24 Commits

Include renames

Author	SHA1	Message	Date
wyucand杨慎	e96e2fbf7a	feat(dsl): standardize the asset manifest and converge the export paths (#1007 part 3) (#1117) ... * feat(dsl): standardize the document asset manifest Add asset-manifest.ts to @openmaic/dsl: the canonical AssetManifestEntry shape (ref, kind, and byteSize/mimeType/duration/voice/prompt metadata where available) plus enumerateAssetManifest, the pure document-to-manifest enumeration. An entry's ref is the reference exactly as the document holds it -- the manifest is the id-based reference enumeration with metadata, not a content hash and not a resolution result. The traversal walks the stage whiteboard, each scene's canvas/whiteboards/speech actions, and the stage video-manifest keys in document order, with logical-owner reference counts that match the accounting duplication-safe replacement uses. This settles the media-ref + asset-manifest schema question (#779 open question 4) on the side the asset-pool RFC already implied: the schema is a function of the id semantics decided there. The type lives in the dsl rather than a new @openmaic/exporter package because the enumeration is pure over document types the dsl already owns (Stage/Scene/Slide/Action), so a separate package would add a published artifact and release-workflow surface without adding a capability; the storage contract comment now points at the module. Refs #1007 * refactor(export): drive the classroom ZIP from the asset manifest collectMediaFiles used to scan the whole mediaFiles table for the stage, so any row the document no longer references -- an orphan left by an edit or a superseded regeneration -- rode along into the archive. Both ZIP collectors now take their reference sets from the standardized asset manifest (buildStageAssetManifest wraps the dsl enumeration with the compatibility rows' metadata): only referenced assets are archived, and a referenced asset whose bytes exist only in the pool is still collected via a synthesized record. Byte resolution is unchanged: pool first through resolveStoredBytes / resolveAudioBlob, with the compatibility row kept as the legacy byte fallback and as the metadata source. mediaIndex is now a serialized view of the manifest, and the missing-audio report derives from the manifest's audio entries instead of a second action walk. The audioRef mapping and the legacy audioUrl fetch path (collectLegacyAudioForExport) are untouched. Refs #1007 * refactor(video-export): take the timeline's reference sets from the manifest createVideoTimelineDeps scanned the whole mediaFiles table for the stage and derived its audio id set from its own action walk -- a third, independent answer to "which media does this course use?". Both record loads now key off the standardized asset manifest: media rows are read per manifest ref by compound key instead of by table scan, and the audio id set is the manifest's audio entries. Orphan rows were never reachable through the scene-scoped elementId-to-mediaRef bridge; now they are not even read. The bridge itself is untouched: element ids recur across scenes, so the elementId-to-mediaRef mapping stays scoped per scene, and the legacy audioUrl fallback keeps its own action walk because a URL is not a manifest ref. AssetPlan remains the video IR's view of the same references. Refs #1007 * refactor(export): resolve PPTX media through the shared resolver only Each PPTX element branch carried its own resolution chain: a task-state renderable-URL lookup first, then -- gated on the legacy placeholder predicate -- a stored-bytes override, with the poster block repeating the pattern. One helper now owns resolution for backgrounds, images, video / audio sources, and posters: opaque refs (allocated ids and legacy placeholders alike, no placeholder-pattern gate) resolve pool-first through resolveStoredBytes and embed as data URLs, concrete addresses resolve through the media state machine and keep the caller's fetch path. exportMediaResolution and the resolveStoredMediaBlob wrapper fold into the helper; resolvePptxMediaBinding stays as the state-machine entry the resolution-surface test matrix drives. Refs #1007 * refactor(export): retire the export-side Dexie byte fallbacks Export call sites no longer read bytes off compatibility rows directly. The ZIP collectors and the video timeline's audio load resolve bytes only through the shared resolvers (resolveStoredBytes / resolveAudioBlob), which answer pool-first and keep the compatibility row as their internal legacy fallback level; the row reads that remain at the call sites supply metadata (format/duration/voice/mime/size/prompt) only. The rows themselves stay for legacy and regeneration readers -- what goes is the export paths' own fallback logic. One observable tightening: a failed media row (error set, empty placeholder blob) no longer ships a 0-byte file into the classroom ZIP, and an evicted row no longer ships its empty local blob; referenced-but- byteless assets are simply absent from the archive, as they already were when no row existed. Refs #1007 * test(media): cover the enriched stage asset manifest builder Pins the join between the pure dsl enumeration and the compatibility rows: metadata attaches by ref, rows no document reference names never appear, and a referenced asset with no row keeps a metadata-free entry. Refs #1007 * fix(video-export): widen the deps stage input for the manifest enumeration enumerateAssetManifest reads the stage's whiteboard and videoManifest, so createVideoTimelineDeps declares them on its input instead of the bare id; callers pass only the id today and the optional fields stay absent. Also applies the repo prettier formatting to the files this branch touched. Refs #1007 * fix(dsl): enumerate slide audio elements in the asset manifest Slide audio elements carry their own src, and the manifest skipped them, so a manifest-driven collector could never archive their bytes. The audio slot maps to kind 'audio' alongside narration ids. Refs #1007 * fix(media): harden ref-keyed lookups against prototype-named asset refs AssetRef is an unconstrained string alias, so a media reference can legitimately be "__proto__", "constructor", or any other Object.prototype member. Plain objects keyed by such refs silently drop assignments or answer lookups with the prototype object, which rewrite paths then accept as a mapped id. Convert the remaining ref-keyed lookup tables introduced by the export convergence to prototype-safe structures: the classroom import media/poster alias maps and the legacy-conversion video-manifest reconstruction now use Map / null-prototype containers with explicit membership checks, and every consumed value is validated as a string before it is written into a src / mediaRef / audioId slot. The shared media-task lookup receives the same treatment: one centralized own-property-checked lookupMediaTask now serves the stored-bytes resolver, the PPTX embeddable-src path, the video collection path, and the element/background task resolution, so a prototype-named placeholderRef can no longer hide a re-keyed task from the fallback chain. Adversarial tests drive "__proto__" and "constructor" refs through the import round trip, the PPTX fallback path, the legacy conversion commit path, and the media-task fallback end to end, including a buildPptxBlob regression with a task re-keyed to an allocated id while retaining a prototype-named placeholderRef. * fix(export): use safe archive asset paths * refactor(dsl): centralize slide media slot roles * refactor(export): derive consumer refs from manifest * fix(export): sanitize classroom archive extensions * fix(video-export): preserve narration speech order * fix(export): enforce kind-coherent archive media * fix(export): define media coherence boundary * fix(export): carry task-owned poster binding for PPTX export A video element with no explicit poster falls back to its media task's generated poster URL, but resolveVideoMediaForElement left posterTask undefined for that case, so the PPTX manifest guard saw a foreign URL with no task-ownership exemption and dropped the video element instead of using the established runtime poster fallback. Carry the poster task binding whenever the task poster is the effective poster: the task-owned URL then satisfies the guard's objectUrl exemption end to end. A concrete explicit element poster still stays element-owned and never borrows the binding, and the guard's foreign-ref rejection is preserved (and exported as a directly testable predicate). Coverage: an element with no poster plus a task-provided poster embeds the task poster as the PPTX cover (red at the pre-fix head, green now), and a genuinely unrelated URL with no task ownership is still rejected by the guard. * fix(export): preserve legacy narration source refs in the media index The explicit sourceRef contract was partial: primary audio and generated media entries carried it, but legacy URL narration serialized no source ref. The legacy URL itself is the natural source ref — it is known at fetch time — so wire it through the collected blob into the mediaIndex entry. Import already registers serialized sourceRefs as aliases, so the URL now round-trips as an explicit mapping instead of being reconstructed only from the action's audioRef. Poster siblings are deliberately NOT given their own mediaIndex entry: a sibling poster (media/asset-<n>.poster.<ext>) is a legacy byte copy written from the video record and is not an independently referenced document asset — when the poster is a real document asset it already has its own indexed entry with a sourceRef, and import reconstructs the sibling by path derivation from its parent video entry, reusing the poster's own indexed allocation when one exists. The PR description is narrowed to match; corrected paragraph: "Archive names never interpolate refs — sequential safe paths (media/asset-<n>.<ext>, audio/audio-<n>.<ext>) with the original ref preserved through an explicit sourceRef mapping on every independently indexed media entry: generated media assets, poster assets, primary narration, and legacy URL narration (the legacy URL itself is the entry's sourceRef). Extensions are allowlisted per kind. The one exception is the legacy sibling poster byte copy (media/asset-<n>.poster.<ext>, written next to its video when the video record still carries the pre-pool poster bytes): it is not an independently referenced document asset, so it has no mediaIndex entry or sourceRef of its own — its identity is derivable from its parent video entry (same index), and import reconstructs it by sibling-path derivation from that video entry, reusing the poster's own indexed allocation when one exists." --------- Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>	2026-08-19 20:43:14 +08:00
