82 Commits

Author	SHA1	Message	Date
Ray Xi	c333324da0	test(amr): verify prerelease runtime identity and Vela contracts (#7957) ... * test(amr): verify prerelease runtime identity and Vela contracts * docs(amr): bind continuation evidence to final upstream commit * docs(amr): track host cancellation integration dependency * docs(amr): record final Write test-only dependency head	2026-09-11 03:08:47 +00:00
lefarcen	3ddff71205	feat(ci): publish the What's New card from the repository (#7892) ... * feat(ci): publish the What's New card from the repository Move the post-update highlight document into the repo and publish it from GitHub Actions, so changing the card is a pull request instead of a task that needs personal Cloudflare credentials. - docs/whats-new.json is the source of truth, next to its spec doc. - pnpm guard validates it through the daemon's own parser on every PR, so a document that would silently show no card cannot merge. - whats-new-publish.yml uploads on merge to main (and on manual dispatch, with a read-only dry-run mode) and verifies the object by reading it back from the origin the daemon fetches, past the edge cache. * docs: name the CI job that actually runs the guard check * fix(ci): gate the What's New publish behind a main-only environment A workflow_dispatch runs the workflow file from the ref it is dispatched against, so the in-workflow main-only assertion was editable by whoever triggered it: anyone with write access could publish unreviewed content to every installed client from their own branch. Split the workflow so credentials live in one place and that place is gated by GitHub rather than by YAML. `validate` holds no secrets and runs on any ref; `publish` declares the `whats-new-publish` environment, whose deployment-branch policy allows main only and which owns the R2 secrets. Dropping the environment declaration to escape the branch policy also drops the secrets. Also points the card at the new Arena URLs supplied by product. * fix(ci): pin the What's New publish trust boundary in a check that runs The missing-credentials error still told operators the R2 keys are repository secrets. Following that string is the exact setup the previous revision closed: repository secrets are readable from any job on any branch, so a modified workflow dispatched from an unreviewed ref could publish to every installed client — or just take the keys. Point the error at the `whats-new-publish` environment and refuse the repository path in the same breath. The boundary itself had no coverage: nothing read the workflow, so moving `environment:` or a `secrets.*` expression back onto the arbitrary-ref job would stay green while still publishing correctly from main. That coverage cannot be lane-routed. Running the planner over `.github/workflows/whats-new-publish.yml` selects neither `web_tests_required` nor `ui_p0_validation_required`, so the `e2e_vitest` workload does not run for a workflow-only edit — an assertion living only there would be skipped for exactly the change class it guards. The check therefore lives in `pnpm guard`, which CI invokes from the unconditional preflight job, same reasoning as the document guard next to it. It asserts that the credential-bearing job declares the environment by its exact name, needs `validate` and is gated on its output with no `always()`/`cancelled()` escape, reads all four bucket bindings, and that no other job attaches an environment or reads any secret at all. The e2e suite drives it over the real workflow mutated into each of those regressions in turn, so every assertion is proven able to fail; gutting the checker turns all eleven red. * chore(whats-new): seed the document from the live card Bringing the workflow in with new copy attached ties the infrastructure to a content decision. The Arena CTA this document pointed at is not live — `/llm-arena-for-design/` and `/zh/llm-arena/llm-arena-for-design/` both 404 — and the card renders regardless, so merging would have put a dead button on every client's Home. Seed the repository copy from the object that is already serving instead: byte-identical to `https://whatsnew.open-design.ai/whats-new.json`, id `0.21.0`. That puts the current state under version control and makes the first automatic publish idempotent — it uploads exactly what is already there, so the merge exercises the whole chain (validate, upload, read-back against the origin the daemon fetches) without changing anything a user sees. The Arena copy is not lost; it moves to the PR body as a follow-up for the release owner, who can now change the card through this workflow without holding personal Cloudflare credentials. * fix(ci): detect secrets by context, not by access shape The guard added last round matched `${{ secrets.NAME }}` with a regex over the raw workflow text. A guard whose whole job is to stop a secret reaching the arbitrary-ref job had a blind spot for most of the ways to read one. Verified against the previous implementation, each returning zero violations while a secret reached `validate`: `secrets['NAME']`, `secrets["NAME"]`, `secrets [ 'NAME' ]`, `secrets . NAME`, `toJSON(secrets)`, a bare `secrets`, and `fromJSON(toJSON(secrets)).NAME`. Extending the regex would have repeated the mistake that caused it. One bypass proves why: a double-quoted YAML scalar may carry a backslash line continuation, so STOLEN: "${{ sec\ rets.NAME }}" parses to a live secret read while the source text contains no such substring. No text scanner can see that, however many shapes it lists. So the workflow is read through a YAML parser, and detection is a single property instead of an enumeration: GitHub's expression language has no string-to-context evaluation, so a secret cannot be reached without naming the `secrets` context as an identifier. Finding that identifier inside any `${{ … }}` expression covers every access form, including ones nobody has thought of. Parsing also retires the hand-rolled job splitter and its own failure modes, and lets the check distinguish "no violations" from "nothing was examined" — an unparseable document, a flow-style jobs mapping, or a renamed publish job now fail closed rather than passing quietly. Two holes the shape list never covered are closed as a side effect: a job-level `secrets:` key passes credentials to a called workflow with no expression at all, and workflow-level `env:` is inherited by every job. `yaml@2.9.0` becomes a root devDependency. It was already in the lockfile via `tools/release` and pinned repository-wide by the existing pnpm override, so the lockfile gains only the root importer entry. Test coverage moves with it: 26 of 46 cases now go red when the checker is gutted, up from 11. --------- Co-authored-by: lefarcen <ontf116@gmail.com>	2026-09-08 11:14:16 +00:00
lbjzz-hash	92f27d1fc1	fix(daemon): finalize deliverable syntax without agent turns (#7801) ... * fix(daemon): add bounded deliverable syntax repair loop * test(daemon): enable OD Next for branch evals * fix(daemon): keep syntax gate narrowly scoped * feat(daemon): report deliverable syntax timing * fix(daemon): remove evaluation rollout override * feat(daemon): measure syntax repair windows * fix(daemon): finalize deliverable syntax without agent turns * fix(daemon): validate committed syntax recovery and quote repairs * docs: clarify syntax gate applicability without touched paths * fix(telemetry): reject partial syntax summaries without version	2026-09-08 07:03:28 +00:00
lefarcen	ad09d38839	feat(chat): rebuild the chat panel against the design spec, and fix what real runs exposed (#7518) ... * fix(chat): close remaining scroll and retry gaps * fix(chat): preserve portrait artifact previews * fix(chat): reconcile media task files after path changes OPEND-2543 / OPEND-2544. A media task persisted its generation-time path, so an agent move/rename left the chat card requesting a 404 path. Resolve the task file against the project's currently registered files using a bounded size+mtime identity witness; ambiguous matches fail closed rather than guessing from filenames. Retry stays gated on run-terminal state so it cannot race the agent's own provider fallback. * fix(chat): stop scoring legacy question forms as successful runs OPEND-2549. An agent emitting the legacy XML question-form shape failed JSON parsing, and the run still terminated as a success with no artifact. Detection now recognises both shapes at the daemon boundary so an unanswered form ends the run as waiting, not done. * feat(chat): align artifact cards and memory shell with the latest design Tracks PR #7170 at 8015870095. Adds a --radius-2xlarge (16px) product token instead of copying raw radii, applies it to the memory shell and summary so expanded and collapsed keep one silhouette, and unifies artifact action buttons at 28px with the top-right controls (OPEND-2560). * fix(chat): register produced artifacts on the turn that made them OPEND-2550. A finished run could leave the chat rail with no artifact card because registration depended on a workspace read that had not landed yet. Registration is now driven by the turn's own file operations, so the card belongs to the turn that produced it. * docs(chat-panel): record the PR #7170 design diff and artifact version design The design-to-implementation audit against PR #7170 at 8015870095, the chat artifact version-semantics design awaiting review, and the rolling issue ledger. Plane attachment binaries stay out of git; the manifest records their SHA-256 and where they came from. * fix(chat): keep agent-written next steps on turns with no file output OPEND-2497. The host gated next-step suggestions on the turn having produced a file, so a turn that only answered in prose - add-to-chat follow-ups, a wording change, a proofread - silently dropped suggestions the agent had already decided were worth offering. Delivery evidence is now named per lane: the default lane trusts the agent's own suggestions, while host-authored lanes still require a deliverable to anchor to. Failed and canceled turns stay withheld. Clicking a suggestion still only fills the composer draft. * feat(media): publish batch coordinates for sequential image generation OPEND-2195. The chat rail could only guess how many images a turn was making by counting 'media generate' in the command string, so parallel tasks drew separate one-cell rows instead of one row of N. Tasks now carry the batch they belong to, their position in it, and its size, derived from overlapping lifetimes on the same run and surface rather than a timing constant. One-at-a-time generation overlaps nothing and reports a batch of one. Also closes the OPEND-2543 gaps this exposed: a file another task resolves by its own path is off-limits, a file more than one moved task can claim is withdrawn from all of them, and kind must agree - so two tasks recording the same size and mtime can no longer both take the same image. A rename landing just after run-terminal is picked up by a bounded reconciliation on runs this pane watched go live, instead of pinning the card to the pre-rename path. * feat(chat): rebuild the upgrade card against the latest design Tracks PR #7170 at 8015870095. The CTA moves out of the balance header into a bottom row beside the explanation, and the colour contract flips from green ink on black to a green surface with dark ink. Low-balance and zero-balance share one layout. Identity branching is unchanged - the card only draws the exit and calls onUpgrade. The error card takes the 16px radius through the chat seam with the product token as fallback. The reconnect counter inherits its weight rather than pinning 500: the design raised its own body weight in the same commit, so a literal 500 here would put a heavier number inside a lighter sentence. * fix(chat): treat an empty produced-file list as unknown, not as proof A turn's producedFiles is a client-side diff of project file names taken before and after the run, not a daemon verdict. It is empty whenever the turn edited a file that already existed, whenever the baseline could not be read, and whenever a settled file-list read wins the race with file-change invalidation - the last of which is OPEND-2550's own scenario. Treating empty as 'this turn produced nothing' therefore recreated the missing card it was meant to fix. Whether a turn has an artifact is now decided by its own write/edit tool rows; the produced list only contributes when it is non-empty. Also covers what was already implemented but untested: the toolbar Share and Export panels close on a second click (OPEND-2552), and artifact previews keep their aspect ratio across image, video, HTML, doc and pending forms without leaking onto execution-record thumbnails (OPEND-2547). Two assertions that passed vacuously - comparing two heights that both computed to auto, and reading a fit attribute without its computed style - now pin real values. Next-step suggestions take the design's medium weight (OPEND-2558, partial). * fix(daemon): emit each Claude tool call once, from whichever frame arrives first The stream had two paths that could emit a tool_use - the incremental content_block_stop and the assistant wrapper frame - but the guard set was named for the incremental one and only written by it, while the wrapper read it as if it meant 'already emitted'. Every tool in a recorded session came through twice. Adding a check to the wrapper alone would have been wrong in both directions: the set is never written by that path so the check could not fire, and a canceled turn where only the incremental path arrives would have lost its one emission. The set now means what its readers assume - emitted by any path - and both paths check and write it, neither waiting for the other, so a turn that produces only one of the two frames still emits exactly once. Flipping the order exposed a second defect the old sequence had hidden: the wrapper frame often carries an empty input object, which would now overwrite the real command. The wrapper prefers the delta-assembled input when that block is still open and parses, and falls back to its own when truncated. * fix(chat): make every composer send path agree on what it will send OPEND-2551. The Send button asked whether the composer had a payload, which counted quotes, while Enter asked whether the composed prompt was empty, and quotes fold into that prompt - so the two hands disagreed and the disabled button could still send. Both now read one canSend. The deeper half: four send paths existed and only one folded the quote prefix, so sending an annotation from the Mark panel cleared the chip and delivered nothing to the agent. All four now compose the outgoing prompt the same way. Also maps the design's user-bubble ground and muted action tier