12 Commits

Include renames

Author	SHA1	Message	Date
4 people	f378c25a53	feat(storage): route settings/user-profile persist through KVStore (no legacy migration) (#1001) ... * feat(storage): route zustand persist through KVStore The settings and user-profile stores persisted through zustand's default `localStorage` storage, while the rest of the app's small keyed values had already moved to `@openmaic/storage`'s `KVStore` — two unrelated mechanisms over the same browser API, which is the split-brain the storage RFC set out to remove. `kvPersistStorage` shipped with the package but had no importer. Add `lib/store/kv-persist.ts`, the app seam that adapts a `KVStore` into a zustand `PersistStorage`, and wire both stores to it under an explicit `account` scope. Store logic is unchanged: `version` / `migrate` / `merge` still belong to the stores, only the bytes' destination moves. Existing installs are adopted rather than orphaned. On first read the seam moves the raw `localStorage` entry into the KV scope — write first, then drop the raw key, so an interrupted migration leaves the value readable from one side or the other but never from neither. Once KV holds the entry it is authoritative, so a stale raw entry reappearing cannot roll back newer state, and re-running can neither duplicate nor resurrect anything. An entry that is not a readable persist envelope is left exactly where it is. Hydration is now asynchronous, because a `KVStore` may be remote. The browser backend resolves within a few microtasks of the store module being evaluated, so nothing user-visible changes, but tests that assert on persisted state now await `persist.rehydrate()` instead of relying on a synchronous read. The four pre-persist keys (`llmModel` / `providersConfig` / `ttsModel` / `selectedAgentIds`) are deliberately untouched: they are read-only inputs to a migration that never owned them, and `providersConfig` is still read independently by `lib/ai/providers.ts`. Part of #857. * fix(storage): close the async-storage failure modes in the KV persist seam Cross-review found that routing `persist` through an asynchronous store opens failure modes a synchronous `localStorage` never had. Each one below is now covered by a test that fails without its fix. Data loss on a failed or empty hydration. A KV read that threw was indistinguishable from an empty scope, so the store stayed on defaults while an always-on initializer's `set()` persisted those defaults; the next load then read them as a completed migration and deleted the raw original, leaving nothing. Reads now separate "nothing there" from "the backend could not answer": a failed read serves the raw entry read-only, adopts nothing and deletes nothing, and leaves the key unwritable for the session so no un-hydrated state can be persisted over an original. Raw entries are additionally only dropped against a recorded completion marker, so a KV entry of unknown provenance can never authorize deleting the only copy of the user's data. Lost adoption across tabs. A reader whose KV read answered before another tab's adoption write, and whose localStorage read landed after that tab's delete, saw nothing in either place and hydrated defaults. Against a remote backend that interleaving is ordinary rather than rare, so an apparent "nothing anywhere" is now re-checked before it is believed. Out-of-order writes. Two rapid `setItem`s could complete in either order and let the older value win. Reads and writes are serialized per key. Pre-persist migration resurrecting on every load. `migrateFromOldStorage` was guarded by the existence of the raw `settings-storage` key — the very key the migration removes — so once the blob moved into the KVStore it ran on every load and republished whatever the pre-persist keys still held, including API keys the user had since deleted, into first-frame state. It is now the persist layer's last-resort source instead of a synchronous read in the store initializer: its result is adopted like any other migration, so the adopted entry is the marker that stops it. Initial state is plain defaults, and nothing stored reaches observable state before the storage layer has vouched for it. The source keys are still only read, never deleted, since `lib/ai/providers.ts` remains a reader. Also: KV reads and writes are guarded so a corrupt entry surfaces instead of throwing through zustand's silent catch; clearing the cache now clears the migrated stores through their own storage, which a server-backed scope would need and a blanket `localStorage.clear()` would only appear to do; `removeItem` drops the KV copy before the raw one; and the e2e suite gains post-migration steady-state coverage, which every existing spec missed by seeding the pre-cutover key. Part of #857. * fix(storage): scope migration bookkeeping to the device, gate writes on call Second review round. The findings shared one root cause: two of the three sentinels recorded a fact about *this machine's* files but were stored beside the data, in the store's own scope. Under a syncing `account` backend that is a category error with teeth — one device's history would travel to another and authorize deleting files it says nothing about. Sentinels are now always `device`-scoped and carry a reserved `__` prefix, whatever scope the store uses. The worst combination this closes: device A migrates, its marker syncs, device B — which has never run this build — loads and deletes the raw entry that is still the only copy of its own settings. A test drives exactly that sequence against two devices sharing one account scope and nothing else. The pre-persist fallback gains a device sentinel of its own. Its source keys are device-local and deliberately left in place, so "KV and raw are both empty" was not a safe trigger: clearing the account entry, from the cache button or a server-side wipe, let any device re-read those keys and republish credentials the user had rotated. It is now consulted at most once per device, and `removeItem` deliberately does not clear that sentinel — clearing the entry is precisely the case it exists for. The fallback also no longer writes the adoption marker: that marker is a licence to delete a raw persist entry, and the fallback has adopted no such thing. Were it written, a raw entry later restored by an older bundle would be deleted unread. The write gate is now read when `setItem` is called rather than when its queued turn arrives. Evaluated inside the queue, a write issued during hydration waited behind `getItem`, found the gate opened by the very read it raced, and persisted its pre-hydration snapshot on top of the stored value. Refused writes are no longer a dead end: the first one asks the store to rehydrate, since the backend may have recovered, and if that does not work the user is told through a durable notice rather than losing every change on reload. Each refusal is logged, not just the first — a once-per-session warning hides how long a session has been silently unsaved. `removeItem` now propagates backend failures, so clearing the cache cannot report success for a clear that did not happen, and that flow reloads immediately instead of leaving a window in which a background `set()` re-persists the credentials just deleted. Also: the recovery hook is bound after each store is constructed, because naming the store inside its own definition made its type circular and silently widened every selector to `any`; the `serial` comment no longer claims an unreachable rejection handler; and the pre-persist version stamp documents that it skips `migrate`'s unversioned normalization too, which `merge` redoes anyway. Part of #857. * refactor(storage): make the KV persist seam a per-key state machine Three review rounds kept turning up the same defect class in new places: a backend failure read as "there is nothing there", and the result of an operation that nobody looked at. Patching instances of it was not working, because both are possible whenever a call site is free to decide for itself what a failed operation meant. This makes that decision unavailable to call sites. Every backend call now returns an `Outcome` whose payload is a private field and whose only reader demands a `KeyState`. Feeding the machine is not a convention to remember; it is the only way to get the value out. What comes back is the value or `UNAVAILABLE` — deliberately not `null`, so "the backend could not answer" is not spellable as "nothing is there". The machine then decides, in one place, what failure means: any read failure is unavailability, any write failure closes the key, and either raises the health signal and asks for recovery. The scattered closure flags (a settled set, a warned set, a recovery latch) become one explicit phase per key — unhydrated, settled, unavailable, clearing — with the transition table written out in the docstring and a test per row. What that consumes: - A write failing after the key settled used to be ignored; its outcome now closes the key, signals, and the value is remembered for replay. - `removeItem` enters `clearing` synchronously at call time, so a `set()` racing a clear cannot be admitted, queue behind the delete, and write the just-deleted value back. Nothing is replayed across a clear. - The pre-persist sentinel is recorded by *every* settling path, not only the one that consults the old keys. A device that had only ever loaded an already-populated account entry recorded nothing, and so stayed eligible to republish its own stale credentials the moment that entry was cleared — which the docstring already claimed it would not. - Two places treated a failed read as an answer: the sentinel read that decides whether the fallback runs, and the confirming re-read before adopting. Both now stop. - An adoption whose marker did not land no longer settles, and never deletes the raw entry: no proof, no licence. - Refused and failed writes are remembered and replayed once storage recovers, but only when the store was holding real data at the time — replaying a snapshot taken over defaults would overwrite the stored value, which is the failure this seam exists to prevent. When a snapshot cannot be replayed the user is told, because rehydration is about to discard those edits. - Health notices publish on a later task, so a recovery that lands moments later cancels a warning nobody should have seen, and a subscriber mounting after the failure is caught up once its toast host exists. `StorageHealthNotice` now sits after the `Toaster` for the same reason. Also: adoption re-reads before committing so a concurrent write is not rolled back; a shadowed raw entry is only deleted if it parses, matching the promise never to delete bytes we could not read; the unavailable copy points at the control that resolves it rather than suggesting a reload that cannot; and the version pin, the pre-persist retention rationale, and the cache-clear comment say what is actually true. Part of #857. * fix(storage): separate the contexts settle() was conflating Convergence round on the state machine. The findings share a root: settle() treated every read that concluded as licence to open the key, without asking what else was true at the time. - A read finishing while a clear is outstanding no longer settles. Under a remote backend a recovery rehydrate in flight during a clear is ordinary, and opening the gate there admits a write that queues behind the pending delete and restores the credentials just removed. Only finishClear opens a cleared key. - The raw entry served read-only after a failed read no longer counts as the authoritative value. A shadowed raw entry is by construction the older copy — long-term coexistence with a newer KV value is a designed state — so an edit taken against it must never be replayed, or one transient read failure on one device rolls the whole account back. - A write that lands supersedes an earlier failed one. Both were admitted before the key closed, so the queue ordered them; replaying the older snapshot on recovery would undo the newer value. - Unreachable browser storage is a failure, not an empty store. Privacy modes make localStorage throw; treating that as "nothing stored" hydrated defaults, refused every write and said nothing until the user reloaded and found the work gone. SSR stays a silent no-op. - The recovery latch re-arms when storage answers, so the three recovery transitions are not empty promises from the second failure onward. - A refusal carries the phase it happened in. Cold-start timing — an always-on initializer writing before the first read resolves, on a backend that never failed — is a log line, not a sticky red toast; only a refusal under `unavailable` reports lost changes. The health channel stops delivering stale catch-ups: its timers are cancellable and re-read the current state when they fire, so a recovery cannot be overtaken by a warning with nothing left to dismiss it. And `changes-lost` is now a fait accompli rather than a condition — a later recovery has nothing to retract and leaves it standing. Also: a throwing `localStorage` is unavailability rather than absence wherever the raw entry is read; clearing records the pre-persist sentinel like every other settling path, making that docstring true; the raw entry is dropped before the marker so a failed marker clear leaves something inert; and the pre-persist fallback and its four source reads can no longer throw into zustand's silent catch. Part of #857. * fix(storage): hold a replay until it lands, and prove a raw copy before deleting it Three failure-path corners. A replay was retired the moment its write was attempted. Readable but not writable is a real state — a quota-exhausted backend answers reads perfectly — so a recovering read could succeed, the replay write fail, and the snapshot be gone with nothing owed: the next rehydrate served the older stored value over the user's edit and said nothing. The snapshot is now held until the write is durable; a failed replay goes back to being a refused write, so the next recovery tries again and a permanent failure is eventually reported. The adoption marker was treated as proof that a raw entry is the migration's leftover. It proves only that a migration happened on this device once. A rolled-back deployment, or a tab still running the old bundle, writes the raw key again with settings the migration never saw, and the next load on the new bundle deleted them unread. A raw entry is now dropped only when its content equals the value shadowing it — anything else is data, and keeping a copy beats deleting an original here as everywhere else in this file. `changes-lost` was being cancelled by a later recovery. The two statuses answer different questions: "storage is down" describes the world now and stops being true when storage works, while "your edits were lost" describes something that already happened and no amount of recovery undoes. They are now tracked on independent lines per key and rendered as two toasts with distinct ids, so retracting the fault cannot take the acknowledgement with it; the loss notice goes