wyuc	1a151c4a49	refactor(media): share one stored-bytes resolver across export paths (#1007 part 3a) (#1116) ... * refactor(media): share one stored-bytes resolver across export paths The classroom ZIP, PPTX, and video exports each re-implemented the same pool-first byte resolution with a Dexie compatibility-row fallback and a task-URL fallback. resolveStoredBytes in lib/media/resolve-stored-bytes.ts now owns the chain, with the per-path differences (which levels run, fetch validation strictness, state-machine gating) as explicit options. The record-id to ref mapping moves alongside it as mediaRefFromRecordId. Intended as a behavior-preserving extraction: same bytes, same fallback order, same error handling. Cross-review found two places where this commit did not achieve that, both repaired later on this branch -- it moved a supplied row's `error` verdict past the pool await (restored by the snapshot fix) and dereferenced `record.blob` unguarded (guarded by the option-surface fix). See the PR description for the resulting divergence from main, which is stated rather than claimed away. Refs #1007 * fix(media): make the resolver's option surface mean what it documents Cross-review round 1 surfaced the same class of defect from both reviewers: options and docstrings that promise more than the code does. - `taskUrlFallback` was inert without `resolutionGating`. The task lookup was derived from the gating flag alone, so the final level resolved with no task and always returned null. The lookup now runs whenever either concern needs it, while the gated levels still read it only when gating is on -- so no current caller's behavior changes, and the pre-refactor callers' own unconditional lookup is restored. - `compatRowBytes` dereferenced `record.blob.size` unguarded, which broke the module's "never throws" contract and lost the guard the pre-refactor video path had (`blob && blob.size > 0`). A row that lost its blob now falls through to the next byte source. - `loadCompatRow` (requires `stageId`) and `compatRowCdnFallback` (needs a row) now state their dependencies instead of silently doing nothing. Six tests pin the behavior; each fix was mutation-checked (reverting the task decoupling reds one, reverting the blob guard reds two). * test(media): pin the resolver behavior the round-2 review found unpinned Round 2 produced no behavior findings from either reviewer; every finding was a test that would still pass with the behavior broken. Six cases close them. Mutation-verified -- reverting the code each covers reddens it: - Gating suppresses stale POOL and row bytes, not only the final level (removing either gate reds it). - With gating off the compatibility row is still accepted while a task is generating. This is the discriminator for keeping `gate` separate from `task`: leaking the task into the gated levels reds it. - A zero-length row blob falls through to the CDN source when enabled, and never reaches it when not (breaking `compatRowCdnFallback` in either direction reds one of the two). - The effective ref comes from a supplied row's compound id, not the ref the caller passed (dropping the derivation reds it). - The classroom ZIP still ships a non-OK pool response body -- the rebase conflict resolution that was correct but untested (tightening `requireOk` reds it). Not mutation-verified, and marked as such in the file: "accepts pool bytes with gating off" documents the pool level's unconditional branch but survives every single-edit revert of the task/gate separation, because that level branches on the option rather than on the gate. It is kept as documentation, not as a sentinel. * fix(media): snapshot a supplied row's error verdict before the pool await Round 4 of cross-review found a divergence three rounds of level-by-level comparison had missed. The pre-refactor video path computed `usableRecord = record && !record.error` BEFORE awaiting the pool; the extraction moved that test after the await. The supplied row is a live object, so an `error` set (or cleared) while the pool lookup was pending changed which bytes the export shipped. The verdict is now taken where the caller took it, and -- the part the first attempt at this fix got wrong -- it is not re-derived afterwards: snapshotting only the reference still re-read `error` off the live object at the later check. A row this function loads itself is still judged when it is read, after the pool miss, because that read did not exist any earlier. This was the last value read at a different point in the SEQUENCE than the code it replaced. What remains is scheduling, not sequence: the row's `blob` and `ossKey` are still read after the pool as they were on main, only one microtask later. The PR description states that, and no writer in the repo mutates a row in place across that window. Two tests pin both directions (an error landing mid-lookup, and one clearing); judging the supplied row after the await reds both. * test(media): commit the frozen-base differential harness (F-1116-001) The PR description claimed a differential comparison against the verbatim pre-refactor implementations, but that comparison was run out of tree and never committed, so no reviewer could re-run it. A claim that cannot be reproduced is not evidence. The three implementations are now reproduced verbatim as they stand at the merge base -- still identical to main, since nothing between the two touched them -- and driven side by side with the current helper under each call site's real option set, over a declared matrix of ref shapes, task states, pool outcomes, fetch outcomes, record shapes, and stage scoping. Every combination compares the outcome (bytes, null, or the thrown type), blob identity by reference, and the ordered lease / Dexie / fetch sequence including arguments. Absolute microtask offsets are not compared, for the reason the description gives: the extraction moves later operations one or two ticks while leaving the sequence, the arguments, and the results alone. The blob-less PPTX row is the only permitted divergence, and the harness pins where it may occur rather than merely tolerating it: every divergent combination must be that row with a stage, and the count must equal the combinations that actually reach the row -- all of them except the ones where the frozen path returns pooled bytes first. The harness bites: dropping the zero-byte rejection reds ZIP and video, dropping the response.ok check reds PPTX and video, and dropping the compound-id ref derivation reds video. Its scope is documented in the file -- option combinations no call site uses, and state that mutates mid-await, are covered by the targeted tests instead. * test(media): extend equivalence harness for colon refs and PPTX divergence (F-1116-001)	2026-08-18 12:10:52 +08:00
wyuc	e15780835a	feat(media): convert legacy references to allocated asset ids (#1101) ... Lands epic #1007 part 2(c): the app-side reference converter, the `audioUrl` removal, and the `DSL_VERSION` bump as one delivery unit. `convertDocumentAssetRefs` walks a loaded document (slide canvases, whiteboards, video-manifest keys, speech actions) and rewrites legacy handles to allocated pool ids: placeholders and `audioId`s with local bytes are ingested, a co-present `audioUrl`/`audioId` pair collapses to one asset, a definitively dead URL converts to an emptied reference, and a transient failure keeps both handles for a later retry. Unavailable bytes leave the document untouched for a later open, and a converted document returns by identity with no writes. Conversion runs lazily on document open and at fetch time for server-generated classrooms, with conversion and the first document save sharing the per-stage document lock: once the document commits it owns every allocation, and every failure exit rolls its pass ledger back. Legacy URL probes are bounded by a per-probe timeout and a shared 60-second pass budget. `SpeechAction.audioUrl` is removed from the DSL and every consumer reads the converted shape; the server classroom generator keeps its derived-id + serving-URL pair as an explicitly typed pre-conversion transport, consumed before persistence. `DSL_VERSION` becomes 0.2.0 with the first real ladder entry, and `@openmaic/dsl` goes to 0.9.0 per the release rule. Deferred follow-ups are tracked in #1129: production principal derivation with document/asset ownership aligned, conditional document writes, and hoisting the aggregate probe budget into the export and video-timeline paths. Refs #1007	2026-08-15 17:38:04 +08:00
3 people	969574bee4	feat(storage): wire the asset backend into the app (#1007) (#1089) ... * fix(persistence): stop corrupting binary response bodies in the route adapter The embedded persistence route bridges a Node `RequestListener` to the Fetch API by hand. Its response object is cast with `as unknown as ServerResponse`, so the compiler checks none of that surface, and two parts of it were wrong in ways only a byte-carrying handler would hit. `end` decoded any `Uint8Array` chunk with `Buffer.from(chunk).toString()`, which is UTF-8. `ServerResponse.end` accepts a `Uint8Array`, and those bytes are not necessarily valid UTF-8, so every unpaired byte became U+FFFD -- silent corruption with no error anywhere. The adapter now buffers chunks as bytes and builds the response from them. `write` was absent entirely, making any chunked handler a runtime TypeError rather than a compile error. It is part of the surface this object claims to implement, so it is now implemented. Neither reaches a caller today: the document and runtime handlers only ever end with JSON strings, which took the string branch. Both are traps laid for the first handler that carries bytes. Both cases are pinned by tests that fail before this change -- the binary one on a byte comparison, the chunked one with a 500 from the TypeError. The existing adapter round-trip test, whose comment already called this the most bug-prone code in the route, covered only the string path. * feat(storage): wire the asset backend into the app (#1007) The server asset registry shipped with #1007 but was reachable from nothing: the persistence route never passed an `assetStore`, and no file under `app/`, `lib/` or `components/` imported the asset server or client modules. This connects it, additively -- no DSL change, no version bump, and no behavioural change when server persistence is off. The route now builds a `PgAssetStore` on the same pool and transaction as the document store, with `PgAssetByteStore` by default and `S3AssetByteStore` when `ASSET_S3_BUCKET` opts a deployment into it. The AWS SDK stays an optional peer, reached only through a dynamic import on that branch. The offline collector is deliberately not scheduled here, and the route says so where a reader would look for it, because leaving it unscheduled grows storage without bound and scheduling it is the deployment's decision. On the browser side the asset pool gains a single-shot configuration seam modelled on the document store's, so that with server persistence enabled the pool is an `HttpAssetStore` carrying the same auth headers as the other stores. Three browser-specific mechanisms needed decisions rather than translation: `clearAssetPool` deletes an IndexedDB database today. In