9 Commits

Include renames

Author	SHA1	Message	Date
wyucandClaude Fable 5	04621578de	release: OpenMAIC 1.0.0 — the agent workbench (#1228) ... * feat(storage): add an agent-session store with PG backend and layered contracts (#1163) * feat(storage): add agent-session store with PG backend and layered contracts * test(storage): avoid BigInt literals for pre-ES2020 root typecheck * fix(storage): close agent-session store review findings * docs(storage): align hook ordering and contention-probe claims with the code * ci: run on the agent-workbench integration branch * chore(storage): bump to 0.5.0 for the agent-session store * fix(storage): carry replay compaction across page boundaries * feat(agent): add the driver model contract and stage route dialect (#1165) * feat(agent): add the driver model contract and stage route dialect * fix(agent): validate route context windows and clarify dialect precedence * feat(agent): adapt the agent-session store and runtime foundations (#1167) * feat(agent): adapt the agent-session store and runtime foundations * feat(agent): resolve request owner identity via an anonymous cookie * docs(agent): document the opt-in compaction default and harden edge cases * feat(agent): add the background session runner (#1169) * feat(agent): add the background session runner * feat(agent): wire the runner into startup behind feature flags * fix(agent): stop clean interruptions from consuming the attempt budget * fix(storage): charge the attempt budget for abandoned leases but not clean parks * docs(storage): document the attempt-charging contract and decouple its tests * feat(agent): add agent session and owner event streams (#1170) * feat(agent): add agent session and owner event streams * fix(agent): close the session-existence oracle and document the owner seam * feat(agent): add agent session lifecycle routes (#1171) * feat(agent): add agent session lifecycle routes * fix(agent): validate session-create input and preserve the owner cookie on errors * refactor(storage): drop the unused active-stage API from the agent-session contract (#1174) * refactor(storage): drop the unused active-stage API from the agent-session contract Tools address stages explicitly on every call, so the store keeps no mutable session-level stage pointer. Removes resolveActiveStage and setActiveStage from the store interface, their PG implementations, the active_stage_changed lifecycle event, the session_active_stage owner event variant, and the contract tests pinning them. The active_stage_id column and the DDL check constraint stay untouched for schema compatibility. * chore(storage): bump @openmaic/storage to 0.7.0 for the contract removal * docs: document the agent runtime configuration surface (#1176) * fix(agent): repair orphaned and late tool results across interruption boundaries (#1180) * fix(agent): repair orphaned and late tool results across interruption boundaries A crash, shutdown, or provider failure can leave the durable transcript with tool calls that have no result, or with results ordered illegally for the provider. Three failure modes were fixed: - Orphaned tool calls: a run that died between an assistant tool-call frame and its result left a dangling call in the entry tree. Resume no longer synthesizes and persists receipts for it: interrupted results are a read-time provider view owned by a shared read-boundary repair, which returns the original array for a healthy transcript and never mutates the tree. - Late parallel results: a parallel tool can finish while pi unwinds an aborted assistant frame, leaving result(A), assistant(aborted), result(B) in durable order. Strict providers reject non-contiguous results, so the read-boundary repair moves existing results next to their owning assistant frame (in call order), omits incomplete unwind frames, and synthesizes receipts only for genuinely missing calls. - Interrupted calls at the write boundary: a call still in flight when the run winds down (shutdown, lease loss, cancellation, provider failure) had no receipt at all. The runner now tracks in-flight calls from their assistant frames and, before the terminal flush, appends an interrupted-result receipt for each still-orphaned call through the same attempt-fenced write chain, so a lease-stealing zombie never writes and the next claim sees a provider-safe transcript. * test(agent): pin the runner wiring for interruption-boundary tool repair * feat(agent): add neutral tool foundation libraries (#1184) * feat(agent): register a web_search tool on the session runner (#1185) * feat(storage): add a per-session URL trust gate (#1186) * feat(agent): add the skills system (#1189) * feat(agent): add the skills system (builtin directories and durable user skills) * fix(storage): serialize the user-skill quota check-and-insert per owner Two concurrent creates at the 50-skill boundary both counted 49 rows and both inserted (READ COMMITTED, no lock), overshooting the quota contract. The create transaction now takes a per-owner pg_advisory_xact_lock first, and the same-name idempotency check runs before the count check so an at-least-once retry of the create that committed as the owner's 50th row still returns its durable receipt instead of a quota error. The 23505 backstop is retained for writes that do not take the lock. * fix(agent): share unstorable-character validation and align skill lookup * feat(agent): add session materials and a fetch_url tool behind the URL trust gate (#1190) * feat(agent): add session materials and a fetch_url tool behind the URL trust gate * fix(agent): harden session material fetching * feat(storage): add an ownership scope to stage documents (#1191) * feat(agent): add material read and search tools (#1192) * feat(agent): add stage read and patch tools (#1194) * feat(agent): add page generation and deck editing tools (#1198) * test(storage): keep the PG contract suite order-independent (#1200) * fix(agent): revoke deleted-session URL authority and reject private ISATAP endpoints (#1199) * fix(storage): revoke deleted session URL authority * fix(ssrf): reject private ISATAP endpoints in strict fetches * chore(storage): bump to 0.11.1 for the session-URL authority fix * feat(agent): add roster and voice registration tools (#1201) * feat(agent): add folder organisation tools (#1202) * feat(api): add stage and material HTTP routes (#1203) * feat(workbench): add the client data layer (#1204) * feat(workbench): add the client data layer * docs(workbench): write the ported comments in English * chore(edit): remove the in-editor agent panel (#1210) * chore(edit): remove the in-editor agent panel * style: apply prettier formatting * fix(agent): report the runtime as unusable without a database (#1207) * fix(agent): report the runtime as unusable without a database * style: apply prettier formatting * feat(agent): add image, video and pptx import tools (#1211) * feat(workbench): add the agent chat surface (#1205) * feat(workbench): add the agent chat surface * docs(workbench): write the ported comments in English * fix(workbench): label the folder and rename tools on the timeline * fix(workbench): label the roster and voice tools on the timeline The reconciliation test iterates every tool the runner registers and requires a display label of its own. The roster and voice-clone tools (list_voices, set_roster, clip_audio, register_voice) reached the integration base with the roster/voice-registration tools but never gained presentation rows, so they fell through to the default branch and rendered their wire names. Port their rows from the reference implementation (labels and i18n keys verbatim) and extend the reconciliation allowlist with ROSTER_TOOL_NAMES and VOICE_CLONE_TOOL_NAMES, so a future tool cannot enter the product without a label. * feat(agent): add the material extraction lifecycle (#1212) * feat(storage): add material extraction lifecycle * feat(agent): execute queued material extraction * style: apply prettier formatting * style: satisfy prefer-const in the extraction runner * test: give material fixtures the extraction lifecycle fields The media-tools slice and the extraction lifecycle slice were each green in isolation but never compiled together: the lifecycle made derivedFrom and extraction required on AgentSessionMaterial while the media-tool fixtures predate them. * chore: remove stray task notes * fix(workbench): label the extraction lifecycle tools on the timeline * feat(workbench): add the workspace shell (#1206) * feat(workbench): add the workspace shell * docs(workbench): write the ported comments in English * i18n(workbench): align workspace keys across locales * fix(workbench): adopt the landed data layer and label the extraction tools - replace the sibling-slice seam stubs with the real data-layer modules - drop ambient declarations now shadowed by landed files - port timeline labels for the extraction lifecycle tools from the reference - align the new i18n keys across all locales * ci: retrigger * feat(api): folder routes, stage-meta viewer surfaces, and the material upload contract (#1215) * fix(storage): restore capability-based stage access * fix(api): bind document access to request owner * fix(agent): restore three-state stage access on the tool layer Port probeStageAccess and the three-state StageAccess (owned / foreign / missing / tombstoned) and gate every stageId-bearing stage tool on an owned probe, mirroring the reference per tool: - move_to_folder, rename_stage, read_stage_outline refuse a non-owned stage with the single not-yours message before touching the store. - The course/DSL toolset and the roster toolset are wrapped by withOwnerStageAuthorization: read_stage, patch_stage, grep_stage and every writer refuse a foreign stage with the same message and refusal shape. - Scene preview keeps its own probe and its own refusal text, and is registered beside the course toolset (never double-gated). - The runner injects one probe factory at the three call sites. Tests: the dsl cross-owner test premise (a foreign stage is readable by id) encoded an invented capability-read policy that the reference does not have at the tool layer; it now asserts foreign read/patch/grep are all refused while the owner still reads. Curriculum cross-owner assertions were already the reference's and now pass with the probes in place. * docs: correct per-file test counts in the fidelity report * test: fix type errors in stage-access fidelity test * test: adapt media-tool and gate suites to the owner-scoped store seam * feat(api): add owner-scoped course-folder HTTP routes Port the reference implementation's /api/folders family (list, create, rename, delete with ungroup/remove modes, and folder membership) onto the owner-bound document store, replacing its provider-based auth with the existing withRequestOwnerId / owner-scoped store seams. The storage package's folder store grows the pieces the routes need: DocumentFolder.order (schema column + max+1 assignment + ordering), renameFolder, deleteFolder(mode) with captured member ids, and setStageFolder(stageId, folderId | null) with idempotent un-filing. FolderNameError moves into folder-name-validation.ts (stage-storage re-exports it, keeping import sites intact). Every route gates on the configured agent runtime (plain 404 when off or unconfigured), keeps the reference's machine codes and envelopes, and is covered by gate tests plus a behavior suite. * feat(api): add stage-meta viewer surfaces for the classroom Port the reference implementation's viewer-facing stage state — can-edit / collected / published / generation-complete — on top of the stage-access base (stage_meta + tombstones). stage_meta gains published_at and generation_complete columns plus a stage_bookmarks table; the reference's deployment-specific origin/claimed_at columns are stripped. New gated routes: GET /api/stage-meta/[stageId] (per-viewer facts, 404 for absent/tombstoned, never returns the owner id), GET /api/stages/[id]/status, POST generation-complete / publish / unpublish (owner-only), POST /api/bookmarks. The resolver lives in lib/server/stage-access.ts. Wiring: a fetchStageMeta client with the reference's three-outcome contract, stage-store isOwner/isBookmarked/readOnly fields (upstream single-user defaults, no-op until the sidecar answers) plus setViewerAccess, the classroom apply path computing readOnly = !