away only when the user closes it. Part of #857. * fix(storage): bound recovery, keep a live store from walking backwards Three interactions the state machine did not have an answer for. Recovery had no budget. A backend that reads but cannot write — a quota-exhausted one does exactly that — turned it into a treadmill: the recovering read succeeds, the key settles, the replay write fails, and that failure asks for recovery again, forever. Attempts now follow a backoff schedule whose length is the cap, and the budget is re-armed only on real progress: a settle that left nothing owed. A settle reached *by* a recovery with a replay still queued is not progress, and counting it as such is precisely what made every lap look like a fresh start. When the budget runs out the key is left read-only and the loss is reported, rather than retrying where nobody can see it failing. A failed read could walk a live store backwards. Once a session has loaded the authoritative value, a transient read failure was still falling back to the shadowed raw copy — which is legitimately older, and legitimately long-lived now that a differing raw entry is kept rather than deleted — and handing it to zustand overwrote a live store with stale data. Worse, the store had already latched "holding real data", so edits made on top of that stale value counted as replayable. A failed read after an authoritative one now returns nothing, which is exactly "keep what you have", and the raw fallback stays where it belongs: the case where nothing authoritative has been seen at all. Dismissing a lost-changes toast only closed the UI. The key stayed in the lost set, so the same store losing changes a second time was swallowed as a duplicate and any later subscriber resurrected a notice the user had already dealt with. The close button now clears the latch, so a second loss is reported and an acknowledged one stays gone. Part of #857. * fix(storage): close the last two provisional and clear-ordering gaps An abandoned migration was handing back an authoritative value. When the confirming re-read fails, or the adoption write does, `adopt` returns the raw envelope unadopted — the same footing as the raw copy served after any other failed read — but it was returned bare, so the store latched "holding real data" and an edit taken on top of it counted as replayable. Another device publishing to the account scope in that window would have been rolled back. `adopt` now reports provisionality like every other read path, and the shape is a named `LoadedValue` so the next path cannot forget. Clearing swallowed a failed raw-entry deletion. The account entry was already gone by then and the marker was cleared afterwards, so the operation reported success while leaving an empty scope beside a live raw entry — precisely the shape the next hydration re-adopts, handing back the settings the user had just deleted. The raw entry now goes first and its failure propagates, which also fixes the ordering: failing before anything is removed leaves the KV value authoritative and the clear simply unperformed, which the caller can retry. Adoption keeps the tolerant variant, where a leftover raw entry is a duplicate rather than a loss. Part of #857. * fix(storage): make the shadowed-raw delete atomic against a concurrent tab cosarah reproduced a data loss: both raw-entry deletes verified the value, then awaited (reading or writing the adoption marker), then removed the key by name. A tab running an old bundle — which takes no Web Lock, so a lock could not have helped — overwrites the raw key with newer settings during that await, and the unconditional `removeItem` then deletes the newer value. The raw side is synchronous `localStorage`, so the fix needs no lock. Both deletes now finish every await first, then run a single synchronous compare-and-delete: re-read the raw bytes, and remove only if they still equal the exact string that was verified. A competing tab is a separate context whose writes surface here only at event-loop boundaries, so its write lands wholly before the re-read (seen — bytes differ — kept) or after the remove, never in between. A changed value is newer data, not a migration leftover, and is kept. Both sites cosarah named are covered: the shadowed-cleanup path (`dropShadowedLegacy`) and the adoption cleanup in `adopt`. `readLegacyEntry` now carries the exact bytes alongside the parse so the re-check is byte-exact rather than comparing a re-serialized value. The clear path's delete is unchanged: it is a deliberate full delete, not a conditional leftover cleanup. Part of #857. * fix(storage): stop deleting the raw entry — adopt by copy (Plan B) Maintainer decision after cross-vendor + red-team review: `localStorage` has no cross-process atomic compare-and-delete (the storage mutex was dropped from the spec), so a tab on an old bundle can insert a write between our re-read and our removeItem in a genuinely parallel process. The synchronous compare-and-delete narrowed that window but could not close it — as its own comment admitted. Since the raw-cleanup cannot be done safely on localStorage while an old bundle may be live, this stops doing it. Adoption is now a copy: the value is written to KV and the raw entry is left in place. The delete race is therefore impossible — there is no delete. KV stays authoritative (once it holds the value, reads take the KV path and never consume the raw one), so the shadow duplicate is inert, left for a wholesale raw-cleanup at migration exit. Removed with the two deletes: - `dropShadowedLegacy` (its only job was the gated delete) and its three call sites. - `deleteLegacyIfUnchanged` and the `{raw,value}` shape of the legacy read (`readLegacyEntry` → back to `readLegacy` returning the value). - The adoption marker (`__persist-adopted:`), whose only reader was that delete gate. It did not prevent re-adoption — the presence of the KV value does — so removing it breaks no invariant. `dropRaw` / `expectedRaw` on `adopt` and the marker-clear step in the clear path go with it. The clear path (user deletes all data) still deletes the raw entry strictly — that is a deliberate full delete, not a migration cleanup. Tests: the delete/marker cases become "the raw shadow always survives, KV is authoritative"; a two-device and an old-bundle-concurrent-write case guard it, and re-adding a delete on either adoption path turns them red. Part of #857. * fix(storage): add a monotonic migrated marker to stop shadow resurrection Cross-vendor + red-team review independently caught a P1 the previous "adopt-as-copy" revision introduced. Because the raw entry is now kept and writes only ever reach KV, the raw copy becomes a frozen pre-cutover value. If the account KV is later emptied by something other than a local clear — a server-side wipe, an account switch, KV eviction — the next load saw `stored === null` beside a live raw entry and re-adopted that stale copy, refilling the wiped account with ancient settings/credentials and syncing them to every device. Deterministic, not a race; it would fire once a server-backed account backend exists. Root cause: "keep the raw entry" inherently requires a record that it has already been migrated, so an empty-KV load can tell "first migration" from "external wipe". Removing the old delete-authorization marker in the copy revision dropped that record — Plan B was only half done. Adds a monotonic, device-scoped `__migrated:<name>` marker: - Read on every load. `stored === null` + raw present + marker set ⇒ respect the wipe, do not adopt (fall through to the confirm re-read, so a concurrent repopulation is still served). Only a genuine first migration (no marker, raw present) adopts. - Written best-effort after a successful KV write. A failed write degrades to the KV value's own presence check, so resurrection needs both a failed marker write and a later external wipe. - Read failure fails closed (do not adopt), never "assume not migrated". - Monotonic: only ever set true, cleared only by a deliberate full clear — no compare-and-delete race, which is why it is safe where deleting the raw entry was not. Live state with a real reader, not the delete-authorization marker removed earlier. The clear path clears the marker too (back to a genuine first-load state); best-effort, since with the raw entry already gone a leftover marker is inert. Tests: resurrection guard (external wipe does not re-adopt; concurrent post-wipe write is served; first migration records the marker; marker read fails closed) + the clear-path marker clearing. Mutation-checked: removing the gate resurrects the shadow, dropping the record leaves it unguarded. P3: the inert `__persist-adopted:` test rot is retargeted to the real `__migrated:` path. Part of #857. * refactor(storage): remove automatic legacy migration — pure KV wiring Maintainer decision (terminal): after repeated review rounds kept finding new P1s in the legacy-adoption path — its state space is too large to keep correct — the PR is narrowed from "migrate + wire" to "wire only". Settings and user-profile persist through the KVStore; pre-cutover data is not migrated; an upgrading user reconfigures once (the data is reconstructable and the cost is one-time). Removed the entire legacy-adoption subsystem from the adapter: - `adopt()`, `readLegacy()`, the `legacyStorage` dep, and the raw-fallback read on a failed KV read. - The `__migrated:` marker and its resurrection guard, the confirm-re-read, and the `provisional`/`LoadedValue` machinery. - The `prePersistFallback` dep, `recordPrePersistHandled`, the `__pre-persist-consulted:` sentinel, and `readSentinel`/`writeSentinel`. - In settings.ts, `readPrePersistSettings` (the llmModel/providersConfig reader wired as that fallback) — reading legacy keys is migration, which this PR no longer does. `lib/ai/providers.ts` still reads `providersConfig` independently, so those source keys are left in place. The adapter now reads and writes the KV scope and touches no legacy key: an empty scope hydrates the store to defaults (ordinary zustand). `load()` is a single KV read; a failed read stays unsettled so defaults are never persisted over an unread value; the clear path removes only the KV entry. Kept, because they are async-storage *steady state* a remote KV backend needs, not migration scaffolding: the KeyState machine (hydration gate, write gate, recovery, replay), the Outcome discipline, per-key serialization, and the persist-health channel. Added `purgeLegacyPersistKey`: a best-effort, fire-and-forget removal of the old raw persist blob, called once by each store. Never read, so a leftover is pure garbage — and the old settings blob held plaintext provider API keys, so clearing it is a small security win. Net: the adapter drops ~460 lines. Tests are rewritten to steady-state KV coverage plus an explicit "old raw key is ignored, not migrated" proof at the store level; the e2e seed fixtures move from the raw key to the KV scope key. Part of #857. * docs(storage): align README and comments with the no-migration behavior Follow-up requested on the approved PR: the migration/adoption logic was removed, but a few comments and one README roadmap line still referred to those deleted concepts. Documentation only — no behaviour change. - README roadmap: the settings/user-profile line said "adopting their pre-cutover raw keys"; it now states there is no automatic migration (legacy keys ignored and best-effort purged, users reconfigure once). - kv-persist.ts: the per-key serial chain comment no longer claims to keep "adoption" from interleaving; it serializes a key's read/write/clear. - settings.ts: `SETTINGS_PERSIST_VERSION` no longer documents a "pre-persist fallback" that no longer exists. - Test/fixture headers that described seeding "the pre-cutover raw key" for "one-time adoption" now describe seeding the KV `account` scope, with no legacy-key migration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(storage): bump version to 0.1.1 for README doc alignment The README is a publishable input, and the no-migration doc alignment changed it, so the package version must increase. Patch bump: documentation only, no code or API change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: wyuc <zdq1204@gmail.com>	2026-07-30 15:12:51 +08:00
sophietao20-star	0cf2a33041	docs: refresh and synchronize documentation (#996) ... Refresh the Chinese documentation against current functionality, synchronize all localized guides, document deployment and configuration behavior, and align the PPTX import feature flag implementation.	2026-07-27 22:45:15 -04:00
LING DUAN	61a7154f07	feat(pi): add evidence-aware Director context runtime (#971) ... * feat(pi): add evidence-aware Director context runtime * fix(web-search): require completed native search * fix(orchestration): preserve whiteboard across agent handoffs * fix(pi): remove wrap-up turn bypass	2026-07-27 11:38:41 -04:00
xuyuanwei678andwyuc	ff95e6683d	feat(renderer): add optional playback canvas (#958) ... * feat(renderer): add optional playback canvas * style(renderer): format playback tests * fix(renderer): center text by default * fix(renderer): address playback review feedback * docs(renderer): align playback canvas API docs --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-27 04:15:07 -04:00
4 people	bb8d4f30e7	feat(chat): add experimental Pi classroom runtime behind a flag (#914) ... * feat(chat): add experimental Pi classroom runtime * fix(chat): harden Pi whiteboard action sequencing * style(chat): format session retirement flow * style(playback): format async scene transition * fix(chat): retire actions on session errors * fix(chat): close Pi runtime lifecycle gaps * fix(chat): avoid replaying historical whiteboard actions * fix(chat): prevent Pi structured-output residue from leaking and inflating turns Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(chat): expose whiteboard element/line ids and bound code-line context Surface each element's id (and code line ids) in the Pi whiteboard context so later child agents can target wb_delete / wb_edit_code, and cap the rendered code lines with a shared character budget so a code-heavy board cannot grow the prompt without bound. Return only the current turn's whiteboard ledger from the Pi director loop instead of carrying history forward across requests. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(chat): bound Pi whiteboard code context Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(chat): prioritize newer persisted whiteboard code in budget Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(chat): enforce whiteboard boundaries across Pi sessions * feat(chat): refine soft-closing discussion controls * fix(chat): make whiteboard clearing model-directed --------- Co-authored-by: apple <apple@GigideMacBook-Air.local> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: LING-6150 <duan.lin@northeastern.edu>	2026-07-17 11:22:02 +08:00