to chat-scoped tokens rather than literals, splits the queue grip and action icon sizes that an override layer had merged, and hides the default design router chip while leaving the underlying plugin binding intact (OPEND-2412). * feat(chat): give question forms a real color and amount control Tracks PR #7170 at 8015870095. The color question was a bare native picker and the amount question a read-only slider. Presets, the system picker and a typed hex now drive one answer, an unparseable hex disables Next, and the number above the slider is editable and clamped to the contract's min/max/step. Canonical hex is six lowercase digits at one site in the parser, matching what the native input sanitizes to, so the controlled value cannot fight the DOM. Alpha and three-digit shorthand stay rejected rather than widening the protocol; a value that cannot be normalized renders as written, never rewritten. The selected counter splits at its existing translation's count slot, so each locale keeps its own word order rather than concatenating fragments. Also fixes option punctuation colliding with the card border (OPEND-2402) and the cramped option row (OPEND-2401). * fix(chat): let option descriptions wrap and give confirmed answers a surface An option row is a button, so it inherited the global button rule that forbids wrapping - the description then overflowed the card and was clipped. The earlier min-width and overflow-wrap were correct but idle: when wrapping is forbidden outright, neither is ever consulted. The option row's existing button reset now zeroes white-space alongside the other global defaults it already undoes; the global primitive keeps nowrap, which is right for genuine single-line buttons. The confirmed-answer block had no padding, ground or radius at all, so it read as bare text rather than the design's panel. All three land through the 16px token, and an answer carrying a thumbnail drops to the 12px tier - keyed on the block actually having one, since a catalog card without a preview collapses to plain text like any other answer. * feat(chat): drop the thinking scroll window and collapse finished runs Product ruled against the design here: reasoning now reads like ordinary body text - natural height, no fixed viewport, no auto-scroll, no fade mask. The mask was what made it hard to read. The gray container and the blur-in reveal stay; the scroll lifecycle is deleted rather than left dormant. The indent moves onto the container so text does not shift when a stream ends. OPEND-2557: a finished run stayed open because details' toggle event cannot say who opened it - React writing the controlled value back fires one too, and that echo latched 'the user chose this' on the frame the shell first opened, disabling the collapse for the rest of the run. An echo always reports the value we already hold; a real click always reports the opposite. OPEND-2195: media cells are placed by their batch coordinate, so parallel generation draws one row of N instead of N rows of one. Placement is all-or-nothing - a batch missing or colliding on an index falls back to arrival order rather than silently displacing half its cells. Three failing tests were outdated rather than regressions: the completion word is deliberately withheld until a run settles, every turn now states its own terminal outcome since the pinned todo card was removed, and the icon slot moved one level down. Each keeps its original intent and gained coverage. * fix(chat): let jump-to-latest and the plan pill trade places by scroll position The two share one floating slot, but the plan pill won unconditionally - and it is present for the whole of any planned run, so scrolling up during one left no way back to the bottom. Scroll position now decides which occupies the slot: scrolled up shows jump-to-latest, near the bottom shows the plan pill. The bottom padding stays keyed on whether the turn has a plan at all, not on what is currently shown - removing it mid-scroll would shrink the scroll height, shorten the distance from bottom, and oscillate. OPEND-2546: re-quoting the same passage now says so. The decision runs in a synchronous mirror rather than inside the state updater, which StrictMode invokes twice; the toast key is a counter, since two clicks inside one millisecond share a timestamp and React would keep the first dismiss timer. The steer button carries a visible label, which is what the design gives it and the only thing that separates it from send-now - the two never render together, so a different glyph on a button seen alone would say nothing. They are genuinely different actions: steer writes into the live run's stdin, send-now stops and restarts it. * fix(chat): anchor the quote bar to the visible selection, above it Two defects stacked. The bar flipped the wrong way by default: the design puts it above the selection and drops it below only when the selection is against the panel's top edge, and the repo's own mirror gallery already renders it that way - the runtime disagreed with its own gallery page. The distance came from Range.getBoundingClientRect(), which is the union of every client rect including the zero-width caret at the selection's end. A drag that overshoots by a hair puts that caret on the next block's first line - nothing looks highlighted, but the union's bottom edge has already moved down there. Anchoring now uses the first and last rects that actually have area, and centres on the one it is touching rather than on the whole span. Together that is why a selection in a dense execution list threw the bar hundreds of pixels down onto the composer, while ordinary prose was only off by one line height and read as a spacing nit. * fix(chat): put the whole turn footer on one muted ink tier The design gives that row a single rule; we had split it into feedback and copy classes, so muting only the feedback half would have left two greys side by side. Both now consume the same token the timestamp already uses, and hover changes the ground rather than the ink - it previously jumped to near-black. Selected states keep their semantic green and red; the guard that proves it is order-sensitive for the positive rating, and the constraint is written next to the rules that depend on it. The support dialog takes the design's 16px radius through the chat seam, and its quoted excerpt is corrected - a stale quote of the source is worse than none. * fix(daemon): carry the original request when a headless continue cannot resume od run continue sends only the continue instruction, on the assumption that the session holds the request it refers to. The daemon may refuse to resume for reasons the caller cannot see - a changed model, a changed cwd, a moved cursor - and then that instruction lands in a blank session that never saw the request. Callers now declare that their message is a continuation, and the daemon seeds the original request from the rejected session's own cursor when it starts fresh. The field is optional and the behavior only fires when set, so existing callers are byte-identical. The web client already handles both branches: it sends the full transcript and the latest turn separately, and the daemon picks by whether it resumed. It is deliberately left alone. * feat(chat): follow a live thinking stream, and stop the rail cutting the mark Thinking sticks to the bottom while it streams, parks when the reader scrolls up, and re-arms when they return to the bottom or reopen the drawer. It reuses the chat log's own stick-to-bottom module rather than growing a second set of predicates: intent changes only on scroll, so content growth cannot masquerade as a gesture, and the geometry baseline refreshes on every resize settle even while parked - otherwise a parked reader could never get back. The follow is one write to scrollTop; the slow stepped scroll and the fade mask stay gone, and the height cap is max-height, so short reasoning is not padded out. OPEND-2417: the rail started at a hard-coded 25px while the status mark is centred in its row, so the mark's bottom moved with row height and crossed the rail the moment a title wrapped to two lines - and this PR's 12px to 13px title bump had already eaten most of the single-line clearance. The mark now sits at a fixed offset like the plan card's, and the rail derives its start from the row's own padding, slot and gap. Single-line rows land on 25px exactly as before; the difference is that they no longer drift when an input changes. * test(chat): measure next-step weight through the real cascade The previous test injected only the component's own module, so it measured a product that does not exist: the global button rule already sets weight 500, and the declaration added to 'fix' it changed nothing. The test now injects the global reset first, in the order the app does, and pins the declaration's actual job - holding the design's value on the component itself, so it survives the day that legacy global button styling is cleaned up. * fix(chat): let a long next-step suggestion wrap instead of being cut off The suggestion is the sentence that will be sent; a reader who cannot see all of it cannot decide whether to click it. Two things were cutting it: the text layer asked for a single line, and the global button rule leaked nowrap, a fixed 36px height, a line-height of 1 and centred alignment into the row - the design's own button reset carries none of those. Both are undone at the component, leaving the global primitive alone, where nowrap is right for a genuine single-line button. The arrow now aligns to the first line rather than floating to the middle of a wrapped row, following the queue row's written precedent for the same shape. A single-line row still measures 36px, so nothing moves until a suggestion is actually long enough to wrap. * feat(chat): let a long single-choice list collapse behind more options A select with more than a handful of options now renders as a menu: common entries first, the rest behind a host-owned 'more options' toggle, capped at a scrolling height. The trigger is the option count or the presence of the new grouping fields, not the type alone - a legacy two-option select keeps the flat list it has today, and the one real product select (a hundred voices) gets the menu without the model changing anything. The toggle's own copy belongs to the host and is generic; a model's group labels still render as headings inside. The authoring rules now cap options at six or seven, ask for plain language over jargon, and put a length target on an option label with long text moving to its description - the missing constraint behind suggestions that had to be truncated. They live in the general form layer, so a mid-conversation form is covered rather than only the opening brief. Those rules and the type list exist in six hand-maintained copies across the daemon, contracts and a bundled skill, with no shared constant; a type could be dropped from any one of them and every test stayed green. A parity spec now pins all six against the renderer's own union rather than against each other, which six copies going stale together would satisfy. * feat(chat): show a tool call the moment it starts, not when it returns An in-flight call rendered nothing at all, so a run that spent fourteen minutes inside one command showed the previously finished rows and a ticking total and nothing else - which is what 'it ran forty minutes and produced nothing' was describing. Everything derivable from the call itself now appears immediately; only what genuinely needs the result waits for it. The shell's span also counts from the in-flight call, so a long stall stops reading as no progress. The row keeps its identity across both phases, so a result swaps the state of the row that is already there rather than adding a second one. Pending means the call has not returned, which is not the same as still running: a cancelled turn leaves rows pending, and they settle to a neutral mark rather than spinning forever or claiming a success or a failure that never happened. The elapsed slot is present but empty while pending, which is what keeps the chevron from shifting when the value lands. * feat(chat): give the panel the design's typographic baseline Every component measured byte-identical to the design and still read wrong, because the panel inherited the app's baseline rather than the draft's: weight 400 against 500 and 14px against 13px. Line height was already right. Both now land on the chat seam, so the panel matches the draft while the sidebar, settings and home keep the baseline they were designed against - the draft only ever covered this panel. The mono face moves with it. The design relabels the same font file from 400 to 500, which is bookkeeping rather than a new weight: with one static face the glyphs are identical either way, and the label simply has to agree with the baseline that requests it. Doing one without the other would leave every elapsed time, path and hex asking for a weight the face does not claim. * fix(prompts): tighten the new form rules and raise the charter ceiling The five rules landed as explanatory prose and pushed the slim charter past its byte ceiling, which is paid on every turn of every run. Rewritten as short imperatives they cost 644 bytes instead of 1,315. That still does not fit: the charter sat 44 bytes below the ceiling, so no amount of compression would have. The rules cannot move somewhere cheaper either - no conditional section can predict that a turn will emit a form, and the on-demand atom that carries them for OD Next is not reachable from a skill-less slim run. The ceiling moves, documented beside the constant in the format the previous raise used, to the next step rather than to just fit: 44 bytes of slack is what made the next sentence hit a wall. * fix(chat): stop our own scrolling from reading as the reader's Positioning a question form animated the log upward, and a frame of that animation looked exactly like someone scrolling up, so following stopped. On a quiet turn it healed itself - the animation finished at the bottom and re-armed - which is why it survived. While the model is still streaming it does not: the destination was fixed when the animation began and does not follow the growing content, so it lands somewhere that is no longer the bottom and the escape stands. Nobody touched anything. Positioning is now instant, which collapses the window to nothing rather than trying to recognise and ignore our own frames inside it. The two near-identical copies of this logic - one already fixed in an earlier pass, one not - are one function now, so they cannot disagree again. Recovery had the mirror problem: it demanded the layout hold perfectly still, and a stream