(isOwner || isBookmarked), the Stage editability gate, and a sidecar probe after each classroom load. A sidecar 'absent' answer keeps the editable default here because the classroom also serves local-only courses; server writes stay owner-enforced. * feat(api): port the reference material upload contract Rewrite POST /api/materials to the reference implementation's upload shape so the workbench uploader (uploadWorkbenchMaterial, which posts no session id and expects a flat 201 view) works unchanged: owner-scoped upload with mime normalization/validation (415), per-class size caps checked on the declared content-length and the streamed body (413), empty body (400), quota (429), sha256 reserve->store->finalize lifecycle with abandon on failure, flat { materialId, originalName, bytes, mime, extraction } 201, and an x-request-id echo. Adds the owner-scoped material library (owner_material table + quota + 24h lazy sweep, bytes in the host's asset registry as the neutral replacement for the reference's object-storage byte path) and the material cap configuration. The session-scoped GET list is left as-is; the reference's owner-material extraction worker is not ported (the branch's session-material extraction lifecycle already covers extraction). Gate tests now cover all 23 persistence routes across the three runtime env states; the materials behavior suite pins the new contract. * feat(media): add an optional local ffmpeg media extractor (#1213) Adds a local ffmpeg/ffprobe pipeline as a second media extraction provider behind the extractor registry, ported faithfully from the reference implementation: duration probing, keyframe-safe chunking, per-chunk ASR with timeout and deadline budgets, and timestamped transcript assembly. - Availability probing feeds the registry's candidate selection: the provider simply is not a candidate when ffmpeg/ffprobe are absent. - With neither ffmpeg nor a cloud provider configured, extraction fails with an actionable message naming both enablement paths. - Media materials route through the same extraction lifecycle and lease fence as documents; no parallel queue. - Tests inject the executable resolver so the missing-ffmpeg path is the default-tested one; the real pipeline test is skip-if-unavailable. - @openmaic/storage 0.13.0 -> 0.14.0 (media routing in the material lifecycle surface). * feat(storage): per-scene monotonic revisions via database triggers (#1214) * feat(storage): per-scene monotonic revisions via database triggers Restore the reference implementation's freshness granularity: a per-scene monotonic revision maintained by database triggers, so every writer (HTTP routes, agent tools, jobs, manual SQL) bumps it without application cooperation. - Companion revision tables + trigger functions in the storage package's idempotent schema bootstrap, with the lock-order invariant, pg_notify wakeup and the suppression switch for batch writers. - ensureDocumentSchema gained a dollar-quote-aware statement splitter. - The freshness and manifest routes serve per-scene revisions. - Mutation-verified: dropping the triggers turns the revision tests red. - @openmaic/storage 0.13.0 -> 0.14.0. * fix: forward the freshness manifest through the owner-bound store * feat(workbench): add the Pro entry points and preserve the mode-transition semantics (#1208) * feat(workbench): add the Pro entry points * feat(workbench): preserve Pro mode transition semantics * fix(workbench): drop ambient declarations shadowed by landed slices * fix(workbench): drop ambient declarations shadowed by the landed shell * feat: port workspace shell sibling modules Port the 16 leaf modules the Pro workspace shell imports but that were only ambient-declared, replacing the compile-time bridge with real implementations adapted from the sibling-slice reference: pure workbench helpers (session title, rail tab, course-chat bootstrap, created-course tabs, course-tabs memory, workspace navigation, pane navigation, pro-edit sizing, existing-course minting, first-message session), the neutral brand context and course-rename server API, the server-action session delete, the home discovery hook, the classroom pane host with its load-policy leaf, the theme toggle and floating-layer owner, plus the floating-layer-owner wiring the dialog/dropdown/tooltip portals stamp. Also add the workbench-shell locale copy for all 12 locales, port the reference tests for the ported modules, and drop types/workbench-sibling-slices.d.ts now that every declaration has a real implementation. * docs: keep ported comments in English and deployment-neutral * docs: announce 1.0.0 and refresh the feature overview (#1216) * docs: announce 1.0.0 and refresh the feature overview * docs: finalize 1.0.0 README after feature merge * fix(agent): control-plane routes answer 404, not 500, without a database The agent control-plane routes gated only on the runtime flag, so an enabled-but-unconfigured deployment (flag on, DATABASE_URL empty) answered 500 from a store that cannot connect. Gate them on the configured check instead, matching the stage/material routes: the whole surface is cleanly absent until both the flag and the database are present. The status probe keeps reporting both bits. * test: mock both runtime gate exports in the control-plane route suites * fix(agent): abort in-flight TTS on cancel and bound each provider request with a timeout (#1217) The generate_tts / scene-tts path checked the runner's AbortSignal between actions but never created the provider HTTP requests with it, so a session cancel left a hung synthesis fetch in flight until a restart repaired the tool result. Thread the signal end-to-end: TTSModelConfig carries an optional signal, generateTTS combines it with a per-request timeout (TTS_REQUEST_TIMEOUT_MS, default 30s, ported from the reference runtime's TTS bounds) via AbortSignal.any, and every provider fetch (openai, azure, glm, qwen incl. voice-clone + audio download, voxcpm, minimax, doubao, elevenlabs, lemonade) is created with that signal. A timeout now fails the tool call with TTSRequestTimeoutError (a clear retryable error) instead of wedging the session; a caller cancel propagates as the interruption so the runner settles the session as cancelled without a restart. Tests: hung-provider simulation rejects at the timeout with the retryable error; abort mid-flight aborts the captured request signal and surfaces the interrupted shape; removing the signal wiring makes the abort tests fail (red), restoring them turns green. * fix(workbench): PG-mode home listing via owner stages; keep the interrupted terminal course card (#1218) Finding 1: with server persistence on, listStages resolved to the generic GET /api/persistence/documents listing, which the capability model deliberately answers 403 FORBIDDEN_DOCUMENTS for (reads by id, listings owner-only). The home/workspace library now lists through the owner-scoped GET /api/stages surface (same anonymous-owner cookie the workbench uses) when server persistence is enabled; the server-side 403 is untouched. Finding 2: a run interrupted (session_interrupted) and repaired (session_resumed) that ends cancelled before agent_end stranded its pending classroom sightings, so the timeline's terminal card lost the course the answer produced. session_end (cancelled) now flushes the pending sightings into the same course card set agent_end paints, before the stopped caption. * chore(workbench): remove the bookmark concept and the saved-courses drawer (#1219) * chore(classroom): remove the bookmark ('collected') concept entirely The stage-meta viewer port introduced a bookmark surface (stage_bookmarks table, POST /api/bookmarks, the isBookmarked sidecar field, and a readOnly rule that let a saved course stay editable). The product has no such concept, so remove it as a closure: - delete the /api/bookmarks route and the stage_bookmarks table plus its query helpers from the persistence bootstrap - drop isBookmarked from GET /api/stage-meta/[stageId] - simplify the classroom read-only rule to readOnly = !isOwner across the sidecar client, ownership signal, classroom load, stage store and the classroom page - keep publish/unpublish, generation-complete, isOwner and isPublic exactly as they were - update the gate and stage-meta route suites and the README mentions The workspace rail's Bookmark glyphs and comments describe the upstream saved-courses (favorites) section, which is driven by isOwner and renders no collect affordance; they are kept as unrelated homonyms. * chore(workbench): remove the saved-courses drawer UI The first pass removed the bookmark data model but kept the rail's "Saved courses" drawer, judging it a separate surface driven by `isOwner === false`. The home/workspace listing is owner-scoped, so that flag can never occur: `allSaved` is permanently empty and the drawer (plus the collapsed-rail Bookmark mini-button) is a dead affordance. Remove it: the SavedDrawer component and its mount, the savedOpen / savedSection state, the allSaved / matchedSaved derivations, the 'saved' variant of the course-list renderers, the mini Bookmark glyph, the drawer-only CSS, and the drawer's i18n keys from all 12 locales. The courses tab is now exactly one folders tree. The authored/favorites split in workspace-tree.ts goes with it; the tree module no longer reads `isOwner`. The discovery course type keeps the field — the shell still reads it for read-only gating. Upstream has no collect concept; the drawer could only ever render empty here. The reference implementation HAS this drawer (its favorites come from its account system), so this removal is a deliberate upstream product decision, not a fidelity bug. * fix(workbench): restore the attach entry, add the rail settings entry, pin all three entry points (#1221) * fix(workbench): restore the composer attach entry by gating it on the live runtime The AttachButton's rollout probe read a `materialsEnabled` field that this branch's /api/agent/runtime never answers (the materials routes gate on the runtime itself, like the stages), so the gate could never pass and the attach button never rendered — the Pro launch and chat composers showed only the @-mention and enhance glyphs. Substitute the field with the runtime's `enabled` value, which IS the upload action's precondition: POST /api/materials answers 404 whenever it is false, so the render condition now equals the action precondition (no dead button). The button's label (`proMode.attach`) is a user-visible string that becomes visible again; port the reference implementation's own translations verbatim into the 11 locales that still carried the Chinese copy. * feat(workbench): add the settings entry to the rail's bottom-left cluster The reference's rail foot carries a cluster of utilities (its saved-courses drawer, the language switcher, the display toggle). This branch removed the drawer — it could only ever render empty here — and the product decision is to fill that freed spot with the settings entry. Add a settings trigger to the foot cluster (expanded rail, beside the language and display toggles, and on the collapsed strip) and mount the model/provider SettingsDialog in the rail, wired to the trigger. It is the same dialog the classic home opens from its header pill; the workspace had no settings entry of its own, so nothing is duplicated within a surface. * test(workbench): pin the restored upload, attach, and settings entry points Covers the three restored entry points: - the courses-tab upload control: rendered beside the course name filter, wired to the discovery hook's ZIP import trigger, disabled while an import runs, and gated by the same condition as its action (the courses tab); - the composer attach control: an actual render of AttachButton under both probe answers (visible when the runtime says the upload path is live, hidden otherwise), its mounts in the launch and chat composers, the branch's runtime-field substitution in the probe, and the reference's own `proMode.attach` copy in all 12 locales; - the settings entry: the trigger in the rail's foot cluster (expanded and collapsed), beside the language and display toggles, opening the SettingsDialog the rail mounts. * chore(config): the Pro workbench flag implies the MAIC Editor gate (#1223) A workbench build without the editor toggle has no way to edit a course: enabling NEXT_PUBLIC_PRO_WORKBENCH_ENABLED while forgetting NEXT_PUBLIC_MAIC_EDITOR_ENABLED produced exactly that split-brain bundle. The workbench IS Pro mode, so its flag now implies the editor gate; the standalone flag remains for deployments that want the classroom editor without the workbench. Documents both flags in .env.example. * fix(agent): wake SSE tails and the runner on durable deltas (streaming fidelity) (#1222) The Pro workbench chat did not stream: the session/owner SSE routes polled the durable event log on a 5s/30s clock with no wakeup, so message_update deltas (written at 150ms cadence) reached the browser in poll-sized blocks and the thinking strip only mounted after the whole reasoning text had accumulated. Port the reference's LISTEN/NOTIFY delta path: - storage: add in-transaction wake hooks (onSessionEventAppended, onOwnerEventAppended, onCancelRequested) so a host queues pg_notify in the same transaction as the durable append; align readEventsAfterForReplay to rank the bounded page so the first delta after the cursor is always kept (the live tail can never starve). Bump @openmaic/storage to 0.18.0. - app: port the process-wide event-notify bus (dedicated LISTEN client, self-check probe, reconnect backoff; notify through the storage transaction surface), wire the store hooks, subscribe both SSE routes before the initial read with the reference's initializing gate, and give the runner one {kind:'session'} subscription whose wake runs the cancel check and the message drain. Polls stay as the lossy-NOTIFY backstop. - lifecycle: start/stop the bus from instrumentation. Tests: storage hook + compaction contract; route wakeup latency; runner wakeup wiring with a fake agent; bus unit tests; PG contracts proving a real append wakes the