so an edit taken against it must never be replayed, or one transient read failure on one device rolls the whole account back. - A write that lands supersedes an earlier failed one. Both were admitted before the key closed, so the queue ordered them; replaying the older snapshot on recovery would undo the newer value. - Unreachable browser storage is a failure, not an empty store. Privacy modes make localStorage throw; treating that as "nothing stored" hydrated defaults, refused every write and said nothing until the user reloaded and found the work gone. SSR stays a silent no-op. - The recovery latch re-arms when storage answers, so the three recovery transitions are not empty promises from the second failure onward. - A refusal carries the phase it happened in. Cold-start timing — an always-on initializer writing before the first read resolves, on a backend that never failed — is a log line, not a sticky red toast; only a refusal under `unavailable` reports lost changes. The health channel stops delivering stale catch-ups: its timers are cancellable and re-read the current state when they fire, so a recovery cannot be overtaken by a warning with nothing left to dismiss it. And `changes-lost` is now a fait accompli rather than a condition — a later recovery has nothing to retract and leaves it standing. Also: a throwing `localStorage` is unavailability rather than absence wherever the raw entry is read; clearing records the pre-persist sentinel like every other settling path, making that docstring true; the raw entry is dropped before the marker so a failed marker clear leaves something inert; and the pre-persist fallback and its four source reads can no longer throw into zustand's silent catch. Part of #857. * fix(storage): hold a replay until it lands, and prove a raw copy before deleting it Three failure-path corners. A replay was retired the moment its write was attempted. Readable but not writable is a real state — a quota-exhausted backend answers reads perfectly — so a recovering read could succeed, the replay write fail, and the snapshot be gone with nothing owed: the next rehydrate served the older stored value over the user's edit and said nothing. The snapshot is now held until the write is durable; a failed replay goes back to being a refused write, so the next recovery tries again and a permanent failure is eventually reported. The adoption marker was treated as proof that a raw entry is the migration's leftover. It proves only that a migration happened on this device once. A rolled-back deployment, or a tab still running the old bundle, writes the raw key again with settings the migration never saw, and the next load on the new bundle deleted them unread. A raw entry is now dropped only when its content equals the value shadowing it — anything else is data, and keeping a copy beats deleting an original here as everywhere else in this file. `changes-lost` was being cancelled by a later recovery. The two statuses answer different questions: "storage is down" describes the world now and stops being true when storage works, while "your edits were lost" describes something that already happened and no amount of recovery undoes. They are now tracked on independent lines per key and rendered as two toasts with distinct ids, so retracting the fault cannot take the acknowledgement with it; the loss notice goes away only when the user closes it. Part of #857. * fix(storage): bound recovery, keep a live store from walking backwards Three interactions the state machine did not have an answer for. Recovery had no budget. A backend that reads but cannot write — a quota-exhausted one does exactly that — turned it into a treadmill: the recovering read succeeds, the key settles, the replay write fails, and that failure asks for recovery again, forever. Attempts now follow a backoff schedule whose length is the cap, and the budget is re-armed only on real progress: a settle that left nothing owed. A settle reached *by* a recovery with a replay still queued is not progress, and counting it as such is precisely what made every lap look like a fresh start. When the budget runs out the key is left read-only and the loss is reported, rather than retrying where nobody can see it failing. A failed read could walk a live store backwards. Once a session has loaded the authoritative value, a transient read failure was still falling back to the shadowed raw copy — which is legitimately older, and legitimately long-lived now that a differing raw entry is kept rather than deleted — and handing it to zustand overwrote a live store with stale data. Worse, the store had already latched "holding real data", so edits made on top of that stale value counted as replayable. A failed read after an authoritative one now returns nothing, which is exactly "keep what you have", and the raw fallback stays where it belongs: the case where nothing authoritative has been seen at all. Dismissing a lost-changes toast only closed the UI. The key stayed in the lost set, so the same store losing changes a second time was swallowed as a duplicate and any later subscriber resurrected a notice the user had already dealt with. The close button now clears the latch, so a second loss is reported and an acknowledged one stays gone. Part of #857. * fix(storage): close the last two provisional and clear-ordering gaps An abandoned migration was handing back an authoritative value. When the confirming re-read fails, or the adoption write does, `adopt` returns the raw envelope unadopted — the same footing as the raw copy served after any other failed read — but it was returned bare, so the store latched "holding real data" and an edit taken on top of it counted as replayable. Another device publishing to the account scope in that window would have been rolled back. `adopt` now reports provisionality like every other read path, and the shape is a named `LoadedValue` so the next path cannot forget. Clearing swallowed a failed raw-entry deletion. The account entry was already gone by then and the marker was cleared afterwards, so the operation reported success while leaving an empty scope beside a live raw entry — precisely the shape the next hydration re-adopts, handing back the settings the user had just deleted. The raw entry now goes first and its failure propagates, which also fixes the ordering: failing before anything is removed leaves the KV value authoritative and the clear simply unperformed, which the caller can retry. Adoption keeps the tolerant variant, where a leftover raw entry is a duplicate rather than a loss. Part of #857. * fix(storage): make the shadowed-raw delete atomic against a concurrent tab cosarah reproduced a data loss: both raw-entry deletes verified the value, then awaited (reading or writing the adoption marker), then removed the key by name. A tab running an old bundle — which takes no Web Lock, so a lock could not have helped — overwrites the raw key with newer settings during that await, and the unconditional `removeItem` then deletes the newer value. The raw side is synchronous `localStorage`, so the fix needs no lock. Both deletes now finish every await first, then run a single synchronous compare-and-delete: re-read the raw bytes, and remove only if they still equal the exact string that was verified. A competing tab is a separate context whose writes surface here only at event-loop boundaries, so its write lands wholly before the re-read (seen — bytes differ — kept) or after the remove, never in between. A changed value is newer data, not a migration leftover, and is kept. Both sites cosarah named are covered: the shadowed-cleanup path (`dropShadowedLegacy`) and the adoption cleanup in `adopt`. `readLegacyEntry` now carries the exact bytes alongside the parse so the re-check is byte-exact rather than comparing a re-serialized value. The clear path's delete is unchanged: it is a deliberate full delete, not a conditional leftover cleanup. Part of #857. * fix(storage): stop deleting the raw entry — adopt by copy (Plan B) Maintainer decision after cross-vendor + red-team review: `localStorage` has no cross-process atomic compare-and-delete (the storage mutex was dropped from the spec), so a tab on an old bundle can insert a write between our re-read and our removeItem in a genuinely parallel process. The synchronous compare-and-delete narrowed that window but could not close it — as its own comment admitted. Since the raw-cleanup cannot be done safely on localStorage while an old bundle may be live, this stops doing it. Adoption is now a copy: the value is written to KV and the raw entry is left in place. The delete race is therefore impossible — there is no delete. KV stays authoritative (once it holds the value, reads take the KV path and never consume the raw one), so the shadow duplicate is inert, left for a wholesale raw-cleanup at migration exit. Removed with the two deletes: - `dropShadowedLegacy` (its only job was the gated delete) and its three call sites. - `deleteLegacyIfUnchanged` and the `{raw,value}` shape of the legacy read (`readLegacyEntry` → back to `readLegacy` returning the value). - The adoption marker (`__persist-adopted:`), whose only reader was that delete gate. It did not prevent re-adoption — the presence of the KV value does — so removing it breaks no invariant. `dropRaw` / `expectedRaw` on `adopt` and the marker-clear step in the clear path go with it. The clear path (user deletes all data) still deletes the raw entry strictly — that is a deliberate full delete, not a migration cleanup. Tests: the delete/marker cases become "the raw shadow always survives, KV is authoritative"; a two-device and an old-bundle-concurrent-write case guard it, and re-adding a delete on either adoption path turns them red. Part of #857. * fix(storage): add a monotonic migrated marker to stop shadow resurrection Cross-vendor + red-team review independently caught a P1 the previous "adopt-as-copy" revision introduced. Because the raw entry is now kept and writes only ever reach KV, the raw copy becomes a frozen pre-cutover