never does, so a reader scrolling all the way back to the bottom had their gesture thrown away on the frames where content grew. Reaching the bottom while the bottom is moving away can only be a real gesture; reaching it because the content shrank underneath still is not, and stays refused. * fix(chat): stop a cancelled turn spinning forever, and give the stream its weight An image cell kept spinning after its turn was cancelled: the row knew the call had not come back but not whether anything was still working on it. It now takes the same turn-state gate the tool rows use, so tool and image rows share one vocabulary end to end - same field, same mark, same question asked of the turn. The thinking stream's body weight had to be written against the stream box rather than the paragraph class: the text inside belongs to a different CSS module, so the obvious selector would have matched nothing. The test proves the two class names differ rather than assuming it, and pins the specificity margin so a later simplification back onto the paragraph class fails loudly instead of depending on bundle order. Three fixtures were typed strictly enough to catch the new required field, and two more were asserting a shape they did not have - one carried a property that does not exist on the type at all, hidden behind a cast that is now gone. * feat(web): measure the chat panel's own runtime health Nothing measured the panel as a thing: long tasks fired without a conversation or run attached, boot timing covered the page rather than opening a conversation, and a panel that mounts and then renders nothing was invisible. Seven events now cover first paint, DOM growth, memory pressure, stream health, interaction latency, protocol anomalies and recovery. They are built to be findable, not just countable. Every event carries the run id - which is simultaneously the PostHog join key, the Langfuse trace id and the diagnostics-bundle handle - plus the conversation, project, agent, model and channel. A pressure event carries the heap trend and the breadcrumbs leading up to it rather than only the moment it broke. Timing events declare whether the measurement can be trusted, so a reading taken before stylesheets landed is excluded rather than reported as a regression. They are also built not to become the problem they measure: interaction latency filters in the browser, a run with no jank emits nothing, and anomalies dedupe per run so a render-time detection cannot end up measuring typing speed. * docs(chat-panel): record the component gap audit, scroll research and dispatch log The 24-component / 89-state audit against PR #7170, the streaming stick-to- bottom research that recommends extracting our own machine rather than adopting a library, and the rolling dispatch ledger with the product rulings that override the design draft. Attachment binaries stay out of git; the manifest records their SHA-256 and where each came from. * fix(chat): show the retry button on a failed message, and animate the audio waveform A message that failed to send offered no way to retry: the action row hides itself with opacity, and opacity does not just fail to inherit - it composites, so a child cannot opt back in. The design hides the individual controls and excludes the retry, which is what this now does, along with the pointer-events the same rule carries: the invisible copy button used to be clickable. The audio waveform never moved. The keyframes it referenced did not exist and the per-bar offset was never written, so a stalled render was the only possible outcome. Bars now stagger off their own index, honour reduced motion, and the play control sits inside the row as the design nests it rather than beside it. Plan steps take the design's explicit 400. They inherited 400 before the panel baseline moved to 500, so they were accidentally right; afterwards a not-yet-current step would have sat one notch below the current one instead of two, flattening the card's hierarchy. * feat(chat): route artifact cards by the version each kind should show An HTML card's face is the screenshot taken on the turn that made it, while clicking it opens whatever the workspace holds now. The two deliberately disagree - the card is a record of that turn, the click is a door to the current file - and the comments say so, so nobody reconciles them later. An image card is the opposite: face, click and export all read that turn's own bytes, which is what stops a later overwrite from rewriting history. With no snapshot - an old conversation, a capture that failed, no renderer, a full quota - HTML shows the live latest and an image shows the current file. Neither says anything about it: a card that announces its own failure is worse than a card that quietly shows the best thing available. A snapshot URL is only handed out once the snapshot is ready. A half-written one renders as a broken image, which is worse than the fallback it replaced. * feat(desktop): capture a first-viewport thumbnail without growing to the page The existing image export measures the document and grows the window to it, up to twenty thousand pixels, which is the long strip it is meant to produce and exactly wrong for a card cover. A capture mode now says which of the two is wanted: the thumbnail path fixes the viewport, never issues the height probe, freezes animation and transitions, tells the page motion is unwelcome before running a script that finishes what is already animating, and captures the first screen only. The export path is byte-identical - the branch happens before the code it used to share. Resource waiting learned to stop at the first viewport, because a cover that waits for assets below the fold pays for page length it will never show. The renderer reports why a capture failed rather than returning a blank or fabricated image, so a card that cannot get a cover knows to show the live file instead of a broken one. * feat(daemon): keep an immutable copy of what each turn produced A chat card read the workspace file by path, so overwriting an image rewrote every earlier card that showed it. A turn's output is now copied into a content-addressed store the moment it exists and referenced by digest, which separates three things that used to be one: where the file lives now, what it contains now, and what this turn produced. Media capture takes the provider's own buffer before the file is written, so exactness is structural rather than a re-read that could race. The general path copies at the run's terminal boundary and stats either side; drift fails the snapshot rather than installing the newer bytes, because a snapshot of the wrong version is worse than no snapshot. Where both paths cover one file the media bytes win, scoped to the run so an earlier turn's copy can never stand in for this one's. Recovery is deterministic because byte-sourced intents record their digest up front: an interrupted capture either completes from what is on disk or is marked interrupted, and a path-sourced one only completes while the source still matches. Sweeping is off until enabled; identity survives a rename and a tombstone releases the path without resurrecting the old row. * fix(chat): pick the main artifacts when a turn declares nothing Declaring was meant to be the only way a card appeared, but a turn that edits without creating declares only a quarter of the time - the instruction asks for 'a file you created this turn', and a small edit does not read as creating anything. So most edit turns showed nothing, and the earlier fix for that showed everything instead: a page, its script, its stylesheet and its images all became cards, which is the pile the marker existed to prevent. Silence now gets an answer rather than a blank or a pile. Pages and documents win; if a turn wrote none, its images stand on their own; stylesheets, scripts, icons and data files never do. An unrecognised extension counts as a deliverable, because the wrong way to fail is to quietly hide what someone just made. The instruction now says that changing a file is delivering it, and that declaring narrows rather than being the only door. Five places claimed otherwise, two of them tests that had pinned the old sentence in place. * fix(chat): put the tool rows and step interludes on the muted tier A tool row read as dark as the step title above it, so the record had no depth: the thing that happened and the thing that describes it weighed the same. The row, its elapsed time and its icon now share the muted ink the design gives them, and a row that failed keeps its own colour. Interludes between steps were meant to be smaller and lighter than the opening line, and were neither. The rule excluded any turn that had a plan - which is most of them - while the thing it was written to protect, the opening line, is already excluded by being the first child. Removing that exclusion is what makes the summaries between steps read as summaries. Thinking now sits on the same surface whether it is still going or already done; it used to gain a background while streaming and lose it once expanded, so the same passage changed shape when it finished. The class that was supposed to carry that surface had never existed, so the rule attached to it had never run - and a CSS Module proxy hands back a class name for any key, which is why no unit test could see it. * fix(chat): hang the chain on steps only, and align surfaces to their own column The vertical rail and its indent belong to things on the chain - the steps of a plan and the summaries between them. Thinking, tool rows and prose at the top level were getting both, so a passage that had nothing to do with any step still read as hanging off one. A step now says so itself, which means a block type added later stays off the chain until someone puts it there, rather than joining by accident. The grey surfaces were positioned to put their text on the column, which left the box itself jutting eight pixels past the rows around it - and since the offset came from nesting depth rather than from where the sibling rows sit, two surfaces at different depths missed their neighbours by different amounts. The box now lands on the column and the text keeps the padding the design gives it. A failed command row says it is failed rather than being inferred from having a reason attached, which is also what lets the failure colour be written the way the design writes it. * fix(chat): let the next-step button size itself the way the design does The button carried a minimum width and a horizontal padding that appear nowhere in the design, and the round that added them wrote both into a test, so the invented numbers were guarding themselves. The padding was also the wrong tier: the design's footer buttons are all small, and the small tier overrides the base padding it was copied from - which is why the button read as oversized rather than merely wide. Only the height stays, because that is the one number the design specifies there, and it explains why: a height written down does not drift when the font size moves, while one grown from padding does. That drift is exactly what happened when the panel baseline went to 13px. The shared button already supplies the padding, size and weight the design gives this tier, which the test now proves by removing that stylesheet and watching the assertions fail. * fix(daemon): stop teaching the model a protocol we retired The critique grammar kept appearing in answers, and four rounds of stripping it out never held, because the feature had two entrances and retiring it closed only one. The protocol itself stopped being injected; the atom carrying its prose stayed in every design run's stage list, telling the model to follow a tagged protocol that was no longer there - so the model wrote the tags from the description. None of the attribute names match the real protocol; every one of them traces to a sentence in that document. The body now travels with the protocol: injected together or not at all, from the decision the server already made rather than a second copy of the predicate, since a second copy is a third entrance. The document itself describes what to check rather than what to emit, and no longer forbids prose outside an envelope - which is also why a turn could finish with no closing summary at all. Stripping is fixed where it failed and extended where it was absent: a held fragment no longer gives up the moment a tag carries an attribute, thinking is stripped before it is persisted rather than only on its way to the screen, and the client covers the execution record and not just the prose beside it. A spec now asserts that the assembled prompt contains none of this grammar, so a future path that reintroduces it fails rather than reaching a user first. * fix(chat): stop the feedback panel yanking the view to the top Rating a turn scrolled the page even when the reason panel was already fully on screen: it asked for the panel's top edge to meet the viewport's top, unconditionally, so a panel sitting comfortably in the middle still dragged everything the reader was looking at. Asking for the nearest position instead leaves a visible panel exactly where it is and, when one really is off screen, moves the least amount that reveals it - the browser's own primitive rather than a hand-rolled visibility check. It was also the one programmatic scroll on the chat log still animating, which is the invariant the question-form fix wrote down: a scroll we start ourselves is instant, and anything that wants animation releases follow first. * fix(chat): keep the quote bar with the start of a long selection Dropping below the selection exists to get out of its way, which works for a phrase and stops working for a selection that fills the screen: the bar got out of the way and landed most of a screen from anything the reader was looking at, on top of the artifact preview. A selection taller than half the panel now keeps the bar at its start when it has to flip, which is where the design anchors it in the first place - flipping below is a correction for having no room above, not a change of reference point. Short selections still clear the whole passage, including a two-line one pressed against the top edge, which is the case the new rule must not capture. * test(chat): pin the thoughts icon against four ways it can silently degrade The icon is already the one the design hands over, byte for byte, so this round has no implementation to change - which is exactly the case where a spec earns its place. A name that stops resolving does not throw: it falls through to a stroke fallback with no case for this one and renders nothing, leaving a blank where the icon was. Asserting the name would not catch that, so the spec