routes and a live SSE route forwards a message_update on the wakeup, and that a rolled-back append never wakes. Also fix the pre-existing park-attempt-budget PG test TRUNCATE (missing CASCADE against newer FK tables). * fix(storage): asset writes self-deadlocked against pooled PostgreSQL (#1225) * fix(storage): refuse the non-transactional byte-write deadlock configuration A byte store whose plain write() runs on its own pooled connection cannot be invoked from inside a registry write transaction: after the transaction has claimed the blob-row lock, that write blocks on the lock the transaction just took while the transaction waits on the write - a self-deadlock PostgreSQL cannot detect (one side is idle in transaction). There is no lock-safe ordering for such a writer: bytes must be written after the row claim (writing before it lets the collector delete the bytes while the upsert waits), and any second-connection write after the claim is the deadlock. The configuration is therefore detected and refused: - AssetByteStore gains writesOutsideRegistryDatabase?: true, declaring that the layer's plain byte operations cannot contend for the registry's row locks. - PgAssetStore refuses put()/replace() up front (and defends coordinatedWrite) when the byte store has no writeWith and does not declare the flag, throwing a clear configuration error before any row is claimed. - The collector mirrors the guard on its delete path (deleteWith or a declared out-of-registry layer, else a configuration error). - The object store declares the flag (its out-of-transaction write remains legitimate); the in-registry PostgreSQL byte column provides writeWith / deleteWith instead. - Write transactions (put/replace/remove) set SET LOCAL lock_timeout = 30s so any future lock-contention variant fails loudly instead of hanging. Bumps @openmaic/storage to 0.18.0. * fix(persistence): forward the transactional byte methods through the lazy asset byte-store wrapper The no-bucket case of lazyAssetByteStore returned a bare { write, read, delete } and dropped writeWith/readWith even though the underlying PgAssetByteStore has them. The registry's hasTransactionalWriter duck check then failed and put() fell back to the byte store's own pooled connection, which blocks forever on the blob-row lock the registry transaction just took when the bytes live in the same PostgreSQL - the production self-deadlock. The no-bucket layer is statically PgAssetByteStore, so its transaction-pinned methods are forwarded eagerly (typed against the real signatures via PgForwardedByteStore). The bucket case keeps its lazy-probing semantics: no transactional writer exists there, the signed-URL method stays absent or lazy exactly as documented, and the wrapper now declares writesOutsideRegistryDatabase so the registry may run the plain write inside its transaction. New tests pin the wrapper's transactional capability red-to-green and assert put()/resolve() route byte traffic through the transaction-pinned queryable. * fix(home): cap the generate-prep ingest drain at 3s so Generate never waits the full server budget The classic home flow's Generate click drained in-flight ingests for the full 15s server budget. Cap the wait at GENERATE_DRAIN_CAP_MS (3000ms, documented as a UX bound) and reuse the existing timeout fallback: sources that miss the cap proceed on the legacy byte path and each late-resolving id is released. * chore(storage): bump to 0.19.0 over the concurrently landed 0.18.0 * fix(agent): bound every tool call with a timeout; never resurrect a cancelled session (#1226) * fix(agent): bound every tool call with a global timeout and settle it on cancel A tool await that neither resolves nor rejects wedges the session forever: the lease keeps heartbeating and the driver never reaches its next cancel checkpoint. Race every tool execution (in buildAgent) against a hard budget (OPENMAIC_AGENT_TOOL_TIMEOUT_MS, default 10 min, per-tool overrides for known long runners) and against the caller's AbortSignal, so even a signal-ignoring await cannot keep a cancelled session running. On timeout the call rejects with AgentToolTimeoutError; the agent loop turns the rejection into a structured error tool-result the agent can retry or proceed from, and the abort signal is delivered to the tool's in-flight work through a derived controller. Zombie-tool updates after settlement are dropped. * fix(storage): never re-lease a cancel-requested session; settle it as cancelled on claim The claim scan treated a session with cancel_requested_at set as a normal claim candidate: after a restart it re-leased the same session for attempt N+1 and resumed generating despite the pending cancel. claimNextSession now settles such candidates as cancelled under the claim lock (status cancelled, attempt reset, lease and cancel request cleared, terminal session_end event and owner projection) instead of leasing them, then keeps scanning. Bump @openmaic/storage to 0.18.0. * docs: takeaway-style 1.0.0 announcement with bilingual guide links The 1.0.0 head is now a short takeaway block — badge links to the official user guides (English and Chinese), five one-line highlights, and pointers into Features and the workbench setup section — instead of six dense paragraphs. The detailed provider-neutrality and freshness notes move into the Features workbench section, phrased database- neutrally (the announcement no longer names a specific database). Release date corrected to August 27. * fix(workbench): restore editor chrome, mode transition, streaming, materials, mentions, folders (#1229) * fix(workbench): wire workspace folder routes * fix(editor): restore reference workbench chrome * fix(workbench): persist composer materials and course refs * fix(workbench): preserve live reasoning frames * fix(persistence): back off failed streaming saves * chore(workbench): retire stale slice seams * test(editor): cover element pin layer * chore(storage): bump to 0.21.0 for the user-message ref/material fields * chore(editor): translate ported code comments to English * fix(agent): fence durable tool writes and consume cancel requests atomically (#1230) * fix(agent): enforce provider force-off in agent tools and scrub vendor identity from tool results (#1231) * fix(materials): serialize per-owner quota reservations and make crashed uploads reclaimable (#1232) * fix(editor): resolve dock-bar i18n keys, remove dock height drag, wire element referencing (#1233) * fix(workbench): send the opening session message exactly once with refs intact (#1234) * feat(editor): port timeline TTS preview single-flight and voice-all state latching (#1235) * fix(media): restore the reference classic media chain (#1236) * fix(import): adapt imported PPTX canvas size so decks render without overflow (#1237) * fix(editor): complete element referencing — renderer DOM contract and GenUI picking aligned with the reference (#1238) * test(providers): reconcile the provider-config vendor-token debt count after the main merge The integration line's AK/SK fallback for the managed document provider adds occurrences that main's allowlist snapshot predates. Same mixed-composition debt category the group already documents; no new vendor behavior. * test(providers): reconcile vendor-token debt counts with the integration line The main-merge brought main's neutrality-guard snapshot next to integration features it predates (media-extractor fallback chain, local voice-profile deletion semantics, the enabled-TTS helper). Same debt categories the guard already documents; counts updated to the guard's own tally and two grouped entries added. No new vendor behavior. * fix(agent): carry reasoning through the completions dialect so the thinking strip renders (#1239) * feat(skills): add Feynman and spiral curriculum methods (#1240) * feat(agent): port missing reference tools and skills (parity audit) (#1241) * feat(media): retire asset-registry wiring; media and materials follow the reference byte model (#1242) * fix(classroom): center adapted canvases in the stage and send back navigation home during generation (#1243) * feat(settings): skill management with real list, download, delete, and upload (#1244) * feat(settings): skill management section with real list, detail, and zip download * feat(skills): owner skill delete and upload across storage, API, and settings * fixup! feat(settings): skill management section with real list, detail, and zip download chore: neutralize a reference note in the settings header comment * fix(media): persist origin-independent classroom-media references from the agent runtime (#1245) * feat(editor): float the insert toolbar in the outer frame with collapse (#1246) The insert strip was bounded to the slide card, so it could only ever sit on top of slide content: the card's overflow clipped it and it could not be parked in the padding beside the slide. Move it into the studio frame the element picker's panel already roams (CanvasOverlayPortal + the frame selector), so both canvas overlays share one bounding container and their handles behave the same. While picking, the strip rises over the picker and goes inert, which is the z-order CANVAS_OVERLAY_Z already documents. Add a fold beside the grip: the chevron collapses the strip to that grip row and back, with the buttons unmounted rather than hidden. The fold is session-local state owned by EditShell, next to the drag offset, so a surface swap keeps it; nothing is persisted. Expanding a strip parked at the bottom edge re-clamps through the same bounds rule the keyboard move uses. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(workbench): align the chat timeline's left edge with the composer (#1247) * fix(agent): fence session claims while an ask_user question is outstanding (#1248) * fix(agent): settle-time rescue tracks real delivery instead of a count offset (#1249) * fix(persistence): migrate owner_material to oss_key and drop legacy asset_id (#1250) * docs(readme): surface the 1.0.0 user guide badges at the top (#1253) * fix(workbench): show newly created folders in the sidebar without reload (#1254) * docs(readme): add the release version prefix and drop the opt-in framing * fix(workbench): single-source the chat gutter so timeline and composer share a left edge (#1255) The transcript and the composer each established their own column: their own `px-*` gutter and their own `mx-auto w-full max-w-*` centering wrapper. Equal padding values were never enough, because the two columns are centered inside different containing blocks — the transcript's is a scroll container, whose content box is narrower than the composer footer's by the scrollbar's width: transcript text left = pad + (pane - 2*pad - scrollbar - measure) / 2 composer box left = pad + (pane - 2*pad - measure) / 2 The padding cancels out of the difference and what remains is `-scrollbar/2` at every padding value, so the transcript sat half a scrollbar to the left of the composer and tuning the two paddings against each other could not move it. The column is now established once, by the nearest common ancestor of both (`chatColumn`), and the scroll viewport and the composer footer are siblings inside it that add no horizontal inset of their own. The cap carries the gutter on top of the 760px reading measure, so the text column keeps its width. The handed-over question row drops the padding that indented it past the agent's prose; framed rows keep their own inner padding, which is what a card's border sitting on the column edge means. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(workbench): lock pane-embedded classroom to edit mode (#1256) The workspace right pane painted the full learning chrome — speed control, play button, learner avatars, mic bar — for a course the agent had just created, then flipped to edit once the first scene landed. resolveStageChromeMode treated playback as the DEFAULT branch for a hosted classroom, so every shortfall fell into it: a course whose tab opens at stage_link time has no scenes yet, so currentSceneId is null and isHostedSceneEditable is false. A folded pane parked the playback root behind the fold and cross-faded it out over the pane on unfold, and a failed editor chunk dropped into playback permanently. Lock it at the pane instead of defaulting per entry path: - WorkbenchPanelProvider — the single element that mounts a classroom into the workspace — publishes editPinned (visible && !playback). Every entry path passes through it, so none of them decides. - The hosted resolution can no longer degrade to playback. Start Learning (workbenchLearning, new input, split out from pane visibility) is the one door; everything else resolves between the neutral loading shell and edit. - Stage's chrome dispatch is exhaustive on chromeMode, so the playback root is no longer the else-branch of a condition about the current scene. No flicker: chromeMode is resolved during render, and preloadEditor now answers synchronously (isEditorPreloaded) so a remount with the chunk already registered paints edit on the first frame. A failed import is no longer cached forever, so the lock cannot strand the pane. Standalone classrooms keep their stored mode unchanged. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 19:26:25 +08:00