server mode there is nothing local to delete, and a "clear cache" action must not remove server-side assets -- that would destroy user data from a button promising to free space. It now revokes local object URLs and closes the client, and deletes nothing remote. The cross-tab replacement broadcast is unchanged. Its job is to make another tab drop a warm object URL when the bytes behind an id change, and that need is identical in server mode. The exclusivity proof that decides whether an in-place `replace` is safe reasons over this browser only: local documents, unflushed state, and a cross-tab presence probe. In server mode those cover a strict subset of the holders, since another device can reference the same id and no probe can see it -- and asking the server who else references an id would be an existence oracle over other principals. The proof therefore returns not exclusive unconditionally in server mode, and regeneration takes the existing fork path. That is the fail-closed direction and a graceful degradation rather than a break. The development authenticator had to grow the asset principal's required `key`; without it every asset request would have been correctly denied. It derives from the same learner partition, and a principal without one still gets no asset access. The route now states plainly that this key comes from a client-supplied header, so the cross-principal isolation the asset contract describes is not in force under this authenticator -- that warning previously lived only in the auth module's own header, where nobody mounting the route would see it. * fix(storage): close three defects in the asset app wiring (#1007) **The S3 branch could not load, and isolated nothing.** The route dynamically imported the storage package's S3 byte store, but that module statically imported the AWS SDK, so merely resolving it pulled the SDK into resolution and bundling. The route then separately performed an ignored native import of the SDK from the app's own scope, which fails with ERR_MODULE_NOT_FOUND because the SDK lives under the storage workspace package -- so a deployment that set the bucket got a broken store rather than an S3 one. There is now one lazy loader in one resolution scope, the storage module no longer imports the SDK at module load, and the bucket is validated at initialization rather than treated as valid because it is non-empty. A test mocks the SDK to throw on resolution and asserts that importing the byte-store module never resolves it. **A cross-tab replacement could leave a mounted lease stale.** The broadcast handler re-resolves, and `HttpAssetStore.resolve` coalesces concurrent calls for one id onto a single in-flight request -- correct on its own, and required by the contract. Together they meant a resolve triggered by the broadcast could merge into a GET that started before the peer's replacement, return the old revision, and leave the consumer on the old URL with nothing to dislodge it. The client gains an invalidation that retires its cached snapshot and advances the per-id generation without revoking any URL already issued; `release` would have been wrong here, since the contract keeps an issued URL valid until its holder releases it. Removing the invalidation call fails the new race test. **Clearing a server-backed pool left the closed client installed.** In server mode `clearAssetPool` closed the client and returned before clearing the module singleton, so every later `getAssetPool()` handed back a closed store until a page reload happened to intervene. Only the IndexedDB deletion is skipped in server mode now; the singleton is always cleared so the next call rebuilds through the configured factory. Also adds the tests whose absence let these through: a route round-trip carrying invalid UTF-8, the SDK-resolution assertion above, the broadcast race, and reopening the pool after a clear. The earlier tests were not wrong so much as aimed past the defect -- the route test used JSON text, and the S3 test injected a loader rather than exercising the imports. * chore(storage): bump package version to 0.3.0 * fix(persistence): make the route adapter faithful where it carries bytes The embedded persistence route bridges a Node `RequestListener` to the Fetch API by hand, and its response object is cast `as unknown as ServerResponse`, so the compiler checks none of that surface. Five divergences are closed here; the first two are the ones that corrupt data, the last three were raised in review. **`end` decoded bytes as text.** It ran `Buffer.from(chunk).toString()` on a `Uint8Array` chunk, which is UTF-8, so every byte outside that encoding became U+FFFD -- silent corruption with no error anywhere. The adapter now buffers chunks as bytes. **`write` was absent**, making any chunked handler a runtime `TypeError` rather than a compile error. **`write` callbacks ran inline.** Node invokes them after the chunk is handed off. A handler that writes its next chunk from each callback therefore recursed synchronously and could overflow the stack, and a throwing callback threw in the wrong execution phase. They are now deferred. **The encoding argument was ignored.** `write(s, 'latin1')` emitted `0xc3 0xa9` where Node emits `0xe9`, corrupting the body and potentially invalidating a `Content-Length` the handler had set. Both `write` and `end` now parse their full overload set and pass the encoding through. Node's own behaviour for an invalid encoding was established by probing `ServerResponse` on Node 22 rather than assumed: it throws `ERR_UNKNOWN_ENCODING` synchronously, so the adapter validates with `Buffer.isEncoding` and lets `Buffer.from` raise the native error. **Bodyless statuses were not suppressed.** Node discards writes after `writeHead(204)` or `writeHead(304)`; this passed the buffered bytes to the Fetch `Response` constructor, which throws for those statuses, so the request became a 500 instead of the intended 204 or 304. Buffered data is now discarded for 204, 205 and 304, and for `HEAD`. None of the five reaches a caller today -- the document and runtime handlers only ever end with JSON strings. They are traps laid for the first handler that carries bytes, which is why they surfaced while wiring the asset server backend, whose byte routes hit the first two immediately. Each is pinned by a test that fails when its fix is reverted. * fix(storage): keep { client, bucket } working for the S3 byte store `S3AssetByteStoreOptions.commands` was required and the store's methods called it directly, so the published `./asset/s3-bytes` export stopped accepting the `{ client, bucket }` construction it had always taken. Anyone not going through `loadS3AssetByteStore` either failed to compile or hit an undefined command factory at runtime. Make `commands` optional. Omitted, the store resolves the AWS SDK's own command constructors through a dynamic import on its first `write` / `read` / `delete` and caches them, so `{ client, bucket }` works again. Importing the module and constructing a store still never reach the optional peer dependency: a deployment that does not select S3 never resolves it. When the SDK cannot be resolved the call rejects naming `@aws-sdk/client-s3` rather than crashing on an undefined property, and the resolution is left uncached so installing the dependency fixes an already-constructed store. The lazily bound store is run against the byte-store contract, and the new isolation tests pin both that construction does not resolve the SDK and that an unresolvable SDK is reported by name. With the break gone this branch's change to the package is additive, so the version becomes a patch above main (0.2.4 -> 0.2.5) rather than the minor it was carrying. Refs #1007 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(persistence): run the asset collector in the shipped deployment `PgAssetStore.remove`, and a `replace` that changes content, only stamp `asset_blobs.unreferenced_at`. `AssetCollector.collect` is the only path that deletes anything, and the persistence route deliberately did not schedule it, on the grounds that scheduling is the deployment's decision. The deployment this repository ships is docker-compose.yml: the app and PostgreSQL, and nothing else that could make that decision. "The deployment decides" therefore meant "it never runs", and ordinary asset churn retained PostgreSQL bytes or S3 objects forever. Schedule it from instrumentation.ts, which Next runs once per server process — a route module can be instantiated more than once and has no shutdown hook, so a schedule started from one is really started per instantiation. Next 15 and later pick the file up with no config, so next.config.ts is unchanged. Collection is on by default with a 15-minute interval and the package's one-hour grace period, so the Compose stack is correct with no operator action. ASSET_COLLECTION_INTERVAL_MS, ASSET_COLLECTION_GRACE_MS, and ASSET_COLLECTION_ENABLED change or disable it, each documented where it is read. Without DATABASE_URL nothing is scheduled at all, and a failed pass is logged and retried on the next tick rather than ending the schedule or the process. Several instances may collect concurrently: each candidate blob row is re-checked and locked FOR UPDATE inside its own transaction, so collectors serialize on the row rather than racing. The comment says so, so nobody adds a distributed lock that is not needed. The byte-store selection moves to lib/persistence/asset-byte-store so the collector reclaims through the same layer the request path wrote through. A collector on the PostgreSQL byte store while the route wrote to S3 would drop the blob row and orphan the object permanently. Refs #1007 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(storage): bound each collector pass and report whether it filled An unbounded collect() is sized by however long a deployment ran before collection was scheduled: one statement selecting every eligible blob, then a transaction and a byte-layer delete each, in a loop nothing interrupts. The first pass over the Compose deployment that grew a backlog before collection was scheduled is exactly that pass. A pass now takes at most batchSize blobs (default one thousand) and returns. Ordinary churn between two scheduled passes is far below the cap, so a healthy deployment behaves as it did when a pass was unbounded; a capped pass costs the remainder one scheduling interval, which is what the interval is for. collect() still answers with the count, and the count alone cannot tell an empty backlog from a full batch -- a re-referenced or concurrently taken candidate is skipped, so even a full batch can collect less than batchSize. collectPass() returns the count together with capped, which is exactly "this batch was full, run again"; a caller draining a backlog loops while it is true. Candidates are taken oldest-unreferenced first, with the content hash as tiebreaker within one timestamp. Ordering by the hash alone would starve: digests are uniformly distributed, so a high-sorting blob waits behind every lower digest stamped after it, and under steady arrivals those keep coming. The tests pin the ordering against a planner that happens to answer the right rows without an ORDER BY. Refs #1007 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(persistence): keep asset backend faults off the shared handler Two review findings on the app wiring. A concrete asset pool instance is single-lifecycle, but resolveConfiguredAssetPoolStore handed the same object out again after clearAssetPool() had closed it, reinstalling a dead store as the live pool. The second handout now refuses loudly and points at the factory form, which rebuilds on every resolution. createPersistenceHandler eagerly awaited the asset byte store, so an invalid ASSET_S3_BUCKET or an unresolvable AWS SDK rejected the shared persistence handler and took document and runtime traffic down with an optional backend. Byte-store construction is now deferred to the first asset byte operation, and a failed construction is not cached, so the next asset request retries -- the route's own no-poisoned-singleton rule. Refs #1007 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-11 13:01:16 +08:00