3 people	d8a0081c7d	feat(video-export): L1 Hyperframes emitter + browser collection + export ZIP (#865) (#931) ... * feat(video-export): L1 Hyperframes emitter + browser collection + export ZIP (#865) Consume the VideoTimeline IR (#864/#913) and produce a self-contained Hyperframes composition project that `npx hyperframes render` turns into an MP4 (render execution itself is #866). - lib/video-export/emit-hyperframes: pure IR → Hyperframes project emitter (one flat composition, one paused GSAP timeline on window.__timelines, spotlight/laser overlays from lib/choreography descriptors). Stays under the purity boundary; emits HTML/JS strings only. - lib/video-export/subtitles: SRT/VTT serialization of the IR subtitle track. - lib/video-export-app: impure app glue (DI adapters over Dexie, slide-snapshot collection lifted from #849, streaming ZIP packaging, useExportVideo hook). - Vendor GSAP locally (public/vendor/gsap.min.js) — determinism red-line. - Export menu entry with resolution select + i18n across all 8 locales. Verified end-to-end against the real hyperframes CLI: lint passes 0 errors on a real classroom export, and a rendered slice produces a valid H.264+AAC MP4. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(video-export): gate Export Video menu behind NEXT_PUBLIC_ENABLE_VIDEO_EXPORT flag The video export UI is experimental until the render pipeline (#866) lands, so hide the "Export Video" affordance behind an off-by-default feature flag. - Add isVideoExportEnabled() to lib/config/feature-flags (NEXT_PUBLIC_, so it inlines at build time for the client-side export menu). - Gate the Export Video block in header-controls on the flag. - Cover the new flag in tests/config/feature-flags.test.ts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): ossKey fallback for evicted blobs + emitter dedup Address code-review findings on #931. - collect: resolveBytes() prefers the local Dexie blob and falls back to the record's CDN ossKey (audio) / ossKey+posterOssKey (media/poster) so a live-mode classroom whose local blobs were LRU-evicted still exports a self-contained ZIP. timeline-deps presence checks widened to `blob.size > 0 || !!ossKey` so the compiler keeps these entries instead of marking them absent; video-duration probe stays local-only. - emit-hyperframes: extract one shared escapeHtml + sec into format.ts, dropping the two divergent escapers (attr vs escapeHtml) and the two sec() definitions with different rounding, plus the middle-man escapeAttr. Output is byte-identical (snapshot unchanged). - Add tests/video-export/collect.test.ts (ossKey fallback, local-first, fetch 404/throw, video+poster). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(video-export): restore evicted generated media into base-frame snapshots Address review blocker (P1) on #931: the ossKey fallback covered standalone audio/video/image/poster asset entries but not the slide base-frame path. resolveGeneratedMedia only accepted a non-empty local blob, so a live-mode record with an evicted blob + valid ossKey had its image src cleared (and video/poster not restored) before slideToPng snapshotted the slide — the frame PNG lost the generated media even though the standalone asset was fetched. - resolveGeneratedMedia now resolves bytes via resolveBytes (local blob first, then ossKey / posterOssKey) before creating the snapshot object URLs. - Add frame-collection tests: evicted image restored via ossKey, evicted video+poster restored, and image with no ossKey still cleared. The renderer snapshot is mocked so the frame path runs in plain Node. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-15 18:22:59 +08:00
wyucand杨慎	c8a638a101	feat: support GPT-5.6 model family (#907) ... * feat: support GPT-5.6 model family * test: cover GPT-5.6 SDK validation * fix: canonicalize GPT-5.6 Sol alias * fix: complete GPT-5.6 alias lookups --------- Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>	2026-07-13 18:19:40 +08:00
Yanpeng Wang	d54e62f5c4	feat(token-plan): one-click token-plan setup + deployment usage dashboard (#784) ... * feat(usage): add usage normalization, pricing, model-fetch, balance, storage Foundational layer for token-plan usage tracking (cc-switch-modeled): - lib/usage/normalize.ts: AI SDK v6 usage → four-class token shape - lib/usage/pricing.ts + defaults: per-class USD pricing table - lib/server/model-fetch.ts: /models candidate-URL multi-fallback (ported) - lib/usage/balance-providers.ts: built-in balance queries + detection - lib/server/usage-storage.ts: fire-and-forget jsonl logging to data/usage All pure/storage logic covered by vitest (32 tests). * feat(usage): capture token usage at the callLLM/streamLLM chokepoint - callLLM records result.usage before returning - streamLLM wraps onFinish to record totalUsage on stream completion, preserving any caller-supplied onFinish - provider/model derived from the model instance (no route changes) - fs-backed storage imported dynamically; fire-and-forget, never throws - include_usage is already sent by @ai-sdk/openai, so streaming is covered * feat(usage): add probe-models, balance, and usage API routes - POST /api/provider/probe-models: discover chat models via /models with candidate fallback; SSRF-guarded; filters non-chat ids; 401/404 typed - POST /api/provider/balance: built-in balance detection + billing fallback - GET /api/usage: aggregate jsonl by model/day/source with costIncomplete flag Verified e2e against the live MAIC gateway: 16 chat models (6 filtered), balance detected, and a real callLLM writes a costed usage row. * feat(settings): add token-plan preset picker to provider dialog - lib/config/token-plan-presets.ts: data-driven vendor presets (Huawei/MiniMax/ Xiaomi token plans, OpenRouter/SiliconFlow gateways, DeepSeek/GLM/Qwen/Hunyuan/ Doubao direct) with baseURL, protocol, optional modelsUrl, category - add-provider-dialog: '选择厂商/自定义' tabs; picking a preset auto-fills baseURL+protocol+modelsUrl, custom tab unchanged - ProviderSettings.modelsUrl carries the optional /models override - i18n keys added across all 8 locales Verified in-browser: preset picker renders grouped by category. * feat(settings): add Fetch Models button and balance bar to provider panel - 拉取模型: probes /models, merges discovered ids into the model list (dedupe, keeps manual additions), with success/no-endpoint/auth messages - 查询余额: queries /api/provider/balance, renders a balance bar or a 'check console' hint when unsupported - index.tsx: handleModelsFetched merges probe results into provider config - i18n keys across all 8 locales; removed a now-unused eslint-disable Verified in-browser against MAIC gateway: 16 models fetched, balance shown. * feat(settings): add usage dashboard to System Settings - usage-dashboard.tsx: echarts dual-axis daily trend (tokens + cost), totals cards, by-model table, refresh; reads GET /api/usage - mounted at the top of GeneralSettings (系统设置) - honest disclaimer + costIncomplete marker when a model lacks pricing - i18n keys across all 8 locales Verified in-browser: shows 1 request / 31 tokens / $0.0003 from a prior call. * feat(token-plan): multi-modal one-click setup in System Settings - token-plan-presets.ts: presets now declare per-modality targets (llm/image/video/tts/webSearch); MiniMax is the full-set template, others LLM-only — extend by adding entries (at-our-best adaptation) - apply-token-plan.ts: fills one key into every declared modality via injected store setters, isolating per-modality failures (TDD, 4 tests) - token-plan-settings.tsx: new sidebar page — pick plan, enter key, one-click apply lights up adapted modalities (+LLM model probe), shows 'not adapted yet' for the rest, balance bar reused - reverted add-provider dialog to plain custom form (preset picker moved here) - i18n across all 8 locales Verified in-browser: Token Plan page renders, MiniMax shows all 5 modalities, apply/balance UI wired. 859 tests pass, build clean. * feat(token-plan): add custom token plan entry to Token Plan page - Custom card at the bottom of the provider list: pick it to manually enter name + protocol + baseURL (LLM-only), then key + one-click apply via the same applyTokenPlan flow (mirrors cc-switch's custom provider) - effectivePreset unifies preset vs custom for apply/balance/probe - i18n keys (customGroup/customName/customHint) across all 8 locales Verified in-browser: custom card expands the manual form; preset flow intact. * feat(token-plan): reflect persisted config on the Token Plan page Other settings panels read the store directly, so they survive section switches; the Token Plan page only wrote the store, so it looked blank on return. Now it also reads providersConfig: - selecting a preset prefills its saved API key - configured presets show a '已配置/Configured' badge State persistence was never broken (apply writes zustand→localStorage); this fixes the missing read-back so the page reflects it. * fix(settings): isLLMProviderConfigured crashed on providers without models Root cause of 'token plan config disappears': applyTokenPlan writes a new LLM provider with no models yet (probe fills them later). isLLMProviderConfigured did config.models.length unguarded → threw inside setProviderConfig's resolver → the whole set() aborted → key/baseUrl/type never persisted. - guard models in isLLMProviderConfigured (shared validator; affects any provider written without a models array) - seed models:[] in applyTokenPlan's LLM write for a valid initial shape - regression tests: validator no longer throws; apply+probe write keeps apiKey Verified in-browser: DeepSeek persists key and shows 已配置 after section switch. * feat(token-plan): add remove/teardown for a configured token plan Apply had no inverse. Add removeTokenPlan: clears the API key and disables (enabled:false) every modality the plan declared; a custom LLM provider is deleted entirely (removeProvider), built-ins keep the cleared shape. - removeTokenPlan in apply-token-plan.ts (mirrors applyTokenPlan, isolated per-modality, injected setters; 3 tests) - trash button on configured preset cards in the Token Plan page; resets page state if the removed plan was selected - i18n 'remove' across all 8 locales Verified in-browser: removing DeepSeek empties its key and drops the 已配置 badge. * feat(usage): track multimodal usage, drop cost/pricing Reframe usage stats as pure usage (no cost), per user decision: - usage-storage: drop all cost fields; add kind (llm/image/video/tts/asr) + quantity + unit; LLM keeps token counts, others store quantity - delete lib/usage/pricing.ts + pricing-defaults.json + its test - instrument image/video/tts at the server-only API routes (not in the provider dispatch — those files are in the client graph and importing fs-backed usage-storage broke the client bundle) - /api/usage: aggregate by model/day/modality, no cost - dashboard: per-modality usage (tokens/images/seconds/chars), token-only daily trend, no '$'; i18n cost keys replaced with modality/unit keys - backward compatible: legacy rows (no kind, stray cost fields) read as llm 912 tests pass, build clean. * feat(usage): per-modality dashboard layout + softer dark-mode chart - group usage into per-modality sections (LLM/image/video/tts/asr), each table's usage column uses one consistent unit (token/image/sec/char) — no more mixed units in a single column - summary chips per modality with their own unit - trend chart now plots daily REQUESTS (unit-agnostic, works for any modality) instead of LLM-only tokens - theme-aware chart: faint thin line + soft gradient area, muted axis/grid colors via useTheme — fixes the harsh solid stroke in dark mode Verified in-browser (dark): TTS shows '字符', LLM shows 'Token', separate sections; chart no longer has a hard line. * refactor(usage): dedupe model/fetch/usage helpers, parallel balance probe Review cleanups on the token-plan/usage branch: - extract modelInfoFromId() (shared vision heuristic + ModelInfo shape) - extract fetchWithTimeout() shared by model-fetch and balance-providers - extract recordGenerationUsage() to dedupe the image/tts/video routes - queryBalance: fetch billing subscription + usage in parallel - parseOneApiBilling: report quota without remaining when usage endpoint is unavailable, instead of implying zero spend (full balance) - split the two jammed imports in settings/index.tsx * feat(token-plan): drop custom token-plan support Custom token plans (manual baseURL/protocol entry) added complexity for little gain — a one-off provider is better configured directly on the Providers page. Token Plan is now preset-only: - remove custom mode, manual fields, and the custom card from the UI - collapse effectivePreset back to the selected preset - drop the now-dead removeProvider action + custom-id branch in removeTokenPlan - remove orphaned customGroup/customName/customHint i18n keys (8 locales) * feat(token-plan): add Volcengine/Tencent/Bailian plans, drop balance feature Add three vendor token-plan presets (all map to existing built-in LLM providers, so it's data-only — no new adapters): - 火山方舟 Volcengine Ark → doubao, OpenAI /api/v3 - 腾讯 TokenHub Token Plan → tencent-hunyuan, OpenAI /plan/v3 (the plan-specific base; /v1 is the pay-as-you-go gateway) - 阿里百炼 Token Plan → qwen, cross-model plan (Qwen + DeepSeek/Kimi/ GLM/MiniMax) on one key; model list is probed/entered Remove the balance/quota feature entirely — we now track usage, not cost, and every vendor's balance query needs its own cloud AK/SK + signature (Volcengine SigV4 / Tencent TC3 / Aliyun BSS), which the Bearer-key billing-endpoint probe never supported anyway: - delete lib/usage/balance-providers.ts, /api/provider/balance, its test - strip the Check Balance button + balance bar from the token-plan page and the provider config panel - remove the 4 balance i18n keys across all 8 locales - restore an eslint-disable the branch had dropped in provider-config-panel * feat(token-plan): use cloud-brand logos for vendor token plans The three vendor plans are cloud offerings, not single-model products, so icon them with the cloud brand rather than a model logo: - 火山方舟 → volcengine.svg (was doubao.svg) - 腾讯 TokenHub → tencentcloud.svg (was hunyuan.svg) - 阿里百炼 → alibabacloud.svg (was bailian.svg) Logos are the colored brand variants from lobehub/lobe-icons, matching the existing colored-logo style (plain <img>, no dark:invert needed). * feat(token-plan): keep only MiniMax and Volcengine presets Trim the token-plan list to the two we want to ship: MiniMax (full-set template) and 火山方舟 Volcengine Ark. Drop the Tencent/Bailian plans and the OpenRouter/SiliconFlow/DeepSeek/GLM/Qwen entries. - remove the now-unused tencentcloud.svg / alibabacloud.svg logos (volcengine.svg stays; the other logos are still used by the provider registry) - retarget the LLM-only apply test from the deleted deepseek preset to volcengine-ark * feat(token-plan): restore aggregator/third-party presets Previous commit over-trimmed: the intent was to drop only the Tencent and Bailian token plans, not the OpenRouter/SiliconFlow/DeepSeek/GLM/Qwen entries. Bring those back; keep only Tencent/Bailian removed. - token_plan: MiniMax, 火山方舟 Volcengine Ark - aggregator: OpenRouter, SiliconFlow - third_party: DeepSeek, GLM, Qwen Revert the apply test