value. If the account KV is later emptied by something other than a local clear — a server-side wipe, an account switch, KV eviction — the next load saw `stored === null` beside a live raw entry and re-adopted that stale copy, refilling the wiped account with ancient settings/credentials and syncing them to every device. Deterministic, not a race; it would fire once a server-backed account backend exists. Root cause: "keep the raw entry" inherently requires a record that it has already been migrated, so an empty-KV load can tell "first migration" from "external wipe". Removing the old delete-authorization marker in the copy revision dropped that record — Plan B was only half done. Adds a monotonic, device-scoped `__migrated:<name>` marker: - Read on every load. `stored === null` + raw present + marker set ⇒ respect the wipe, do not adopt (fall through to the confirm re-read, so a concurrent repopulation is still served). Only a genuine first migration (no marker, raw present) adopts. - Written best-effort after a successful KV write. A failed write degrades to the KV value's own presence check, so resurrection needs both a failed marker write and a later external wipe. - Read failure fails closed (do not adopt), never "assume not migrated". - Monotonic: only ever set true, cleared only by a deliberate full clear — no compare-and-delete race, which is why it is safe where deleting the raw entry was not. Live state with a real reader, not the delete-authorization marker removed earlier. The clear path clears the marker too (back to a genuine first-load state); best-effort, since with the raw entry already gone a leftover marker is inert. Tests: resurrection guard (external wipe does not re-adopt; concurrent post-wipe write is served; first migration records the marker; marker read fails closed) + the clear-path marker clearing. Mutation-checked: removing the gate resurrects the shadow, dropping the record leaves it unguarded. P3: the inert `__persist-adopted:` test rot is retargeted to the real `__migrated:` path. Part of #857. * refactor(storage): remove automatic legacy migration — pure KV wiring Maintainer decision (terminal): after repeated review rounds kept finding new P1s in the legacy-adoption path — its state space is too large to keep correct — the PR is narrowed from "migrate + wire" to "wire only". Settings and user-profile persist through the KVStore; pre-cutover data is not migrated; an upgrading user reconfigures once (the data is reconstructable and the cost is one-time). Removed the entire legacy-adoption subsystem from the adapter: - `adopt()`, `readLegacy()`, the `legacyStorage` dep, and the raw-fallback read on a failed KV read. - The `__migrated:` marker and its resurrection guard, the confirm-re-read, and the `provisional`/`LoadedValue` machinery. - The `prePersistFallback` dep, `recordPrePersistHandled`, the `__pre-persist-consulted:` sentinel, and `readSentinel`/`writeSentinel`. - In settings.ts, `readPrePersistSettings` (the llmModel/providersConfig reader wired as that fallback) — reading legacy keys is migration, which this PR no longer does. `lib/ai/providers.ts` still reads `providersConfig` independently, so those source keys are left in place. The adapter now reads and writes the KV scope and touches no legacy key: an empty scope hydrates the store to defaults (ordinary zustand). `load()` is a single KV read; a failed read stays unsettled so defaults are never persisted over an unread value; the clear path removes only the KV entry. Kept, because they are async-storage *steady state* a remote KV backend needs, not migration scaffolding: the KeyState machine (hydration gate, write gate, recovery, replay), the Outcome discipline, per-key serialization, and the persist-health channel. Added `purgeLegacyPersistKey`: a best-effort, fire-and-forget removal of the old raw persist blob, called once by each store. Never read, so a leftover is pure garbage — and the old settings blob held plaintext provider API keys, so clearing it is a small security win. Net: the adapter drops ~460 lines. Tests are rewritten to steady-state KV coverage plus an explicit "old raw key is ignored, not migrated" proof at the store level; the e2e seed fixtures move from the raw key to the KV scope key. Part of #857. * docs(storage): align README and comments with the no-migration behavior Follow-up requested on the approved PR: the migration/adoption logic was removed, but a few comments and one README roadmap line still referred to those deleted concepts. Documentation only — no behaviour change. - README roadmap: the settings/user-profile line said "adopting their pre-cutover raw keys"; it now states there is no automatic migration (legacy keys ignored and best-effort purged, users reconfigure once). - kv-persist.ts: the per-key serial chain comment no longer claims to keep "adoption" from interleaving; it serializes a key's read/write/clear. - settings.ts: `SETTINGS_PERSIST_VERSION` no longer documents a "pre-persist fallback" that no longer exists. - Test/fixture headers that described seeding "the pre-cutover raw key" for "one-time adoption" now describe seeding the KV `account` scope, with no legacy-key migration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(storage): bump version to 0.1.1 for README doc alignment The README is a publishable input, and the no-migration doc alignment changed it, so the package version must increase. Patch bump: documentation only, no code or API change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: wyuc <zdq1204@gmail.com> |
||
|
wyucandClaude Opus 5
|
3e4eece53a |
test(lint): regression-test the require('ai') form in the guard matrix (#1018)
Non-blocking follow-up requested by @cosarah on #1006. `require('ai')` is already rejected everywhere — measured across all six source extensions, all six report an error — but by the inherited repo-wide `@typescript-eslint/no-require-imports`, not by the guard's own rules. That makes it the one covered form with nothing pinning it: relaxing that rule (allowing require in .cjs, say) would silently reopen an SDK path. So the matrix now carries the form too. Two details worth the reviewer's time: - Guarded paths assert the PROPERTY (this import is rejected here), not a particular rule id, so the config stays free to satisfy it however it likes — including by keeping the inherited rule. - Exempt paths can no longer assert "zero errors", because the inherited require ban legitimately fires in tests/ and eval/ too. They now assert that neither of the guard's own two rules fires, which is the property that actually matters and is a tighter claim than the old one. Fault-injected to confirm it bites: setting `@typescript-eslint/no-require-imports` to 'off' turns every require row red. Out of scope, as agreed on #1006: render-service/** is in globalIgnores and linted under its own config, so the guard does not reach it. That predates this work. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5
|
97f8585728 |
refactor(pbl-v2): route runtime agents through the shared LLM entry point (#1006)
* refactor(pbl-v2): route runtime agents through the shared LLM entry point The five PBL v2 runtime call sites (instructor x2, evaluator, simulator x2) invoked the AI SDK directly while the other 21 call sites in lib/ and app/ go through callLLM / streamLLM, so they silently opted out of everything the shared entry point applies: - Usage accounting. recordUsage is reached only from the wrappers, so no instructor turn, evaluator pass, simulator line or narrator pass was ever accounted for - the highest-frequency, longest-context LLM traffic in the product. The comment at llm.ts:275, that every server-side call funnels through the wrappers, did not hold. - The LLM_THINKING_DISABLED kill switch, read inside the wrappers only. - One thinking resolution path. runtime-thinking.ts existed precisely because the agents bypassed the wrapper, and it was wired into instructor (x2) and evaluator but neither simulator site. Also fix callLLM recording result.usage, which on a multi-step tool run (stopWhen) is the final step alone; totalUsage is the aggregate, and the instructor turn is exactly such a run. streamLLM already preferred the aggregate. Thinking semantics are preserved per call site: the teaching turns keep force-disabling thinking, now through the wrapper's own `thinking` argument, and keep their existing providerOptions spread, which injectProviderOptions yields to; the simulator keeps honouring a per-request config, as before. The one behavioural difference is on native adapters when no thinking config arrives: the policy now resolves to an explicit lowest/disabled provider option instead of leaving the model's default in place - which is what the policy always claimed to do, and what OpenAI-compatible providers already got. Unifying the wider divergence is a product decision and stays out of scope; runtime-thinking.ts now documents it, along with the fact that the original tool_choice justification no longer matches the tree. A lint guard restricts importing generateText / streamText to lib/ai/llm.ts so the split cannot grow back. It uses the @typescript-eslint variant of no-restricted-imports deliberately: flat config replaces a rule's options per key rather than merging them, and the base rule is already configured for the lib/choreography and lib/video-export module boundaries. The runtime-thinking test moves from asserting the retired helper to asserting what the call site is responsible for, at the provider boundary: an evaluator turn reaches the provider with a disabled config in the thinking store, does not leak it, and is accounted for under its own usage source. Closes #1003 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(pbl-v2): address cross-review findings on the shared-entry migration Consensus findings from an independent cross-vendor review of |
||
|
wyucandClaude Opus 5
|
cc95851dc5 |
chore(packages): publish storage and enforce version bumps (#998)