3 people	ceb05adb41	feat(media): allocate generated assets through the registry (#1007 part 2, step b) (#1039) ... * feat(media): establish shared asset ownership primitives Introduce global browser asset-pool ownership, asset-reference collection, stage reclamation planning, and lease-based URL access. Carry allocated media identity through storage and generation boundaries with regression coverage. * fix(media): enforce safe resolution across every consumer Route image, video, thumbnail, presentation, and video-export consumers through one resolution state machine. Prevent opaque allocated or generated references from reaching render and export sinks, with fallback and ownership tests. * fix(media): protect document-owned assets across mutations Allocate pool bytes before compatibility writes and document commits, then roll back uncommitted generations safely. Preserve document ownership across edits, retries, imports, speech generation, scene changes, and stage deletion. * fix(media): scope retries and tighten ownership guard Scope retries to the target scene and slide and refuse ambiguous shared-reference mutations. Expand retry rendering coverage and keep direct pool URL resolution behind the shared lease owner. * fix(storage): avoid nested lock during stage cleanup Execute prepared reclamation plans against an explicitly deleted document so the compatibility cascade cannot re-enter the per-document lock. Cover deletion of stage-owned media rows even when the document has no references. * refactor(media): confine reclamation to stage deletion Remove inline pool and compatibility-row cleanup from element, speech, scene, and audio replacement flows. Keep whole-stage reclamation behind explicit stage ownership, preserve stage-less legacy audio rows, and document deferred document-truth sweeping. * fix(media): close retry and resolution gaps Restore shared source tasks after successful forks, scope retries across both whiteboard locations, and wait for parallel TTS workers before rollback. Resolve background media through import, rendering, and PPTX export paths while keeping retry controls visible over last-good bytes. * test(media): execute the consumer safety matrix Replace source-substring checks with resolver seam execution across all six UI consumers, stage hydration, and both exporters. Pin each rollback layer independently and harden the ownership guard against aliased pool imports. * chore(packages): publish the additive DSL field Bump the DSL patch version for the optional speech-action field. Keep the transitional reclamation policy app-owned and document the legitimate transaction rollback removals there. * fix(media): make retry rollback task-safe Delay allocation task re-keying until final document reconciliation succeeds, restore shared source tasks on failed forks, and require exact stage-whiteboard targets before falling through from a missed scene. * fix(media): clear private assets and refresh leases Delete the asset-pool database during the confirmed local-data wipe. Notify the app lease layer after same-id replacement so mounted consumers re-resolve current bytes without reaching into storage internals. * test(media): pin closure safety guards Exercise the CSS allocation boundary, unfiltered legacy-row ownership, delete-and-undo byte survival, and real distinct consumer seams. Restore the video-only manifest overwrite condition and share the direct video resolution hook across both element variants. * test(media): narrow rollback element assertion Narrow the reconciled slide element to an image before checking its source so the rollback regression remains type-safe under the full root compiler configuration. * fix(media): close lease refresh races Gate the first batch publication by unique resolved refs, then publish every replacement snapshot without mutating the prior React state object. Serialize invalidation behind pending releases, evict rejected refreshes, and register replacement observation at the pool boundary. * fix(media): reopen pool after clear failures Always evict the singleton once its store has been closed, including blocked and failed database deletion paths. Report blocked deletion as deferred and prove a later write uses a fresh live store. * fix(media): isolate shared retry progress Track forked regeneration under the selected element until it receives a fresh asset identity, leaving the shared source task and bytes untouched. Surface targeted failures through renderer task lookup and skip the redundant fork reconciliation lock. * fix(media): close final asset retry gaps Keep blocked asset clears fail-loud until a successful retry, with actionable settings guidance. Clear failed shared-fork state across durable and live key spaces, and pin renderer lookups, lease publication identity, and committed-ref rollback protection. * fix: preserve actionable retry failures Localize the blocked cache-clear recovery hint across every supported locale and pin the deferred-error mapping. Retain durable fork failure rows while retries run, deleting them only after successful generation so unstructured failures survive reload. * fix(media): hydrate legacy stored video thumbnails Home-page recent-video thumbnails regressed for legacy Dexie mediaFiles rows keyed by gen_vid placeholders: the reworked hydration resolved the row's bytes through the sealed resolver but never surfaced the stored blob (and its poster) as object URLs for the preview card, so the CI recent-video-thumbnail e2e specs found no visible element. Hydration now materializes legacy stored video rows into blob URLs for both the element src and poster while keeping the resolver invariants: opaque refs still never reach a DOM src, and concrete addresses are never blanked. Unit pins cover the seam so the vitest suite catches this class without a browser. * fix(media): resolve sole restored legacy video Classroom playback restored tasks by exact document media references. Legacy gen_vid references can outlive the key used by the one persisted video row, leaving the player on a placeholder even though bytes were restored. Select the sole completed stage video only for legacy sequential refs after exact and reconciled matches. Keep exact failures authoritative, refuse ambiguous candidates, and cover success, ambiguity, and failure precedence in unit tests. * fix(media): scope legacy video recovery Decide restored legacy video recovery once from the complete document and record it through the shared task lookup consumed by playback, editing, and resolved slides. Keep ambiguous documents as placeholders, apply the same decision to thumbnail hydration, and preserve exact failure precedence. * fix(media): exclude claimed video recovery tasks Model restored legacy recovery as a two-pass match across document video elements and task rows. Remove tasks claimed by exact, targeted, or placeholder lookup before applying the sole-candidate fallback, and cover the ownership/cardinality matrix. * fix(media): unify video element resolution Centralize source, task, poster, and legacy recovery decisions for every video consumer. Ensure direct URLs win over opaque refs and play_video waits on element-targeted retry tasks. * refactor(media): route legacy recovery through resolver Let document-aware consumers request legacy video recovery through the unified element binding API, keeping thumbnail hydration on a single decision path. * fix(media): preserve import refs and prefer pool bytes Recognize unambiguous extensionless relative media addresses during classroom import. Resolve allocated export and thumbnail assets from the shared pool before falling back to lagging compatibility rows. * fix(export): preserve concrete video sources Route PPTX video elements through the shared media binding resolver so an unresolved opaque reference cannot replace a playable source. Complete browser and persisted-store cleanup when asset-pool deletion is deferred, while retaining distinct hard-failure behavior. * fix(media): fork retries without exclusive ownership Enumerate logical asset owners across every persisted document before allowing global pool replacement. Thread explicit targets through fresh-id rewrites and cover cross-document aliases plus unreadable ownership. * fix(media): guard global asset reclamation Share a fail-closed persisted-document liveness check between stage deletion and retry replacement. Preserve cross-document pool aliases while deleting stage-owned compatibility rows and cover enumeration failures. * fix(media): cover complete slide asset references Route slide media traversal through a shared mutable slot contract so backgrounds participate in export, thumbnail hydration, collection, and rewrite lifecycles. Snapshot complete surviving-document refs once per reclamation and preserve manifest-only owners while retaining fail-closed behavior. * fix(media): preserve exclusive retry asset ids Allow targeted retries to replace exclusively owned pool assets in place. Keep shared and unprovable ownership paths on fresh allocations, and pin production-shaped retries plus compatibility-row cleanup. * fix(media): revalidate asset bindings at completion Recheck repository-wide ownership before replacing generated media and fork scoped retries when exclusivity changed. Route video export selection through the unified resolver and keep concrete posters independent of task state. * fix(media): count unflushed owners and broadcast replacements The completion-time exclusivity proof read only the persisted document, but slide duplication updates the Zustand aggregate synchronously and schedules persistence behind a debounce. A retry finishing inside that window saw a single persisted owner and replaced the bytes behind a reference the duplicate also held. The proof now also counts owners in the live stage snapshot when that snapshot represents the stage being retried, so an unflushed duplicate forks instead. Same-id replacement notifications were realm-local, so a second tab showing the same classroom kept its lease pinned to the superseded blob URL. The notification now travels over a BroadcastChannel; each receiving realm runs its own observers against its own pool, so a spoofed message can at most force a re-resolve. A missing or failing channel never fails the replacement. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): bind replacement listeners and spare shared audio rows A realm that only renders never sends a replacement, so binding the channel from the sender path left passive tabs deaf to peers. Binding now happens where the observer is registered, when the asset-pool module loads, and the receiving realm resolves its own pool lazily so a cleared or unavailable pool degrades to the next resolve instead of throwing. Observer notifications ran under Promise.all, so a rejection surfaced after BrowserAssetStore.replace had already committed and turned a durable success into a reported failure. They are settled individually now; the callback is wrapped because a synchronous throw would otherwise escape before allSettled sees the array. audioFiles rows are keyed globally by audioId, so deleting a stage removed the sole row for an id a surviving document still referenced — playback and both export paths read that table directly and cannot fall back to the preserved pool blob. Rows are now filtered against surviving references, while a failed enumeration still withholds only the irreversible pool removal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): serve replaced bytes from the pool everywhere Unknown survivor liveness deleted every planned audioFiles row. Those rows are keyed globally by audioId, and playback plus both export paths read the table directly, so losing one is as irreversible for them as removing the pool entry. Unknown liveness now preserves the rows too, leaving bounded garbage for a later pass that can prove exclusivity. The earlier pool-first change covered PPTX, video collection and thumbnail hydration but missed classroom ZIP export, which still serialized the stale compatibility row after a lagged same-id replacement, shipping media the classroom no longer renders. Auditing every direct reader of the media and audio tables surfaced the same gap in playback: speech regeneration also replaces bytes under a stable id and does not roll the pool back when the compatibility write fails, so the player kept serving superseded narration. It now resolves the pool first and falls back to stored rows for legacy and imported audio. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(audio): replace exclusively owned speech clips in place regenerateSpeechAudio accepted the action's audioId but always passed undefined as replaceAssetId, so regenerating an exclusively owned pool-backed clip allocated a new asset every time, rewrote the action and orphaned the previous pool entry and compatibility row until stage reclamation — contradicting the stable-id path generateAndStoreTTS already implements for media. Ownership is now established before synthesis, and the rule itself moved to the shared reference module so media retries, poster replacement and speech regeneration consume one implementation instead of restating it. An exclusively owned clip keeps its id and has its bytes replaced; a shared clip, a legacy id with no pool entry, or unprovable ownership still gets a fresh allocation so other holders keep their audio. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(media): drop the import left behind by the ownership move Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): resolve audio pool-first and fence peer realms Stable-id TTS regeneration commits replaced narration to the pool before the audioFiles mirror write, so a failed mirror leaves the row stale. AudioPlayer already resolved pool-first, but audioObjectUrl, collectAudioFiles and the video timeline dependencies still read Dexie directly and would serve the superseded clip. All allocated-audio readers now share one resolver, with Dexie kept as the fallback for legacy and imported rows. The exclusivity proof modelled unflushed owners in the active realm only, so another tab duplicating the same asset during its save debounce could still be observed as a single owner and have its bytes replaced globally. A peer's pending state cannot be read across realms, so presence is probed instead: any realm holding the stage forces the fork path. A deferred asset-pool deletion no longer reloads the page. The database is still on disk and the guidance asks the user to close the other tab and retry, which the reload discarded. The decision moved into a shared helper so the rule is pinned rather than living inline in the component. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(media): fail closed when presence cannot be probed The presence helper documented that an unanswerable probe must count as a peer, but every unavailable path — no BroadcastChannel, a constructor that threw, a send that failed, and the window before the pool's asynchronous binding completes — returned false, so the ownership proof cleared a single local owner and replaced globally shared bytes in place. Probing now returns present, absent or unknown, and only a probe that was actually sent and went unanswered is absent; the ownership decision treats unknown exactly like present. The pool declares its binding intent synchronously so a probe issued during the load-time window waits for the bind instead of concluding that presence is unavailable, and releases that gate if the import fails. Coverage reaches the write boundary: with presence unknown, a production-shaped targeted retry forks to a fresh id instead of calling replace, and the original bytes stay intact for a peer's unflushed owner. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(dsl): bump to 0.6.3 after the release dedupe took 0.6.2 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(i18n): add the deferred-clear guidance to fr-FR The locale landed on main after this branch added the key, so the alignment check flagged it as the one missing translation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>	2026-08-06 18:49:34 +08:00
Yizuki_Ameandwyuc	59a8bac62e	fix(ssrf): disable redirects in media connectivity probes (#930) ... * fix(ssrf): reject redirects in media auth probes * fix(ssrf): stop redirects in strict media probes * fix(ssrf): disable redirects in Google media probes --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-16 14:14:32 +08:00
Yizuki_Ameandwyuc	fe35941bfd	refactor(media): share auth probe across matching adapters (#903) ... * test(media): characterize provider auth probes * refactor(media): share auth probe across matching adapters --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-11 21:09:08 +08:00
Yizuki_Ameandwyuc	d431d19b1c	refactor(media): share submit-poll task driver (#900) ... * refactor(media): add shared polled task driver * refactor(media): migrate video adapters to shared polling * docs(media): remove obsolete task adapter guidance --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-11 19:02:19 +08:00
PhillLittlewoodandwyuc	a2886af92a	Added ComfyUi to has Image Provider (#850) ... * feat: integrate comfyui workflows into image provider selection * style: format code with prettier * fix: align i18n keys for russian locale * feat: implement requested changes and format code * feat: implement requested changes including renaming default workflow --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-07-10 18:49:28 +08:00
Yanpeng Wang	d54e62f5c4	feat(token-plan): one-click token-plan setup + deployment usage dashboard (#784) ... * feat(usage): add usage normalization, pricing, model-fetch, balance, storage Foundational layer for token-plan usage tracking (cc-switch-modeled): - lib/usage/normalize.ts: AI SDK v6 usage → four-class token shape - lib/usage/pricing.ts + defaults: per-class USD pricing table - lib/server/model-fetch.ts: /models candidate-URL multi-fallback (ported) - lib/usage/balance-providers.ts: built-in balance queries + detection - lib/server/usage-storage.ts: fire-and-forget jsonl logging to data/usage All pure/storage logic covered by vitest (32 tests). * feat(usage): capture token usage at the callLLM/streamLLM chokepoint - callLLM records result.usage before returning - streamLLM wraps onFinish to record totalUsage on stream completion, preserving any caller-supplied onFinish - provider/model derived from the model instance (no route changes) - fs-backed storage imported dynamically; fire-and-forget, never throws - include_usage is already sent by @ai-sdk/openai, so streaming is covered * feat(usage): add probe-models, balance, and usage API routes - POST /api/provider/probe-models: discover chat models via /models with candidate fallback; SSRF-guarded; filters non-chat ids; 401/404 typed - POST /api/provider/balance: built-in balance detection + billing fallback - GET /api/usage: aggregate jsonl by model/day/source with costIncomplete flag Verified e2e against the live MAIC gateway: 16 chat models (6 filtered), balance detected, and a real callLLM writes a costed usage row. * feat(settings): add token-plan preset picker to provider dialog - lib/config/token-plan-presets.ts: data-driven vendor presets (Huawei/MiniMax/ Xiaomi token plans, OpenRouter/SiliconFlow gateways, DeepSeek/GLM/Qwen/Hunyuan/ Doubao direct) with baseURL, protocol, optional modelsUrl, category - add-provider-dialog: '选择厂商/自定义' tabs; picking a preset auto-fills baseURL+protocol+modelsUrl, custom tab unchanged - ProviderSettings.modelsUrl carries the optional /models override - i18n keys added across all 8 locales Verified in-browser: preset picker renders grouped by category. * feat(settings): add Fetch Models button and balance bar to provider panel - 拉取模型: probes /models, merges discovered ids into the model list (dedupe, keeps manual additions), with success/no-endpoint/auth messages - 查询余额: queries /api/provider/balance, renders a balance bar or a 'check console' hint when unsupported - index.tsx: handleModelsFetched merges probe results into provider config - i18n keys across all 8 locales; removed a now-unused eslint-disable Verified in-browser against MAIC gateway: 16 models fetched, balance shown. * feat(settings): add usage dashboard to System Settings - usage-dashboard.tsx: echarts dual-axis daily trend (tokens + cost), totals cards, by-model table, refresh; reads GET /api/usage - mounted at the top of GeneralSettings (系统设置) - honest disclaimer + costIncomplete marker when a model lacks pricing - i18n keys across all 8 locales Verified in-browser: shows 1 request / 31 tokens / $0.0003 from a prior call. * feat(token-plan): multi-modal one-click setup in System Settings - token-plan-presets.ts: presets now declare per-modality targets (llm/image/video/tts/webSearch); MiniMax is the full-set template, others LLM-only — extend by adding entries (at-our-best adaptation) - apply-token-plan.ts: fills one key into every declared modality via injected store setters, isolating per-modality failures (TDD, 4 tests) - token-plan-settings.tsx: new sidebar page — pick plan, enter key, one-click apply lights up adapted modalities (+LLM model probe), shows 'not adapted yet' for the rest, balance bar reused - reverted add-provider dialog to plain custom form (preset picker moved here) - i18n across all 8 locales Verified in-browser: Token Plan page renders, MiniMax shows all 5 modalities, apply/balance UI wired. 