back to the deepseek fixture (restored). tencentcloud.svg / alibabacloud.svg stay deleted (their plans are gone). * fix(token-plan): point Volcengine plan at the Coding Plan endpoint The plan's ark--prefixed API keys authenticate only against /api/coding/v3, not the general /api/v3 endpoint — the latter rejects them with "The API key format is incorrect", so model probing returned nothing. Switch the base URL to https://ark.cn-beijing.volces.com/api/coding/v3. * fix(token-plan): Volcengine is an Agent Plan (Anthropic /api/plan) Per the Ark Agent Plan docs, the ark--prefixed keys authenticate ONLY against the dedicated Anthropic-compatible base https://ark.cn-beijing. volces.com/api/plan ("其他 Base URL 无法在 Agent Plan 中使用"). The general /api/v3 and the Coding Plan /api/coding endpoints both reject the key as "API key format is incorrect", which is why model probing kept returning 0. - baseUrl → https://ark.cn-beijing.volces.com/api/plan/v1 (the /v1 lets the Anthropic SDK land on /api/plan/v1/messages) - apiFormat → anthropic - rename to 火山方舟 Agent Plan Probe still targets /api/plan/v1/models (the path exists); if the Anthropic gateway doesn't return an OpenAI-shaped list, users fall back to typing a model id like ark-code-latest. * fix(token-plan): Volcengine Agent Plan = OpenAI /api/plan/v3 + ark-code-latest Settled after probing the real key and reading cc-switch's approach: - The ark- plan key works on the OpenAI-compatible /api/plan/v3 endpoint (chat/completions returns 200); switch apiFormat back to openai. - The plan exposes NO /models list (every /api/plan/*/models is 404), which is why probing kept returning 0. cc-switch handles this by hardcoding a single ark-code-latest (an auto-routing alias valid on any tier) and does NOT use AK/SK for model listing — so we do the same. - Seed defaultModels: ['ark-code-latest'] only; users add specific ids by hand. Supporting machinery (kept, general-purpose): - applyTokenPlan seeds models from defaultModels instead of wiping to [] - handleApply uses defaultModels and skips the doomed probe when present - drop stray .playwright-mcp/ debug artifacts and gitignore them * style: fix prettier formatting in usage files CI runs prettier on the whole repo (prettier . --check); these four files predate this branch's formatting pass and tripped the check. * feat(token-plan): verify Volcengine Agent Plan's published model set The Agent Plan publishes a fixed model set but exposes no /models endpoint, so carry the documented models as CANDIDATES and verify each on apply: - add verifyModels flag to TokenPlanModalityTarget - new /api/provider/probe-chat-models route: sends a minimal chat request per candidate (OpenAI /chat/completions or Anthropic /messages) in parallel, returns the subset that succeeds; SSRF-guarded, auth-failure short-circuits - handleApply gains a verify branch (before the fixed-defaultModels fast path), falling back to the seeded list if verification fails - Volcengine preset now carries the 12 published Agent Plan text models (doubao-seed-2.0-*/deepseek-v4-*/minimax-m*/glm-5.2/kimi-k2.*) as candidates This auto-prunes retired (docs flag deepseek-v3.2/glm-5.1 as 即将下线) and tier-gated models without code changes. Verified all 12 resolve against a real plan key. * feat(token-plan): wire Volcengine Agent Plan image + video modalities Make the Ark seedream/seedance adapters path-configurable and light up the image/video modalities on the Volcengine plan: - seedream/seedance adapters: resolveArkRoot() uses baseUrl verbatim when it already carries an /api/... path (token plan's /api/plan/v3), else appends the standard /api/v3 — no regression for the pay-as-you-go default host. - applyTokenPlan: image/video branches inject a modality's defaultModels as customModels and set them as the active provider+model, so generation works out of the box. New optional setImageProvider/ModelId + setVideoProvider/ ModelId actions (UI passes the store setters; tests omit them). - Volcengine preset declares image (doubao-seedream-5.0-lite, verified 200 on /api/plan/v3/images/generations) and video (doubao-seedance-2.0/1.5-pro — Medium+ tiers only; lower tiers reject at call time, no code change needed to upgrade). Applying the plan overwrites the shared seedream/seedance slot with the plan config (same overwrite model as LLM); switching back to pay-as-you-go is a manual edit or plan removal. Verified image end-to-end with a real plan key. * feat(token-plan): verify image/video models on apply, disable unsupported tiers The Volcengine plan lit up video optimistically, but lower tiers (Small) don't include video — so using it 404'd with UnsupportedModel. Probe media models on apply and only keep what the tier actually supports: - generalize /api/provider/probe-chat-models with a `kind` (chat|image|video): image hits /images/generations, video hits /contents/generations/tasks with empty content. The model-support check (404 UnsupportedModel) runs before any billable work, so probing never starts a real image/video job; for media, "supported" = any non-404 response. - handleApply: after lighting up image/video, probe each verifyModels modality; prune to the verified model set + re-select a working model, or disable the modality entirely if none pass (no false "available"). - Volcengine preset: image/video targets gain verifyModels: true. - add settings.tokenPlan.tierUnsupported across 8 locales. Verified with a real Small-tier key: image (seedream-5.0-lite) passes and is kept; video (seedance-2.0/1.5-pro) 404s and is disabled. * feat(web-search): add Doubao (豆包搜索) provider Doubao Search (Custom 版) over its REST endpoint POST open.feedcoopapi.com/search_api/web_search with Bearer auth — the same endpoint the askecho-search-infinity MCP server wraps, so the Volcengine Agent Plan key authenticates directly. Mirrors the MiniMax adapter: maps Result.WebResults to WebSearchSource (prefers Summary, the query-relevant excerpt, over Snippet for LLM use) and surfaces errors from ResponseMetadata.Error. - register 'doubao' in WebSearchProviderId + WEB_SEARCH_PROVIDERS - searchWithDoubao adapter, searchWeb dispatch, store default config - SSRF allowlist entry for the search host * feat(audio): support Agent Plan single-key auth for Doubao TTS generateDoubaoTTS now picks auth + endpoint from the key shape, since Volcengine exposes Seed-TTS as two products with separate credentials (verified: a plan key 401s on the normal endpoint, and the plan endpoint rejects appId-style auth): - single key (no colon) -> X-Api-Key, for the Agent Plan /plan endpoint - appId:accessKey -> X-Api-App-Id + X-Api-Access-Key (unchanged) A malformed pair (empty half) fails clearly instead of sending an empty header. Reuses the existing NDJSON/base64-mp3 parsing and voice list. * fix(media): map MiniMax video 720p to its real 768P tier normalizeVideoOptions defaults minimax-video to '720p' (the first supported resolution), but Hailuo 2.3 only accepts 768P/1080P and rejects 720P with '2013 ... does not support resolution 720P'. MiniMax's mid tier is 768P, not 720P (the adapter already falls back to 768P, as does the connectivity test), so map the shared enum's '720p' to 768P. Regression tests lock the mapping. * feat(token-plan): add web search + TTS to Volcengine Agent Plan, widen image tiers Extend the volcengine-ark preset now that the adapters exist: - webSearch -> doubao (own host open.feedcoopapi.com, not the ark endpoint) - tts -> doubao-tts on the /api/plan/tts endpoint (single-key auth) - image defaultModels widened to a best-first Seedream 5.0/4.5/4.0 list so a higher tier keeps the strongest model while verifyModels prunes the rest; video keeps the 2.0 + 1.5-pro candidates Comments record the verified host/auth quirks of each modality. * feat(token-plan): show result panel only after probing, with two clear states Addresses review feedback that a green check implied generation works when it only meant 'configured'. The panel now renders after probing finishes (gated on results && !applying) so it reflects the final set, and uses two states: green when the modality is configured/usable, muted when a live probe proved it unavailable (e.g. video on a tier without it). * feat(token-plan): scope presets to true multi-modal token plans Drop the single-modality LLM presets (OpenRouter, SiliconFlow, DeepSeek, GLM, Qwen) from Token Plan. A token plan's defining trait is one key spanning many modalities; those entries are ordinary LLM API providers already covered by the add-provider flow, and listing them here muddied the 'one key, every modality' promise. Only MiniMax and the Volcengine Ark Agent Plan remain. The UI already hides categories with no entries. apply-token-plan's LLM-only test now uses a local fixture instead of the removed deepseek preset. * feat(token-plan): progressive reveal of probe results on apply The result panel previously rendered all at once after probing finished, reading as dead air during the model probe. Now rows appear immediately on Apply: modalities with a live probe in flight show a spinner ('pending') and resolve to lit/failed independently as each probe returns, while non-probe modalities show lit right away. Probes run in parallel (Promise.all) instead of sequentially. A row only turns green once its own probe confirms, so this reveals structure + live progress without a premature green — complementing the earlier 'render only after probing' intent rather than reverting it. Per review feedback from @wyuc on #784. * fix(token-plan): enrich seeded models with built-in thinking capability Token Plan built ModelInfo objects from probed ids via modelInfoFromId(), filling only streaming/tools/vision — so a model that supports configurable thinking lost capabilities.thinking and InlineThinkingControl was hidden. modelInfoFromId now takes an optional providerId and overlays the catalog thinking capability for that (provider, model) pair; applyTokenPlan does the same for its synchronously-seeded list. Added the Ark Agent Plan's dotted aliases to the metadata table: - native Doubao Seed 2.0 family (doubao-seed-2.0-pro/code/lite/mini) - cross-vendor models the plan serves through its OpenAI-compatible endpoint (deepseek-v4-pro/flash, glm-5.2, kimi-k2.7-code/k2.6, minimax-m3/m2.7, ark-code-latest) All verified against a live plan key: each accepts the gateway's unified reasoning_effort field (low/medium/high) and actually reasons. They share the doubao effort adapter, which disables via 'minimal' (not 'none') — matching what the plan endpoint accepts (it rejects reasoning_effort:'none'). Addresses review point #1 from @wyuc on #784. * Improve token plan capability setup UI * fix token plan setup flow * chore: prettier format tts-providers.ts	2026-07-03 11:03:12 +08:00
wyuc	e83db6a531	fix(agents): persist AgentBar voice picks and mode/selection across reloads (#723) ... * feat(audio): let resolveAgentVoice honor per-agent voice overrides * feat(settings): persist per-agent voice overrides * fix(agents): persist AgentBar voice picks via settings overrides * fix(classroom): keep user's agent mode and selection across loads * fix(agents): only carry user-set agent selection across classrooms Review follow-ups: stage-derived defaults written by a classroom load were re-read as a user choice on the next load, so visiting a preset classroom permanently downgraded auto classrooms to preset agents. Track the origin with a persisted agentSelectionIsUserSet flag (set by AgentBar interactions, cleared by fallback writes). Also: voice overrides are now clearable (undefined deletes), the override type is single-sourced in voice-resolver, and persist rehydration of the new fields is pinned by tests. * fix(agents): don't mark stage-derived selections as user choices Round-2 review: clicking the already-active mode tab no longer flags the selection as user-set (a visual no-op must not promote stage defaults to a choice), generation-preview clears the flag when it writes the generated roster, and tests now pin that setter writes actually reach storage. * fix(agents): restore generated agent selection when switching back to Auto Review follow-up (#723): handleModeChange('auto') left the preset ids selected, so the UI said Auto while discussion playback kept using preset agents, and the persisted user-set auto pair could never validate on restore. Switching to Auto now selects the loaded classroom's generated agents (empty when none are loaded, falling back to stage defaults on the next classroom load).	2026-06-11 19:02:42 +08:00
RongHuiQiang	50c0aefd13	fix(vocational): gate procedural content generation	2026-06-09 23:43:34 +08:00
RongHuiQiang	e6debb093b	fix(vocational): address review feedback	2026-06-09 11:30:38 +08:00
wyucandClaude Opus 4.8	47d28145b4	feat(maic-editor): slide surface — MAIC Editor v0 (epic #562) (#615) ... * feat(maic-editor): framework primitives + edit StageMode (#564) * feat(maic-editor): framework primitives + edit StageMode Phase 1 framework foundation for the MAIC Editor (RFC #547, tracking #560). Plumbing only — no UI consumers ship in this sub-PR; the EditShell chrome and slide surface registration land in follow-ups. - StageMode gains 'edit' alongside 'autonomous' | 'playback'; setMode resets canvas selection when leaving 'edit'. - <Stage> auto-exits 'edit' whenever the current scene becomes uneditable (no scenes / pending generation / no current scene) so a follow-up Pro toggle can never strand the user in an empty edit shell. - SceneEditorSurface contract + tiny registry under lib/edit/ so each SceneType plugs in a surface without the shell importing surfaces directly. Surfaces declare CanvasComponent, useSurfaceState(), insert palette items, floating actions, commands, and (reserved for AI) inline coach hints. - Slide kernel (lib/edit/slide-ops.ts): immutable, history-aware operations covering slide-update, element add / update / updateMany / delete / deleteMany / reorder / duplicate / align / removeProps, and text content edit. - Slide element factories (lib/edit/slide-edit-elements.ts) for default text / shape / image elements + HTML <-> plain-text helpers. - i18n: stage.editCourse + stage.doneEditing across all 6 locales, consumed by the header toggle in the next sub-PR. - Vitest coverage for the slide kernel (operations + history) and the edit-mode store transition (entry + canvas reset on exit). PBLRenderer's mode prop is widened from the literal pair to StageMode so <SceneRenderer> (which already passes StageMode) type-checks. The prop is unused inside the renderer. * style(maic-editor): apply prettier to lib/edit + tests/edit CI runs on PRs to main only, so the prettier check did not fire for this PR's target branch — applying formatting locally before the merge train reaches main avoids a follow-up style commit. * ci: also run on PRs targeting feat/maic-editor-v0 The MAIC Editor lands as a series of stacked sub-PRs against the long-lived feat/maic-editor-v0 branch. Without this entry, none of those sub-PRs get a CI gate — style/lint/type/test regressions only surface when feat/maic-editor-v0 finally merges back to main, at which point fixing them is a lot more disruptive than catching them per sub-PR. Push trigger is intentionally left main-only: nobody pushes directly to feat/maic-editor-v0, every change arrives through a PR that now runs the gate. * fix(maic-editor): address kernel review on #564 Addresses cosarah's review against #561 scope: Important: - element.align now uses the canonical lib/utils/element.ts geometry helper instead of a forked copy. The local fork ignored PPTLineElement start/end and rotation, so bounds were wrong for lines and rotated elements. - Cap slide-edit history at MAX_HISTORY = 50; drop oldest on overflow. - Narrow slide.update patch to Partial<Omit<Slide, 'elements' | 'animations'>> via a new SlideMetaPatch alias, so element / animation collections can only be mutated through their dedicated ops. - element.add throws on id collision; element.duplicate throws when idMap is missing entries or when new ids would collide with existing elements. - scene-editor-registry dev-warns on overwriting a *different* surface for the same SceneType (HMR re-register of the same instance stays silent); add unregister() for HMR cleanup and tests. Minor: - Unify on structuredClone over JSON.parse(JSON.stringify(...)); inside immer's produce, un-proxy with current() first. - Skip history push when produce returns the same content reference (true no-op detection). element.delete / deleteMany pre-check membership so their unconditional filter assignments don't break the ref-equality signal. - Drop redundant cloneSlideContent calls in undo/redo/push paths; immer's structural sharing already guarantees immutability of the produced output. createSlideEditHistory keeps its defensive clone since the initial value comes from outside immer. Coverage: - Extract auto-exit predicate into lib/edit/stage-mode.ts so the policy can be unit-tested without rendering <Stage>. - New tests: every align direction, line / rotated element align, no-op paths for update/delete/reorder/removeProps/text/align, element.add index clamping + id collision, element.duplicate default offset + contract errors, history future cleared after branching, history capped, registry register/unregister/HMR-safe re-register, and the auto-exit predicate. 