Nguyễn Lê TrườngandClaude Opus 5	36d6c14a3d	fix(i18n): load every Inter subset so non-Latin text keeps the UI font (#1026) ... `app/layout.tsx` pointed next/font at a single subset file, `inter-latin-wght-normal.woff2`. Only the stylesheets shipped by @fontsource carry the per-subset `unicode-range` declarations, so nothing requested the other subsets and every character outside Latin fell back to an arbitrary OS font — rendering in a different typeface, weight and metrics from the surrounding text, often mid-word. This already affects a shipped locale: `ru-RU` is Cyrillic, and `inter-cyrillic-wght-normal.woff2` was never loaded. `pt-BR` and `es-MX` lose the accented characters that live in `latin-ext`. Declaring the remaining subset files as sibling faces of the same family does not fix it. Faces with identical descriptors and no `unicode-range` are not tried per glyph — the browser picks one — and next/font/local has no way to express `unicode-range`. Importing the @fontsource stylesheet does, so that is what this switches to. `--font-sans` moves to `globals.css` because the family no longer comes from next/font's generated class. The typeface is unchanged: still Inter, now with all seven subsets it already shipped in node_modules. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-03 05:46:15 -04:00
4 people	f378c25a53	feat(storage): route settings/user-profile persist through KVStore (no legacy migration) (#1001) ... * feat(storage): route zustand persist through KVStore The settings and user-profile stores persisted through zustand's default `localStorage` storage, while the rest of the app's small keyed values had already moved to `@openmaic/storage`'s `KVStore` — two unrelated mechanisms over the same browser API, which is the split-brain the storage RFC set out to remove. `kvPersistStorage` shipped with the package but had no importer. Add `lib/store/kv-persist.ts`, the app seam that adapts a `KVStore` into a zustand `PersistStorage`, and wire both stores to it under an explicit `account` scope. Store logic is unchanged: `version` / `migrate` / `merge` still belong to the stores, only the bytes' destination moves. Existing installs are adopted rather than orphaned. On first read the seam moves the raw `localStorage` entry into the KV scope — write first, then drop the raw key, so an interrupted migration leaves the value readable from one side or the other but never from neither. Once KV holds the entry it is authoritative, so a stale raw entry reappearing cannot roll back newer state, and re-running can neither duplicate nor resurrect anything. An entry that is not a readable persist envelope is left exactly where it is. Hydration is now asynchronous, because a `KVStore` may be remote. The browser backend resolves within a few microtasks of the store module being evaluated, so nothing user-visible changes, but tests that assert on persisted state now await `persist.rehydrate()` instead of relying on a synchronous read. The four pre-persist keys (`llmModel` / `providersConfig` / `ttsModel` / `selectedAgentIds`) are deliberately untouched: they are read-only inputs to a migration that never owned them, and `providersConfig` is still read independently by `lib/ai/providers.ts`. Part of #857. * fix(storage): close the async-storage failure modes in the KV persist seam Cross-review found that routing `persist` through an asynchronous store opens failure modes a synchronous `localStorage` never had. Each one below is now covered by a test that fails without its fix. Data loss on a failed or empty hydration. A KV read that threw was indistinguishable from an empty scope, so the store stayed on defaults while an always-on initializer's `set()` persisted those defaults; the next load then read them as a completed migration and deleted the raw original, leaving nothing. Reads now separate "nothing there" from "the backend could not answer": a failed read serves the raw entry read-only, adopts nothing and deletes nothing, and leaves the key unwritable for the session so no un-hydrated state can be persisted over an original. Raw entries are additionally only dropped against a recorded completion marker, so a KV entry of unknown provenance can never authorize deleting the only copy of the user's data. Lost adoption across tabs. A reader whose KV read answered before another tab's adoption write, and whose localStorage read landed after that tab's delete, saw nothing in either place and hydrated defaults. Against a remote backend that interleaving is ordinary rather than rare, so an apparent "nothing anywhere" is now re-checked before it is believed. Out-of-order writes. Two rapid `setItem`s could complete in either order and let the older value win. Reads and writes are serialized per key. Pre-persist migration resurrecting on every load. `migrateFromOldStorage` was guarded by the existence of the raw `settings-storage` key — the very key the migration removes — so once the blob moved into the KVStore it ran on every load and republished whatever the pre-persist keys still held, including API keys the user had since deleted, into first-frame state. It is now the persist layer's last-resort source instead of a synchronous read in the store initializer: its result is adopted like any other migration, so the adopted entry is the marker that stops it. Initial state is plain defaults, and nothing stored reaches observable state before the storage layer has vouched for it. The source keys are still only read, never deleted, since `lib/ai/providers.ts` remains a reader. Also: KV reads and writes are guarded so a corrupt entry surfaces instead of throwing through zustand's silent catch; clearing the cache now clears the migrated stores through their own storage, which a server-backed scope would need and a blanket `localStorage.clear()` would only appear to do; `removeItem` drops the KV copy before the raw one; and the e2e suite gains post-migration steady-state coverage, which every existing spec missed by seeding the pre-cutover key. Part of #857. * fix(storage): scope migration bookkeeping to the device, gate writes on call Second review round. The findings shared one root cause: two of the three sentinels recorded a fact about *this machine's* files but were stored beside the data, in the store's own scope. Under a syncing `account` backend that is a category error with teeth — one device's history would travel to another and authorize deleting files it says nothing about. Sentinels are now always `device`-scoped and carry a reserved `__` prefix, whatever scope the store uses. The worst combination this closes: device A migrates, its marker syncs, device B — which has never run this build — loads and deletes the raw entry that is still the only copy of its own settings. A test drives exactly that sequence against two devices sharing one account scope and nothing else. The pre-persist fallback gains a device sentinel of its own. Its source keys are device-local and deliberately left in place, so "KV and raw are both empty" was not a safe trigger: clearing the account entry, from the cache button or a server-side wipe, let any device re-read those keys and republish credentials the user had rotated. It is now consulted at most once per device, and `removeItem` deliberately does not clear that sentinel — clearing the entry is precisely the case it exists for. The fallback also no longer writes the adoption marker: that marker is a licence to delete a raw persist entry, and the fallback has adopted no such thing. Were it written, a raw entry later restored by an older bundle would be deleted unread. The write gate is now read when `setItem` is called rather than when its queued turn arrives. Evaluated inside the queue, a write issued during hydration waited behind `getItem`, found the gate opened by the very read it raced, and persisted its pre-hydration snapshot on top of the stored value. Refused writes are no longer a dead end: the first one asks the store to rehydrate, since the backend may have recovered, and if that does not work the user is told through a durable notice rather than losing every change on reload. Each refusal is logged, not just the first — a once-per-session warning hides how long a session has been silently unsaved. `removeItem` now propagates backend failures, so clearing the cache cannot report success for a clear that did not happen, and that flow reloads immediately instead of leaving a window in which a background `set()` re-persists the credentials just deleted. Also: the recovery hook is bound after each store is constructed, because naming the store inside its own definition made its type circular and silently widened every selector to `any`; the `serial` comment no longer claims an unreachable rejection handler; and the pre-persist version stamp documents that it skips `migrate`'s unversioned normalization too, which `merge` redoes anyway. Part of #857. * refactor(storage): make the KV persist seam a per-key state machine Three review rounds kept turning up the same defect class in new places: a backend failure read as "there is nothing there", and the result of an operation that nobody looked at. Patching instances of it was not working, because both are possible whenever a call site is free to decide for itself what a failed operation meant. This makes that decision unavailable to call sites. Every backend call now returns an `Outcome` whose payload is a private field and whose only reader demands a `KeyState`. Feeding the machine is not a convention to remember; it is the only way to get the value out. What comes back is the value or `UNAVAILABLE` — deliberately not `null`, so "the backend could not answer" is not spellable as "nothing is there". The machine then decides, in one place, what failure means: any read failure is unavailability, any write failure closes the key, and either raises the health signal and asks for recovery. The scattered closure flags (a settled set, a warned set, a recovery latch) become one explicit phase per key — unhydrated, settled, unavailable, clearing — with the transition table written out in the docstring and a test per row. What that consumes: - A write failing after the key settled used to be ignored; its outcome now closes the key, signals, and the value is remembered for replay. - `removeItem` enters `clearing` synchronously at call time, so a `set()` racing a clear cannot be admitted, queue behind the delete, and write the just-deleted value back. Nothing is replayed across a clear. - The pre-persist sentinel is recorded by *every* settling path, not only the one that consults the old keys. A device that had only ever loaded an already-populated account entry recorded nothing, and so stayed eligible to republish its own stale credentials the moment that entry was cleared — which the docstring already claimed it would not. - Two places treated a failed read as an answer: the sentinel read that decides whether the fallback runs, and the confirming re-read before adopting. Both now stop. - An adoption whose marker did not land no longer settles, and never deletes the raw entry: no proof, no licence. - Refused and failed writes are remembered and replayed once storage recovers, but only when the store was holding real data at the time — replaying a snapshot taken over defaults would overwrite the stored value, which is the failure this seam exists to prevent. When a snapshot cannot be replayed the user is told, because rehydration is about to discard those edits. - Health notices publish on a later task, so a recovery that lands moments later cancels a warning nobody should have seen, and a subscriber mounting after the failure is caught up once its toast host exists. `StorageHealthNotice` now sits after the `Toaster` for the same reason. Also: adoption re-reads before committing so a concurrent write is not rolled back; a shadowed raw entry is only deleted if it parses, matching the promise never to delete bytes we could not read; the unavailable copy points at the control that resolves it rather than suggesting a reload that cannot; and the version pin, the pre-persist retention rationale, and the cache-clear comment say what is actually true. Part of #857. * fix(storage): separate the contexts settle() was conflating Convergence round on the state machine. The findings share a root: settle() treated every read that concluded as licence to open the key, without asking what else was true at the time. - A read finishing while a clear is outstanding no longer settles. Under a remote backend a recovery rehydrate in flight during a clear is ordinary, and opening the gate there admits a write that queues behind the pending delete and restores the credentials just removed. Only finishClear opens a cleared key. - The raw entry served read-only after a failed read no longer counts as the authoritative value. A shadowed raw entry is by construction the older copy — long-term coexistence with a newer KV value is a designed state — so an edit taken against it must never be replayed, or one transient read failure on one device rolls the whole account back. - A write that lands supersedes an earlier failed one. Both were admitted before the key closed, so the