859 tests pass, build clean. * feat(token-plan): add custom token plan entry to Token Plan page - Custom card at the bottom of the provider list: pick it to manually enter name + protocol + baseURL (LLM-only), then key + one-click apply via the same applyTokenPlan flow (mirrors cc-switch's custom provider) - effectivePreset unifies preset vs custom for apply/balance/probe - i18n keys (customGroup/customName/customHint) across all 8 locales Verified in-browser: custom card expands the manual form; preset flow intact. * feat(token-plan): reflect persisted config on the Token Plan page Other settings panels read the store directly, so they survive section switches; the Token Plan page only wrote the store, so it looked blank on return. Now it also reads providersConfig: - selecting a preset prefills its saved API key - configured presets show a '已配置/Configured' badge State persistence was never broken (apply writes zustand→localStorage); this fixes the missing read-back so the page reflects it. * fix(settings): isLLMProviderConfigured crashed on providers without models Root cause of 'token plan config disappears': applyTokenPlan writes a new LLM provider with no models yet (probe fills them later). isLLMProviderConfigured did config.models.length unguarded → threw inside setProviderConfig's resolver → the whole set() aborted → key/baseUrl/type never persisted. - guard models in isLLMProviderConfigured (shared validator; affects any provider written without a models array) - seed models:[] in applyTokenPlan's LLM write for a valid initial shape - regression tests: validator no longer throws; apply+probe write keeps apiKey Verified in-browser: DeepSeek persists key and shows 已配置 after section switch. * feat(token-plan): add remove/teardown for a configured token plan Apply had no inverse. Add removeTokenPlan: clears the API key and disables (enabled:false) every modality the plan declared; a custom LLM provider is deleted entirely (removeProvider), built-ins keep the cleared shape. - removeTokenPlan in apply-token-plan.ts (mirrors applyTokenPlan, isolated per-modality, injected setters; 3 tests) - trash button on configured preset cards in the Token Plan page; resets page state if the removed plan was selected - i18n 'remove' across all 8 locales Verified in-browser: removing DeepSeek empties its key and drops the 已配置 badge. * feat(usage): track multimodal usage, drop cost/pricing Reframe usage stats as pure usage (no cost), per user decision: - usage-storage: drop all cost fields; add kind (llm/image/video/tts/asr) + quantity + unit; LLM keeps token counts, others store quantity - delete lib/usage/pricing.ts + pricing-defaults.json + its test - instrument image/video/tts at the server-only API routes (not in the provider dispatch — those files are in the client graph and importing fs-backed usage-storage broke the client bundle) - /api/usage: aggregate by model/day/modality, no cost - dashboard: per-modality usage (tokens/images/seconds/chars), token-only daily trend, no '$'; i18n cost keys replaced with modality/unit keys - backward compatible: legacy rows (no kind, stray cost fields) read as llm 912 tests pass, build clean. * feat(usage): per-modality dashboard layout + softer dark-mode chart - group usage into per-modality sections (LLM/image/video/tts/asr), each table's usage column uses one consistent unit (token/image/sec/char) — no more mixed units in a single column - summary chips per modality with their own unit - trend chart now plots daily REQUESTS (unit-agnostic, works for any modality) instead of LLM-only tokens - theme-aware chart: faint thin line + soft gradient area, muted axis/grid colors via useTheme — fixes the harsh solid stroke in dark mode Verified in-browser (dark): TTS shows '字符', LLM shows 'Token', separate sections; chart no longer has a hard line. * refactor(usage): dedupe model/fetch/usage helpers, parallel balance probe Review cleanups on the token-plan/usage branch: - extract modelInfoFromId() (shared vision heuristic + ModelInfo shape) - extract fetchWithTimeout() shared by model-fetch and balance-providers - extract recordGenerationUsage() to dedupe the image/tts/video routes - queryBalance: fetch billing subscription + usage in parallel - parseOneApiBilling: report quota without remaining when usage endpoint is unavailable, instead of implying zero spend (full balance) - split the two jammed imports in settings/index.tsx * feat(token-plan): drop custom token-plan support Custom token plans (manual baseURL/protocol entry) added complexity for little gain — a one-off provider is better configured directly on the Providers page. Token Plan is now preset-only: - remove custom mode, manual fields, and the custom card from the UI - collapse effectivePreset back to the selected preset - drop the now-dead removeProvider action + custom-id branch in removeTokenPlan - remove orphaned customGroup/customName/customHint i18n keys (8 locales) * feat(token-plan): add Volcengine/Tencent/Bailian plans, drop balance feature Add three vendor token-plan presets (all map to existing built-in LLM providers, so it's data-only — no new adapters): - 火山方舟 Volcengine Ark → doubao, OpenAI /api/v3 - 腾讯 TokenHub Token Plan → tencent-hunyuan, OpenAI /plan/v3 (the plan-specific base; /v1 is the pay-as-you-go gateway) - 阿里百炼 Token Plan → qwen, cross-model plan (Qwen + DeepSeek/Kimi/ GLM/MiniMax) on one key; model list is probed/entered Remove the balance/quota feature entirely — we now track usage, not cost, and every vendor's balance query needs its own cloud AK/SK + signature (Volcengine SigV4 / Tencent TC3 / Aliyun BSS), which the Bearer-key billing-endpoint probe never supported anyway: - delete lib/usage/balance-providers.ts, /api/provider/balance, its test - strip the Check Balance button + balance bar from the token-plan page and the provider config panel - remove the 4 balance i18n keys across all 8 locales - restore an eslint-disable the branch had dropped in provider-config-panel * feat(token-plan): use cloud-brand logos for vendor token plans The three vendor plans are cloud offerings, not single-model products, so icon them with the cloud brand rather than a model logo: - 火山方舟 → volcengine.svg (was doubao.svg) - 腾讯 TokenHub → tencentcloud.svg (was hunyuan.svg) - 阿里百炼 → alibabacloud.svg (was bailian.svg) Logos are the colored brand variants from lobehub/lobe-icons, matching the existing colored-logo style (plain <img>, no dark:invert needed). * feat(token-plan): keep only MiniMax and Volcengine presets Trim the token-plan list to the two we want to ship: MiniMax (full-set template) and 火山方舟 Volcengine Ark. Drop the Tencent/Bailian plans and the OpenRouter/SiliconFlow/DeepSeek/GLM/Qwen entries. - remove the now-unused tencentcloud.svg / alibabacloud.svg logos (volcengine.svg stays; the other logos are still used by the provider registry) - retarget the LLM-only apply test from the deleted deepseek preset to volcengine-ark * feat(token-plan): restore aggregator/third-party presets Previous commit over-trimmed: the intent was to drop only the Tencent and Bailian token plans, not the OpenRouter/SiliconFlow/DeepSeek/GLM/Qwen entries. Bring those back; keep only Tencent/Bailian removed. - token_plan: MiniMax, 火山方舟 Volcengine Ark - aggregator: OpenRouter, SiliconFlow - third_party: DeepSeek, GLM, Qwen Revert the apply test back to the deepseek fixture (restored). tencentcloud.svg / alibabacloud.svg stay deleted (their plans are gone). * fix(token-plan): point Volcengine plan at the Coding Plan endpoint The plan's ark--prefixed API keys authenticate only against /api/coding/v3, not the general /api/v3 endpoint — the latter rejects them with "The API key format is incorrect", so model probing returned nothing. Switch the base URL to https://ark.cn-beijing.volces.com/api/coding/v3. * fix(token-plan): Volcengine is an Agent Plan (Anthropic /api/plan) Per the Ark Agent Plan docs, the ark--prefixed keys authenticate ONLY against the dedicated Anthropic-compatible base https://ark.cn-beijing. volces.com/api/plan ("其他 Base URL 无法在 Agent Plan 中使用"). The general /api/v3 and the Coding Plan /api/coding endpoints both reject the key as "API key format is incorrect", which is why model probing kept returning 0. - baseUrl → https://ark.cn-beijing.volces.com/api/plan/v1 (the /v1 lets the Anthropic SDK land on /api/plan/v1/messages) - apiFormat → anthropic - rename to 火山方舟 Agent Plan Probe still targets /api/plan/v1/models (the path exists); if the Anthropic gateway doesn't return an OpenAI-shaped list, users fall back to typing a model id like ark-code-latest. * fix(token-plan): Volcengine Agent Plan = OpenAI /api/plan/v3 + ark-code-latest Settled after probing the real key and reading cc-switch's approach: - The ark- plan key works on the OpenAI-compatible /api/plan/v3 endpoint (chat/completions returns 200); switch apiFormat back to openai. - The plan exposes NO /models list (every /api/plan/*/models is 404), which is why probing kept returning 0. cc-switch handles this by hardcoding a single ark-code-latest (an auto-routing alias valid on any tier) and does NOT use AK/SK for model listing — so we do the same. - Seed defaultModels: ['ark-code-latest'] only; users add specific ids by hand. Supporting machinery (kept, general-purpose): - applyTokenPlan seeds models from defaultModels instead of wiping to [] - handleApply uses defaultModels and skips the doomed probe when present - drop stray .playwright-mcp/ debug artifacts and gitignore them * style: fix prettier formatting in usage files CI runs prettier on the whole repo (prettier . --check); these four files predate this branch's formatting pass and tripped the check. * feat(token-plan): verify Volcengine Agent Plan's published model set The Agent Plan publishes a fixed model set but exposes no /models endpoint, so carry the documented models as CANDIDATES and verify each on apply: - add verifyModels flag to TokenPlanModalityTarget - new /api/provider/probe-chat-models route: sends a minimal chat request per candidate (OpenAI /chat/completions or Anthropic /messages) in parallel, returns the subset that succeeds; SSRF-guarded, auth-failure short-circuits - handleApply gains a verify branch (before the fixed-defaultModels fast path), falling back to the seeded list if verification fails - Volcengine preset now carries the 12 published Agent Plan text models (doubao-seed-2.0-*/deepseek-v4-*/minimax-m*/glm-5.2/kimi-k2.