* chore(packages): publish storage and enforce version bumps * fix(packages): cover all publish inputs and tarballs * fix(packages): scope version guard to release inputs * fix(packages): fail closed on new package inputs * docs(packages): clarify version guard boundaries * fix(packages): harden release guard edge cases * fix(packages): align smoke peers and git inputs * docs(packages): make release smoke policy explicit * fix(packages): anchor version guard at repository root * fix(packages): report version guard setup errors * fix(packages): harden release validation * fix(ci): validate complete main pushes * test(storage): pin the exported PostgreSQL schemas DOCUMENT_PG_SCHEMA and RUNTIME_PG_SCHEMA are public API. A deployment that provisions these tables with its own migration tooling has to reproduce the DDL exactly for ensureDocumentSchema() / ensureSchema() to stay the intended no-op against an already-provisioned database. Nothing guarded that today: every statement is CREATE ... IF NOT EXISTS, so PostgreSQL silently accepts whatever table already exists under the name. A column type, a nullability, an index or a FK action can drift apart from a downstream migration without an error, and the first symptom is a store query failing in production or succeeding against the wrong types. Pin both constants verbatim, and assert every statement stays IF NOT EXISTS guarded so the ensure functions remain idempotent. The pin does not judge the DDL; it makes changing it impossible to do by accident. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): gate publishing on the version check The version check ran only in ci.yml. publish-packages.yml is a separate workflow, so it could reach `pnpm publish` on a main push, a matching tag, or a manual run with dry_run=false even when CI was red, skipped, or never ran. Run the validation inside the publish job, before publishing, in a new release mode that works for every trigger. A push range only exists for branch pushes, so release mode judges each package against the registry instead: a version that is not published yet is a release, and a version that is already published is accepted only when the package source has not moved since that release. `pnpm publish` skips an already-published version, so without that second half a drifted package releases as a silent no-op. The anchor for "since that release" is the @openmaic/<name>@<version> tag the job now writes after every successful publish, falling back to the push range for packages released before those tags existed. With neither anchor the release stops instead of guessing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): make the release gate prove only what it can Three independent reviews of the previous revision converged on one root cause: it used git tags and a push range as the record of which tree produced a published version. Neither is trustworthy. Tags are mutable and can be created or moved by hand, so "the tag resolves" was being read as "the tag is authentic"; pnpm records no gitHead; and a push range describes one push, not the origin of a release. Packages released before the scheme existed had no anchor at all, which made the tag and manual triggers fail closed from the first run with no way to self-heal, dry runs included. Drop the anchor machinery. Drift is prevented where it is provable, in diff mode at merge time, which sees every commit before it can be released. The pre-publish gate is now limited to claims a release can establish: every version it publishes is new and moves forward, an already-published version is reported and left alone, and any registry answer that is not a definitive 404 stops the release. Around it, close what the reviews found in the workflow: - real publishes only from a commit contained in main, so a tag or manual run cannot ship an unreviewed ref while holding NPM_TOKEN - one repository-wide concurrency group, so a main push and a tag push cannot each decide the same version is unpublished - publish and mark each package individually, so a partial failure stays retryable instead of leaving published packages unrecorded - fail if the build rewrites tracked package files, which would otherwise publish content that is not in the released commit - compare against every published version when ordering, and refuse to guess when the registry holds versions this check cannot order The schema pin also asserted the constants without asserting what the ensure functions execute, so those could diverge. Both are now run against a recording queryable and their exact statement sequence is asserted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): refuse to release from a tree behind the registry Simplifying the gate introduced a hole that a mutation check caught: a package whose local version is already published took the "already published, skip" path before any ordering check, so a tree rolled back to an older published version passed silently. That is not a harmless no-op, because pnpm publish rewrites each workspace dependency to the version in the tree, and a sibling released alongside it would be published declaring a dependency on the older package. Order every package against the registry first, then decide: at the highest published version it is a legitimate skip, below it the release stops. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): couple publishing to a green CI run for the same commit Second review round, on the reworked design. The headline defect was a hard blocker: `git fetch --depth=0` is not valid git (that is an actions/checkout convention), so under `set -e` every real publish aborted before the gate ever ran. Remove the depth argument; the checkout already has full history. The rest closes the gap both reviewers reached independently, that being on main is not the same as having passed the gate: - wait for this exact commit's CI conclusion and require success. ci.yml runs concurrently with this workflow on a push to main and blocks nothing, so an unpublished version whose source drifted could be released while its own version check was still running or already red. - require the commit on main's FIRST-PARENT history. Plain reachability also accepts every intermediate commit of every branch merged with a merge commit. A pull request that adds a bad tree and reverts it in the next commit leaves that tree an ancestor of main forever, and a tag pointing at it published it. - do not cancel CI runs on main. Each run validates only its own push range, so cancelling one drops the range that contained the change, and its replacement compares against the cancelled tip and sees nothing. - run the version check on every main push. A branch creation or force push reports an unusable `before`, which used to skip the gate entirely; fall back to the first parent instead. - publish with --ignore-scripts. Every package's prepublishOnly reruns the build, deleting and regenerating the dist that was just verified and smoke-tested, so npm could receive bytes nothing had checked. - run storage's PostgreSQL contract suites before publishing it. They skip themselves without a database, so the one backend that needs a real PostgreSQL was shipping unexercised. - order registry versions with real semver, prereleases included. Rejecting every non-x.y.z version meant one historical prerelease anywhere in one package's history would refuse every future release of every package. - warn when a release marker exists but points at another commit. Note what is NOT enforceable here: a workflow_dispatch or tag run executes the workflow definition from the selected ref, so a branch that edits this file can delete these checks. The boundary has to be a GitHub Environment holding NPM_TOKEN behind a main-only deployment branch rule. The job now declares that environment and the header states the required setup; the in-file checks are defence in depth. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): stop the first-parent check failing on SIGPIPE Third review round. The blocker this time: `git rev-list --first-parent | grep -qx` under `set -o pipefail`. grep exits at the first match, rev-list then dies of SIGPIPE, and the pipeline returns 141, so a commit that IS on main is read as "not on main" and every real publish is refused. It does not reproduce in a shallow clone, where main's history fits in the pipe buffer; with the full history this job checks out it always will. Count matches instead, which reads the whole stream. Also from this round: - identify the CI run by workflow file and triggering event rather than by a check-run display name. Names are not unique, so any other workflow or app publishing a check called "Lint, Typecheck & Unit Tests" could stand in for a red version gate. - fail the main-push version check when the push range is unusable instead of substituting HEAD^. A force push can replace many commits at once, so the previous commit is not the range that needs checking, and a green run here is what publishing depends on. - correct the stated limitation. It claimed the package-directory input model was exact for dsl and storage; it is not. Their dist is whatever the lockfile's TypeScript emits, and dsl's shipped JSON schema comes from the lockfile's ts-json-schema-generator, so a toolchain bump can change any of the four tarballs with no diff under the package directory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(packages): make a merged version bump the only release input The tag trigger was incoherent. Its own documentation admitted that any @openmaic/* tag republishes the whole family and that which packages actually go out is decided by the manifests, so the tag name never participated in the decision. It was a second entry point to one decision function, it bypassed review entirely because a tag is not a diff and can be created by anyone with write access on any commit, and it cannot be guarded: environment deployment rules match GITHUB_REF, so refs/tags/* and a main-only rule are mutually exclusive. Drop it. A version bump that landed on main is now the only release input, and `@openmaic/<name>@<version>` tags are an output written after a package reaches the registry. Nothing is lost: a manual dispatch from main still republishes without a new commit, and that path is inside the protected environment. Split the workflow so the token has a boundary. `validate` holds everything that does not need NPM_TOKEN and runs from any ref, which keeps dry runs useful to contributors. `publish` is the only job declaring the `release` environment, so the token is never attached to a run that is merely validating. It rebuilds rather than sharing state, which is the right trade for a release. Also add the `actions: read` permission the CI-conclusion query needs; it was switched from the checks API to the Actions API without updating the scope, which would have failed with 403 on every real publish. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(contributing): explain when a package version must be bumped CONTRIBUTING said nothing about versioning or releases, while this branch adds a CI check that fails a contributor's PR with "publishable package inputs changed but version did not increase". A gate that rejects work without telling anyone the rule is the kind that ends up disabled. State the rule, the exact failure message, which files are exempt, and how to choose the number, with a specific warning for @openmaic/dsl: it is the contract the other packages validate against, so narrowing what an existing document may contain is breaking even when the diff is small. Also state what contributors do NOT do: publishing is automatic once a bump lands on main, and the release tag is a marker written afterwards rather than something to push. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): run renderer's tests before publishing renderer The pre-publish gate ran renderer's typecheck but never its test suite, so the one package whose behaviour is hardest to typecheck was the one shipping unexercised. It has 25 test files and 242 tests; they just were not in the filter list. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(packages): keep the git credential away from package code Review finding: the publish job held `contents: write` while actions/checkout had persisted that credential, and it then ran `pnpm install` and the package builds. Any dependency or build script executed with a credentialed git remote in reach and a write scope to use it, which is a wider blast radius than publishing needs. Separate the two capabilities so no job holds both: - `validate` and `publish` run package code. Both now check out with `persist-credentials: false`, `validate` is pinned to `contents: read`, and `publish` drops write scope entirely, keeping only the `actions: read` it needs for the CI conclusion and `id-token: write` for provenance. - a new `mark` job is the only holder of `contents: write` and a git credential, and it installs nothing and builds nothing. `mark` also reconciles instead of only recording this run. A marker whose push failed previously could never be repaired before, because the release plan excludes versions already on the registry and the marker logic sat behind that plan. It now marks any registry version whose tag is missing, and leaves an existing tag alone rather than moving it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>@openmaic/storage@0.1.0 @openmaic/importer@0.1.1 @openmaic/renderer@0.0.3 @openmaic/dsl@0.5.0 |
||
|
xuyuanwei678
|
f4c1b46642 | fix(importer): handle custom shapes without paths (#1015) | ||
|
Yizuki_Ame
|
23a9e757d5 |
refactor(choreography): drive overlays from descriptors (#947)
* feat(choreography): add Motion descriptor adapter * fix(choreography): harden descriptor lookups * fix(choreography): preserve descriptor special keys * refactor(choreography): drive overlays from descriptors * fix(choreography): preserve spotlight fade easing * fix(choreography): align descriptor consumers * docs(choreography): clarify spotlight easing |
||
|
sophietao20-star
|
0cf2a33041 |
docs: refresh and synchronize documentation (#996)
Refresh the Chinese documentation against current functionality, synchronize all localized guides, document deployment and configuration behavior, and align the PPTX import feature flag implementation. |
||
|
LING DUAN
|
61a7154f07 |
feat(pi): add evidence-aware Director context runtime (#971)
* feat(pi): add evidence-aware Director context runtime * fix(web-search): require completed native search * fix(orchestration): preserve whiteboard across agent handoffs * fix(pi): remove wrap-up turn bypass |
||
|
xuyuanwei678andwyuc
|
ff95e6683d |
feat(renderer): add optional playback canvas (#958)
* feat(renderer): add optional playback canvas * style(renderer): format playback tests * fix(renderer): center text by default * fix(renderer): address playback review feedback * docs(renderer): align playback canvas API docs --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
杨慎andClaude Opus 4.8
|
6d29241bb0 |
feat(video-export): fidelity polish — spotlight geometry, video clips, formulas, subtitles (#952)
* fix(video-export): bridge play_video element id → media ref Generated-media records are keyed by the element's media ref (gen_vid_…), but a play_video action targets the slide element by its .id. The app-side compiler deps looked media/durations up by the raw element id, so every generated video missed → present:false → no <video> emitted, no bytes collected → the clip vanished from the export (only its static first frame, baked into the base PNG, remained). Build an elementId → mediaRef bridge across all slide scenes in createVideoTimelineDeps (mirroring the live engine's resolveMediaPlaceholderId) and resolve both media() and videoDurationMs() through it. Refs #867. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): re-measure KaTeX fit-scale after fonts settle KaTeX sizes large delimiters (\left\{, \begin{cases}) from its KaTeX_Size faces, which load asynchronously. KatexContent measured its shrink-to-fit scale once on mount, against the fallback font, and never recomputed — so a cold slide snapshot baked a stale scale and the big brace desynced from the piecewise body ("大括号后面的分段函数与大括号错位"). - Re-run the fit-scale measurement on document.fonts.ready and on each `loadingdone`, keeping the shrink-only (cap-at-1) behavior. - slideToPng waits two extra frames before capture so the font-triggered React re-measure commits into the DOM html2canvas reads. Refs #867. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): place spotlight/laser/video on the rendered content box The pure geometry helper resolves an element's authored outer box against a fixed 1000×562.5 base, but the live overlays — and the exported frame PNG — measure the element's `.element-content` box, which for horizontal text is auto-height plus 10px content padding. So a spotlight/laser sat offset from where the text actually renders ("spotlight 与对应元素的位置有偏差", #867 item 5). Add an optional GeometryProbe to the compiler's DI boundary: when supplied, the geometry pass prefers each element's measured content-box geometry (video keeps its rotation from the authored element), degrading to the pure authored-box calc on a miss so the compiler stays deterministic in unit contexts. App side: measureSlideElementGeometry (new, in @openmaic/renderer/snapshot) mounts the slide off-screen and reads the same `.element-content`-against- container box the live SpotlightOverlay uses; createVideoTimelineDeps pre-measures every spotlight/laser/play_video target per scene and serves the probe as a synchronous table lookup. Tests: geometry.test.ts quantifies the outer-box vs content-box delta and proves probe-wins / fallback / rotation-preservation; timeline-deps.test.ts covers the pre-measure wiring. Refs #867. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): decode a first-frame poster for posterless videos A play_video clip only shows during its play window; the rest of the time the static base-frame PNG backs that spot. But html2canvas can't draw a <video>, so the snapshot swaps it for its poster <img> — and generated videos usually carry no poster, leaving the video area blank whenever the clip isn't playing. When a video record has no stored poster bytes, decode the video blob's first frame (seek slightly off 0, draw to a canvas) and set element.poster before the base snapshot, so that spot shows the first frame — the "paused on frame one" look — instead of blank. Falls back to no poster on decode failure / timeout / CORS taint, never failing the export. Refs #867. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(video-export): split subtitles, make burn-in optional, centered modal Burned-in captions used one cue per whole narration paragraph, so a long cue became a 4–6 line block covering the lower half of the slide, and there was no way to turn it off. - Split cues (pure, compiler layer): lib/video-export/split-cue.ts splits each cue on sentence → clause → hard-wrap to ≤~40 CJK-equiv units, distributing the parent window by character weight (last piece pinned to the parent end, sub-1.2s slivers merged). Wired into the timeline pass, so the burned-in overlay and the SRT/VTT sidecar share one split track and can't drift. - Burn-in optional (default off, #867 item 2): emitHyperframes gains burnInSubtitles; off → clean video + sidecar SRT/VTT only. Caption layout hard- clamped to 2 lines so an outlier can't grow tall again. - Download subtitles without rendering: compileSubtitles() runs only the compiler (no assets/zip/service); new useDownloadSubtitles saves an .srt. - Centered modal: video-export-dialog.tsx replaces the cramped dropdown section, grouping Output / Subtitles / Actions / Progress with a stable lifecycle for multi-minute renders. header-controls opens it from an "Export Video" entry; old video-export-menu.tsx removed. i18n keys added across all 8 locales. Refs #867. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style: prettier format video-export fidelity changes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: drop unused playVideo helper in timeline-deps test The media-bridge tests assert via deps.assets.media(...) directly, so the playVideo helper (and its PlayVideoAction import) were dead. Flagged by the code-quality bot on #952. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): resolve cross-review findings + lower subtitle band - emit-hyperframes: drop duplicate `display:-webkit-box` on subtitle cues so they start truly `display:none` (a second declaration overrode the `none`, showing every cue stacked at t=0 when burn-in was enabled). - geometry: don't feed the measured content-box AABB to a rotated video clip — it already encloses the rotation, so re-applying `rotate` doubled it. Rotated elements fall back to the authored box (one, un-doubled source of truth). - build-export-zip: extract shared `compileStageIr` so buildExportZip and compileSubtitles can't drift on the timing/assets/geometry wiring. - split-cue: join merged CJK cue pieces without a spurious ASCII space. - subtitles: lower the caption band (bottomRatio 0.055 → 0.01) and hoist the band's magic numbers into a named SUBTITLE constants block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): stop the snapshot onclone override from reshaping KaTeX The export snapshot injects a neutral-kerning / geometricPrecision style over `.slide-renderer-prose *` to keep CJK prose+table glyphs from mis-advancing under html2canvas-pro. KaTeX formulas (output:'html') also live inside `.slide-renderer-prose`, so the override was reshaping their math glyph advances — a burned-in formula rendered subtly differently from the live canvas, which applies no such override. Empirical check (Playwright + system Chrome, cases+fraction formula, native paint vs html2canvas): the override raised the formula's mean per-pixel delta vs the live paint from 120.1 to 139.2 (~16%) and moved ~75% of inked pixels. Restoring native font-kerning/text-rendering for `.katex` subtrees brings the formula's delta back to 120.1 (bit-identical to the no-override capture) while prose and table text keep the override. The residual 120.1 is the deeper html2canvas rasterization gap (vlist/frac-line/delimiter), a separate track. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): render slides via native paint, bundle KaTeX font embed Root-fix the exported-vs-live formula distortion (and the filter/mask/video gaps) by rasterizing slides with native Chrome paint instead of html2canvas's reimplementation. - slideToPng now captures via html-to-image (foreignObject → the same Chrome engine that paints the live classroom rasterizes the same DOM). KaTeX formulas, CSS filter, soft-edge masks, and mixed CJK/Latin text come out as the classroom shows them. html2canvas-pro stays as a fallback (with the filter/mask bakes + KaTeX text-rendering reset) for when native paint can't run — e.g. a cross-origin image taints the canvas. - A foreignObject SVG can't reach the document font registry, so fonts must be inlined. KaTeX math faces are prepended from the bundled woff2 (KATEX_FONT_EMBED_CSS, generated by scripts/generate-katex-fonts.mjs), NOT left to runtime getFontEmbedCSS — which reads cssRules and silently drops a cross-origin KaTeX stylesheet, collapsing a large brace to a fallback glyph (the observed "formula render failure" on e.g. a \begin{cases} with \text{}). A per-face guard verifies every KaTeX face the formula references is embedded, falling back to html2canvas otherwise. Verified in a Playwright spike (native vs html2canvas vs html-to-image): formula inked-delta 143→53; filter/mask/video match native; and with getFontEmbedCSS forced empty, the bundled embed alone still renders the failing formula correctly. Renderer package tests: 226 passed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): prettier-format the generated KaTeX font-embed module The generator emitted an unformatted TS file (double quotes, long unwrapped CSS literal) that failed CI `prettier --check`. Run the generated output through the repo's Prettier config before writing, so every rebuild produces CI-clean, stable output. Regenerated the committed file to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(lint): rename reserved `module` var in katex-fonts generator; ignore .scratch - generate-katex-fonts.mjs assigned to a variable named `module`, tripping @next/next/no-assign-module-variable (the one hard eslint error). Renamed to `fileContents`; generated output is byte-identical (deterministic). - Add `.scratch/**` to the eslint globalIgnores (alongside .claude/.worktrees) so local throwaway verification scaffolding doesn't pollute `pnpm lint`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): address PR #952 review — scene-scoped media bridge, safer cue splitting Resolves the two blocking correctness issues and three follow-ups from the cross-review on #952. - Scope the elementId→mediaRef bridge by scene (was deck-wide/last-writer-wins): slide-local ids like `video_001` now resolve within their own scene. `assets.media` uses its scene arg; `timing.videoDurationMs` resolves via action object identity. Adds a cross-scene collision test. - Stop treating every ASCII period as a sentence boundary: a lone `.` splits only when not between word chars (3.14, v1.2) and not an abbreviation dot (e.g.), collapsing repeated-punctuation runs. Adds decimal/version/abbrev/ellipsis tests. - Share the module-level in-flight guard across ZIP export and subtitle download (extracted to export-in-flight.ts); dialog `busy` folds in `downloading`. - Skip the off-screen geometry render for the subtitles-only path (skipGeometry); duration probes are kept so sidecar cue timing stays in sync with the video. - Align measure.ts font settling with slideToPng: force-load each used face before fonts.ready so measured content-boxes don't bake fallback advance widths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(video-export): prettier-format split-cue test Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(video-export): enable beginFrame capture via PRODUCER_BROWSER_GPU_MODE=hardware The producer defaults to `software` GPU mode, which silently force-enables the CPU-bound `Page.captureScreenshot` fallback: SwiftShader pins every core on rasterization and caps frame capture at ~10 fps. Selecting `hardware` keeps Chromium's `HeadlessExperimental.beginFrame` capture active instead. Measured on a 900-frame (30s) clip, no real GPU on the host: - capture ~10 -> ~19 fps, total 100s -> 62s (~38% faster) - CPU peak ~810% -> ~98%; peak mem 2.2 GiB -> 0.9 GiB - static frames pixel-identical; animation frames differ only in sub-pixel edge antialiasing (same-path re-render is deterministic/inf PSNR) No real GPU is required — the win is the faster capture API, not hardware rasterization; beginFrame falls back gracefully if the host lacks a GPU. Also eases the RENDER_JOB_DEADLINE_MS timeout risk on long videos. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(video-export): sentence splitting via Intl.Segmenter + abbreviation merge Addresses the PR #952 follow-up: separate sentence-boundary detection from cue shaping and stop growing a custom punctuation heuristic. - splitSentences now delegates boundary detection to Intl.Segmenter (locale- agnostic ICU), the multilingual/CJK baseline. It already preserves 3.14, v1.2, e.g., U.S., ellipses, and CJK 。！？… without any hand-rolled period scan. - ICU still ends a sentence after a titlecase abbreviation before a capitalized word (Dr. Smith, Fig. 3) — the edge case the reviewer flagged. A small abbreviation-aware post-merge re-joins those, driven by an ABBREVIATIONS set. - Semicolons are no longer sentence ends (they join clauses); moved ；; into the clause-level SECONDARY splitter so over-budget sentences still break there. - Cue shaping (budget / clause / hard-wrap / weighted timing) is unchanged, so detection and shaping are now distinct stages. Not using `sbd` as suggested: lib/video-export/*.ts sits behind the machine- enforced eslint purity boundary (imports limited to @openmaic/dsl, zod, ../choreography, siblings), so a new npm dep is rejected. Intl.Segmenter is a pure Node >=20.9 builtin, matching the reviewer's "small abbreviation-aware post-merge layer" alternative. Tests: add Dr. Smith / Fig. 3 / U.S. coverage; the rhetorical ellipsis now stays one under-budget cue (was split); add a semicolon over-budget case. 22/22 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(video-export): prettier-format split-cue sentence refactor Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * i18n(es-MX): add 7 subtitle/video export keys to align with en-US main added the Spanish (Mexico) locale (#942) after this branch's subtitle keys landed, so es-MX was the only locale missing export.subtitles* and export.videoBurnSubtitles* — which failed the i18n key-alignment CI check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): restrict title post-merge so it never deletes real boundaries Addresses the blocking re-review on the Intl.Segmenter change: the abbreviation post-merge unconditionally rejoined the next ICU segment whenever the previous one ended in a listed abbreviation, which erased genuine sentence boundaries — `It was made by Acme Inc. Next point.` collapsed into one cue, and even an explicit newline (`Acme Inc.\nNext topic`) was rejoined. The merge now fires only for the case ICU actually mis-splits — a title (Mr/Mrs/Ms/Dr/Prof/Sr/Jr) before a capitalized proper noun — and only when: - the previous segment does not end at a newline (hard boundary), and - the next segment starts with a capital letter. Sentence-trailing abbreviations (Inc./Ltd./etc./vs./No.) are dropped from the set entirely: they legitimately end sentences, and ICU already keeps a title before a number (No. 5, Fig. 3) or a lowercase continuation (etc. and…) whole without any merge, so nothing there needs rejoining. Regression tests: Inc./etc. boundary preserved, newline-after-title preserved, lowercase continuation kept whole, plus the retained Dr. Smith / Fig. 3 / U.S. cases. 26 split-cue tests pass; full video-export suite 123 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
|
b4e3145c90 |