queue ordered them; replaying the older snapshot on recovery would undo the newer value. - Unreachable browser storage is a failure, not an empty store. Privacy modes make localStorage throw; treating that as "nothing stored" hydrated defaults, refused every write and said nothing until the user reloaded and found the work gone. SSR stays a silent no-op. - The recovery latch re-arms when storage answers, so the three recovery transitions are not empty promises from the second failure onward. - A refusal carries the phase it happened in. Cold-start timing — an always-on initializer writing before the first read resolves, on a backend that never failed — is a log line, not a sticky red toast; only a refusal under `unavailable` reports lost changes. The health channel stops delivering stale catch-ups: its timers are cancellable and re-read the current state when they fire, so a recovery cannot be overtaken by a warning with nothing left to dismiss it. And `changes-lost` is now a fait accompli rather than a condition — a later recovery has nothing to retract and leaves it standing. Also: a throwing `localStorage` is unavailability rather than absence wherever the raw entry is read; clearing records the pre-persist sentinel like every other settling path, making that docstring true; the raw entry is dropped before the marker so a failed marker clear leaves something inert; and the pre-persist fallback and its four source reads can no longer throw into zustand's silent catch. Part of #857. * fix(storage): hold a replay until it lands, and prove a raw copy before deleting it Three failure-path corners. A replay was retired the moment its write was attempted. Readable but not writable is a real state — a quota-exhausted backend answers reads perfectly — so a recovering read could succeed, the replay write fail, and the snapshot be gone with nothing owed: the next rehydrate served the older stored value over the user's edit and said nothing. The snapshot is now held until the write is durable; a failed replay goes back to being a refused write, so the next recovery tries again and a permanent failure is eventually reported. The adoption marker was treated as proof that a raw entry is the migration's leftover. It proves only that a migration happened on this device once. A rolled-back deployment, or a tab still running the old bundle, writes the raw key again with settings the migration never saw, and the next load on the new bundle deleted them unread. A raw entry is now dropped only when its content equals the value shadowing it — anything else is data, and keeping a copy beats deleting an original here as everywhere else in this file. `changes-lost` was being cancelled by a later recovery. The two statuses answer different questions: "storage is down" describes the world now and stops being true when storage works, while "your edits were lost" describes something that already happened and no amount of recovery undoes. They are now tracked on independent lines per key and rendered as two toasts with distinct ids, so retracting the fault cannot take the acknowledgement with it; the loss notice goes away only when the user closes it. Part of #857. * fix(storage): bound recovery, keep a live store from walking backwards Three interactions the state machine did not have an answer for. Recovery had no budget. A backend that reads but cannot write — a quota-exhausted one does exactly that — turned it into a treadmill: the recovering read succeeds, the key settles, the replay write fails, and that failure asks for recovery again, forever. Attempts now follow a backoff schedule whose length is the cap, and the budget is re-armed only on real progress: a settle that left nothing owed. A settle reached *by* a recovery with a replay still queued is not progress, and counting it as such is precisely what made every lap look like a fresh start. When the budget runs out the key is left read-only and the loss is reported, rather than retrying where nobody can see it failing. A failed read could walk a live store backwards. Once a session has loaded the authoritative value, a transient read failure was still falling back to the shadowed raw copy — which is legitimately older, and legitimately long-lived now that a differing raw entry is kept rather than deleted — and handing it to zustand overwrote a live store with stale data. Worse, the store had already latched "holding real data", so edits made on top of that stale value counted as replayable. A failed read after an authoritative one now returns nothing, which is exactly "keep what you have", and the raw fallback stays where it belongs: the case where nothing authoritative has been seen at all. Dismissing a lost-changes toast only closed the UI. The key stayed in the lost set, so the same store losing changes a second time was swallowed as a duplicate and any later subscriber resurrected a notice the user had already dealt with. The close button now clears the latch, so a second loss is reported and an acknowledged one stays gone. Part of #857. * fix(storage): close the last two provisional and clear-ordering gaps An abandoned migration was handing back an authoritative value. When the confirming re-read fails, or the adoption write does, `adopt` returns the raw envelope unadopted — the same footing as the raw copy served after any other failed read — but it was returned bare, so the store latched "holding real data" and an edit taken on top of it counted as replayable. Another device publishing to the account scope in that window would have been rolled back. `adopt` now reports provisionality like every other read path, and the shape is a named `LoadedValue` so the next path cannot forget. Clearing swallowed a failed raw-entry deletion. The account entry was already gone by then and the marker was cleared afterwards, so the operation reported success while leaving an empty scope beside a live raw entry — precisely the shape the next hydration re-adopts, handing back the settings the user had just deleted. The raw entry now goes first and its failure propagates, which also fixes the ordering: failing before anything is removed leaves the KV value authoritative and the clear simply unperformed, which the caller can retry. Adoption keeps the tolerant variant, where a leftover raw entry is a duplicate rather than a loss. Part of #857. * fix(storage): make the shadowed-raw delete atomic against a concurrent tab cosarah reproduced a data loss: both raw-entry deletes verified the value, then awaited (reading or writing the adoption marker), then removed the key by name. A tab running an old bundle — which takes no Web Lock, so a lock could not have helped — overwrites the raw key with newer settings during that await, and the unconditional `removeItem` then deletes the newer value. The raw side is synchronous `localStorage`, so the fix needs no lock. Both deletes now finish every await first, then run a single synchronous compare-and-delete: re-read the raw bytes, and remove only if they still equal the exact string that was verified. A competing tab is a separate context whose writes surface here only at event-loop boundaries, so its write lands wholly before the re-read (seen — bytes differ — kept) or after the remove, never in between. A changed value is newer data, not a migration leftover, and is kept. Both sites cosarah named are covered: the shadowed-cleanup path (`dropShadowedLegacy`) and the adoption cleanup in `adopt`. `readLegacyEntry` now carries the exact bytes alongside the parse so the re-check is byte-exact rather than comparing a re-serialized value. The clear path's delete is unchanged: it is a deliberate full delete, not a conditional leftover cleanup. Part of #857. * fix(storage): stop deleting the raw entry — adopt by copy (Plan B) Maintainer decision after cross-vendor + red-team review: `localStorage` has no cross-process atomic compare-and-delete (the storage mutex was dropped from the spec), so a tab on an old bundle can insert a write between our re-read and our removeItem in a genuinely parallel process. The synchronous compare-and-delete narrowed that window but could not close it — as its own comment admitted. Since the raw-cleanup cannot be done safely on localStorage while an old bundle may be live, this stops doing it. Adoption is now a copy: the value is written to KV and the raw entry is left in place. The delete race is therefore impossible — there is no delete. KV stays authoritative (once it holds the value, reads take the KV path and never consume the raw one), so the shadow duplicate is inert, left for a wholesale raw-cleanup at migration exit. Removed with the two deletes: - `dropShadowedLegacy` (its only job was the gated delete) and its three call sites. - `deleteLegacyIfUnchanged` and the `{raw,value}` shape of the legacy read (`readLegacyEntry` → back to `readLegacy` returning the value). - The adoption marker (`__persist-adopted:`), whose only reader was that delete gate. It did not prevent re-adoption — the presence of the KV value does — so removing it breaks no invariant. `dropRaw` / `expectedRaw` on `adopt` and the marker-clear step in the clear path go with it. The clear path (user deletes all data) still deletes the raw entry strictly — that is a deliberate full delete, not a migration cleanup. Tests: the delete/marker cases become "the raw shadow always survives, KV is authoritative"; a two-device and an old-bundle-concurrent-write case guard it, and re-adding a delete on either adoption path turns them red. Part of #857. * fix(storage): add a monotonic migrated marker to stop shadow resurrection Cross-vendor + red-team review independently caught a P1 the previous "adopt-as-copy" revision introduced. Because the raw entry is now kept and writes only ever reach KV, the raw copy becomes a frozen pre-cutover value. If the account KV is later emptied by something other than a local clear — a server-side wipe, an account switch, KV eviction — the next load saw `stored === null` beside a live raw entry and re-adopted that stale copy, refilling the wiped account with ancient settings/credentials and syncing them to every device. Deterministic, not a race; it would fire once a server-backed account backend exists. Root cause: "keep the raw entry" inherently requires a record that it has already been migrated, so an empty-KV load can tell "first migration" from "external wipe". Removing the old delete-authorization marker in the copy revision dropped that record — Plan B was only half done. Adds a monotonic, device-scoped `__migrated:<name>` marker: - Read on every load. `stored === null` + raw present + marker set ⇒ respect the wipe, do not adopt (fall through to the confirm re-read, so a concurrent repopulation is still served). Only a genuine first migration (no marker, raw present) adopts. - Written best-effort after a successful KV write. A failed write degrades to the KV value's own presence check, so resurrection needs both a failed marker write and a later external wipe. - Read failure fails closed (do not adopt), never "assume not migrated". - Monotonic: only ever set true, cleared only by a deliberate full clear — no compare-and-delete race, which is why it is safe where deleting the raw entry was not. Live state with a real reader, not the delete-authorization marker removed earlier. The clear path clears the marker too (back to a genuine first-load state); best-effort, since with the raw entry already gone a leftover marker is inert. Tests: resurrection guard (external wipe does not re-adopt; concurrent post-wipe write is served; first migration records the marker; marker read fails closed) + the clear-path marker clearing. Mutation-checked: removing the gate resurrects the shadow, dropping the record leaves it unguarded. P3: the inert `__persist-adopted:` test rot is retargeted to the real `__migrated:` path. Part of #857. * refactor(storage): remove automatic legacy migration — pure KV wiring Maintainer decision (terminal): after repeated review rounds kept finding new P1s in the legacy-adoption path — its state space is too large to keep correct — the PR is narrowed from "migrate + wire" to "wire only". Settings and user-profile persist through the KVStore; pre-cutover data is not migrated; an upgrading user reconfigures once (the data is reconstructable and the cost is one-time). Removed the entire legacy-adoption subsystem from the adapter: - `adopt()`, `readLegacy()`, the `legacyStorage` dep, and the raw-fallback read on a failed KV read. - The `__migrated:` marker and its resurrection guard, the confirm-re-read, and the `provisional`/`LoadedValue` machinery. - The `prePersistFallback` dep, `recordPrePersistHandled`, the `__pre-persist-consulted:` sentinel, and `readSentinel`/`writeSentinel`. - In settings.ts, `readPrePersistSettings` (the llmModel/providersConfig reader wired as that fallback) — reading legacy keys is migration, which this PR no longer does. `lib/ai/providers.ts` still reads `providersConfig` independently, so those source keys are left in place. The adapter now reads and writes the KV scope and touches no legacy key: an empty scope hydrates the store to defaults (ordinary zustand). `load()` is a single KV read; a failed read