*) as candidates This auto-prunes retired (docs flag deepseek-v3.2/glm-5.1 as 即将下线) and tier-gated models without code changes. Verified all 12 resolve against a real plan key. * feat(token-plan): wire Volcengine Agent Plan image + video modalities Make the Ark seedream/seedance adapters path-configurable and light up the image/video modalities on the Volcengine plan: - seedream/seedance adapters: resolveArkRoot() uses baseUrl verbatim when it already carries an /api/... path (token plan's /api/plan/v3), else appends the standard /api/v3 — no regression for the pay-as-you-go default host. - applyTokenPlan: image/video branches inject a modality's defaultModels as customModels and set them as the active provider+model, so generation works out of the box. New optional setImageProvider/ModelId + setVideoProvider/ ModelId actions (UI passes the store setters; tests omit them). - Volcengine preset declares image (doubao-seedream-5.0-lite, verified 200 on /api/plan/v3/images/generations) and video (doubao-seedance-2.0/1.5-pro — Medium+ tiers only; lower tiers reject at call time, no code change needed to upgrade). Applying the plan overwrites the shared seedream/seedance slot with the plan config (same overwrite model as LLM); switching back to pay-as-you-go is a manual edit or plan removal. Verified image end-to-end with a real plan key. * feat(token-plan): verify image/video models on apply, disable unsupported tiers The Volcengine plan lit up video optimistically, but lower tiers (Small) don't include video — so using it 404'd with UnsupportedModel. Probe media models on apply and only keep what the tier actually supports: - generalize /api/provider/probe-chat-models with a `kind` (chat|image|video): image hits /images/generations, video hits /contents/generations/tasks with empty content. The model-support check (404 UnsupportedModel) runs before any billable work, so probing never starts a real image/video job; for media, "supported" = any non-404 response. - handleApply: after lighting up image/video, probe each verifyModels modality; prune to the verified model set + re-select a working model, or disable the modality entirely if none pass (no false "available"). - Volcengine preset: image/video targets gain verifyModels: true. - add settings.tokenPlan.tierUnsupported across 8 locales. Verified with a real Small-tier key: image (seedream-5.0-lite) passes and is kept; video (seedance-2.0/1.5-pro) 404s and is disabled. * feat(web-search): add Doubao (豆包搜索) provider Doubao Search (Custom 版) over its REST endpoint POST open.feedcoopapi.com/search_api/web_search with Bearer auth — the same endpoint the askecho-search-infinity MCP server wraps, so the Volcengine Agent Plan key authenticates directly. Mirrors the MiniMax adapter: maps Result.WebResults to WebSearchSource (prefers Summary, the query-relevant excerpt, over Snippet for LLM use) and surfaces errors from ResponseMetadata.Error. - register 'doubao' in WebSearchProviderId + WEB_SEARCH_PROVIDERS - searchWithDoubao adapter, searchWeb dispatch, store default config - SSRF allowlist entry for the search host * feat(audio): support Agent Plan single-key auth for Doubao TTS generateDoubaoTTS now picks auth + endpoint from the key shape, since Volcengine exposes Seed-TTS as two products with separate credentials (verified: a plan key 401s on the normal endpoint, and the plan endpoint rejects appId-style auth): - single key (no colon) -> X-Api-Key, for the Agent Plan /plan endpoint - appId:accessKey -> X-Api-App-Id + X-Api-Access-Key (unchanged) A malformed pair (empty half) fails clearly instead of sending an empty header. Reuses the existing NDJSON/base64-mp3 parsing and voice list. * fix(media): map MiniMax video 720p to its real 768P tier normalizeVideoOptions defaults minimax-video to '720p' (the first supported resolution), but Hailuo 2.3 only accepts 768P/1080P and rejects 720P with '2013 ... does not support resolution 720P'. MiniMax's mid tier is 768P, not 720P (the adapter already falls back to 768P, as does the connectivity test), so map the shared enum's '720p' to 768P. Regression tests lock the mapping. * feat(token-plan): add web search + TTS to Volcengine Agent Plan, widen image tiers Extend the volcengine-ark preset now that the adapters exist: - webSearch -> doubao (own host open.feedcoopapi.com, not the ark endpoint) - tts -> doubao-tts on the /api/plan/tts endpoint (single-key auth) - image defaultModels widened to a best-first Seedream 5.0/4.5/4.0 list so a higher tier keeps the strongest model while verifyModels prunes the rest; video keeps the 2.0 + 1.5-pro candidates Comments record the verified host/auth quirks of each modality. * feat(token-plan): show result panel only after probing, with two clear states Addresses review feedback that a green check implied generation works when it only meant 'configured'. The panel now renders after probing finishes (gated on results && !applying) so it reflects the final set, and uses two states: green when the modality is configured/usable, muted when a live probe proved it unavailable (e.g. video on a tier without it). * feat(token-plan): scope presets to true multi-modal token plans Drop the single-modality LLM presets (OpenRouter, SiliconFlow, DeepSeek, GLM, Qwen) from Token Plan. A token plan's defining trait is one key spanning many modalities; those entries are ordinary LLM API providers already covered by the add-provider flow, and listing them here muddied the 'one key, every modality' promise. Only MiniMax and the Volcengine Ark Agent Plan remain. The UI already hides categories with no entries. apply-token-plan's LLM-only test now uses a local fixture instead of the removed deepseek preset. * feat(token-plan): progressive reveal of probe results on apply The result panel previously rendered all at once after probing finished, reading as dead air during the model probe. Now rows appear immediately on Apply: modalities with a live probe in flight show a spinner ('pending') and resolve to lit/failed independently as each probe returns, while non-probe modalities show lit right away. Probes run in parallel (Promise.all) instead of sequentially. A row only turns green once its own probe confirms, so this reveals structure + live progress without a premature green — complementing the earlier 'render only after probing' intent rather than reverting it. Per review feedback from @wyuc on #784. * fix(token-plan): enrich seeded models with built-in thinking capability Token Plan built ModelInfo objects from probed ids via modelInfoFromId(), filling only streaming/tools/vision — so a model that supports configurable thinking lost capabilities.thinking and InlineThinkingControl was hidden. modelInfoFromId now takes an optional providerId and overlays the catalog thinking capability for that (provider, model) pair; applyTokenPlan does the same for its synchronously-seeded list. Added the Ark Agent Plan's dotted aliases to the metadata table: - native Doubao Seed 2.0 family (doubao-seed-2.0-pro/code/lite/mini) - cross-vendor models the plan serves through its OpenAI-compatible endpoint (deepseek-v4-pro/flash, glm-5.2, kimi-k2.7-code/k2.6, minimax-m3/m2.7, ark-code-latest) All verified against a live plan key: each accepts the gateway's unified reasoning_effort field (low/medium/high) and actually reasons. They share the doubao effort adapter, which disables via 'minimal' (not 'none') — matching what the plan endpoint accepts (it rejects reasoning_effort:'none'). Addresses review point #1 from @wyuc on #784. * Improve token plan capability setup UI * fix token plan setup flow * chore: prettier format tts-providers.ts	2026-07-03 11:03:12 +08:00
wyuc	8a9cf24a77	Update Doubao Seed model catalog (#827) ... Closes #826	2026-07-02 08:02:39 -04:00
wyuc	7cb129183d	chore(packages): publish the @openmaic/* SDK family to npm (#778) (#780) ... * chore(packages): publish the @openmaic/* SDK family to npm (#778) Prepares the @openmaic/{dsl,renderer,importer} family for its first npm publish, and moves the SDK packages onto the @openmaic scope. Why the scope move: the @maic org name is unavailable on npm (an unscoped `maic` package already holds the name), so @maic/* is not claimable. @openmaic matches the project name, the scope is free, and the repo already ships an @openmaic/docs package — so the SDK family now lines up with that convention. - rename @maic/{dsl,renderer,importer} -> @openmaic/* across packages, the workspace glob, the package dir, and all import sites; lockfile regenerated - renderer: add publishConfig (public, registry.npmjs.org) — was missing, so a scoped publish would default to the wrong registry / restricted access - importer: add a files allowlist (dist, README, LICENSE) and drop the fragile .npmignore blacklist that shipped src; add an exports map so ESM consumers resolve dist/index.js instead of falling back to the .cjs main - all three: add a prepublishOnly build (+ test/typecheck) guard so a publish can never ship a stale or empty dist - add a tag-triggered publish workflow with npm provenance, pinned by name to the three @openmaic packages so the vendored forks (mathml2omml, pptxgenjs) are never published Refs #778, #720 (Phase 1). * fix(packages): address cross-review on the @openmaic publish prep Cross-review (Claude /code-review + codex) on this PR surfaced: - renderer's advertised CJS entry was broken: it keeps @openmaic/dsl external and imports a runtime enum from it, but dsl is ESM-only (no `require` condition), so `require('@openmaic/renderer')` would throw ERR_PACKAGE_PATH_NOT_EXPORTED. Make renderer ESM-only: drop the `.cjs` rollup output, `main` now points at the ESM build, and the `require` conditions are removed from `exports`. (importer is unaffected — it bundles dsl, so its CJS build still works.) - prepublishOnly re-ran the test suite during `pnpm -r publish`, so a flaky test after dsl had already published gave a non-atomic partial release. Reduce prepublishOnly to a build-only guard (never ship stale/empty dist) and move the real test/typecheck gate into the workflow, before any publish. - document that an @openmaic/* tag publishes the whole family via `pnpm -r` (pnpm skips already-published versions); the tag is a release marker, not a per-package gate. Verified: dsl + renderer + importer build; renderer emits ESM only (0 .cjs), all exports entries resolve; `npm pack` ships dist + README + LICENSE with no src leak; frozen-lockfile passes. Refs #778. * style: reflow @openmaic/dsl type imports past print-width after rename The @maic -> @openmaic rename lengthened two single-line type imports past prettier's 100-col width; prettier --check flagged them. Pure formatting. Refs #778. * docs(importer): mark @openmaic/importer browser-only (cr-loop accepted limitation) codex cross-review flagged that the published @openmaic/importer throws `XMLHttpRequest is not a constructor` when loaded in a pure Node process — its rollup build is browser-targeted (`nodeResolve({browser:true})` + a browser pdf.js build). The app only consumes it client-side ('use client'), so this is by design. Document it as an accepted limitation: prominent browser-only note in the README and a `browser` field in the manifest. Refs #778.	2026-06-24 15:12:23 +08:00