feat(roster): single-source the generated agent roster on the stage document (#994)
* feat(roster): single-source the generated agent roster on the stage document The generated agent roster used to live in two places at once: the stage document carried generatedAgentConfigs, while a per-stage IndexedDB mirror (db.generatedAgents) was the actual read authority — and the only home of each agent's voice binding. The split caused real losses: voices vanished on device switches, exports, and shares (the mirror never travels), the load path trusted a device-local table over the portable document, and roster edits persisted through a bespoke debounce with no beforeunload flush. Make the stage document the single source of truth: - Contract: add optional voiceConfig/voiceDesign to GeneratedAgentConfig in @openmaic/dsl (VoiceDesign moves into the contract; the app re-exports it). Additive optional fields — not a breaking serialized-shape change, so DSL_VERSION stays put per the version policy. - Writes: remove every mirror writer (registry saveGeneratedAgents, the stage store's debouncedSaveAgents bypass, classroom-load hydration, import direct writes). setStageAgents now only marks the stage dirty for the shared persistence scheduler plus synchronous in-memory registry/selection mirrors; generation and import embed the roster on the stage. - Reads: classroom load hydrates the registry from the loaded stage's generatedAgentConfigs; export reads the stage roster directly. - Lazy migration: the mirror is retained read-only. On load, a roster (or voice fields) missing from the document is backfilled from the mirror, committed onto the in-memory stage, and persisted by the next flush — idempotent, and gated on the current stage id after every await so a classroom switch cannot leak a stale roster into the registry. - Deletion: deleteStageData discards the deleted stage's pending persistence work so a queued flush cannot resurrect the document. - Round trip: classroom ZIP manifests now carry the voice fields, so export/import preserves agent voices. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(roster): harden deletion, migration, selection, and ingress paths Review hardening on top of the roster single-source change: - Deletion vs in-flight persistence: deleting a stage now registers a session-scoped tombstone (lib/utils/deleted-stages.ts) before the cascade starts. Every persistence landing point checks it — the scheduled flush and the departing-stage retry drop their snapshots, and the aggregate/incremental saves re-check under the document lock, including the incremental path's full-save fallback that would otherwise rebuild a deleted document from the in-memory snapshot. A deletion that fails before the document is removed lifts the tombstone so the still-existing stage keeps persisting. - Lazy migration termination: a fruitless legacy-mirror probe (nothing to merge — e.g. server-generated rosters, which are voiceless by design) is remembered per stage for the session instead of re-querying the mirror on every load forever. Successful merges are not memoized so a failed flush is retried on the next load. Docstrings now state the real lifecycle. - Selection provenance: setStageAgents no longer overwrites a user-set agent selection with the full roster. Stage-derived selections still track the roster; a user-set auto selection is only narrowed to surviving agents (newcomers are not auto-selected, the user-set flag is untouched), and a user-set preset selection is left alone — matching restoreAgentSelection. - Mirror hygiene: deleteStageData clears the deleted stage's rows from the legacy roster mirror (best-effort), and the mirror table's docs now describe its actual access pattern (migration reads + deletion hygiene). - Registry persistence: the agent registry's persist snapshot partializes generated agents out of localStorage, making the stage document the roster's only durable home; the rehydration merge filter remains as defense in depth. - Ingress validation: imported manifest voice fields are structurally validated (malformed bindings dropped per field, the agent survives), and applyGeneratedAgentsToRegistry validates providerId against the known TTS provider registry instead of casting, treating unknown providers as "no bound voice". - Contract: drop the speculative AgentVoiceConfig.modelId — an audit of every roster producer, current and historical, found none that ever emitted it. Contract fields are added once a producer exists, not before. New tests cover the deletion tombstone at both the store and storage layers (including the missing-destination full-save pin and the lock-race re-check), the fruitless-probe memo, the selection-provenance matrix, persistence exclusion of generated agents, and voice-field sanitization on import. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(roster): close tombstone lifecycle, probe-memo, and selection-intent gaps Second hardening pass over the deletion/migration/selection fixes: - Tombstone lifecycle: a deleted classroom id can legitimately come back (deletion is client-side only). Explicit (re)creation points now lift the tombstone — server-copy restore in applyClassroomStageAndScenes and backup restore in importDatabase — so edits after a same-session restore persist again, while in-flight flushes stay fenced. - Failed deletion now restores the dirt it discarded: deleteStageData snapshots the pending map plus the in-flight round before tombstoning, and re-marks it when the delete fails with the document still present. - Legacy-mirror probe memo now distinguishes a FAILED read (null, retried on the next load) from a confirmed-empty mirror (memoized), so a transient IndexedDB error cannot suppress migration for the whole session. - Incremental save tail (currentScene KV row + chat sessions) is tombstone- fenced like the aggregate path, and both paths re-check the tombstone immediately before every write, with comments scoped honestly for the lock-free (no Web Locks) best-effort LWW fallback. - Roster-edit selection mirror: an empty intersection now falls back to the full roster and clears the user-set flag (matching restoreAgentSelection's length > 0 gate), and a user-set selection that equals the pre-edit full roster keeps tracking the roster wholesale so newcomers are not excluded forever by the AgentBar auto-toggle snapshot. - TTS/ASR provider lookups use Object.hasOwn instead of `in`/bare indexing, so prototype-chain keys ('toString', 'constructor', ...) no longer pass the provider whitelist or resolve to Object.prototype members. - Documented the per-tab limit of the tombstone set. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(roster): replace the boolean deletion tombstone with a deletion-generation model A boolean tombstone cannot express the deletion lifecycle once a deleted id legitimately comes back (server-copy restore on revisit, backup import): after the restore lifts the flag, a pre-delete flush still in flight is indistinguishable from a post-restore edit and can overwrite the restored document with pre-delete content. Two rounds of point fixes kept leaking variants of this race, so this restructures the fence instead. deleted-stages.ts now keeps a per-stage monotonic deletion epoch plus a deleted flag. markStageDeleted bumps the epoch; unmarkStageDeleted clears only the flag and never rewinds the epoch. Every persistence path captures the epoch at the moment it captures the data it will write (flush-round snapshot, departing-stage snapshot, aggregate save entry) and re-checks "captured epoch is current AND not deleted" immediately before each individual write. Invariants: - A write captured before a deletion can never land after it, even when a same-id restore has lifted the deleted flag (the captured epoch is permanently stale). - A write capturing data after a restore observes the current epoch and persists normally. - A failed deletion lifts only the flag; the restored pending changes are re-queued as descriptors, so their flush re-captures current store state under the current epoch and is neither dropped nor a stale replay. Also fixed in the same restructuring: - Incremental tail writes (currentScene, chats) each re-check independently; a delete landing while the first tail write is awaiting now fences the chat write instead of riding the earlier check. - Deleting a classroom evicts it from the warm in-memory store, and loadFromStorage treats a warm-but-deleted stage as not loaded (discarding the ghost), so navigating Back to a deleted classroom reaches the server-restore path instead of rendering an editable ghost whose every edit is silently dropped. - importDatabase records each document's pre-import deletion state and reinstates it when a failed import rolls the document back, so an outstanding flush cannot recreate the rolled-back document. - Docstrings on the failed-deletion restore path now state that only dirt captured before the deletion is restored; edits refused during the deletion window are not part of the snapshot. New tests cover the epoch invariants at the storage layer (pre-delete rounds dropped across restores on the incremental, aggregate, and tail paths; post-restore captures landing; strictly increasing epochs), the scheduler layer (departing-retry delete+restore straddle; restored dirt flushing under the current epoch), the warm-ghost restore driven through the real loadFromStorage, and the import lift/rollback pair. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deletion): report fenced drops, gate ghost eviction on cascade settlement Edge hardening around the deletion-epoch fence; the epoch model itself is unchanged. - An epoch-stale drop is now reported, not disguised: saveStageData / saveStageDataIncremental return a distinct 'stale-dropped' status (entry check, every in-mutation re-check, and both tail-write re-checks) instead of a shape identical to success. saveToStorage reacts by skipping all success bookkeeping - no chatSnapshot rebind to a snapshot that never landed, no pending-dirt clearing - and returns false, keeping its "true means verified write" contract honest. persistDirtySnapshot keeps its existing (correct) semantics explicitly: a drop has nothing to retry. - Warm-ghost eviction is settlement-gated: the deletion cascade records an in-flight bit (begun by deleteStageData, settled in its finally), and the deleted-warm branch of loadFromStorage keeps the warm state while the cascade is unsettled - a delete can still fail before removing the document, in which case the warm state plus the restored pending dirt is the only copy of the pre-delete edits. Once settled, the ghost discard and server-restore path behave as before. - Read-side landing re-check: loadFromStorage re-checks isStageDeleted after hydration, immediately before set(), mirroring the write-side "re-check immediately before landing" discipline - a lock-free mid-cascade read can no longer re-materialize a ghost classroom. - clearStoreForDeletedStage re-checks isStageDeleted at eviction time, so a same-id restore completing inside the cascade-tail window is never wiped. - capturedEpoch is now a required parameter on both storage entry points: the default (call-time capture) silently reopened the capture-point/ validation-point split for future callers; the type system now enforces the pairing. All production callers already passed it explicitly. New tests cover the dropped-status contract, the cascade in-flight lifecycle (including both failure shapes), keep-warm during an unsettled delete with end-to-end pending restore after a failed delete, settlement- then-eviction on success, the eviction guard against a tail-window restore, and the read-side hydration re-check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deletion): settle the deleted-warm load by awaiting the cascade outcome Hardening around the deletion settlement gate introduced previously; the epoch model is unchanged. - The deleted-warm branch of loadFromStorage no longer completes the load while the deletion cascade is undecided (which exposed a classroom whose edits were refused without being restorable, and left a successful deletion's eviction with no follow-up reload). It now parks on a per-stage settlement promise (stageDeletionSettled) and branches on the outcome: a failed delete keeps the warm, restored classroom; a successful delete falls through to a full cold load so the server-restore path recovers the route; a navigation that moved on during the park is stopped by the load token guard. The eviction (clearStoreForDeletedStage) deliberately stops claiming a new load token so the parked load stays current - ghost re-materialization is fenced by the read-side deleted re-checks instead. No deadlock: a parked load holds no document lock, and the cascade never waits on a load. - 'stale-dropped' now propagates through the debounced flush path: persistDirtySnapshot returns the sentinel instead of an empty failure set, and startFlushRound skips the chatSnapshot rebind on it (mirroring saveToStorage) - a falsely rebound baseline would let later chat saves no-op-skip chats that never landed and corrupt cross-tab conflict detection. Pending-map clearing keeps its empty-failure semantics (restored descriptors mint fresh revisions). - The cascade in-flight state is a counter (begin++/settle--) instead of a boolean, and deleteStageData is single-flight per stage (a concurrent second call joins the first cascade), so overlapping deletions can never expose an undecided cascade as settled. - The StaleDroppedSave docstring no longer overpromises: a tail saveCurrentScene can land after the cascade's clearCurrentScene; the orphaned cursor row is ignored by the load path rather than removed by the cascade. Net +8 tests: overlapping-cascade counting, settlement-promise resolution (success and failure), concurrent double-delete single-flight join, the parked mid-cascade Back in both outcomes plus the navigation-away guard, and the fenced flush round keeping an honest chat baseline end-to-end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deletion): re-verify store identity on keep-warm resume, re-run joined deletes after a mid-cascade restore Three hardening refinements on the deletion/persistence fencing: - loadFromStorage's parked keep-warm branch now mirrors the success path's store-identity guard: if a tokenless writer (e.g. a database import) replaced the stage during the park, a failed deletion falls through to the cold load instead of reporting another classroom as the kept warm state. The ghost-discard block is correspondingly gated on the deleted flag so the fall-through does not mislabel a surviving document as a ghost. - deleteStageData: a joined call carries its own deletion intent. When the first cascade fulfills but a same-id restore lifted the deleted flag in the meantime, the joined caller now runs one fresh cascade against the restored document instead of reporting the pre-restore outcome. Exactly one re-check per call (no recursion); a rejected first cascade still propagates unchanged to every joined caller. - Narrowed the failed-delete restore-ownership comments: the restore covers only the pending map plus an in-flight flush round's dirt; a departing-stage snapshot is outside that capture and is fenced and dropped by design. Comment-only, no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(roster): gate deleted-warm handling on stage identity, keep an explicit empty roster authoritative Final-audit fixes, three items: - loadFromStorage keyed its deleted-warm settlement handling (park / keep-warm / ghost discard) behind the scenes.length > 0 shortcut, so a zero-scene warm ghost of a deleted classroom skipped it entirely: the cold load found no document, the ghost stayed in the store, and the classroom loader's server-fallback gate (!getCurrentStage()) never ran — the silently-uneditable trap this branch exists to close, in its scene-less form. Deletion handling now keys on stage identity alone, before any scene-count shortcut; the non-deleted warm skip still requires scenes. - rosterNeedsLegacyFallback collapsed "roster field absent" (document predates roster persistence) with "explicitly persisted empty roster". A future writer persisting [] on a device whose read-only mirror still held stale rows would have its emptied roster resurrected on every load. The full-lift branch now triggers only when the field is absent (undefined); an explicit [] is authoritative and never probes the mirror. No current writer produces [], but the read side no longer depends on that invariant. - The GeneratedAgentConfig docstring claimed the voice fields are not a breaking change; that only holds for this codebase's tolerant structural validators. The generated stage.schema.json sets additionalProperties: false, so consumers pinning an older published schema artifact reject documents carrying the new fields. The docstring now states both sides honestly. Tests: a zero-scene deleted warm ghost is restored through the real loadFromStorage (fails pre-fix), an explicit empty roster does not resurrect stale mirror rows (fails pre-fix), and the rosterNeedsLegacyFallback unit matrix covers undefined vs []. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deletion): re-queue aggregate persistence when a failed deletion is recovered Direct aggregate saves (saveToStorage: generation completion, server-restore hydration) run outside the pending map and the flush round, so the deletion path's pre-delete dirt snapshot cannot describe them. When a deletion bumped the epoch while such a save was in flight, the save was correctly fenced ('stale-dropped') — but if the deletion then failed before removing the document, the recovery only re-queued the snapshotted scheduler descriptors. The fenced aggregate-only content stayed memory-only with no retry anywhere, and a later reload lost it. The failed-deletion restore now merges a full re-mark of the aggregate (structure / stage / outline / currentScene / chats plus a descriptor for every current scene) into the recovery set, still guarded on the store holding the stage. Because the flush recaptures the CURRENT store state under the CURRENT epoch, this necessarily carries whatever the fenced aggregate save held — and, for the same reason, edits refused by the scheduler during the deletion window, which previously stayed memory-only as well; the scope docstrings now say so instead of declaring them excluded. New integration coverage drives the real store scheduler and the real storage layer end to end: a genuinely fenced in-flight saveToStorage (generation completion) plus a pre-removal deletion failure ends with the completion flag durable on the next flush; a deletion-window scene edit survives the same way; and a successful deletion re-marks nothing (control). Both recovery tests fail against the previous restore logic. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> |
||
|
wyucandtejs1
|
f78f8599b4 |
feat(providers): add latest Claude, Gemini, Kimi, and Grok models (#993)
* feat(providers): add latest model catalog entries Co-authored-by: tejs1 <tejsrelax@gmail.com> * fix(ai): preserve reasoning settings across provider paths * fix(providers): define Grok output limits * fix(kimi): preserve reasoning across tool calls * fix(kimi): scope reasoning replay to K3 * fix(kimi): gate pi reasoning replay by model --------- Co-authored-by: tejs1 <tejsrelax@gmail.com> |
||
|
wyucand杨慎
|
28ea48bba9 |
fix(storage): omit undefined object fields at persistence boundaries (#992)
* fix: canonicalize optional persistence fields * fix: preserve document store method receivers * fix: support immutable document stores * fix: align persistence equality checks * test: reset document store wrappers * fix: normalize injected migration stores --------- Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> |
||
|
davidmedel
|
1466a55eef |
feat(i18n): add Spanish (Mexico) locale (#942)
Spanish is not among the supported locales, so browsers sending es/es-MX
fall through resolveLocale to the default (zh-CN) and Spanish-speaking
users get the UI in Chinese.