stays unsettled so defaults are never persisted over an unread value; the clear path removes only the KV entry. Kept, because they are async-storage *steady state* a remote KV backend needs, not migration scaffolding: the KeyState machine (hydration gate, write gate, recovery, replay), the Outcome discipline, per-key serialization, and the persist-health channel. Added `purgeLegacyPersistKey`: a best-effort, fire-and-forget removal of the old raw persist blob, called once by each store. Never read, so a leftover is pure garbage — and the old settings blob held plaintext provider API keys, so clearing it is a small security win. Net: the adapter drops ~460 lines. Tests are rewritten to steady-state KV coverage plus an explicit "old raw key is ignored, not migrated" proof at the store level; the e2e seed fixtures move from the raw key to the KV scope key. Part of #857. * docs(storage): align README and comments with the no-migration behavior Follow-up requested on the approved PR: the migration/adoption logic was removed, but a few comments and one README roadmap line still referred to those deleted concepts. Documentation only — no behaviour change. - README roadmap: the settings/user-profile line said "adopting their pre-cutover raw keys"; it now states there is no automatic migration (legacy keys ignored and best-effort purged, users reconfigure once). - kv-persist.ts: the per-key serial chain comment no longer claims to keep "adoption" from interleaving; it serializes a key's read/write/clear. - settings.ts: `SETTINGS_PERSIST_VERSION` no longer documents a "pre-persist fallback" that no longer exists. - Test/fixture headers that described seeding "the pre-cutover raw key" for "one-time adoption" now describe seeding the KV `account` scope, with no legacy-key migration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(storage): bump version to 0.1.1 for README doc alignment The README is a publishable input, and the no-migration doc alignment changed it, so the package version must increase. Patch bump: documentation only, no code or API change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: wyuc <zdq1204@gmail.com>	2026-07-30 15:12:51 +08:00
wyuc	7cb129183d	chore(packages): publish the @openmaic/* SDK family to npm (#778) (#780) ... * chore(packages): publish the @openmaic/* SDK family to npm (#778) Prepares the @openmaic/{dsl,renderer,importer} family for its first npm publish, and moves the SDK packages onto the @openmaic scope. Why the scope move: the @maic org name is unavailable on npm (an unscoped `maic` package already holds the name), so @maic/* is not claimable. @openmaic matches the project name, the scope is free, and the repo already ships an @openmaic/docs package — so the SDK family now lines up with that convention. - rename @maic/{dsl,renderer,importer} -> @openmaic/* across packages, the workspace glob, the package dir, and all import sites; lockfile regenerated - renderer: add publishConfig (public, registry.npmjs.org) — was missing, so a scoped publish would default to the wrong registry / restricted access - importer: add a files allowlist (dist, README, LICENSE) and drop the fragile .npmignore blacklist that shipped src; add an exports map so ESM consumers resolve dist/index.js instead of falling back to the .cjs main - all three: add a prepublishOnly build (+ test/typecheck) guard so a publish can never ship a stale or empty dist - add a tag-triggered publish workflow with npm provenance, pinned by name to the three @openmaic packages so the vendored forks (mathml2omml, pptxgenjs) are never published Refs #778, #720 (Phase 1). * fix(packages): address cross-review on the @openmaic publish prep Cross-review (Claude /code-review + codex) on this PR surfaced: - renderer's advertised CJS entry was broken: it keeps @openmaic/dsl external and imports a runtime enum from it, but dsl is ESM-only (no `require` condition), so `require('@openmaic/renderer')` would throw ERR_PACKAGE_PATH_NOT_EXPORTED. Make renderer ESM-only: drop the `.cjs` rollup output, `main` now points at the ESM build, and the `require` conditions are removed from `exports`. (importer is unaffected — it bundles dsl, so its CJS build still works.) - prepublishOnly re-ran the test suite during `pnpm -r publish`, so a flaky test after dsl had already published gave a non-atomic partial release. Reduce prepublishOnly to a build-only guard (never ship stale/empty dist) and move the real test/typecheck gate into the workflow, before any publish. - document that an @openmaic/* tag publishes the whole family via `pnpm -r` (pnpm skips already-published versions); the tag is a release marker, not a per-package gate. Verified: dsl + renderer + importer build; renderer emits ESM only (0 .cjs), all exports entries resolve; `npm pack` ships dist + README + LICENSE with no src leak; frozen-lockfile passes. Refs #778. * style: reflow @openmaic/dsl type imports past print-width after rename The @maic -> @openmaic rename lengthened two single-line type imports past prettier's 100-col width; prettier --check flagged them. Pure formatting. Refs #778. * docs(importer): mark @openmaic/importer browser-only (cr-loop accepted limitation) codex cross-review flagged that the published @openmaic/importer throws `XMLHttpRequest is not a constructor` when loaded in a pure Node process — its rollup build is browser-targeted (`nodeResolve({browser:true})` + a browser pdf.js build). The app only consumes it client-side ('use client'), so this is by design. Document it as an accepted limitation: prominent browser-only note in the README and a `browser` field in the manifest. Refs #778.	2026-06-24 15:12:23 +08:00
3 people	7bb9e864ae	feat(packages): introduce maic-import and maic-renderer workspace packages (#668) ... * feat(import): add pptxtojson-pro workspace package and stage-1 PPTX import Vendor the TypeScript pptxtojson-pro parser as a workspace package, sync its bundle to public/vendor at install time (avoids Turbopack dynamic require issues), and wire a home-page import hook that parses files for inspection. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(import): extend pptxtojson-pro with PPTX → Slide[] pipeline `importPptx` now turns a .pptx file directly into canvas `Slide[]`, optionally uploading every base64 image and blob-backed media via a caller-supplied OSS callback before resolving. - Vendor OpenMAIC slide types and shapes config into `src/openmaic/` so the bundled dist is self-contained and loadable via `/vendor/` URL under Turbopack; add stubs for `resolveFont`, `getSvgPathRange` and `parseVideoCodec` until the real PPTist helpers are ported. - Move `import-pipeline/` under `src/` and re-export `importPptx`, `parsedToSlides`, `OssUpload`, `ImportPptxOptions` and `CanvasSlide` from the package main entry. - Add `nanoid`, `katex` and `pptxtojson` as runtime deps of the package. - Update `useImportPptx` to accept `upload` / `onImported` and return the converted `Slide[]`. - Document the new API surface, error semantics and Turbopack workaround in the package README. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(slide-renderer): package skeleton (rollup + tsc + empty index) Workspace package scaffolding: package.json with peer deps (react/react-dom/motion/tailwindcss), rollup ESM+CJS config, tsconfig (strict, jsx react-jsx), and empty entrypoints under src/. Verified: pnpm --filter slide-renderer build produces dist/{index,elements/index,types/index}.{js,cjs,d.ts} (empty chunks are expected at this stage). * docs(slide-renderer): DESIGN.md + README.md * feat(slide-renderer): copy Slide/Element types + add effects types * feat(slide-renderer): add utils (geometry simplified to elements API, element ranges, cn) * feat(slide-renderer): shared element hooks (fill/outline/shadow/flip) + ElementOutline * feat(slide-renderer): BaseTextElement * feat(slide-renderer): BaseShapeElement + GradientDefs + PatternDefs * feat(slide-renderer): pure <img> BaseImageElement, decouple OpenMAIC media business The base component drops: - useMediaGenerationStore / isMediaPlaceholder (AI media generation polling) - useSettingsStore (imageGenerationEnabled toggle) - useMediaStageId / retryMediaTask (classroom-scoped retry orchestration) - useI18n (placeholder/error/disabled copy) - skeleton / error / disabled render branches Retains: clip / filter / outline / shadow / colorMask, output <img src={elementInfo.src}>. Adds a `renderImage` slot so consumers can re-inject business behavior (placeholders, retry buttons, custom src resolvers) without modifying the package. * feat(slide-renderer): Line / Table / Latex / Code base elements - Line + LinePointMarker: copied with stroke-draw animation intact - Table + StaticTable + tableUtils: copied with getTableSubThemeColor moved to package utils - Latex: katex HTML + legacy SVG fallback, no business deps - Code: shiki-based syntax highlighting (dynamic import); shiki added as optional peer dependency so consumers without code slides pay zero install cost * feat(slide-renderer): BaseChartElement + Chart + chartOption (echarts as optional peer) * feat(slide-renderer): pure <video> BaseVideoElement, decouple OpenMAIC media business Drops: - useCanvasStore (playingVideoElementId / pauseVideo) - useMediaGenerationStore / useMediaStageId / retryMediaTask / getVideoMediaRefForElement - useSettingsStore (videoGenerationEnabled) - useI18n, motion/react animate scope - skeleton / error / disabled / placeholder branches Retains <video src controls preload=metadata>. Adds a `renderVideo` slot so consumers can re-inject orchestrator-driven playback or placeholders. * feat(slide-renderer): canvas hooks (useSlideBackgroundStyle, useViewportSize simplified) - useSlideBackgroundStyle: copied as-is (no business deps) - useViewportSize: rewritten to take viewportSize/Ratio/canvasPercentage as args, drop useCanvasStore, drop editor-only canvasDragged/dragViewport, return fitScale instead of writing to a store * feat(slide-renderer): 4 effect overlays (Highlight/Spotlight/Laser/Zoom), props-driven All overlays now receive element/geometry/options through props instead of reading useCanvasStore. SpotlightOverlay uses a configurable element-id prefix (default 'slide-element-') to locate DOM nodes for measurement, matching the convention SlideElement will set in T14. HighlightEffectOptions extended with color/opacity/borderWidth/animated to surface the original visual knobs through the public API. * feat(slide-renderer): SlideElement dispatcher with renderImage/renderVideo slots * feat(slide-renderer): SlideCanvas v1 main entry (props-driven, auto-fit viewport) Mirrors ScreenCanvas structure but reads from props: slide.elements, slide.theme, props.background ?? slide.background, props.scale ?? autoFit, props.effects. Auto-fits viewport into container by default via useViewportSize+ResizeObserver; pass scale=1 to opt out and render at slide-native dimensions. * feat(slide-renderer): SlideRendererProvider + useSlideContext (props or context) SlideCanvas now reads from context as a fallback when props are omitted. Allows the wrap-then-compose pattern from spec §3.2: provider holds shared data, sibling overlays read via useSlideContext. * feat(slide-renderer): aggregate public exports Main entry exposes SlideCanvas, SlideElement, Provider/hooks, effects, hooks, utils. `slide-renderer/elements` re-exports all 9 Base*Element + shared ElementOutline/useElementXxx for granular composition. `slide-renderer/types` already lived in src/types/index.ts. * docs(slide-renderer): complete README (install / quickstart / API / effects / Tailwind setup) * feat(demo): /slide-renderer-demo route exercising the workspace package Hand-written single Slide with shapes + text demonstrates the v1 API end-to-end: - props-driven SlideCanvas - auto-fit viewport via parent container - gradient background, shape outline + text fill Wires slide-renderer as a workspace dep and registers its dist as a Tailwind @source so utility classes inside the package get picked up by the host PostCSS pipeline. * feat(pptxtojson-pro): align imported Slide JSON with renderer contract - Drive `viewportWidth` from the deck's actual pixel width (json.size.width × ratio) instead of the legacy 960 default, so 16:9 widescreen decks no longer get text element widths clamped to 4:3 dimensions (e.g. titles truncated to 842px and forced to wrap). Per-slide `viewportSize` now reports the same value, keeping transform-time and render-time aligned. - Replace the pass-through font STUB with real resolution: 22-font self-hosted whitelist + alias map (微软雅黑/等线/宋体/楷体/仿宋/Arial/etc.) → 5-category primary font mapping, so unknown PPT fonts fall back to a rendered open-source equivalent and the pipeline can surface the replacement via `replacedFonts.fallback`. - Translate cell `vAlign` from PPT-native (`up`/`mid`/`down`) to CSS-native (`top`/`middle`/`bottom`) at the importer boundary, so the renderer can transparently pass it through to `vertical-align` / `justify-content` without per-component conversion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(slide-renderer): drop Tailwind defaults, data-drive styles, ship fonts Three intertwined changes that together make the package self-contained and align it with the "slide JSON is the single source of visual truth" contract. 