wyucandClaude Opus 4.8	4dce1f7414	refactor(types): import the slide DSL directly from @maic/dsl; drop the shim (#738) ... #707 left lib/types/slides.ts as a thin `export * from '@maic/dsl'` shim so the ~100 existing `@/lib/types/slides` import sites kept working unchanged. Point them at `@maic/dsl` directly and delete the shim, so the app consumes the package contract with no indirection and the legacy module path is gone. Pure module-specifier migration — every symbol imported from `@/lib/types/slides` was already a re-export of the same `@maic/dsl` symbol, so behavior is identical. Also redirects the two `lib/types` relative importers (`./slides`), the e2e fixture's relative import, and the dynamic `import('../types/slides').Slide` type alias in stage-storage; merges the now same-module import pair in slide-edit-elements. Verified: tsc --noEmit clean, eslint clean, vitest 804/804, next build OK, e2e (Playwright) 19/19. Part of #720 (Phase 1). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 15:04:06 +08:00
wyuc	e5709790f0	fix: hide unsupported MiniMax Hailuo fast T2V model (#632)	2026-06-01 23:09:21 +08:00
wyuc	2dff6d10be	feat: add generated video manifest refs (#540) ... * feat: add generated video manifest refs * style: format video manifest changes * fix: address video manifest review feedback	2026-05-09 20:56:31 +08:00
Helckandxuruiray	46b61dedfd	feat: add HappyHorse video adapter (#509) ... Add Alibaba Cloud DashScope HappyHorse text-to-video support as an OpenMAIC video generation provider. Co-authored-by: xuruiray <15962843+xuruiray@users.noreply.github.com>	2026-05-09 10:07:31 +08:00
3 people	be759a8252	feat: add lemonade to provider (#508) ... * feat: add lemonade to provider * fix(lemonade): correct TTS/ASR model IDs and expand Kokoro voices - TTS model: kokoro → kokoro-v1 - ASR model: single 'whisper' → 6 Whisper variants (Base/Large-v3/Large-v3-Turbo/Medium/Small/Tiny), default Whisper-Base - Expand lemonade-tts voices to full Kokoro v1 set (54 voices across en-US/en-GB/zh-CN/ja-JP/es/fr-FR/hi/it-IT/pt-BR) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lemonade): zh-TW i18n parity, real Kokoro default voice, language code consistency - zh-TW.json: add missing providerLemonadeTTS/ASR/Image keys - TTS default voice: 'default' → 'af_heart' (Kokoro expects real voice ID, not placeholder) - Voice language codes: 'es'/'hi' → 'es-ES'/'hi-IN' for consistency Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(lemonade): add unit tests for image/TTS/ASR adapters and wav-utils Covers: - lib/media/adapters/lemonade-image-adapter: request shape, base URL fallback, custom model, optional Bearer auth, error paths, connectivity probe - lib/audio/tts-providers (lemonade-tts case): request body (model/voice/format), af_heart fallback, optional auth, error path - lib/audio/asr-providers (lemonade-asr case): WAV-only validation, model/language form fields, "audio is empty" graceful empty result, error propagation, default model fallback - lib/audio/wav-utils: isWavBlob detection by MIME and filename, normalizeASRUploadAudio pass-through and wav handling Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lemonade): remove text path fork and harden fallbacks * style: format lemonade tts files * i18n: add lemonade voice language labels * fix(lemonade): align image default model and harden wav detection * test(lemonade): fix File BlobPart typing * fix(lemonade): simplify tts voice selection and clear asr test state * docs: highlight Lemonade support --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>	2026-05-08 13:53:37 +08:00
wyuc	a95aa87bf1	support recent model providers (#481)	2026-04-24 15:29:12 +08:00
kaiyuan ZhangandClaude	cce7087f67	Fix action filtering logic and add safety improvements (#163) ... * fix: fix 3 bugs found during code review 1. formatQuestionsForPrompt called .join() on QuizOption objects, producing "[object Object]" in AI prompts instead of readable option text (e.g. "A. Option1, B. Option2"). 2. json-repair Fix 1 regex double-escaped valid JSON escapes (\t, \n, \r, \b, \f) and couldn't handle strings with escaped quotes. Now uses a proper string-aware regex and preserves valid escapes. 3. PlaybackEngine spotlight/laser actions used synchronous recursion via processNext(), risking stack overflow with many consecutive non-speech actions. Now uses queueMicrotask() to break recursion. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: ensure allowedActions whitelist applies to non-slide scenes The early return in Step 6 (slide-only action filter) caused Step 7 (allowedActions whitelist) to be skipped for non-slide scenes. This meant hallucinated actions from agents in quiz/interactive/pbl scenes were not filtered by the role-based allowedActions whitelist. Refactored to use a mutable result variable instead of early returns so both filters always apply. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: prevent video playback hang and division by zero in CJK detection 1. executePlayVideo could hang forever if the video element was invalid or the state change was missed between playVideo() and subscribe(). Added a 5-minute safety timeout to prevent indefinite blocking. 2. CJK language detection in browser TTS divided by chunkText.length without checking for empty strings, producing NaN. Now guards against zero-length text. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: prevent ordered entry with invalid index when partial text has no remaining content When a previously-partial text item completed but all content had already been streamed as deltas (remaining is empty), the code still pushed an ordered entry pointing to textChunks.length - 1, which could be -1 or reference an unrelated chunk. This caused spurious warnings in director-graph and potential text loss. Now only pushes the ordered entry when there is actual remaining content to emit. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: validate quiz points parameter and fix parse-pdf metadata spread order 1. quiz-grade: `points` from request body was used without validation, causing NaN in score calculation and invalid JSON responses when points was undefined, negative, or non-numeric. Now validates it is a positive finite number. 2. parse-pdf: metadata spread order put the default `pageCount` before `...result.metadata`, so the spread would overwrite the fallback. Fixed by spreading metadata first, then applying defaults after. Also changed `||` to `??` so pageCount=0 is preserved correctly. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: crash in moveUpElement, dead-code in video options, wrong parens in canCombine 1. use-order-element.ts: moveUpElement crashed with TypeError when a grouped element was already at the top of the z-order. The code accessed copyOfElementList[maxLevel + 1] without bounds checking, then dereferenced .groupId on undefined. Added early return guard matching the pattern used in the non-grouped branch. 2. video-providers.ts: normalizeVideoOptions had a dead-code ternary inside an if-block that already proved the condition was false. Simplified to directly use the fallback value. 3. use-canvas-operations.ts: canCombine check had incorrect parenthesization: (el.groupId && el.groupId) === firstGroupId evaluated the && first, which is equivalent to just el.groupId. Fixed to: el.groupId && el.groupId === firstGroupId. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * style: fix prettier formatting in 3 files https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm * fix: use valid ApiErrorCode in quiz-grade route INVALID_PARAMETER is not a member of API_ERROR_CODES. Use INVALID_REQUEST instead, which is the appropriate code for invalid request parameters. https://claude.ai/code/session_01JdigqQtiAvomeifvWSQbjm --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-04-04 12:46:27 +08:00
wyucandHi-Jiajun	9badd59856	feat: add and expand MiniMax provider support (#182) ... Add MiniMax LLM models (M2–M2.7), TTS provider (speech-2.8/2.6/02/01), image generation (image-01), and video generation (Hailuo 2.3/02, T2V-01). Unify base URLs to api.minimaxi.com and add MiniMax-specific base URL normalization for the Anthropic-compatible endpoint. Co-authored-by: Hi-Jiajun <3138947285@qq.com>	2026-03-30 12:41:43 +08:00
Madoka	e92d1958a6	feat: add Grok (xAI) support as an LLM, image generation, and video generation provider (#113) ... * feat: add Grok (xAI) provider support for LLM, Image and Video generation - Add Grok as LLM provider (OpenAI-compatible, 11 models including grok-4.20, grok-4, grok-3) - Add Grok Image generation provider (grok-imagine-image, grok-imagine-image-pro) - Add Grok Video generation provider with async polling (grok-imagine-video) - Add env vars: GROK_*, IMAGE_GROK_*, VIDEO_GROK_* - Add web search note: Grok search is via chat completions, not standalone API - Update README/README-zh with Grok in supported providers Closes #87 * fix: ensure new image/video providers are auto-added to persisted settings Add ensureBuiltInImageProviders and ensureBuiltInVideoProviders functions that run on every store rehydrate, mirroring the existing LLM provider sync logic. Without this, Grok Image/Video providers would not appear for users with existing localStorage settings. * fix: add missing English translation for providerGrokVideo * style: fix prettier formatting for grok video provider * fix: remove unsupported grok multi-agent model and improve video error	2026-03-22 21:42:34 +08:00
wyucandClaude Opus 4.6	843d33e5cc	chore: enforce Prettier formatting and fix lint issues ... - Add .prettierignore to exclude vendor packages, lock files, markdown, and YAML - Update .prettierrc: printWidth 100, singleQuote, trailingComma "all" - Run Prettier across all source files for consistent formatting - Fix unused imports (UserRequirements, setTTSProvider) - Fix eslint-disable comment placement after Prettier reformat Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 16:09:45 +08:00
wyucandClaude Opus 4.6	633a30700d	fix: remove non-existent Seedream 5.0 non-lite model entry ... The API only offers Seedream 5.0 Lite (model ID remains doubao-seedream-5-0-260128). Remove the phantom lite-260128 entry and update display name accordingly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 15:13:57 +08:00
wyucandClaude Opus 4.6	0d20abfed9	Initial commit: OpenMAIC AI classroom platform ... Next.js 16 App Router application with: - AI-powered interactive classroom generation from PDF/text requirements - Multi-agent discussion system (teacher, students, assistant roles) - Provider abstraction for LLM, TTS, ASR, image, video, web search - Local-first data architecture (IndexedDB/Dexie) - i18n support (zh-CN/en-US) - Structured logger, SSRF guard, lint/build passing (0 errors) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-12 16:41:07 +08:00