- lib/i18n/locales/es-MX.json: complete translation (1,504 keys), following
TRANSLATION_GUIDE.md including the design-intent notes (greetingWithName
as CTA, defaultNickname warm and gender-neutral, readyToLearn inviting).
- lib/i18n/locales.ts: register es-MX at the end of supportedLocales per the
guide, making it the default for the bare 'es' prefix.
Rebased onto current main and translated the 17 keys added since the branch
diverged (15 export.video* + chat.softClosing + roundtable.softClosing), per
@wyuc's review. Key parity and {{interpolation}} variables verified with
scripts/check-i18n-keys.mjs (passed: 9 locale files aligned).
|
||
|
wyuc
|
c923e50e4a | ci: retire the completed document-server-backend trunk from the PR whitelists (#981) | ||
|
wyucand杨慎
|
16dad613c9 |
fix(storage): bind default fetch to globalThis in both HTTP store clients (#984)
* fix(storage): bind default fetch to globalThis in both HTTP store clients Browsers require fetch to be invoked with this === globalThis; storing the global as an instance field and calling this.fetchImpl(...) throws 'Illegal invocation' on the very first request — while node's undici does not enforce the receiver, which is exactly why every node-side contract suite stayed green. Found by a downstream end-to-end test: the persistence bootstrap configured the HTTP stores correctly, but the first page load crashed on fetch and nothing ever reached PostgreSQL. A strict-receiver regression test now guards the gap node cannot catch natively. * fix(storage): validate the fetch option before binding it (review P2) .bind on a non-function throws a native TypeError that preempted the documented 'requires a fetch implementation' error; both constructors now validate the selected implementation first. --------- Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> |
||
|
|
be3d313bc3 |
feat(document): dirty-set incremental saves + operation-level flush (#983)
* feat(document): dirty-set incremental saves + operation-level flush + unload protection Every store mutation used to trigger a debounced FULL aggregate rewrite — editing one word rewrote the whole document, scene switches during playback rewrote it for nothing, and concurrent editors clobbered each other at document granularity. Mutations now mark precise dirt (scene:<id> / structure / stage / outline / currentScene / chats): scene edits flush as version-gated putScene, stage metadata as putStage, structure and outline changes keep the full-save path, and currentScene/chats no longer touch the document at all. Dirt entries are revisioned so a mutation landing during a write is never accidentally cleared, and failed writes retain their dirt for retry. flushStageSave() drains the debounce single-flight; agent apply operations await it so each AI edit is durable before its tool result returns; hidden-page/unload kick a best-effort immediate flush. The PendingChange type stays neutral about the change unit so a future operation-log backend can replace the flush internals at one seam. Co-authored-by: Codex <codex@openai.com> * fix(document): incremental-persistence review round — bypass-proofing, true drain, no stranded dirt Structural mutations carry the cursor they changed (and cursor resolution validates membership on load, so a stale device cursor can never resurrect a deleted scene). The Stage API now wraps the real store in a guard that diffs pre/post state and centrally classifies every raw write — whiteboard, element, canvas, and action-engine mutations can no longer bypass dirty tracking, and new API namespaces inherit the guard by construction (with a lint-like inventory test). flushStageSave is a bounded true drain: an awaiter whose mutation landed mid-flight loops until its own dirt is durable. setStage hands the old document's dirt to a departing flush instead of discarding it, and a failed flush always reschedules. Mixed dirty batches (scene+stage/outline) use the atomic full save — the incremental fast path is homogeneous-only. Chat-half failures keep the chats dirt for retry without changing the tolerated-split outer semantics. Co-authored-by: Codex <codex@openai.com> * fix(document): reviewer round — drain covers caller dirt, full-path chat retry, stamping unification flushStageSave's early-return now only fires when the failing round's snapshot actually covered the caller's dirt — an agent edit landing beside an in-flight failing round is written before the promise resolves, keeping the tool-result durability guarantee unconditional. The full-save path reports chat failures the same way the incremental path does (chats dirt survives and reschedules; the tolerated-split semantics are unchanged). The departing-stage flush retries once and its doc-comment states the best-effort semantics honestly. Stage and scene stamping are extracted and shared — fixing the incremental putScene branch silently dropping the order ?? index normalization the full path applies — and the dead outline mark in setGenerationComplete is gone. Co-authored-by: Codex <codex@openai.com> --------- Co-authored-by: Codex <codex@openai.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> |
||
|
wyucandCodex
|
e39c64cd9e |
feat(persistence): one-command server-backed stack (compose profile + embedded API + docs) (#982)
* feat(persistence): one-command server-backed stack — embedded API + compose postgres profile docker compose --profile server-persistence up --build runs exactly two containers: the app (persistence HTTP server embedded at /api/persistence, enabled only when DATABASE_URL is set — unset keeps today's browser-only behavior byte-for-byte) and PostgreSQL 16. Client bootstrap configures both storage seams against the same-origin route when NEXT_PUBLIC_PERSISTENCE=1, riding the existing lazy migrations so prior browser data reaches the server per-course on first open. Dev auth (bearer token + client-asserted learner header) lives in one overridable module and is loudly documented as development-grade. Verified end-to-end against the real stack: document PUT/GET and runtime session create land in Postgres; bad tokens 401. Co-authored-by: Codex <codex@openai.com> * fix(persistence): review round — structural bootstrap ordering, retryable init, honest failure surfaces The bootstrap side-effect import moves into the two storage seam entry modules, so any module graph that can resolve a store necessarily evaluates it first — no client-entry ordering luck, and the two configure calls are all-or-nothing. A failed server init clears its cached promise (next request retries instead of permanent 500s). listStages rethrows backend failures and the dashboard surfaces a persistence-unavailable error instead of rendering an empty list that reads as data loss. Docs state the build-time nature of NEXT_PUBLIC_PERSISTENCE, the real token boundary (any visitor can extract it and impersonate any learner — localhost/trusted-network only), and the correct postgres password rotation. Dev-token compare is timing-safe; the handler singleton lives on globalThis so HMR cannot leak pools. Co-authored-by: Codex <codex@openai.com> * fix(persistence): review response — no-confidentiality wording + adapter round-trip coverage The token docs now state plainly that the NEXT_PUBLIC token is compiled into the public bundle and provides no confidentiality or user isolation (its only role is keeping unrelated scanners off a trusted network). The Fetch/Node adapter — the route's most bug-prone code — gains a round-trip integration test: PUT body streaming, 201 with multi-value headers, 204 empty body, and encoded path segments reaching the handler un-decoded. --------- Co-authored-by: Codex <codex@openai.com> |