1. Remove Tailwind utility classes from every element renderer. - Replace `className="absolute ..."` / `className="rounded ..."` etc. with inline `style={{ position: 'absolute', borderRadius: ... }}`. - The few rules that can't be expressed inline (descendant selectors, keyframes, browser-default <p> margin reset) move to a new `src/styles.ts` injected once by `<SlideCanvas>` via `<style>`. Named animation classes (`slide-renderer-pulse` / `-ping`) replace `animate-pulse` / `animate-ping` so consumers don't need Tailwind. 2. Strip renderer-level positive defaults; surface them as data fields. - `BaseTextElement`: drop hardcoded `overflowWrap: 'break-word'` and the `paragraphSpace ?? 5` fallback. `--paragraphSpace` is only set when defined in data; CSS `var()` fallback is 0. - `StaticTable`: drop hardcoded `padding: '5px'`, `verticalAlign: 'middle'`, `wordBreak: 'break-word'`. Extend `TableCell` with `padding?: string` and `vAlign?: 'top' | 'middle' | 'bottom'` so PPT-extracted padding / vertical alignment flow through unchanged. - `PPTTableElement` gets `rowHeights?: number[]` (per-row min-height; content can still grow rows). - Reshape `<td>` to match the classroom Vue layout: outer `<td>` carries only border + textStyle; inner `slide-renderer-cell-text` <div> is a flex column with `min-height = rowHeight - 4`, `padding = cell.padding`, `line-height: 1`, `justify-content` from `cell.vAlign`. Add `.slide-renderer-cell-text p + p { margin-top: 0.4em }` to give adjacent paragraphs breathing room without breaking the reset. 3. Self-contained font shipping. - Move the 22 woff2 files into `packages/slide-renderer/fonts/`. - Ship a sibling `fonts.css` with @font-face declarations using relative `./fonts/<name>.woff2` URLs. - Expose both via `package.json` exports (`./fonts.css`, `./fonts/*`) and the `files` array. - Consumer adds one import (`import 'slide-renderer/fonts.css'`); the bundler resolves the relative URLs against the package and emits each woff2 as a static asset. Removes the dependency on consumer- owned `app/globals.css` @font-face blocks and `public/font/` copies. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(demo): wire slide-renderer fonts and swap demo to a table-heavy slide - Import `slide-renderer/fonts.css` in the root layout so consumer apps pull the package's self-hosted @font-face declarations and woff2 assets through Next.js' static-asset pipeline. - Replace the hardcoded `demoSlides` array (24 mixed-element slides) in `/slide-renderer-demo` with a single 5×7 table-heavy slide so the demo exercises the new `TableCell.padding` / `TableCell.vAlign` / `PPTTableElement.rowHeights` fields and the flex-based cell layout. Convert the legacy `vAlign: 'up' | 'mid' | 'down'` values to the CSS-native `'top' | 'middle' | 'bottom'` form the renderer now expects. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(slide-renderer): add slideToPng standalone snapshot util Exposes a new `slide-renderer/snapshot` sub-export with `slideToPng(slide, options)`, the foundation for the AI-driven visual diff loop (snapshot the rendered slide, compare against PowerPoint's own PNG export, decide whether a discrepancy belongs to the import algorithm or the renderer). Implementation notes - Mounts `<SlideCanvas>` into an off-screen container sized exactly to the slide's native pixels, so `useViewportSize` collapses to a 1:1 render (no scale offset). - `flushSync` for the initial commit so the snapshot doesn't fire on an empty container; `requestAnimationFrame` × 2 to let the ResizeObserver settle; then waits for `document.fonts.ready` and every `<img>` in the container (with a configurable `timeoutMs`, default 5s). - Snapshots the SlideCanvas root (`container.firstElementChild`) rather than the outer wrapper — html2canvas-pro's bounding-box math otherwise leaves white edges or drops absolutely-positioned children. - Uses `html2canvas-pro` instead of `html-to-image`: the latter's SVG `<foreignObject>` path loads embedded woff2 asynchronously, so the drawImage fires before fonts decode and text re-wraps in the fallback font. html2canvas-pro walks the DOM and inherits the parent document's font registry, keeping wrap positions identical to the on-screen render. - `onclone` hook injects a small CSS reset (`font-kerning: none`, `font-feature-settings: normal`, `font-variant-east-asian: normal`, `text-rendering: geometricPrecision`) scoped to the slide tree, to prevent html2canvas-pro's CJK text measurement from clipping full-width punctuation (e.g. `（` / `）`) past cell boundaries. - Default `pixelRatio` follows `window.devicePixelRatio` for retina-sharp output; consumers can override. - Optional `debugVisibleMs` briefly shows the off-screen container after snapshot so callers can compare what was captured vs the live render. Wiring - Sub-export added to `package.json` (`./snapshot`) and Rollup `entries` for tree-shaking — apps that don't use snapshot don't pay the `html2canvas-pro` bundle cost. - Demo route adds an "导出 PNG" button that calls `slideToPng` on the active slide and triggers a browser download. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: build slide-renderer in root postinstall Without this, fresh installs leave packages/slide-renderer/dist missing and Next.js fails to resolve the `slide-renderer` import. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(parser+renderer): iteration-0601-002 fidelity fixes Parser (pptxtojson-pro): - shapeSerializer: stop painting parent fill on grpFill children; honor explicit <a:ln><a:noFill/></a:ln> over theme lnRef (master logo dots were rendering as visible green rings). - imageSerializer: detect custGeom ellipses and 8-vertex chamfered-rect photo frames; resolve to 'ellipse'/'octagon' instead of falling back to 'rect'. - textSerializer: emit text-shadow from rPr effectLst > outerShdw, and compensate the half-leading PowerPoint puts above the first line for unitless lnSpc > 1 (cover-title gap regression). - border/tableSerializer: pass rgba()/hsla() colors through ensureHex untouched so '#rgba(...)' never reaches the DOM. - transformParsedToSlides: drop the 1.1 SAFE_PADDING wrap-fudge and thread bodyPr@anchor through as vAlign. - font config: add 思源黑体/思源宋体 + Source Han aliases and a trailing region/weight suffix stripper so 'SourceHanSerif CN Light' resolves. Renderer (slide-renderer): - SlideCanvas: new chrome prop (default true) to opt out of the preview-only card shadow + rounded corners; snapshot pipeline passes false so html2canvas output matches PPT edges. - BaseTextElement: flex-column + justifyContent driven by the new vAlign field; width/height stay 100% so the box anchors correctly. - BaseImageElement: maxWidth/maxHeight 'none' to prevent host CSS from shrinking absolutely-positioned <img>. - snapshot: render with chrome=false. Docs: SKILL.md expanded with the iteration workflow + OOXML traps. * fix(parser+renderer): iteration-0605-001 fidelity fixes slide-renderer: - PPTImageElement: add `softEdge` field (feather radius that fades image alpha to transparent at every edge, per a:softEdge@rad). - TableCell: add per-side `borders` so cells with partial dividers render each side independently instead of falling back to the table-level uniform outline. - BaseTextElement: hoist `fill`/`opacity` to the outer wrapper so the background covers the full shape rectangle, matching PowerPoint behavior for short text inside tall shapes. - Misc tweaks across image/latex/shape/video base elements, StaticTable and the standalone snapshot util. pptxtojson-pro: - Parser/serializer fidelity improvements for text, math, image, shape and table (notably ~500 lines in textSerializer and ~127 in mathSerializer). - Refinements in GroupNode, MathNode and ShapeNode models; richer Theme, StyleResolver and RenderContext plumbing. - Expanded shape presets and customGeometry utilities, plus adapter and import-pipeline updates to surface the new fields. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: stop tracking local slide-renderer-demo sandbox `app/slide-renderer-demo/page.tsx` is a personal scratchpad used for ad-hoc rendering tests; it shouldn't ship with the package. Remove it from the index (file stays on disk locally) and ignore the directory so future tweaks don't show up in `git status`. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: rename packages pptxtojson-pro→maic-import and slide-renderer→maic-renderer Align workspace package names with the MAIC product family: packages/pptxtojson-pro → packages/maic-import packages/slide-renderer → packages/maic-renderer Functional references updated end to end: - Root package.json: workspace deps + postinstall/sync scripts - next.config.ts: transpilePackages - app/globals.css: Tailwind `@source` for renderer dist - app/layout.tsx: `maic-renderer/fonts.css` import - lib/import/use-import-pptx.ts: imports + runtime URL (`/vendor/maic-import/index.js`) + script comment - scripts/sync-maic-import.mjs: renamed and pointed at the new dist - .gitignore: vendor path and sync-script comment - Package package.json `name` fields and cross-link in READMEs Also re-include the gitignored `app/slide-renderer-demo/` in Tailwind's source detection via an explicit `@source` so its classes (e.g. `bg-violet-600`) keep getting generated — Tailwind v4 skips gitignored paths by default, which was making the demo's import button render white-on-white after the demo was excluded from version control. CSS class names (`slide-renderer-prose` / `slide-renderer-cell-text` / `slide-renderer-pulse` / `slide-renderer-ping` / `slide-renderer-code- cursor-blink`) and internal source comments that still reference the old package names are intentionally left untouched to keep the rename diff minimal; they can be updated separately as the codebase evolves. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(dsl): extract @maic/dsl contract package and adopt @maic/* scope Establish the SDK family's contract keystone and align package naming with the planned @maic/* scope, per PR #668 review. 1. New @maic/dsl package (packages/maic-dsl) - Pure, zero-runtime-dependency spec: the canonical slide object model, pure type-guards, and DSL version/migration scaffolding. - Seeded from lib/types/slides.ts but reconciled into a *superset* of the three previously-drifted copies (app / renderer / importer); merged fields are annotated @since-merge. README documents the divergence and the acyclic dependency arrows (renderer/importer -> dsl -> nothing). - Enums are regular (not const) so consumers compiling with isolatedModules can import them across the package boundary (TS2748). 2. Wire @maic/importer to @maic/dsl - Import all slide types from @maic/dsl; delete the vendored openmaic/types/slides.ts copy. - Eliminate the Slide drift at the root: transformParsedToSlides now fills viewportSize/viewportRatio/theme at construction and emits a complete DSL Slide, removing the partial "draft slide" + post-fill step in parsedToSlides (no DraftSlide type needed). - Add @maic/dsl to the root postinstall build chain before the importer. 3. Adopt @maic/* scope (agent-noun names) - maic-import -> @maic/importer - maic-renderer -> @maic/renderer - Update all package-name references (deps, app imports, transpilePackages, fonts.css subpath import, Tailwind @source node_modules path, READMEs). - Directory names and /vendor paths are intentionally left unchanged. Note: @maic/renderer still vendors its own slide types; wiring it to @maic/dsl is the next step. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(renderer): consume slide types from @maic/dsl, drop vendored copy Wire @maic/renderer to the @maic/dsl contract keystone, completing the de-duplication of the slide object model across the SDK family. - Delete packages/maic-renderer/src/types/slides.ts (the vendored copy) and repoint all ~30 internal imports at @maic/dsl. SlideElement's runtime `ElementTypes` value import now resolves to the DSL enum. - Re-export the DSL types from src/types/index.ts so the public `@maic/renderer/types` entry keeps exporting the full slide contract (alongside the renderer-only effect types). - Add @maic/dsl as a regular dependency and mark it external in the rollup build so consumers share a single copy (enum not inlined); the emitted .d.ts references @maic/dsl directly. @maic/dsl is a superset of the renderer's former types, so this is non-breaking; the renderer additionally gains `script` and the importer-origin fields it didn't previously declare. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(renderer): serve fonts from OSS, drop the 43.6MB bundled woff2 Move the 22 CJK fonts off the repo and onto object storage to fix the PR #668 blocking repo-weight concern. - fonts.css now points every @font-face src at https://file.maic.chat/fonts/<name>.woff2 instead of bundled local files. - Extract the CDN origin + font whitelist into fonts.config.mjs (single source of truth) and generate fonts.css from it via scripts/generate-fonts-css.mjs. `genfonts` runs first in the build, so the CSS always reflects the config; changing the domain is now a one-liner. - Delete packages/maic-renderer/fonts/*.woff2 (22 files, ~43.6MB) and drop the now-unused "./fonts/*" export and "fonts" files entry from package.json (fonts.css is kept). Font names are unchanged, so consumers and the importer font whitelist are unaffected. Note: this removes the files going forward only; purging them from git history (LFS / filter-repo) is a separate follow-up. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(home): gate the unwired PPTX import button behind a feature flag The PPTX import flow is still scaffolding — `useImportPptx` has no `onImported` consumer, so clicking it only logs the parsed slides. Hide both PPTX import entry points (and the hidden file input) behind NEXT_PUBLIC_ENABLE_PPTX_IMPORT (default off) so the UI doesn't expose a no-op. The classroom import button is unaffected. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(import): harden the runtime URL-loaded PPTX parser The PPTX parser is loaded at runtime from /vendor/maic-import/index.js — a gitignored artifact synced into public/vendor during postinstall. If a deploy skips that step the URL 404s and import() fails with an opaque SyntaxError (404 HTML parsed as JS). Add guards on both ends plus docs. - Build-time assertion: scripts/assert-vendor-maic-import.mjs verifies the bundle exists and is non-empty; wired into `build` so a misconfigured deploy fails early with an actionable message instead of shipping a broken runtime. - Runtime guard: use-import-pptx.ts HEAD-probes the URL before import() and, on a non-ok response, throws a clear error surfaced to the user via the new import.error.parserUnavailable string (added to all 6 locales). - Docs: document the postinstall deploy dependency and the pull-without-install type/runtime drift in @maic/importer's README. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: unify the @maic/* license policy to AGPL-3.0 Pick one license for the SDK family and apply it uniformly, matching the OpenMAIC root, per PR #668 review. - @maic/dsl and @maic/importer: relicense MIT -> AGPL-3.0 (package.json + full AGPL-3.0 LICENSE text). - @maic/renderer: already AGPL-3.0; add the LICENSE file its package.json `files` already referenced. @maic/importer is derived from pptxtojson (MIT); MIT permits relicensing a derivative under AGPL, and the upstream MIT attribution is retained in the package README/index.html, so this is compliant. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: rename packages/maic-import dir to maic-importer Align the importer's directory with its @maic/importer package name and the maic-* sibling dirs (maic-dsl, maic-renderer). Package name is unchanged, so imports/transpilePackages/node_modules resolution are unaffected. - git mv packages/maic-import -> packages/maic-importer (history preserved). - Rename the vendor sync/assert scripts and the runtime vendor path to match: scripts/{sync,assert-vendor}-maic-importer.mjs, public/vendor/maic-importer, URL /vendor/maic-importer/index.js. - Update all path references: root postinstall/build/sync scripts, .gitignore, use-import-pptx.ts, and doc links in the dsl/renderer/importer READMEs. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: nest the @maic packages under packages/@maic/ Mirror the @maic/* npm scope in the directory layout: move the three family packages into packages/@maic/{dsl,importer,renderer}. Package names are unchanged, so imports / transpilePackages / node_modules resolution are unaffected. - git mv packages/maic-{dsl,importer,renderer} -> packages/@maic/* (history preserved). - pnpm-workspace.yaml: add packages/@maic/* glob. - Recompute the root postinstall cd chain for the nested layout. - Update dir-path references: sync script srcDir, .gitignore comment, the dsl source comment, and the renderer/importer README/SKILL cross-links. Unchanged: the @maic/* package names, the runtime vendor path (public/vendor/maic-importer) and its sync/assert scripts. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(renderer): clear font licenses, drop non-redistributable faces, remove importer font remapping Address the PR #668 blocking font-license-clearance review. Font licensing (renderer): - Reduce the self-hosted whitelist to 6 clearly-redistributable faces: SourceHanSans/SourceHanSerif/LXGWWenKai/ZhuQueFangSong (SIL OFL 1.1), ZcoolHappy (ZCOOL free-use), WenDingPLKaiTi = AR PL KaitiM GB (Arphic PL 1999). - Drop AlibabaPuHuiTi: free to *use* commercially but its license grants no explicit redistribution/re-host right, unlike OFL — dropped to keep public CDN serving unambiguous. - Add FONTS.md (per-face attribution/clearance record, separate from the package's AGPL LICENSE) and bundle the verbatim license texts under font-licenses/ (OFL.txt, ZcoolHappy-LICENSE.txt, ARPHIC-PL.txt); ship both via package.json `files`. Regenerate fonts.css from the trimmed config. Importer font remapping removed: - The importer no longer rewrites font-family names (alias -> category -> primary). It passes each slide's original font-family through unchanged, so it can never target a face the renderer doesn't ship. Delete configs/font.ts, the resolveFont/replaceFontFamilyInHtml helpers, and the now-unused FontReplacementBucket / ImportContext.replacedFonts plumbing. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(renderer): document the CDN font runtime dependency Add a "Fonts" section to the renderer README per PR #668: the optional `@maic/renderer/fonts.css` loads woff2 from an external host (https://file.maic.chat), which must be reachable + CORS-enabled or the browser silently falls back to system fonts. Note that the import is optional and that the origin is configurable via fonts.config.mjs + `pnpm run genfonts`. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(renderer): verify WenDingPLKaiTi == AR PL KaitiM GB from the font name table Record the embedded-name-table evidence (Family/Copyright/Trademark/Designer = Arphic, nameID 13 = the full Arphic Public License) so the WenDingPLKaiTi ⇄ AR PL KaitiM GB correspondence is provable, and correct the copyright year to 1994–1999 to match the font metadata. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: fix `pnpm check` (prettier) after merging main main added a `prettier . --check` CI step that flagged 180 files. Resolve it consistently with the existing convention (vendored/workspace packages are excluded from root Prettier): - .prettierignore: exclude `packages/@maic/` (own rollup/tsc/eslint toolchains; dist is generated, importer/src1 is a vendored oracle), matching how pptxgenjs / mathml2omml / docs are already handled. - Format the three root-level files we added/edited that root Prettier does cover: lib/import/use-import-pptx.ts and the two scripts/*-maic-importer.mjs. `pnpm check` now passes. Co-authored-by: Cursor <cursoragent@cursor.com> * style: align @maic/{dsl,renderer,importer} source to root Prettier Per review preference, the @maic packages are our own code and should follow the repo style rather than be ignored wholesale. Narrow .prettierignore to only the generated build output (packages/@maic/*/dist/) and the vendored legacy reference (packages/@maic/importer/src1/), then `prettier --write` the package sources. Formatting-only; all three packages still build. `pnpm check` passes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(lint): scope ESLint to @maic source and clear all errors - eslint.config.mjs: replace blanket packages/** ignore with precise rules so @maic/{dsl,importer,renderer} source is linted, while skipping third-party packages, dist output, importer/src1 and public/vendor (the generated bundle was producing thousands of false errors in CI). - importer: replace `any` with concrete narrowings/types, fix prefer-const. - renderer: drop manual useMemo that React Compiler could not preserve. - remove leftover debug console.log + stale eslint-disable in use-import-pptx. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(i18n): add missing PPTX import keys to pt-BR pt-BR.json was missing import.{pptx,parsingPptx,pptxSuccess} and import.error.{invalidPptx,parserUnavailable}, failing the i18n key alignment check against en-US.json. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-09 03:25:05 -04:00
3 people	c071e02d83	feat: ACCESS_CODE site-level authentication (#407) (#411) ... * feat(access-code): add status API endpoint Returns whether ACCESS_CODE is enabled and whether the current user is authenticated via cookie, to support the frontend access gate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(access-code): add verify API endpoint Creates POST /api/access-code/verify that validates ACCESS_CODE env var and sets an HttpOnly 7-day cookie on success. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(access-code): add Next.js middleware to gate API routes Intercepts all requests when ACCESS_CODE env var is set. API routes return 401 without the openmaic_access cookie; page requests pass through so the frontend can render the access-code modal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(i18n): add accessCode translations for all 4 locales Add accessCode top-level key to en-US, zh-CN, ja-JP, and ru-RU locale files with title, placeholder, submit, and error strings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: add ACCESS_CODE documentation to .env.example Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add AccessCodeGuard component and integrate into root layout Wraps page children with an access-code gate that checks /api/access-code/status on mount and renders AccessCodeModal when authentication is required. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(access-code): add AccessCodeModal component Adds the modal dialog component that prompts users for an access code, using existing Dialog/Button/Input UI components and i18n translation keys. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(access-code): fix lint error and format files - Fix useEffect setState pattern in access-code-guard.tsx - Format middleware.ts and layout.tsx with Prettier Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * style(access-code): redesign modal as full-screen gate Replace generic Radix Dialog with a custom full-screen gate: - Mesh gradient background with noise texture - Frosted glass card with backdrop-blur - Staggered motion animations on mount - Inline submit button inside input field - Success state animation before dismissal - Proper dark mode support Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(access-code): address code review findings Critical: - Middleware now validates HMAC-signed cookie tokens, not just existence - Verify endpoint uses timingSafeEqual for constant-time comparison - Cookie value is now `timestamp.HMAC(ACCESS_CODE, timestamp)` instead of UUID Important: - Middleware 401 response includes `errorCode` matching apiError shape - Status endpoint uses apiSuccess wrapper for consistency - Remove unused `accessCode.submit` i18n key from all 4 locales Suggestions: - Guard renders children during loading (overlay on top, not blocking) - Network error defaults to enabled=true (safer than silently disabling) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(access-code): use Web Crypto API in middleware for Edge Runtime Node.js crypto module is not available in Next.js Edge Runtime. Replace createHmac/timingSafeEqual with crypto.subtle HMAC and manual constant-length XOR comparison. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>	2026-04-12 22:14:14 +08:00
wyucandClaude Opus 4.6	843d33e5cc	chore: enforce Prettier formatting and fix lint issues ... - Add .prettierignore to exclude vendor packages, lock files, markdown, and YAML - Update .prettierrc: printWidth 100, singleQuote, trailingComma "all" - Run Prettier across all source files for consistent formatting - Fix unused imports (UserRequirements, setTTSProvider) - Fix eslint-disable comment placement after Prettier reformat Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 16:09:45 +08:00
wyucandClaude Opus 4.6	cc44f32ca8	Refactor: directory structure cleanup + Google Fonts localization ... - Replace next/font/google with local fonts (geist + @fontsource-variable/inter) to eliminate build-time network dependency - Resolve lib/utils.ts vs lib/utils/ naming conflict (cn() → lib/utils/cn.ts) - Move React Context Providers from lib/store/ to lib/contexts/ - Consolidate hooks into lib/hooks/ (use-theme, use-i18n) - Organize loose components into subdirectories: agent-* → components/agent/ canvas-* → components/canvas/ generation-toolbar, media-popover → components/generation/ speech-button, tts-config-popover → components/audio/ proactive-card → components/chat/ 65 files changed, lint 0 errors, build 28 pages passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 19:35:06 +08:00
wyucandClaude Opus 4.6	0d20abfed9	Initial commit: OpenMAIC AI classroom platform ... Next.js 16 App Router application with: - AI-powered interactive classroom generation from PDF/text requirements - Multi-agent discussion system (teacher, students, assistant roles) - Provider abstraction for LLM, TTS, ASR, image, video, web search - Local-first data architecture (IndexedDB/Dexie) - i18n support (zh-CN/en-US) - Structured logger, SSRF guard, lint/build passing (0 errors) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 16:41:07 +08:00