371 vitest tests pass (was 335). tsc/lint/prettier/i18n/build all green locally. * fix(maic-editor): close kernel escape hatches (subagent CR follow-up) Two defense-in-depth fixes flagged by independent review after the prior commit: - element.duplicate now deep-clones the source via structuredClone(current(element)). The previous shallow spread shared nested mutable references (start/end tuples, outline, points) with the source; immer's COW would have handled most mutations but ops that operate on nested arrays in place (sort/reverse/splice) would silently leak between source and duplicate. The deep clone keeps the kernel's invariants independent of how downstream op consumers write their recipes. - slide.update gains a runtime guard that throws when patch contains elements / animations. The type-level SlideMetaPatch narrowing already forbids these keys, but the runtime guard closes the `as any` escape hatch for callers that might bypass the type system. New tests cover both paths: meta-only slide.update succeeds, an elements-containing patch throws, and a duplicated line element's start/end/points tuples are independent from the source. * feat(maic-editor): EditShell chrome and Pro mode toggle (#565) * feat(maic-editor): EditShell chrome and Pro mode toggle Adds the scene-type-agnostic editor chrome (EditShell + CommandBar + FloatingToolbar + HintRail), an edit-mode sidebar, and the header Pro toggle that flips into the 'edit' StageMode from #561. No scene editor surfaces are registered yet — the next sub-PR wires up the slide surface. In this PR every scene type falls through to the i18n unsupportedScene placeholder, which is the verifiable visible behavior. - canEdit gating reuses the canonical isCurrentSceneEditable predicate shipped in #561 so the toggle and the auto-exit effect are in lock-step. - handleToggleEditMode tears down live session / engine / TTS before entering edit mode. - ChatArea slides out in edit mode for a full-width canvas. - reorderScene extracted from EditModeSidebar with unit tests; the positional-order preservation is the part worth a guard test. - i18n scoped to keys this PR's components actually reference; surface-specific keys deferred to the slide-surface PR. * test(reorder-scenes): single-element + reference-inequality cases; zh-CN newSlide distinct from addSlide CR follow-ups: - reorderScene tests now cover a 1-element array (both directions return null) and explicitly assert the returned array is a new reference, not the input. - zh-CN edit.sidebar.newSlide was duplicating the addSlide label ("新建幻灯片" both); using "未命名幻灯片" for the default new-slide title to match the English Add slide / New slide distinction. * refactor(maic-editor): drop EditModeSidebar; clean Pro mode chrome (#568) Course-correct on #565. EditModeSidebar was rejected by the design owner as inappropriate for Pro mode (#560 wording is "minimal top bar + slide thumbnail rail", not a file-list panel). #565 also left the playback chrome wrapped around the editor — Header / sidebar / Roundtable / ChatArea all stayed mounted with only the sidebar swapped, and EditShell's CommandBar/FloatingToolbar/HintRail were never visible since no surface registers yet. Drop EditModeSidebar + reorder-scenes helper + tests + the edit.sidebar i18n block (8 keys x 6 locales) + the CommandBar sidebar-toggle. Stage keeps Header mounted in both modes — it owns the global Pro toggle Switch, which is the entry AND exit affordance (closing the Switch exits; no separate Done-editing button). In edit mode: SceneSidebar / Roundtable / ChatArea are not mounted, and the canvas slot renders <EditShell scene> instead of <CanvasArea>. EditShell internally resolves the surface via sceneEditorRegistry; when none is registered it falls through to edit.unsupportedScene. With no surfaces registered, every scene type lands on that placeholder — the visible v0 behavior. New optional EditShell.leftRail slot reserves the spot for a redesigned slide-navigation surface; v0 ships with the slot empty. SceneRenderer is now playback-only — the mode === 'edit' branch and its sidebarCollapsed / onToggleSidebar props moved up to EditShell / Stage. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): enablement infrastructure (pre-slide-surface) (#571) * feat(maic-editor): enablement infrastructure (pre-slide-surface) Pre-requisite for the slide surface (#562). Ships the safety infrastructure so each subsequent surface PR is small and recoverable: 1. Feature flag NEXT_PUBLIC_MAIC_EDITOR_ENABLED, default OFF — gates the Pro toggle in Header. StageMode unchanged. 2. SlideContent.schemaVersion + pure idempotent migrateSlideContent / migrateScene; setScenes / addScene funnel legacy data through the migrate at the store boundary. 3. tests/edit/round-trip/ harness: apply ops -> buildPptxBlob -> JSZip parse -> assert content survived. No PPTX -> Slide reimport exists in the codebase, so the full reimport-diff shape isn't doable; per-op assertions extend the harness in #562. buildPptxBlob is now exported (hook is still the only runtime caller). 4. Per-scene slide-history persistence helpers (persist / load / has / clear, keyed maic-editor:slide-history:${sceneId}, swallow storage failures) + standalone SlideHistoryRestorePrompt dialog + 4 new i18n strings x 6 locales. Stage wiring deferred to #562. 5. Concurrency guards: isSceneEditLocked predicate (defensive; no current call path structurally hits it); localStorage-backed multi-tab edit lock with tryAcquire / refresh / release / heldByOther, stale-lock takeover after 3x heartbeat; standalone MultiTabEditConflictPrompt + 3 new i18n strings x 6 locales. Stage wiring deferred to #562. The slide-surface PR owns the edit-entry effect machinery (where the history-state lifecycle and per-tab tabId ref naturally live), so shipping half-wired dialogs here would speculatively build Stage state we know we'll restructure on contact with the surface. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): migrateSlideContent forward-compat — no silent downgrade CR follow-up: previously, content with schemaVersion newer than CURRENT (e.g. v2 written by a future client) was silently truncated back to the current version. Now: if schemaVersion >= CURRENT, return the content untouched. The slide may not render correctly on an older client, but its on-disk shape stays intact for the next compatible client to read. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): slide surface skeleton + #571 wiring + geometry (#562) (#579) PR1 of the slide-surface work (infra-first slice). Registers the slide SceneEditorSurface so EditShell lights up Pro mode for slide scenes. - SceneEditorSurface impl + sceneEditorRegistry registration; the surface owns a SlideEditHistory via the #564 kernel. - Reuse the unmodified slide renderer Canvas through a surface-owned scene context; geometry drag/resize/rotate commits funnel into element.update ops (scene-edit bridge), one gesture = one undo step. - Geometry numeric x/y/w/h/rotate popover as the precise fallback; gated off for line elements (PPTLineElement omits height/rotate). - Wire #571 infra: cross-tab edit lock + conflict prompt, slide-history persistence + restore prompt, regen-lock guard. - Renderer-commit classification: a real geometry gesture commits synchronously inside a pointer interaction; the renderer's ResizeObserver text-normalization commits with none, so it is folded into the baseline (no undo step / no persist / no spurious restore prompt on entry) instead of being staged as a user edit. - Per-op round-trip test for element.update geometry; bridge + session unit tests; edit.geometry i18n across all 6 locales. Upstream-shared changes are kept minimal and additive: an optional `controller` prop on SceneProvider (uncontrolled/playback path unchanged) so staged edits don't write through to the live stage store, and a FloatingToolbar trigger-nesting fix (it wrapped PopoverTrigger around <Tooltip>, a provider, so no popoverContent action could open). Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): lock data-URL image PPTX round-trip (PR2 R1 gate) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): insert palette — text box + image (data-URL/URL) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): address Task 1 review — spy cleanup, popover-only comment, ImagePicker error log Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): drop PR1 debug geometry toolbar; element-aware floating bar Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): drop redundant PPTTextElement cast (Task 2 review) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): additive ProseMirror command bridge for the property bar (C1) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): exhaustiveness guard + tidy C1 adapter (Task 3 review) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): refresh property-bar attrs on caret/keyboard selection (C2) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): satisfy no-explicit-any in PR2 test stubs (Task 1+4 review) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): compact text property bar in the reused floating slot Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): Task 5 review — uniform selection-guard, Lucide icons, JSX, memo Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * i18n(maic-editor): edit.text.* + edit.insert.* across 6 locales Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): round-trip gate for formatted text + inserts Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(maic-editor): clarify remote-URL image round-trip scope (Task 7 review) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): drop stale scaffolding comment + orphaned geometry i18n keys Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * style(maic-editor): prettier --write PR2 files (pre-push check) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): make no-explicit-any suppression prettier-robust Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): CommandBar insert popover never opened (PopoverTrigger wrapped a Tooltip provider) Insert→Image was unreachable: InsertButton wrapped <PopoverTrigger asChild> around <Tooltip> (a context provider, no DOM node), so Radix's Slot bound no element. Chain both triggers onto the real <button>, exactly mirroring the PR1 fix already in FloatingToolbar's ActionButton. PR2's insert-image is the first popoverContent InsertButton consumer to exercise this path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): text property bar no longer clips/overflows in the floating popover The ~450px single-row bar was jammed into FloatingToolbar's fixed w-72 (288px) PopoverContent and clipped. Let the popover size to content (w-auto, max-w-[92vw], Radix handles edge collision) and harden the bar row (w-max + no child shrink, fixed-width font select) so it renders as one clean line. Chrome/surface layout only — no renderer change. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): property bar stays open across consecutive formatting steps execCommand refocuses the editor after every command; the uncontrolled Radix popover treated that focus-shift as focus-outside and dismissed, forcing a re-open of the Text bar for each format action. Prevent onOpenAutoFocus (don't steal the canvas selection on open) and onFocusOutside (editor refocus must not dismiss); Escape and pointer-down truly outside still close it. Chrome-only, no renderer change. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): editor canvas now resolves gen_img_* media placeholders The editor's interactive ImageElement rendered elementInfo.src raw, so entering Pro mode on any slide whose image was a generation placeholder showed a broken-image icon (while playback's read-only BaseImageElement correctly resolved the placeholder to the generated objectUrl). Extract the resolution into a shared useResolvedImageSrc hook so both variants stay aligned. Strictly additive: for any non-placeholder src (legacy / direct URL / data URL) resolvedSrc === elementInfo.src and the media store is not subscribed to. Pre-existing upstream gap surfaced by PR2 as the first real-user editor consumer — same shape as the CommandBar popover-trigger fix. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): unit-test gen_img placeholder resolution (9 cases) Splits useResolvedImageSrc into a pure resolveImageSrc function (no hooks) wrapped by the hook, so the resolution logic can be unit-tested in vitest's plain node environment (no jsdom/RTL needed in this repo). Covers: done→objectUrl; no task→raw; pending/generating/failed→raw; done with no objectUrl→raw; cross-stage isolation; no-stageId path; non-placeholder src passes through (the additive contract). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): auto-save edits to stage store, drop staging UX Reverses PR1's "staged edits don't write through to the live lesson" design. The slide-edit-session now writes through every history move (applyOp / user commit / ResizeObserver normalization / undo / redo) to useStageStore.updateScene as the canonical source of truth, which Dexie already auto-persists. The renderer reads from the stage store via the controller's getSnapshot. Removes the entire staging surface that has no place in a modern editor (Figma/Notion/Google Docs have no "unsaved changes" concept): - DEL lib/edit/slide-history-persistence.ts (localStorage layer) - DEL tests/edit/slide-history-persistence.test.ts - DEL components/edit/SlideHistoryRestorePrompt.tsx (restore dialog) - DROP pendingRestore field + restore() action from slide-edit-session - DROP restorePrompt branch + handlers from useSlideCanvasController - DROP edit.history.restore.* keys across all 6 locales Edits now flow: user input → renderer onUpdate → controller.updateSceneData → slide-edit-session.commitContent → writeThrough(useStageStore.updateScene) → Dexie. There is nothing "unsaved" to restore, by design. The session retains its in-memory undo/redo history (per Pro session) and the user-vs-ResizeObserver gesture classification (so reflow doesn't push undo steps). Test suite rewritten to assert write-through on every history move and no write-through on seed (the stage already has that content). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): address PR review — element delete affordance + cross-platform fonts Two issues from review on #586: 1. A selected image/text element couldn't be deleted — the renderer's delete lives only in a right-click menu, undiscoverable in Pro mode. Add a Delete button to the FloatingToolbar for any single selected element (text or image), dispatching the existing element.delete op. Button-only, consistent with #560's keyboard-shortcuts deferral. 2. Switching fonts had no effect on macOS Chrome — the property bar's font list was a hardcoded SimSun/SimHei set (Windows-only system fonts the renderer never loads). Use OpenMAIC's canonical FONTS registry (configs/font.ts) — the web fonts the renderer actually loads, so a pick renders identically on every platform. Adds edit.delete × 6 locales + the parity-test key; floating-actions unit tests for the delete action. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): selection-anchored text editing for the slide surface (#590) * feat(maic-editor): add resolveEditingElementId text-editing policy Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): drop text-format floating action (moves to anchored bar) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): surface hooks to derive and sync editingElementId Add useResolvedSlideContent / useEditingTextElementId / useSyncEditingElementId. Realign the PR2 buildFloatingActions tests with the new behavior (text formatting moved off the FloatingToolbar) and co-locate the editing-state test. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(ui): export PopoverAnchor from the popover wrapper Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): add useTrackedRect for element screen-rect tracking Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): add AnchoredTextBar selection-anchored format bar Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): wire anchored text bar + editing flag into SlideCanvas Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): draw a clean solid frame for the text element being edited Gated on the canvas store's editingElementId (default ""), so the dashed select frame is unchanged for multi-select and for any consumer that never sets the flag. Editor-path only; playback never renders Operate. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): drop the editor focus ring so text editing shows one frame Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * style(maic-editor): prettier-format the editing-state test import Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): anchor the bar to the text element node, not the wrapper Code review caught that #editable-element-{id} is a zero-size absolute wrapper — measuring it would pin the bar to the canvas origin. Measure the .editable-element-text child, which carries the real geometry. Also correct the dismiss-behavior comment: the bar is purely selection-driven. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): modernize the text format bar UI Replace the native <select> font picker with the design-system Select, rebuild the size control as one cohesive stepper pill, swap the color "A" for a swatch chip, and unify every control to a single height and hover/ active language (violet accent, matching the editor's Pro-mode accent). Behavior and the text commands are unchanged. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): curate the font picker to fonts the app actually loads configs/font.ts listed 29 fonts but the app only ever loads Inter (via next/font); the other 28 had no @font-face or bundled file, so picking them silently fell back with no visible effect — and nothing but the format bar even imports the registry. Trim it to what genuinely renders; the file's comment records how to restore the rest (wire up font loading first). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): load the picker fonts via @fontsource The font registry listed 29 fonts the app never loaded. Wire up a curated set that genuinely renders — 思源黑/宋, 霞鹜文楷, 站酷快乐体, and 9 Latin families — via @fontsource packages (npm-managed, no font binaries in the repo; CJK faces are unicode-range-subsetted so they download lazily per glyph range). app/editor-fonts.ts registers the @font-face CSS from the root layout; configs/font.ts is now the real, honest 14-entry list. The ~14 commercial decorative Chinese fonts are intentionally left out — they need self-hosting + subsetting + a licensing review, separate work. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): quote font-family names so spaced/numeric ones work Picking a font whose family name has spaces or a trailing digit (e.g. "Source Sans 3") threw `Failed to execute 'check' on 'FontFaceSet'` — `document.fonts.check(\`16px ${name}\`)` needs the family quoted — and the fontname mark's toDOM emitted an invalid unquoted `font-family`, so the font silently never applied. Quote the family in both spots; the mark's parseDOM already strips quotes, so the attr still round-trips clean. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): make the editing frame pointer-events-none The clean editing frame is a purely visual full-size overlay, but it was pointer-events: auto — so it masked the text element's own move cursor, text cursor, click-to-place-caret and drag-to-move; only a thin uncovered sliver at the edges still triggered them. The dashed BorderLines it replaced are thin edge lines, so they never had this problem. Mark the frame pointer-events-none; the resize/rotate handles are separate and keep their own pointer events. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): drop the "font is loading" toast With @fontsource fonts and font-display: swap, a picked font swaps in smoothly on its own — the "Font is loading, please wait..." toast was noise (and fired on most CJK picks while a unicode-range chunk loaded). Remove it along with the now-unused document.fonts.check and toast import. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): move the delete action onto the anchored text bar A text element's contextual actions now sit together on the anchored bar — format controls + delete, hugging the element — instead of delete sitting alone in the top-center FloatingToolbar. buildFloatingActions returns nothing for text (its FloatingToolbar then renders null); non-text elements still get their delete there. Delete logic is shared via a new deleteSlideElement helper. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): anchor the delete action for image elements A selected image element now gets a selection-anchored bar hugging it — just a delete button (image replace/crop/flip stay in a later sub-PR) — the same way text elements do. The anchoring shell is extracted out of AnchoredTextBar into a reusable AnchoredBar, and the delete button into a shared DeleteButton; AnchoredTextBar and the new AnchoredImageBar are thin wrappers. useTrackedRect now measures .editable-element-text or .editable-element-image. buildFloatingActions returns nothing for image elements too (other element types still get their delete there). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * style(maic-editor): tighten the anchored bar padding (p-2 → p-1) p-2 left a chunky white margin around the content — most visible on the image bar, a lone delete button in an oversized box. p-1 (4px, the value the FloatingToolbar used) makes both bars sit snug to their controls. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): anchor the delete bar for every element type The selection-anchored delete bar now covers all non-text element types (shape, line, table, chart, …), not just image — so every element's editing chrome is anchored uniformly. AnchoredImageBar becomes the type-agnostic AnchoredDeleteBar; useTrackedRect matches any .editable-element-{type} content root; buildFloatingActions is dropped — the surface no longer contributes top-center FloatingToolbar actions, everything is on an anchored bar. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): show legacy font names in the picker trigger When a text element's `fontname` was a value not in the curated FONTS registry (e.g. `Microsoft YaHei`, `PingFang SC`, theme defaults), the Select couldn't match it and `<SelectValue/>` rendered a blank trigger — both reviewers (cosarah Important, xuyuanwei678 #1) caught this. Add a placeholder fallback so the raw family name surfaces in the trigger. Also clean up the dead `'默认字体'` label that `text-format-bar.tsx` overrode unconditionally: introduce an optional `labelKey` field on `FontEntry`, use it for the default entry, and let the picker prefer the i18n key when present — no more by-value special case. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): address cr minors - `marks.ts` fontname `toDOM` rejects `"` or `\` instead of interpolating them: a hand-crafted mark with `fontname: 'X"; background:url(...);'` could otherwise close the quoted string and inject arbitrary CSS. - `AnchoredBar` gains `onOpenChange` (clears the canvas selection on Radix-initiated dismiss): silences the controlled-without-handler dev warning, and brings back Esc / SR dismissal that our focus-outside hardening had cut off. - `useSyncEditingElementId` folds two `useLayoutEffect`s into one with a cleanup; the previous unmount-only effect was structural noise. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: pin body padding-right so popovers don't reflow the page Radix Select / Popover wrap with `react-remove-scroll`, which adds a compensation `padding-right` to <body> when they open. Our <html> already reserves the scrollbar gutter (`scrollbar-gutter: stable` + `overflow-y: scroll`), so the compensation added a visible ~15px shift on every dropdown open. Pin body's padding-right with `!important` so the page stays still. (xuyuanwei678 review #2.) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): surface legacy font names via SelectValue children The earlier placeholder approach didn't work — Radix's `placeholder` only fires for an empty `value`, not for an unmatched non-empty one. So an element with a legacy fontname (e.g. `Microsoft YaHei`, `PingFang SC`, theme defaults) outside the curated FONTS registry still rendered a blank trigger. Render the trigger text via `SelectValue` children instead — the new `currentFontLabel` helper covers all three cases: matched → entry's i18n / fallback label, unmatched non-empty → the raw family name, empty → the default-font label. Unit tests cover each case. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): preventDefault on pointer-down-outside so drag/resize work The onOpenChange handler added to silence the Radix dev warning + restore Esc dismissal also fired on pointer-down-outside — i.e. on every mousedown on the selected element to drag it or grab a resize handle. That cleared the selection before the drag could start, so nothing on the canvas could be moved or resized. preventDefault on `onPointerDownOutside` (matching the existing `onFocusOutside` hardening) keeps the bar selection-driven while leaving Esc as the legitimate onOpenChange path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): arm-and-place insertion for text boxes Replaces the "auto-insert at a hidden default position" UX. Click `Text box` → arms text-insertion: the button takes the violet active style, and the renderer's existing ElementCreateSelection overlay turns the canvas cursor into a crosshair. On the canvas: - click → 300×60 box at the click point - drag → a box at the dragged rect Either way the new box is auto-selected (addElement defaults that on), and the surface's existing useEditingTextElementId picks it up so the AnchoredTextBar opens on it. Esc disarms; clicking the armed button again disarms (toggle). Completes the text branch in the renderer's `useInsertFromCreateSelection` (pptist scaffolding left it TODO) and bypasses the 200² square fallback in `ElementCreateSelection` for the text type (a square wouldn't suit a text box). `InsertPaletteItem` gains an `active?` field so `CommandBar` can render the armed style. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): render list bullets in slide text Tailwind's preflight resets `list-style` to none, so the format bar's `bulletList` toggle wrapped selected text in `<ul><li>` but no marker ever appeared — the button looked inert. Scope a list-style restoration to `.editable-element-text ul/ol/li` so bullets / numbers render in the slide text without leaking into the rest of the app. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): editable font-size input in the text format bar The size was a read-only `<span>` between the −/+ steppers. Replace with an `<input type=text>` that mirrors `attrs.fontsize` locally, commits on Enter / blur (clamped to [8, 96]; non-numeric reverts), and reverts on Escape. Adds the `edit.text.fontSize` aria-label key in all 6 locales. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): force list markers visible (defeat preflight specificity) The earlier list CSS didn't survive Tailwind's preflight (which also resets `padding: 0` on `<ul>`/`<ol>`, so with `list-style-position: outside` the markers had no room to render). Add `!important` on `list-style` and `padding-inline-start`, and broaden to also match `.prosemirror-editor ul`/ `ol`/`li` in case the markup ever nests differently than expected. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): reset richTextAttrs when the editing element changes `richTextAttrs` is a single shared store updated by whichever ProseMirror was last focused. Switching from one text element to another visibly carried the previous element's toggle states (bold / italic / alignment / list) on the format bar for a moment — until the new element's ProseMirror took focus and repopulated the attrs. `useSyncEditingElementId` now resets the attrs to defaults whenever the editing id changes, so the bar shows a neutral state during the transition instead of stale. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): replace OS color dialog with a curated palette popover Clicking the text-color swatch opened the browser's native `<input type=color>` dialog — off-brand and inconsistent across platforms. Swap it for a `ColorPicker` popover: a 12-swatch grid covering the common slide-text needs (4 neutrals + warm + cool) plus a hex input for anything else. Closes on pick. Selected swatch gets the violet outline; hex input commits on Enter / blur (reverts if invalid). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): replace flat swatch popover with a real color picker The previous popover was a chunky 12-swatch grid plus a hex input nobody types into. Rebuild on `react-colorful` (3KB, well-tested): - SV pad + hue slider for free-form picking, with scoped CSS overrides to keep the picker tight (128px pad height) and rounded — not stock. - OS eyedropper via the EyeDropper API, feature-detected (Chrome / Edge; hidden on Safari / Firefox). - Row of 10 small (18px) common colors at the foot for one-click reach. - Current-color preview + read-only hex display. - Hex input dropped entirely — picking is meant to be tactile. Live preview while dragging; the popover closes on a swatch / eyedropper commit (not on drag). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): keep the color popover open while dragging the picker Each SV-pad / hue-slider drag tick fires onChange → dispatches the color command → `editorView.focus()` pulls focus out of the popover into ProseMirror. Radix's default onFocusOutside path was treating that as a dismiss, so the popover closed the instant a drag started — clicking anywhere on the picker shut it. preventDefault on `onFocusOutside` (mirrors the AnchoredBar hardening) keeps it open; the popover still closes on swatch / eyedropper commits and on outside-click / Esc. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): scope body padding override + gate ColorPicker mid-drag sync Two follow-ups from a self-CR on the branch: - `body { padding-right: 0 !important }` was global, overriding Radix's `react-remove-scroll` compensation for every Dialog / Sheet / Select / Popover across the app. Scope it to a `body[data-maic-editor='true']` selector; `SlideCanvas` sets the attribute while mounted. Non-editor pages get Radix's default behavior back. - `ColorPicker`'s `useEffect(() => setColor(value), [value])` mirror could race a stale `value` against the user's current pointer position mid-drag — a single late round-trip would snap the picker back. Gate the re-sync on `isDragging.current` (cleared on `pointerup`); external commits (swatch / eyedropper) still sync immediately because they fire while no drag is in flight. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): polish from self-CR - Gate the `richTextAttrs` reset in `useSyncEditingElementId` to only fire on element-to-element transitions (track previous editing id via a ref). The unconditional reset on the first selection briefly flashed neutral defaults (color #000, fontsize 16px) before the focusing ProseMirror repopulated the real values. - Doc-comment the text-insertion add-element asymmetry: text uses the renderer's `addElement` (because the rect math lives there and we get auto-select for free), image uses surface-side `applyOp` (its source is the ImagePicker, not a canvas gesture). Both commit through the same store, but the text lane doesn't show as a typed `element.add` op in the session history — acceptable, now explicit. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): listen to every gesture-end channel in ColorPicker CR round-2 residual nit: the single `pointerup` listener that clears the drag-gate would silently keep the gate stuck on any browser / emulator that only emits the older mouse/touch families. Listen on all four (`mouseup`, `touchend`, `pointerup`, `pointercancel`) — belt-and-suspenders, no behavior change on the common path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): preserve image aspect ratio on insert `createDefaultImageElement` hardcoded the new image's box to 360×220, so anything not ~1.6:1 (which is almost everything users upload — photos, screenshots, logos) ended up squashed or stretched the moment it landed on the slide. Wrap the factory in `insertImageElement` that measures the source via `new Image()`, then dispatches `element.add` with dimensions scaled to fit MAX 600×400 while preserving the natural ratio. Load failure falls back to the factory default so insertion always succeeds. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): drop the now-dead addElement helper `addElement` was only ever used by the inline image-insert which became `insertImageElement`; text uses `armText` (toggle). PPTElement-typed parameter was already unused after the text refactor — removing the dead helper resolves the lint warning. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): drop now-unused PPTElement import in use-slide-surface After `addElement` was dropped (55a9a71), the `PPTElement` type import has no remaining consumers in this file. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): nav rail, scene management, Pro mode chrome rework (#601) * feat(maic-editor): slide nav rail + scene management (3/3) PR3a Phase 1 ships the Pro mode left rail + slide-level management, the last user-visible block of #562. Closes the gap where Pro mode locked the user on the current scene with no way to navigate or manage the deck. SlideNavRail (Studio Editor aesthetic, mirrors playback `SceneSidebar` visually — index badge + title above an aspect-video thumbnail card — so the two sidebars read as the same component family across mode toggle): - Vertical thumbnail strip via `motion.dev` `Reorder.Group` with drag-to-reorder. `Reorder.Item layout="position"` keeps the layout animation on y-axis only; width changes from rail resize don't fight. - Drag-to-resize handle on the right edge writes `style.width` directly on the DOM during the gesture and commits to settings store only on mouse-up; matches playback drag feel exactly and skips the per-frame `persist` serialization that would otherwise burn the frame budget at 60 Hz. - Collapsed and expanded modes; width and collapsed flag persist in `useSettingsStore` (`editRailWidth`, `editRailCollapsed`). - All scene types are first-class — slides render a live `ThumbnailSlide` (now with optional `size` prop → self-measures via `ResizeObserver` when omitted, so the rail width is the single source of truth), non-slide scenes render the same stylised mockups playback `SceneSidebar` uses (extracted to `SceneThumbnailContent`). Slide management: - `+ Add` in the rail header inserts a blank slide after the current scene; new store action `useStageStore.insertSceneAfter` validates stage id, migrates the scene, splices, rebalances `order`, and triggers `debouncedSave`. - Three-dot menu per tile: Rename / Duplicate / Delete. Rename also reachable via double-click on the title; Enter commits, Escape cancels, blur commits, empty input reverts. - Duplicate deep-clones slide content with fresh element IDs (avoid React key collisions) and a `(copy)` title suffix. - Delete uses a toast with Undo action; deleted scene is held in a small `useDeletedSceneRecycle` zustand store and re-inserted at its original index on Undo. Deck-empty guard at the rail layer. - Inter-thumb `InsertionZone` reveals a violet `+` badge on hover, right-anchored, with a popup motion (`cubic-bezier(0.34,1.56,0.64,1)`) + drop shadow + `z-20` so it lifts above the active tile's violet ring. Zero layout shift. Chrome bar: - `HeaderControls` (settings pill + Pro Switch) extracted from `Header` so Pro mode can mount it in the CommandBar's trailing slot — single top chrome bar in Pro mode instead of stacking Header + CommandBar. - Back-to-home button in CommandBar mirrors the playback Header's leftmost button. i18n: new `edit.nav.*` namespace across en-US / zh-CN / zh-TW / ja-JP / ar-SA / ru-RU. Tests: vitest for `insertSceneAfter`, `useDeletedSceneRecycle`, `createBlankSlideScene` / `duplicateSlideScene`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): split Stage chrome into mode-specific roots Bug-driven architectural rework. Two symptoms motivated this: 1. Switching from a slide scene to a non-slide one (interactive / quiz / pbl) flickered the entire edit chrome — CommandBar and SlideNavRail remounted along with the canvas. Root cause: EditShell returned a different component type (EditShellWithSurface vs EditShellReadOnly) based on whether a SceneEditorSurface was registered for the scene type, so React reconciled the change as an unmount/remount of the whole subtree. 2. `components/stage.tsx` had grown to 1391 lines — playback engine state, chat / TTS / discussion wiring, presentation/fullscreen, keyboard handling, AND the edit-mode dispatcher all in one place. Any change to mode coordination meant touching this god component. Changes: - New `NOOP_SURFACE` (`lib/edit/noop-surface.tsx`) — a no-op SceneEditorSurface used as a fallback when a scene type has no registered editor surface. `SurfaceState.history` is now optional so read-only surfaces can omit undo/redo cleanly. EditShell falls back to NOOP for unregistered types. - EditShell now mounts a single Frame across all scene types. Surface state is published from a child `SurfaceStateRunner` keyed by `scene.type` (so it remounts only when the runner's hook signature changes — rules-of-hooks compliant), with a custom shallow equality so the chrome doesn't re-render every render cycle for reference-fresh state objects. Result: slide ↔ interactive no longer remounts the CommandBar or the leftRail. - `stage.tsx` → 113 lines. Mode dispatch + cross-tab edit-lock coordination + Pro-Switch toggle wiring + multi-tab conflict prompt only. Everything else moved into one of two new components: - `PlaybackChromeRoot` (`components/edit/PlaybackChromeRoot.tsx`): owns the entire playback / autonomous chrome — PlaybackEngine, chat, discussion TTS, presentation mode, keyboard shortcuts, SceneSidebar, Header, CanvasArea, Roundtable, ChatArea, AlertDialog. Exposes `teardown()` via forwardRef so the toggle can `await` SSE / engine / TTS shutdown before unmounting it. - `EditChromeRoot` (`components/edit/EditChromeRoot.tsx`): the Pro mode chrome wrapper — EditShell + SlideNavRail + HeaderControls trailing slot. Owns `body[data-maic-editor]` lifecycle (lifted from SlideCanvas so it covers read-only Pro-mode scene types too). - New `StageGrid` (`components/edit/StageGrid.tsx`) — CSS-Grid named- slot layout shell with top / left / center / right / bottom areas for the Pro mode chrome. Future right panel (properties / AI) and bottom timeline plug in as props with no structural code change. EditShell's Frame now uses StageGrid internally. - Deleted `components/edit/SlideTransitionBridge.tsx` (dead code from the original A3 transition plan that this rework supersedes). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): cross-fade chrome roots on Pro mode toggle Wrap the chrome-root dispatch in `AnimatePresence mode="wait"` with a 180 ms opacity fade-out / fade-in. The outgoing root fully exits before the incoming one mounts, so: - The single-canvasStore-writer guarantee from the chrome split is preserved (ScreenCanvas and Editor/Canvas never coexist). - Mode toggle reads as a smooth fade instead of a hard cut. Stage's outer wrapper now carries the stable `bg-gray-50 dark:bg-gray-900` background so neither root reveals raw page colour while it passes through opacity 0. `initial={false}` skips the entry animation on first mount so the initial playback render is instant. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): drawer-style mode swap transition Pro toggle was a hard cut — playback chrome vanished, edit chrome popped into place. Now wraps the swap in `AnimatePresence` with the two chrome roots layered via `absolute inset-0` so they coexist for ~280ms: - Edit chrome enters from above (`translateY: -32 → 0`) + fades in, giving a "drawer drops down" feel that matches the inner CommandBar/leftRail stagger choreography. - Playback chrome cross-fades opacity-only; no transform so its active slide canvas stays put underneath while edit drops over it. Both roots keep rendering during the overlap, so `canvasStore`'s scale writer doesn't briefly read zero and snap the slide to a stale size when one root exits ahead of the other. Duration 280ms / `CHROME_EASE` matches the inner Frame timing source. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): Pro Switch as a shared layout element across modes The Pro Switch is the click anchor for the mode swap, but it lives in two different positions: the 80px playback Header (top-right) vs the 56px edit CommandBar trailing slot (also top-right but at a different y and with different padding). After the click the switch "jumped" — it visibly moved + restyled — which felt unsmooth even though the chrome itself was cross-fading. Tag the Pro Switch label (and the settings pill) with `motion.layoutId` so motion treats them as shared elements across the AnimatePresence swap. During the ~280ms transition, motion measures both instances and morphs position + size between them — the user's click target slides into its new home instead of teleporting. Same easing source as the chrome cross-fade so the two animations stay locked together. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(maic-editor): unify chrome shell across modes Pro Switch + settings pill + download icon are the user's mode-toggle "anchors" — they need to sit at the same screen pixel across playback ↔ edit. They didn't, because the two chromes had different shapes: Playback: SceneSidebar (left, full height) | Header (h-20, 80px) on top of CanvasArea + Roundtable Edit: CommandBar (h-14, 56px, FULL width) on top of a row of (SlideNavRail | content), so the rail sat *below* the bar So when the user clicked Pro, the bar collapsed by 24px AND the rail shifted down by 56px AND the right-side controls re-styled (compact variant) — three simultaneous moves. layoutId masked some of it but the underlying structure was wrong. Unify the shells: - `StageGrid` template flipped from `top top top / left center right / bottom bottom bottom` to `left top top / left center right / left bottom bottom`. The left column now spans all rows so the sidebar always reaches the absolute top edge, matching playback exactly. - `CommandBar` grows h-14 → h-20 + px-5 → px-8, identical to playback Header. - `EditChromeRoot` drops the `variant="compact"` flag on `HeaderControls` so the settings pill renders at the same h-9 pill it does in playback. - `SlideNavRail` header replaces the "SCENES" label with the OpenMAIC logo (click → home), matching `SceneSidebar`'s shape so the sidebar top reads as the same component family in both modes. - Download / Export dropdown moves out of `Header` and into `HeaderControls` so it's present in both playback and edit chrome at the same right-cluster position (was previously playback-only). `Header.tsx` slimmed accordingly. Net effect: the right-edge cluster (EN, theme, settings, download, Pro Switch) lives at the same screen pixel across modes; the cross-fade transition only animates the *contents* inside the bars + sidebar lists, not the bar/rail positions themselves. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): drop sidebar header + button, add insert-before-first zone The header `+` was a duplicate affordance — every gap between thumbs already has its own `InsertionZone`. Remove the header button; insert flows entirely through the gap zones now (with hover-popup + and right-anchored visual). Add one extra `InsertionZone` rendered BEFORE the first thumb so the top padding of the rail is also clickable / hoverable. Insert-before- first is implemented inline via `setScenes([blank, ...scenes])` because the `insertSceneAfter` store API only handles insertion after an existing anchor. `PlusCircle` import dropped (no longer used). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): move Download out of settings pill, place right of Pro Switch Download isn't a settings function (it's an export/share action), so it shouldn't sit inside the pill that hosts language/theme/settings. Move it back to a standalone button on the right side of the Pro Switch — both in playback and edit chrome. Right cluster now reads: [ EN · theme · settings ] [ PRO switch ] [ Download ] Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): floating insert toolbar above canvas (collapsible) Text box / Image / future shape buttons no longer share CommandBar with global stage controls (back / undo / redo / title / settings / Pro Switch / Download). Insert is a content-creation action, not a stage-navigation one — mixing them blurred the chrome's role. Lift insert items into a new `FloatingInsertToolbar` that floats centered ~12px above the slide canvas card. Default expanded; collapse arrow tucks it into a small chevron handle at the same anchor. State persists in `settings.editInsertToolbarCollapsed`. Reuses the existing `InsertButton` (extracted from CommandBar into a sibling module so both surfaces — the now-removed CommandBar slot and the floating bar — can share styling). CommandBar drops its `insertItems` prop / middle slot entirely; right-side controls collapse to a single `flex shrink-0` cluster matching playback Header's shape. i18n: `edit.insert.expandToolbar` / `collapseToolbar` across 6 locales. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): auto-focus text element after toolbar insert Inserting a Text box via the FloatingInsertToolbar + click/drag on the canvas left the user one click short — the new element was selected and the AnchoredTextBar opened, but the ProseMirror editor never received focus, so the first keystroke went nowhere and the user had to click inside the element again before typing. `useEditingTextElementId` already mirrors the surface's editing-target choice into `canvasStore.editingElementId`. Have `ProsemirrorEditor` watch that flag in an effect: whenever its own elementId becomes the editing target (insert, programmatic selection, etc.) and it doesn't already have focus, push focus into the view. `hasFocus()` guard keeps this from re-focusing on every re-render of an already-active editor. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(maic-editor): prettier + drop ThumbItem rename sync effect - prettier --write on three files touched by the recent edits. - ThumbItem: drop the `useEffect(() => { if (!renaming) setDraft(...) })` external-title sync that tripped `react-hooks/set-state-in-effect`. Idle display now reads from `scene.title` directly (derived rather than mirrored); `startRename` seeds `draft` at session start and `cancelRename` resets it so the next session starts clean. Rename e2e still passes the menu + double-click + Escape paths. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): CR-loop pass — pointer capture, stage-scoped recycle, equality docs PR #601 reviewer feedback. **Drag handle uses Pointer Events with `setPointerCapture`** so the rail no longer gets stuck in "still dragging" state when the cursor leaves the window, the OS reclaims focus, or a tab interrupt suppresses the mouseup that the old document-bound mousemove/mouseup pair relied on. The handle's onPointerMove/Up/Cancel are now bound directly on the element; capture guarantees event delivery for the lifetime of the gesture. Drag tracking e2e still PASS (1 px cursor lock). **Toast Undo guards stage identity** before re-inserting the deleted scene. If the user navigated to a different stage while the toast was up, the recycle entry belongs to the previous stage and `insertSceneAfter` would reject it on stage-id mismatch — silently losing the deleted scene. New check drops the undo cleanly when stage ids don't match. The `stageId` field was already captured on RecycleEntry; just wasn't consulted. **`surfaceStateEqual` extended** to compare per-item `id` / `disabled` / `label` on `floatingActions` (was length-only) and per-item `id`/`severity`/`message` on `hints` (was length-only). Today's slide surface returns `floatingActions: []` and `hints: []` so this is dormant, but PR3b's z-order actions land in `floatingActions` — pinning the equality semantics now keeps a future state field from silently going stale in the chrome. SurfaceState gets a maintenance note cross-linking to the equality function. **Header.tsx mode guard comment** updated. The `mode !== 'edit'` guard around the title block isn't dead — it covers the ~280ms AnimatePresence exit window where playback chrome is still rendering its exit animation while mode has flipped to 'edit'. Without the guard, this title would briefly stack on top of the incoming EditChromeRoot's CommandBar title during the cross-fade. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(maic-editor): CR-loop round 2 minors — sharpen JSDocs Round-2 reviewer flagged two doc-only refinements: - `surfaceStateEqual`: clarify that callback identity (`onInvoke`, `popoverContent`) is intentionally NOT compared, and that today's safety comes from slide-surface returning `floatingActions: []` rather than the per-item compare covering callbacks. A future surface that emits closure-capturing actions must fold its own change signal into the comparison or the stale callback fires at click time. - `setPointerCapture` catch: spell out that this is paranoia, not a real fallback — if capture genuinely fails the gesture still tracks for in-window moves but out-of-window `pointerup` won't route here. Acceptable degradation; the catch exists only because the spec permits an `InvalidPointerId` throw that browsers we ship to don't actually emit on same-pointer `pointerdown`. No functional changes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(maic-editor): undo restore at index 0, reset mode on classroom load Two issues from PR #601 manual-verification review: **Undo of the first slide restored it as the second.** The toast undo handler clamps `entry.index - 1` to 0 then calls `insertSceneAfter(scenes[0], entry.scene)`, which lands the entry at position 1 instead of position 0 — no scene exists before scenes[0] to anchor on. Fall back to `setScenes([entry.scene, ...live])` when `entry.index === 0` (or when the deck is empty). The store's existing non-rebalancing `deleteScene` keeps the surviving scenes at orders 2..N, so the prepended entry's original order=1 lines up naturally; StageGrid auto-selects the restored scene as current. **`mode` survived SPA navigation between classrooms.** Refresh reset mode to 'playback' via the initial store value, but switching classrooms via Next.js navigation kept the zustand singleton intact; entering Pro mode in A and then opening B left B in edit mode. `loadFromStorage` and the server-side classroom-load path both now set `mode: 'playback'` on every classroom load, normalising the SPA path to match the refresh path. Mode stays transient UI state, not persisted with the stage. e2e: delete Slide 1 → Undo → restored to position 1 (was position 2 before fix). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * feat(maic-editor): gate slide scene creation until inserted scenes are playable (#612) * feat(maic-editor): gate slide scene creation until inserted scenes are playable Editor-created slide scenes (blank insert + duplicate) ship without playback actions, so the playback engine gives them zero dwell and skips straight past them — a freshly inserted slide is effectively unplayable. Seeding default actions on new scenes is a separate change; until then, hide the two scene-creation entry points so the editor stays coherent as an in-place "fine-tune the generated deck" tool. - add lib/edit/scene-creation-enabled.ts (SCENE_CREATION_ENABLED=false) - hide inter-thumb "+" insertion zones (SlideNavRail) - hide per-slide Duplicate menu item (ThumbItem) - keep reorder / delete / rename, which are playback-safe Re-enable by flipping the flag once new scenes get default actions. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): e2e guard for slide scene-creation gate Adds an e2e that generates a classroom (mocked), enters Pro mode, and asserts the slide rail exposes no insertion "+" zones and the per-slide overflow menu has only Rename + Delete (no Duplicate). Fails if SCENE_CREATION_ENABLED is flipped back on without removing the gate. Two stable test ids support locale-independent assertions: - slide-nav-insert (InsertionZone button) - slide-nav-more (ThumbItem overflow trigger) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): enable editor flag for the e2e webServer The scene-creation gate e2e needs the Pro Switch, which only renders when NEXT_PUBLIC_MAIC_EDITOR_ENABLED is on. It's a build-time NEXT_PUBLIC_* flag, so set it in the Playwright webServer env (applies to `pnpm build` in CI and `pnpm dev` locally). Fixes the e2e failure on CI. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(maic-editor): attach gate screenshot to report instead of fixed path CR: e2e-artifacts/ is not gitignored, so writing the screenshot to a fixed path left an untracked file that could be committed by accident. Use testInfo.attach so the image lands in the (ignored) Playwright report. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * i18n(maic-editor): add pt-BR translations for edit.* / stage.* keys pt-BR locale (added on main post-stack) lacked the 51 editor keys, so check:i18n-keys failed after rebase onto main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(maic-editor): defer editor-only side effects behind Pro mode mount editor-fonts (~23 @fontsource CSS tables) and slide-surface registration were top-level static imports in app/layout.tsx and components/stage.tsx, so flag-off classroom/playback users paid the font-face CSS + slide-edit module-init cost on every page load. Move both to a dynamic import in EditChromeRoot (mounts only when mode==='edit', which requires NEXT_PUBLIC_MAIC_EDITOR_ENABLED). Hold the EditShell render until the slide surface registers to avoid a NOOP/ read-only flash on first Pro mode paint. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(maic-editor): CR-loop correctness fixes (redo/groupId/edit-lock) Three confirmed issues from the rebase code-review pass: - slide-edit-session: a non-user (ResizeObserver auto-height) commit updated history.present while preserving a now-stale future, so a redo after undo silently resurrected pre-undo content. Clear future on the non-user path (present has diverged from the redo branch); past is left untouched so no spurious undo step is created. - slide-defaults: duplicateSlideScene reassigned element ids inline, leaving grouped elements pointing at the source slide's groupId. Use the existing createElementIdMap so clones get a new shared groupId. (Path is gated off today via SCENE_CREATION_ENABLED; fixes a latent defect.) - stage: wrap playback teardown on Pro-mode entry in try/catch and release the just-acquired cross-tab lock on failure, so a rejected teardown can't strand the lock with the UI stuck in playback. Adds regression tests for the redo-stale and groupId cases. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(maic-editor): scope editor list-marker CSS to Pro mode The .editable-element-text ul/ol/li rules used a bare selector, but that class is the playback text wrapper rendered for every classroom user — so the !important list-style overrides leaked into normal playback. Scope them to body[data-maic-editor='true'] (set only while Pro mode is mounted) so flag-off playback rendering stays unchanged; markers still show while editing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(maic-editor): smooth Pro mode transition and stabilize header controls The Pro mode enter/exit animation janked and the right-side header controls (settings pill + Pro Switch) drifted in width/position across the swap. Three causes, all addressed: - The flag-gating dynamic import gated EditShell behind surfaceReady, so the chrome animated in empty and content popped in once the slide-surface chunk loaded. Preload the editor chunk (fonts + surface registration) in the Pro Switch handler BEFORE flipping mode (lib/edit/preload-editor.ts), and drop the render gate — content is present when the animation starts. - Mode-swap layers and EditShell chrome layers used translateY/translateX slides; with backdrop-blur on the rail and pills that forced a per-frame backdrop-filter recompute (dropped frames) and, as transform ancestors, distorted the layoutId measurement. Switched all chrome enter animations to pure opacity fades. - HeaderControls rendered a fragment whose children were spaced by the host's flex gap (Header gap-4 vs CommandBar trailing gap-2), so the control cluster changed width/anchor between modes. Wrapped it in a self-contained gap-4 container and dropped the cross-bar layoutId morph so the cluster is pixel-stable across the swap. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(maic-editor): address review — image insert race, scene migration, i18n staleness Review feedback from @cosarah on the integration PR: - Image insert resolved size via Image.onload then applied the op to whatever slide session was current at callback time, so switching slides before the image loaded inserted it into the wrong slide. Bind the insert to the scene active at click time and drop the op if the session changed before onload fires. - Classroom scenes loaded from IndexedDB (loadFromStorage) and from the server API (classroom page) bypassed migrateScene, so legacy slide content was not normalized with schemaVersion. Both load paths now migrate on the way in, matching setScenes/addScene. - surfaceStateEqual compared insert-item/command id/active/disabled but not label/tooltip, so the Pro-mode insert toolbar text stayed stale after a language switch. Compare label/tooltip too. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-31 21:54:04 +08:00