asserts the rendered path, entire rather than by fragment, since the filled and outlined variants agree on precisely the strokes a fragment would match. It also pins that the in-progress state keeps its spinning orb, so a later attempt to make the two states consistent replaces motion with a static glyph loudly instead of quietly. * fix(daemon): stop an unfinished marker from swallowing the answer after it An upstream reconnect cut a next-step marker mid-attribute, and the scanner tracking quotes paired that unclosed quote with the next tag's, so it never found an end: every closing bracket after it counted as text inside a string. The buffer grew past its limit and the overflow branch handed the whole thing to the screen, and to the database, where a refresh could not remove it. A value cannot contain a newline or a raw angle bracket, so either one proves the quote never closed. Seeing one now retires just the broken tag and keeps reading, rather than waiting for an end that cannot come; overflow discards rather than releasing. A held fragment at end of stream is discarded too, the way the artifact marker already did. A reconnect is also no longer dropped on its way to storage. It is a real upstream event that happened once, not the polling noise the rest of that list suppresses - and without it a conversation that was interrupted and rewritten reads, on reopening, as though a second answer appeared from nowhere. The qoder stream decodes with a per-handler decoder instead of converting each chunk alone, so a character split across chunks survives. * fix(chat): give the thoughts drawer one box instead of two Hovering the thoughts header lit a background that started seven pixels left of the passage underneath it - twenty-nine when nested - because the header row stretched its hover target to the shell edges while the body was pulled back to the column. Both were right on their own and wrong together. The column now belongs to the drawer, and the header inside it carries none: the same arithmetic reaches the same place, so nothing about the title or its icon moves, and the two backgrounds share an edge because they share a box. Which is what the thing is - a panel with a lid, not a row that happens to be followed by a panel. The row rule that stretches hover targets is untouched; removing it turns eight assertions red, which is the point of keeping it. * fix(chat): say a generation failed while it still might be retried by the agent A cell that failed mid-run already could not be clicked - the host withholds the callback until the turn settles, so the agent's own provider retry cannot race a manual one. But it still read 'Retry' next to a retry icon, so the only thing the reader learned was that the button was broken. It now says what actually happened, as a statement rather than a dead control, and becomes a real button once the turn is over. Over includes cancelled and failed: what the gate protects against is a second retry running beside the agent's own, and once the turn stops there is nothing to race. Wanting one image after abandoning the batch is a normal next step. The wording reuses the label the tool rows already carry in every locale rather than storing the same word a second time. * fix(web): distinguish auto-expanded folds from user-opened ones `defaultOpen` is only read on the mounting frame, so a fold that opens because its subject is running has no way back: when the subject finishes and the key has not changed, the same instance keeps the same `selfOpen` and stays sprawled open. `lifecycleOpen` follows the subject's lifecycle on every change instead of just the first — until the user touches it, after which the fold is theirs and neither direction is forced back. Telling a real click from React's own write-back is the whole problem: `<details>` fires `toggle` for both. The predicate compares values, not occurrence — an echo reports the state we already hold, a click reports the opposite — and reads it through a ref, because the memoised handler's closure would still hold the first frame's value by the time a queued echo arrives. Same predicate ExecutionShell already uses, verbatim. Opt-in: every caller that does not pass `lifecycleOpen` keeps its exact current behaviour, and controlled folds never reach it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): drop the step rail and restore the hover overhang The designer retired the grey vertical line that chained the steps together, so both `::before` pseudo-elements go, along with the five variables that existed only to place them and the two `position: relative` they were positioned against. Nothing is kept "in case the line comes back" — re-deriving it from a fresh measurement beats reading stale constants. The status dot's own guard survives the line that used to clear it: it was never about the rail, so its test moves to a file named after what it actually pins. The offset stays 1.5px even though the step title has since grown to 13px, which puts single-line centring 0.75px away; the assertion pins "under a pixel of drift" rather than pretending the two agree. The hover background reads slightly larger than the panel below it because the design gives them different insets, not because anything is added: the row bleeds 7px to each side and the summary pads 7px back, while the body panel sits flush at 8px. An earlier attempt zeroed the summary's leading inset to line the two up, which made them one rectangle and read as the panel itself flashing. Text lands exactly where it did. Indentation of the between-step notes keeps its 22px for now — the design justifies it twice, once independently and once by the rail — and the second half of that rationale is gone. Flagged for a ruling. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(web): show elapsed time on rows that are still running A row that has been running for twenty-eight minutes showed nothing at all until it finished, which is exactly backwards: the number matters most while the user is waiting for it. The design leaves the slot open for this — `ToolRow` needed no code change, only data. One live end-of-span for the whole turn, `turnIsLive ? nowMs : endedAtMs`, the same sentence the shell header already uses. Steps, thinking and tool rows all read it, so none of them can settle to a different endpoint than the one they were counting toward: a step that reported "1m 2s" while running would otherwise collapse to "2.0s" the moment the turn stopped, because the settled path counts to the last timestamped event rather than to now. The live value is computed after span bookkeeping, never into it, or the silence-detection span would be identically zero. No new timer: every number is `nowMs - startedAt` off the one interval that already drives the shell header, and a test pins that rendering four live rows calls `setInterval` no more often than rendering one. Rows whose start is unknown still print nothing rather than inventing a zero. Known gap: a tool row can tick back by one frame when its result arrives stamped earlier than the last tick. Strict monotonicity needs a per-row high-water mark, which means component state; the test pins the magnitude instead so the drift cannot grow silently. Also lands the one line the fold-lifecycle change was waiting on: a running todo drawer now follows its subject's lifecycle instead of only its first frame, so it stops staying sprawled open after the step finishes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(chat): pin where the failure card contradicts the daemon A colleague hit a TLS certificate failure and got a card offering Retry as its primary action. The daemon had already classified it correctly and said on the wire, three separate ways, not to retry. The web side reads none of those three and re-derives the answer itself. The survey is exhaustive rather than sampled — all 67 failure reasons run through the real resolver — because the question product has to answer is not "what about certificates" but "how far apart are the two verdicts". Forty cells offer Retry against an explicit not-retryable; thirty-two of those are reachable under an opaque error code. Six more are not missing rows but opposite conclusions, which is the cheaper half to fix: no new copy is needed to stop saying the wrong thing. The blocker is structural. Nine primary actions exist and none of them is "go fix your environment", while the ladder's own comment claims to cover that rung. The error catalog already ruled on the shape twice; only the button has nowhere to land. The daemon-side test locks the classification that is already correct, so the gap cannot later be misread as a backend bug. The web-side red test stays out of the tree until the ruling lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(run-errors): bring the error-UX design back into the repo The design that settles the failure-card questions has been living only in Feishu. The implementation audit's header says the source file sits on this branch, but git has never held it — the audit has been pointing at a file that does not exist for a week. That matters more than usual right now: today's survey of the failure ladder rediscovered a gap this design had already ruled on. The environment class was never an open question — S30 names the copy, the slots it interpolates, and the button order. The audit had already recorded that neither of the two actions those scenarios need exists in the codebase. Feishu stays authoritative; this copy is for reading alongside the code and for grep. The screenshots are short-lived signed links, so only their descriptions survive here. One line in S30 is now known to be stale: the daemon does classify certificate failures, and has since the detail was introduced. The web side never reads the answer. Left as written rather than edited silently, since the doc is under review. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): pin every newly sent message to the top, not just typed ones Two independent defects were splitting the behaviour in half, which is why it looked intermittent. Whether to pin was something each send site had to declare by raising a flag, and that flag was raised in exactly one place: the composer's own callback. Seven of the eleven entrances that put a new user message on screen never went through it — question-form answers, the home page's first send, annotations, anything the queue released, resume, and image retry. Pinning now follows from the transcript itself: the trailing user message changed identity, so a new turn is on screen, regardless of which button produced it. New entrances are covered by construction, which matters because no one has ever remembered to add the line. The other half is the reason it varied run to run. The pin scrolled smoothly, and nothing distinguishes our own animation from a user dragging the scrollbar — position is all either one reports. Mid-animation frames sit far outside the release tolerance, so the first one dropped the pin and froze the tail spacer; the final frame lands exactly at the bottom while the reply is still empty, which re-arms stick-to-bottom and drags the message back off the top. A reply that starts quickly grows the log past that point and the pin survives; a slow one does not. Same code, opposite outcome. Self-initiated scrolls are already required to be instant — the question-form anchor was moved off smooth for this exact reason — and this was the last one still animating. Visible change: the pin now lands on the frame instead of gliding, losing roughly 300ms of animation. That animation was the defect. Also updates the feedback-panel assertion left behind by c121d81b17, which changed that scroll to nearest/auto without carrying its test along. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): anchor the quote bar to highlighted text, not to a swallowed box The bar was not being clamped to the bottom of the panel — it was faithfully anchoring to a box that had no highlight in it at all. Selection geometry came from the whole Range's client rects, and per CSSOM that list contains the border box of every element the Range fully encloses, mixed in with the text line boxes. Dragging a selection a hair past the end of a bubble — invisible on screen, since what follows is blank — swallows the tail spacer: full width, real height, not one character. The earlier fix asked only whether a rect had area, so that box passed as the selection's last line, and the bar chased it down to the composer and centred itself on the panel. Painted text is what "the visible selection" means: no text, no highlight, no anchor. Both edges are found by walking a short way in from each end of the Range rather than over the common ancestor, which grows to the whole log during a cross-message drag and would re-measure every text node per frame. The bar also has to leave the pane. It is positioned in viewport coordinates and declares `position: fixed`, but an ancestor carrying backdrop-filter becomes the containing block for fixed descendants — so those coordinates were being read as pane-relative, shifting the bar down by the pane's top edge and letting the pane's overflow clip it. The composer is portalled out for exactly this reason and that rule says so in its own comment. Adjacent, deliberately left alone: a quote taken from the user's own message carries a null message id, because the lookup reads the attribute the assistant bubbles use. Its own red test, its own change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): stop disabled options reacting, and say when a question was skipped Two defects in the same component. An option that cannot be chosen because the limit is reached was picking up the global `button:disabled` fill, which outranks the chip's own transparent background, and then `.qf-chip:hover` outranked that in turn — so the row carried a permanent grey pill AND still lit up under the cursor. Disabling a button stops clicks, never styling. The design draws no disabled state for options at all: one background, transparent. The repo had already fought this exact leak for the visual-direction cards and won it back with a second class; the option row never got the same treatment. Skipping was reported as "Answers sent". Skip is not a separate path — it is a submission whose skipped questions carry no value, and the text the model receives spells out `(skipped)` for each one, so nothing is being hidden from the agent. The summary was dropping valueless rows entirely, which erases what the user chose to skip and, when every question is skipped, leaves nothing at all — at which point the render falls back to a line that is false by construction, since its condition is "no answers exist". The summary now reads back what was sent. Three cases, not two: a value is read out, a submitted-but-empty question says Skipped, and a question absent from the submission stays silent rather than announcing a decision the user never made. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(chat): record the ruling that the quote bar stays on screen The half-a-panel threshold it replaces was guessing whether the selection was too big to dodge. The question that actually decides where the bar goes is which part of the selection is on screen, and that is measurable. The threshold was also reading contaminated input: until this morning a selection could swallow a full-width spacer sitting at the bottom of the log, which made every such selection taller than half the panel by construction. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): retire two assertions the D3 reversal left behind Both reds outlived their premise; neither implementation was wrong. The image row's running mark was deliberately put behind the same turn-state gate the tool rows use, so that a cancelled turn stops spinning. That change updated the tool-row fixtures in the shared primitives file and missed the image-row one — an omission, not a contract. The fixture now says whether the turn is alive, and a counter-case pins that staying silent gets the neutral mark, so the gate cannot quietly go back to spinning unconditionally. The thinking-inflation case was still written for "a call that has not come back does not get a row". Product reversed that on 2026-09-02: a call renders the moment it goes out. Grouping then follows the rule the module already states — a tool row between two stretches of reasoning makes them two stretches, so two cells. The old case also called 10s an undercount, which only held while both halves shared one cell; once split, the second cell owns that gap alone and 10s is the true figure, now asserted positively so the file cannot go green by handing out no numbers at all. The docblock that sent three agents hunting in the wrong place said a call still in flight does not get a row. It says the opposite now. D3 and B8 in the spec were still stating the retired rule too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): win the option row's colours back from the global primitive The same `button:disabled` declaration that was repainting the option's background also greys its title, while the description underneath keeps its own colour — so the title read fainter than the text it was meant to head, with the opacity on top of that. It reaches a second victim as well: a chosen option in an already-submitted form is styled by a rule of equal weight and loses the same way, so answers the user actually picked were being drawn as if unavailable. Hovering a chosen option also flashed the checkmark's border, because the design wins that with two ancestors we dropped when porting; without them the rule sits below hover instead of above it. Every fix here restores a design selector rather than inventing weight. Where the previous pass had reached for `:not(:disabled)` to lift hover above the checkmark rule, that lift is undone: hover goes back to what the design writes, and the disabled case takes its own selector — the same shape the background pair already uses. The chosen state then sits strictly above both, rather than tying and depending on source order, which is how this class of leak got in the first time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(chat): give proxy and certificate failures the card the design specifies Five backend reasons — certificate, proxy, network, host policy, local storage — had no row on the web side at all, so a failure the daemon had named precisely arrived as "task failed" with a Retry that could not work. The design settled this months ago (S30): name the fault, name the likely cause, and lead with the action that can actually fix it. The card now says what happened and offers Settings first, with Retry kept beside it — deliberately, because upstream folds two different faults into one message and one of them really is a blip. The copy interpolates the cause rather than repeating a near-identical sentence five times, so nineteen locales translate five short phrases instead of five paragraphs. Nothing in it promises that configuring a CA will help; a test holds that line, since upstream has versions where it does not. The unclassified fallback stated as fact that nothing had named the failure. That was false for exactly the cases it was hurting. It now asks the daemon: only when the daemon both named the reason and ruled retrying useless does the card drop out of the retry rung; a genuinely unknown failure keeps today's behaviour, because most of those are one-offs. Asking whether the daemon named it has to come first, and is not decoration: the classifier's own fallback stamps `unknown` with retryable already false, so reading the verdict without that guard would strip Retry from precisely the case that deserves it. Two things this does not reach. The verdict fields are not yet carried on the SSE end frame or the persisted error event, so the new branch is inert until three call sites outside this change forward them. And `local_storage_failure` is a local disk fault wearing a sentence about corporate proxies; it is marked in the source as needing its own copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): anchor the quote bar to the part of the selection on screen The rule it replaces was guessing: a selection taller than half the panel was assumed too big to dodge, so the bar went back to the start. What actually decides where the bar belongs is which part of the selection the reader can see, and that is measurable — intersect each edge line with the visible area and anchor to whichever edge survives. A selection entirely on screen is untouched, down to the pixel. When the first line has scrolled above the fold the bar stops reaching for it and sits under the visible last line instead; when the last line is below the fold it falls back to the visible start. With both ends off screen there is no edge to hug, so it takes the top of the visible area and centres on the panel — the horizontal coordinates of off-screen lines are meaningless, and the top stays clear of the composer the reader is about to type into. The invariant that the bar's rendered box always lands inside the visible area was already true — edge clamping saw to that — and is now pinned across forty geometries so a future placement cannot skip the clamp. What was broken was the other half: being anywhere near the selection. This reverses an earlier call that a tall but fully visible selection should anchor to its start. That call came from a report of the bar flying most of a screen away and landing on an artifact preview, but the cause was the bar anchoring to a swallowed element box, fixed this morning. With the last line now guaranteed to be painted text that is genuinely on screen, hugging it cannot throw the bar off screen — and it is where the cursor just was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): follow the draft's chosen-option weight, and stop hover erasing the tick The 600 weight on a chosen option was not a transcription slip. The draft said 600 when the panel was built, and changed it to 500 a week later along with the ink token. We picked up the colour half of that change and missed the weight, so the two halves of one edit have been out of step since. The history is now in the source, or the next reader will "fix" it back. The own-answer tick was losing to hover outright, not tying: `:hover` carries a class-level slot of its own, which puts the chosen rule a full step below. Same defect the fixed options had, one box later — the expanded row renders a different element, and the earlier pass only reached the first one. The draft wins this with two ancestors, so that is what restores it, and the guard asserts strictly-greater rather than merely checking the colour. A tie also paints correctly today, purely because of source order; the colour assertion cannot tell the two apart, and the ordering is exactly what breaks the next time someone moves a rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): calibrate the cascade ruler against the spec The helper that decides which CSS rule wins was counting `:not()` itself as a pseudo-class. The spec says the functional pseudo contributes nothing and is replaced by the weight of its heaviest argument, so every `:hover:not(:disabled)` in the tree read a full step heavier than a browser would. `:is()` and `:has()` had the same fault, `:matches()` was not recognised at all, and `:where()` — correctly zero — was matched by a pattern that only survived one level of nesting. Pseudo-elements were being deleted outright rather than counted as elements, and the single-colon legacy spelling was counted as a pseudo-class, which is wrong in both columns at once. Selector lists were summed instead of taking the heaviest branch. A ruler that reads high hides real leaks; one that reads low invents them. Either way the readings are not evidence, and this family is where several of today's cascade fixes were judged. So the reading change was measured, not assumed: both rulers were run over every selector in the loaded sheets (313 branches move) and then over every resolved property of the question-form tree in each state (7619 readings, none move). The zero is only meaningful because a control case with a deliberate disagreement was checked first — it goes red, so the comparison can see a difference when there is one. Nothing this family asserted was resting on the fault: none of the rules it actually compares contain `:not()`. Assertions cite the spec sections they come from, and the cases the implementation does not model are named in its header rather than guessed at. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(web): correct why the hover and disabled rules stay apart The comment claimed merging them would outrank the chosen-option rule. `:not()` carries no weight of its own, so the merged selector ties with it instead — and wins today only because of where it sits in the file. Which is the actual reason not to merge: a tie decided by source order is the trap the spec's own note forbids, and nothing goes red when someone moves a rule. The pair above ties too, but a test pins which of them wins, because a disabled button still matches `:hover` — that being the defect this pair was written to fix. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(chat): carry the daemon's failure verdict to the error card The classifier decides two things about every failed run — whether retrying can help, and what the user should do — and the card was seeing neither. It re-derived the answer from the failure detail instead, and disagreed with the daemon in forty places. `failureAction` at least reached the status endpoint. `retryable` existed only inside the classifier: the finalize path read the classification and dropped that field on the floor, so no transport could have carried it. Both now ride the end frame, the status body, the durable run state and the persisted error event. All four, because each is somebody's only path: live listeners take the frame, a reconnect re-reads the status body, a restarted daemon restores from durable state, and reopening the conversation replays the stored event. Missing one is a failure that silently downgrades under a condition nobody reproduces. Every read and write of `retryable` tests for a boolean rather than truth, since `false` is the whole point of sending it and `x ? {x} : {}` would eat exactly that. The card needs no change — it already asks for the verdict, and the answer now arrives. Around twenty of the mismatched cells resolve from this alone; the rest have their own web-side row and need those rows corrected, which is a separate judgement about which side is right. Absence still means absence: a replayed event from before this change carries no verdict and keeps today's behaviour, pinned by an exact-shape assertion rather than a negative match, which an added optional field would have made vacuously true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): stop the cascade ruler dropping and misfiling rules Selector lists were split on a bare comma, so any list nested inside `:where()` or `:has()` came apart. The damage is not that the pieces throw — it is that they parse. `.markdown-rendered :where(p, li, …, h6) > code` becomes `li`, `td`, `h1`… , each a perfectly valid selector, so a rule meant for inline code is applied to every list item and table cell in the tree while the actual `<code>` matches nothing. One rule, misfiled and dropped at the same time, silently. Four real rules in the loaded sheets are affected. Two corrections to what was reported earlier: the parser tolerates the unclosed bracket rather than throwing, so the `:has()` case quietly loses one branch instead of failing outright; and the earlier explanation of the local rulers' error was wrong — parameterised pseudo-classes are skipped entirely, not mistaken for type selectors. The catch that hid all this now swallows only vendor pseudo-elements, which are the sole selectors that legitimately fail to match. It earned that during verification by naming a fragment that used to vanish without a word. Eight test files each carried their own copy of the specificity calculation, each with its own faults: pseudo-elements counted in the wrong column, parameterised pseudo-classes ignored, attribute values read as element names, `:where()` not zeroed, one that could not see an id at all, and one that counted every class twice. They now share the calibrated implementation, through a shape-preserving adapter so that not one assertion changes — the readings were surveyed first, and of the sixty-five selectors these files actually ask about, three move and none of them flip a verdict. The worst of the eight was never called. It has been replaced rather than deleted, so it is a correct tool rather than a loaded one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(styles): drop the local specificity helper nothing calls Both functions were dead. Keeping a second copy of a calculation that has one calibrated implementation is how the eight divergent copies happened in the first place; a caller that needs it should reach for the shared one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(chat): record that artifact cards open the latest file, always The thumbnail is the snapshot; the click is not. HTML and images follow the same rule, so the versioning design's read-only snapshot tab is retired. Recorded because it was nearly built: the doc listed the tab as outstanding work and it read like a gap. It was a decision. An item a design names but no one has implemented is not automatically a debt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): finish porting the tool icon rule, not half of it The draft changed size and colour in one declaration when it was refined. The port cited that exact line and brought the colour across, leaving the width at the previous draft's 14px — the comment in our stylesheet points at the line that says 16. The stroke baseline moves with it. 1.75 is in user units, so what reaches the screen is that times the viewBox scale: 1.75 × 14/24 reads 1.021, and 1.75 × 16/24 reads 1.167. The constant did not change; the multiplier did. The size is now asserted explicitly alongside the stroke, because a product of two factors lets one silently compensate for the other. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): assert the thinking icon's real size, not its attribute The case asserted the svg's `width` attribute was 14 and titled itself "size unchanged". The attribute is what `Icon` writes by default; the stylesheet overrides it, so the number on screen has been 16 since the tool icon rule was finished — and this case stayed green through that, still claiming otherwise. What matters after today's ruling is that the thinking icon and the tool icons are the same size. That is structural: both render into the same leading slot, so one stylesheet rule governs both and they cannot drift. The case pins that they share the slot, that exactly one rule gives it a width, and that the width is the draft's. Counting rules by selector was wrong at first — two others target the same slot to turn it red on failure and say nothing about size. The count is over rules that actually declare a width. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(chat): hold OPEND-2586 pending a clarified description Its stated expectation is a permanently visible Retry on any network failure, which is the thing the failure ladder was built to prevent: the design's fourth principle is that Retry appears only when it can work, and the ladder's bottom rung exists so an unclassified failure structurally cannot produce one. The report also cites a draft that specifies the permanent Retry. Which draft, and which cell, needs checking — the panel handover and the error-UX design are different documents and only the second governs this card. It also bundles two symptoms whose causes are probably unrelated: a failed turn presented as a completed reply, and a failure card that appears and then vanishes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): say which gate stopped a blocked strategy task Answering the form and then being told the task failed reads as a contradiction: the answer is on screen, the agent replied at length, and the card says it could not continue. The verdict itself is right. In the clarification stage the contract admits only three conclusions, and the one requiring a plan contract had none, so blocked was the only honest call left. Nothing was lost when the form was submitted — the agent simply omitted the machine block that turn, and unlike the opening turn, that stage has no inference to fall back on. What was wrong is that the daemon knows exactly which gate refused and threw that away. Every structured daemon failure carries its reason on the error; this path alone raised a bare one, so the diagnostic panel showed no code, the card matcher had nothing to match, and every gate in the strategy contract rendered as the same anonymous sentence. The reason now rides along, and the sentence says what happened rather than that something did. Two things this does not fix. The wording is a draft — the error-UX design has no cell for it, and the nearest one describes an unusable reply, which this is not — and the string is still hardcoded English on this path. And the Retry on that card cannot work: the task is terminal, so continuing it answers 409 either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): stop two assertions calling our own values the draft's Both numbers in this file were labelled as the design's and are not. The own-answer label is pinned at 600 with a comment saying the draft says 600. The delivery draft says 500; 600 is the previous draft's value. The same commit corrected the chosen option to 500 two rules away and left this one citing the old sheet. The unchosen option is pinned at 400 as "no weight declared, so 400". In the draft nothing declares a weight there either, but its baseline is 500, so what it inherits is 500. Neither value moves here — the weights across this family have to be reviewed together, and changing one in isolation fights its neighbours. What changes is what the file claims: both are recorded as our current state with the deviation named, so a later migration reads them as work to do rather than as conformance already achieved. A test that reports the status quo as the specification is worse than no test: it makes the correct fix look like the regression. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(chat): give HTML artifact cards a frozen cover, and delete the open-snapshot path Every part of the first-viewport capture existed and nothing called it, so HTML cards still mounted a live iframe each — the thing the design set out to avoid in a long conversation. The wire lands at the run's terminal chokepoint, on the rows the capture just wrote, in the same window that already freezes image bytes. Queuing "screenshot this later" is the wrong shape, because by the time the renderer runs the page may be the next turn's, and a screenshot of the wrong bytes looks exactly like one of the right bytes. The freeze is structural instead: the entry and its local dependencies are read in one window and fingerprinted, inlined into a single self-contained document, and every fingerprint re-checked before the document is accepted — drift voids it rather than stitching two versions together. The renderer then gets that document with no base address, so a render starting minutes later has nowhere to read the workspace from. It is not forbidden from reading the latest file; there is nothing to read. The spec's fallback path — render against the live file while the entry's fingerprint holds — is documented rather than built. It hands the live endpoint back to the renderer and fingerprints only the entry, leaving dependencies free to move mid-render. Separately, `openPolicy` is removed rather than pinned to one value. After the ruling that cards always open the latest file, it carries a constant while reading as a switch — and the host dropping the click target looked like a bug whose "fix" would have built the behaviour that was just rejected, with typecheck and tests both silent. Now no value can mean "open the snapshot". The cover half is untouched and pinned: an overwritten image still shows the turn's version in the older message. Nine corrections to the design, struck through with dates and sources rather than erased: the placeholder-on-failure policy and the compat matrix that product overturned, a state that never existed, the click column, and the lineage description. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(media): tell the user what to do when a picture or video fails The failure text printed an internal code at the user, because the prompt told the model to write one. Deleting the code alone would trade exposing our plumbing for saying nothing, which is not what was asked: a generation that fails should say enough for the user — or the agent — to decide what happens next. Two hundred-odd throw sites across dispatch and the provider bridge land on nine next steps, so the copy is grouped by what the user does, not by which code fired. A missing key and a model with no renderer are different bugs and the same sentence, because both are answered in Settings. Eight of the nine sentences come from cells the error-UX design already ruled on, minus the vendor half — the media contract forbids naming the provider or model. The ninth, for a run that cannot generate at all, has no cell and is marked as a draft for product to edit. The agent gets the same nine values as a closed set on every failure, and the contract says which two it may retry itself. Previously it had a code meant for our own triage and had to infer intent from wording. The semantics reuse the run-failure ladder rung for rung and the names line up with it. The rendering does not: a failed run is a whole turn collapsing into a card, while this is a successful turn with one missing picture, and the sentence is written by the model rather than the interface. No new locale keys: nothing renders this on the front end yet, so keys would be dead. The value now sits in the task snapshot for whoever builds that card. Costs about 600 tokens of system prompt per media-capable project. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(strategy): name a repeated clarification even when the machine block is missing Three gates run in order and the general one is first. When a turn omits the machine block, the parser raises "runtime state missing" and the task is blocked before the gate that recognises a repeated clarification is ever reached — that gate reads the parsed state, which by definition does not exist here. So the precise code only appeared when the agent both asked again *and* declared itself properly. The same failure, written two ways, was reported under two names: the honest half got the accurate name and the sloppy half got the catch-all. The order is not changed. The evidence needed — a renderable form, and no machine block at all — is already observable where the general gate hands off, so the code is corrected there, after the repair path has declined, and using the same predicate the precise gate applies to the same shape. It replaces rather than appends, because the consumer reads only the first code. The guard that narrows it to the clarification stage is load-bearing: nine other shapes reach the same point, and without it an opening turn carrying two forms would be reported as a repeat. An existing case catches that. The verdict does not move — the stage still admits only three conclusions and the one requiring a plan contract still has none. Blocked, but finally able to say why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): retire the prose an interrupted attempt already wrote The ticket blamed missing stable ids on text events. It is not a storage problem: the run genuinely produced the answer twice, and no idempotency key could recognise two independently generated passages as one replay. We are what made it write twice. Ordinary retry refuses to rerun a turn that has already put words on the user's screen; the post-tool resume path checks only whether a tool ran, so "called a tool, streamed half the answer, lost the connection" reopens the same assistant message and the model writes its conclusion again. Persistence appends, and nothing tells it the previous passage was superseded. A turn is only reopened when it did not close cleanly, so whatever prose it left behind is unfinished and about to be rewritten. On the second start for one message, that trailing prose is dropped before the new attempt's first delta lands — stepping over the attempt's own closing status row, and rolling the stored content back only when it matches as an exact suffix. Tool rows stay: they are already committed to the agent's session and the resume continues from them. No new field. The second `start` on one message is the existing, observable boundary, so replaying an old conversation reads exactly as before. Two things left alone deliberately. The live view still shows both passages until reload, since retiring them on screen means reaching into the web retry callback. And the strategy that decides to rerun at all is untouched: adding the seen-output guard there would stop rescuing genuinely interrupted long answers, which is a different question from cleaning up after a rerun that has already been decided. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): explain the blocked clarification instead of showing a blank failure The premise this started from was wrong, and the correction changed the fix. The English sentence was never what Chinese users saw: with no row for this reason code, the failure fell to the generic fallback, whose null message key renders the translated "the task failed" line. The English text only ever appeared in the collapsed diagnostics. So the card explained nothing at all while the user looked at their submitted answers and a complete plan. Translating the string would have changed nothing on screen; the missing piece was a row, which is the repo's own mechanism for this. The card now says the reply arrived and could not be recorded — it does not blame the user, whose answers did land — and keeps Retry, because the omission is intermittent and rerunning the same prompt usually emits the block. All four runtime-state codes share the row: to the user they are one story, and splitting them would ask product for four wordings of one sentence. The wording is marked as a draft; the error-UX design has no cell for this, and the nearest one describes an unusable reply, which this is not. The verdict is untouched, and a guard proves that is not decoration: mutating the row to a non-retry card turns four assertions red. Also repairs two assertions orphaned by the open-policy removal, which pinned a second argument that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): give the repeated-question failure its own card A reason code added earlier today had no row, so it landed in exactly the blank-fallback hole the neighbouring case had just been lifted out of — the same defect, freshly made, because the daemon side and the web side were worked separately and neither knew about the other. It does not share the neighbour's row. To the user that one is "the reply came back but could not be recorded"; this one is "I answered, and it asked me another question instead of carrying on". Different story, different sentence. Retry stays, but not for the reason it first appeared to. The omission is not flaky: a task admits exactly one clarification round, and a properly declared second question is refused by the identical code. Retry earns its place because it does not re-roll the turn — it opens a new task at a fresh clarification count, where asking is legal again. So the agent will likely ask the same thing, and that time it renders as an ordinary round of questions rather than a failure. The copy therefore promises a restart rather than a coin flip, and a test fails if the English ever picks up "intermittent" or "usually goes through". No cell exists for this in the error-UX design, so the wording is marked as a draft. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): add the field the pending-tool change owes the history baseline Showing a tool call the moment it starts added one field to every tool row. The commit updated three suites and left this baseline behind, so it has been red since. The difference is exactly that field, seven times, all false — no block moved, merged, split or changed owner. None of the fixtures can reach the new branch: every call in them has its result, so nothing is ever pending, and the field is inert in rendering too. Only those seven lines are added. Re-recording the whole baseline would replace "what the implementation should output" with "what it currently outputs", which is how a guard quietly stops guarding — a check confirms this one still catches an unrelated structural change. Three comments were still stating the retired rule, one of them thirty lines above the field that contradicts it, and a fourth called the image row the sole exception to it. That is the shape that burned three agents today on a different red: the comment sends you to change the implementation. The spec's own note on why live terminal output is impossible listed two blockers; the first is gone with the rule, leaving only the missing incremental channel. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): stop keeping video and audio originals Product ruled these out of snapshots. They are the wrong shape for the budget: one revision of a video eats a large slice of a project's allowance, and once that is full the image snapshots in the same batch start failing — a semantic nobody ruled on squeezing out one that was ruled on. The policy comment promised removing a kind from the set needed no other change. It did. The provider-bytes hook hands its payload straight to the capture without consulting the policy, so a display-only edit would have left every generated video in the store while the cards said otherwise. The exclusion is enforced at the capture chokepoint instead, which is where the bytes actually arrive. The gate keys on whether a kind's original *is* the evidence rather than on the kind alone, because HTML also declines to store originals and a kind-only gate would have silently killed every HTML cover. A test pins that. A residual pending intent from an older build would have been re-captured by the boot reconciler, putting the bytes back on the build that just excluded them. It is retired instead, under its own code so "product excluded this" does not sit among real quota and render failures. Video cards fall back to the live file and the browser draws its own first frame — the same path an old conversation already takes. Audio was never a card at all, so every audio snapshot stored so far was bytes no surface read. Two fixtures described a record their code path cannot receive; corrected, with the gate they were standing in for now covered directly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * docs(chat): track the newest design draft, not the handover one Standing rule, not a one-off retarget: when the design moves, the baseline moves with it. This retires the line in the ledger and both audits naming the handover commit as the only current baseline, and it means some cells those audits scored as implemented are deviations again — they were judged against a sheet that has since changed in five places. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): give the thinking panel a real grey, and settle the terminal's ink The thinking surface used a translucent fill, so it had no colour of its own — it took whatever it happened to sit on. The draft names an opaque grey and we have a token for exactly that value. The terminal's three tiers really are one ink in the draft, and that is not a flattening: the draft moved the distinctions elsewhere and says so in its own comments. Command versus output is carried by the leading `$`, which is the terminal's own convention rather than a mark we invented; an error line is marked by a red `✗` at the start rather than by reddening prose that is log content, not an error state. Success lines keep the brand green, so no semantic colour was lost. Guards now watch those two marks, because that is where a real regression would show. The gap between the command and output blocks was set on each side, so the two added up to twice the outer padding — the seam between them breathed wider than the edges. The change-count beside a written file was one shade darker than the file name next to it: the last cell the muted-ink pass missed. A fourth edit was reverted after removal verification left everything green. It widened the muted-ink ownership to the terminal for a case that cannot occur — the terminal only renders from a tool row, which only renders inside the flat shell — and the reasoning is now a comment so it does not get added back. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): close seven gaps against the draft, and delete two rules that never applied The memory card's summary had no hover fill. The attachment placeholder was a flat grey where the draft carries a mark — the artwork is the design's own svg, taken from the sheet's own base64 and decoded to confirm it matches the source file byte for byte, not redrawn. The fork divider had no entrance at all. Two rules were proved dead rather than argued dead. The queued row's active highlight is outranked by a later rule of equal weight that resets exactly the two properties it sets, so toggling the class changes no computed value; the scrollable class has one origin in the tree and it is not on that element. In both cases the suite was green before the deletion and green after, which is the evidence. The class name for the first is still emitted by a component outside this change and now has no rule reading it. Two radius tokens were missing from the seam, and the count of consumers falling through to the fallback had grown to three today. Both scopes get the definition, and the test enumerates consumers rather than naming them, so the next omission reports itself. Bare buttons in the panel were pinned to 400 while the baseline moved to 500, leaving every one of them a step lighter than the prose around it. The author had left a tripwire saying so; it fired on the fix and asked to be removed, which is what happened. What the draft actually inherits — weight, size and family — is asserted by value. The fork entrance follows the draft's easing rather than the repo's default, which the same stylesheet uses two hundred lines above for message entrance. Flagged in the source, not reconciled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): align the question card to the current draft, value by value Every number here is read off the sheet, not derived. The rule I handed over — "the size ladder bottoms out at 12px, so the 11px cells must be wrong" — is a rule, and rules are how you end up one step away from the drawing. Following it literally would have pushed a cell the draft never specifies. Four of the five 11px cells do have a rule, and it says 12. The fifth is our own addition — the draft styles an invalid colour value with a border and no message — so it stays where it is, flagged rather than guessed at. A sixth cell the list missed sits in the same block and had been left behind by a half-finished pass. The value-answer row was keyed on "does it have a swatch". The draft's own comment says colours *and* numbers, and its example page shows a numeric answer with no swatch at all, so the key is whether the answer is a value. Weights follow the baseline that moved to 500. Two of them now agree with the global button reset, which means deleting the rule entirely would still read 500 — so the guards name which rule wins, rather than only what the number is. The colour block's two captions are one weight in the draft and a lighter one for the legend specifically. We had collapsed both into the lighter one. The slider is the newest draft's, all twelve declarations. Two things flagged rather than resolved: the draft moves the numeric field's focus ring from outline to box-shadow, which forced-colors modes drop entirely — and the slider track beside it still uses outline. And 1.35em leaves room for about two digits, while our own fixtures clamp to 100. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): let the rail and the transcript count the same messages The body drops the user message that carries form answers — a deliberate call, so the same decision is not stated twice and the machine payload never reaches the screen. The rail counted `role === 'user'` on the raw list, so it reported three where two were drawn, and clicking the extra one navigated to a message that does not exist. The fix shares the array, not a predicate. Exporting a predicate for three callers to apply is still three implementations that merely agree today. The render items are computed once and handed down, so the rail can no longer see the unfiltered transcript at all. The same mismatch had a second victim. Pinning a new turn to the top keys on the trailing user message changing identity, and after answering a form that message is the one nothing draws — so it pinned the *previous* turn's bubble and padded 328px of empty space beneath it. The vote now happens over the messages that exist in the DOM, which makes "should we pin" and "pin to what" the same question. That turn falls back to sticking to the bottom. Not for convenience: the spacer, the landing point and the release tolerance are all defined in terms of the pinned user message, and here there is none. Every other entrance sends a message that is drawn, and a counter-case pins that a real message after the form still goes to the top. Side effect worth knowing: a conversation whose only two user messages include a form answer no longer shows a rail at all, where before it showed two dots and one was dead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): retire the steps a replacing todo snapshot dropped A snapshot that shares even one item with the previous one is treated as the same list making progress, and that path only ever appends: an item that vanished from the new snapshot is never touched, so it sits there as "not started" while the newly split steps queue up behind everything else. The pill and the transcript then disagree about which step is current — the pill reads the newest snapshot, the transcript reads insertion order — and the card contradicts itself, its header counting the new snapshot's steps while the rows below it are the union of both. Vanished steps are now retired the way a full replan already retires them: struck through, out of the count, out of the ordering, and parked next to the step they replaced so the change of plan stays legible. Surviving rows follow the newest snapshot's order. Partial overlap has no ruling of its own, so this follows D14 from the same family, and the source says exactly that at the one place a different answer would change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): recognise a produced image by its extension, not only its kind Three predicates decide which file a turn should open, and two of them accept an extension when the kind field is absent. The media one does not — and the candidates built from the agent's write trace carry no kind at all, so every image produced that way scored zero and was skipped in silence. The extension list is copied from the daemon function that assigns the kind in the first place, because a fallback that disagrees with the field it stands in for is a second source of truth. Two consequences come with it: `.svg` is a sketch, not an image, and a root-level sketch raster is the user's own drawing rather than this turn's output — opening that would be a worse behaviour than the bug. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * refactor(web): delete the card skeleton nothing has ever rendered It arrived with the repository's first commit and no file has imported it since. Its own docblock aims it at a different grid than the one people keep reaching for it to solve — an investigation into the design-files panel's missing loading state found it, assumed it was the intended piece, and had to be pulled back. Its stylesheet block goes with it; the shared skeleton primitive stays, since other panels do use that. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): keep the confirmed answers where the user gave them Two completed shells stacked together with the answers below both, when the user had answered between them. Neither the cross-run fold nor the form block put them there: the block order the turn builder produces is correct — shell, form, shell — and the renderer split it by kind, drawing every shell and then every piece of prose. So this was never about how many runs a turn has. A single run that goes shell, prose, shell would have come out the same way. The turn now carries the original sequence alongside the two filtered lists, and the conclusion is grouped by position instead of joined into one string. The processing chain is unchanged, just run in two halves: the strippers filter per block and are equivalent either way, while form de-duplication is first-wins across the whole turn and so runs flat before being sliced back — a map, so the slice is exact. An ordinary one-shell turn renders byte for byte as before, because alternating and "shells then prose" are the same thing when there is one of each. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): one card for running out of credit, not two Running out mid-turn drew the generic failure card — white, four buttons — while the upgrade card the design specifies was wired only to the pre-send gate. Product ruled there is one card per state and no second white card behind it. The two states are the design's own: below five dollars reads as a warning in amber, zero reads in red. The card already splits on the balance, so nothing new was needed there — what was missing is that the failure carries no balance at all, only a code, so the wallet is read once after the turn settles and the card is lit from that. When the wallet cannot be read the card does not appear and no number is invented. That leaves a hole: the white card is gone, so the user sees nothing at all. Flagged, not papered over. Retry, export logs and contact support go with the white card, because the design's card carries one button and inventing the others is the thing we were told not to do. The cost is real: topping up now means sending the turn again rather than resuming it. The predicate reads the last assistant message rather than hooking the error callback, so the card survives a reload and does not have to be written twice for the send and reattach paths. Team members still have a path — the same button routes non-owners to a prompt they can send their admin. The error-UX design would put that on the card face instead; the two drafts are left unmerged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(chat): land replayed history at once instead of restreaming it Reopening a running project replays the whole run from the daemon's buffer, and that replay travelled the same path as live output: chunked per animation frame, then revealed character by character. So content the user had already read arrived again as forty separate commits, each with its own entrance, tangled with the new output still arriving. Batching alone was not enough, and the numbers say why: forty commits became one, but the reveal budget counts characters per frame regardless of where they came from, so the whole history still animated in over two seconds. Both halves are needed. The obvious shortcut — treat a large batch as history — is wrong: a non-streaming agent emits its answer in one piece, and that is exactly the case the reveal exists for. The question is where the text came from, not how much of it arrived. The transport draws no such line. The daemon writes its buffer synchronously and only then registers the client for live frames; same channel, same id sequence, same shape, no marker. What can honestly be observed is cadence, so the replay window closes on the first quiet gap, with a hard ceiling in case the model happens to be producing densely right then. The ceiling errs toward landing a moment of live output at once rather than disabling streaming. Queued updaters are the update functions themselves, so de-duplication, merging and the ordering of prose against events all survive; and both flush and cancel hand the queue over, since the message is emptied on remount and losing the queue would leave a blank screen. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): type the failure-detail fixture to the contract's own union Written as a free string, a misspelt reason name would never be caught — and this file's assertions are precisely the ones that branch on it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * test(chat): guard the artifact wiring, and give maintenance a loop and a signal Four seams had code and no test, which is the shape where a break goes unnoticed: the media hook that captures provider bytes — the strongest capture path in the design — plus rename, both delete handlers, and the fork seeding. Three of them sit inside catch-and-warn, so deleting them left the suite green. The guards test the seam, not the layer beneath it: the media one runs a real generation over HTTP, overwrites the workspace file afterwards, and asserts the snapshot still returns the provider's bytes. Reconcile and sweep ran once at boot, so anything that stalled during a long run waited for a restart. They now share one pass with the boot path, because two implementations drift and the drift only shows in the case nobody watches. A tick that overlaps the previous one is skipped rather than queued: the pass is idempotent and rescans from scratch, while queueing builds a backlog on a slow disk and lets two passes reach different conclusions about the same grace window. Stopping drains the pass in flight — the next thing shutdown does is close the database. The interval defaults to off, because neither section names a period and the quota section shows the author does write "product decides" when that is the case. One assertion was rewritten after it survived swapping the two steps it claimed to order. It now uses a case that can tell them apart. Telemetry reports one event per turn that produced artifacts, and turns that produced none send nothing — a row of zeros from every other turn would bury the failures in rounding. The source-changed count is separate because it is the only code that means the capture window itself was wrong: at two percent of storage used, running out and forging history read identically. The payload is the return value of a pure function, unspread, so what the function's test asserts is what reaches the sink. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * fix(home): make the handoff surface look like the page it hands off to Jumping in from Home crossed two blank states that did not resemble each other, so the layout jumped twice before anything appeared. Every alignment here is copied from the frame that follows — the sidebar dock, the collapse control, the user bubble's structure, the centred empty state with its call-to-action row — rather than styled fresh. Nothing new was drawn, and no skeleton was needed once every position had something real to hold. The back arrow goes because the real page leaves that slot empty; one extra button there shifts the title by a notch, which is the shift the recording shows. The staged attachments appear immediately. They are already `File` objects in the browser, so an object URL draws them with no request at all — this surface still may not read anything project-scoped, and a test asserts zero project-scoped calls while they are on screen. Uploads now run four at a time, matching what the in-project composer has always done, and only inside the upload step: the working-directory handoff must still complete first, or the files land in a managed folder the user did not choose and vanish when the base directory swaps. A per-file failure also stops condemning every file queued behind it. Two things this does not reach. The long wait is the upload itself, which cannot leave this surface until the attachment handshake stops requiring server paths before the project view mounts. And the split width still falls back to the default rather than the user's saved one; both live behind ProjectView. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): follow the draft's reversal of the progress ink The draft turned the whole task-progress family back to strong ink — step titles, elapsed times, plan numbers, the tool rows inside a progress shell, and the summary between steps, which also returns to 13px at weight 400. Our muted-ink pass had taken it the other way; product confirmed the reversal against the sheet. The terminal block is the half that must not follow. The draft still writes it literally muted, and only the copy sitting inside a progress shell is overridden, so sharing one variable would have darkened a block the design never asked to darken. It gets its own token, and two assertions hold both ends: one that the progress family is strong, one that the terminal is not. The remaining four cells were aligned in the same pass rather than left half done, because they hang off the same variable and the same draft rule — a partial port would produce a state the sheet does not contain. Eleven assertions across three files pinned the retired direction. Four of them had quietly become vacuous: they told two things apart by colour, and the two are now the same colour, so both sides of the comparison passed. Those are re-anchored on what actually distinguishes them — a red icon, a weight, an indent — rather than given new numbers. The file that asserted "the row goes muted" is renamed for what it now guards: which layers follow the progress ink and which stay behind. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): align the send queue to the draft, hover states included Three of the four cells flagged for review already matched. What was actually wrong sat next to them. The drag handle lit up like a button on hover — our own fill plus a darker ink, where the draft changes the ink alone and by one step. The action buttons had the wrong fill and the wrong ink. And the row itself carried a hover background the draft does not have anywhere: a leftover from when the queue was a card, missed when the frame, the fill, the floor and the shadow were all taken out. A queue held together by dividers has no notion of a selected row. Long unbroken text could still burst the row: the clamp was there, the draft's companion rule allowing a break anywhere was not, so a URL neither wrapped nor truncated. First-row tooltips flip downward per the draft. Ours are portalled so they cannot be clipped by the scroller; what the rule earns here is that an upward bubble no longer covers the last message in the log, and the comment says so rather than repeating the draft's reason as if it were ours. The first-row highlight class goes. The draft's only treatment of that row is removing its top border, so the question the class was left open for has an answer. The guard now asserts the name is absent from the tree, and explains that reinstating the highlight means beating the later rule of equal weight rather than adding another declaration that gets silently overridden. The drag handle is not decorative: real drag events reorder the queue. One removal check passed by accident first time round — the script deleted a different rule with the same declaration elsewhere in the file. Redone by line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * i18n: one word per locale for the agent Five locales each called the agent two different things, and one of them was a mistranslation rather than a style difference: Arabic used the word for customer, including on the agent picker's own label. Traditional Chinese turned out to be wider than it looked. The word we were treating as a synonym also means proxy in seven strings and agency in two — so the settings page was using one word for three different things, with the network-proxy hint and the agent picker reading identically. Those nine stay as they are; the other thirty-two join the rest. Bare English stays wherever it already is: it clusters on developer-facing surfaces while native words carry the user-facing ones, and that division reads deliberate. Turkish is written per key rather than replaced, because the word takes case suffixes — and because the same string is the word for tool in eight places and means "by way of" in five more. A blind replacement would have ruined thirteen unrelated lines. The Persian call is the weakest here and is marked as such: both forms are correct, and the choice rests on which one already holds the interface. The guard compares the set of keys containing each word against an explicit allow-list with the English source quoted per entry, so a new offender is reported by name rather than as a count, and the traditional-Chinese case also fails on a simplified character. The glossary gains the row it always said should be added when someone hit a real terminology choice, including why "agent" must not be translated back to the proxy word and which Turkish strings look like matches but are not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * Revert "i18n: one word per locale for the agent" This reverts commit 457f6c34e3. Nobody asked for it. It surfaced as an adjacent observation while another change was editing the locale files, and I dispatched it off my own list rather than checking whether it belonged in today's work — a hundred keys across five locales, none of which any report or acceptance criterion touches. Two genuine defects it fixed are worth keeping in mind if this is ever picked up deliberately: Arabic names the agent with the word for customer, including on the picker's own label, and Traditional Chinese uses one word for both the agent and a network proxy, side by side on the settings page. Each is fixable on its own without unifying anything. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(chat): freeze a video card's first frame The video card drew whatever the workspace file currently holds, so overwriting the file changed the frame shown in an older message — the same defect image cards had, one medium later. The original still does not get stored: that was ruled out on capacity, and a frame is a picture, sized like the HTML cover rather than the video. ffmpeg is already a daemon runtime dependency and is already bundled on all three platforms, so nothing new ships. The browser-screenshot path was not reused — loading a video into an Electron window to grab one frame is neither cheap nor reliable, and a daemon with no renderer would never get a frame at all. A test runs without one on purpose. HTML can freeze first and render later because its self-contained document is portable evidence. A video has no equivalent short of copying the file, so extraction *is* the freeze: it runs inside the run-terminal window and checks the file's identity on both sides, discarding a frame decoded across a write. The cost is that it counts toward the turn, so it is budgeted and capped. The card gains a poster attribute and nothing else — the platform's own slot for a first frame, so no layout, ratio or control changes. Failing to extract falls back silently to today's behaviour, per the standing ruling against placeholder copy. Also fixes an existing leak the change would have spread: attaching a cover wrote the cover's own mime onto the workspace file record, so an mp4 became image/jpeg. HTML has been doing this to index.html all along, unnoticed because nothing reads that column yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * style(web): underline a clickable file reference without waiting for hover The draft moved the underline out of hover and into the resting state, and dropped the transition with it: a file name you can open now looks openable before you point at it. The name you cannot open explicitly does not get one. The draft's reason for the underline is that the thing is clickable, so putting it on a plain span would be saying something untrue — the same call as the ruling that a control which looks pressable and does nothing is worse than no control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YLzsEWJ1UAjk9WjXEozQiW * feat(web): split create-file icon from edit, per design 729fa43ce7 The draft's create-file rows switched to a solid node glyph while the edit row kept the pencil. Our `toolIcon` mapped `write` and `edit` to the same pencil, so the create rows could never match. Counted in the draft itself rather than read from a commit message: `729fa43ce7` renders 4 solid create glyphs to 1 pencil edit glyph, and the previous baseline `361b78253e` was already 1 solid to 4 pencils -- the solid glyph was settled a revision earlier and this commit only finishes propagating it. Adds `FILL_ICON` alongside `STROKE_ICON` instead of making it a variant: the fill family carries no `stroke-*` at all, so a dead `stroke-width` cannot mislead the next reader into thinking it honours the 1.75 ruler. `FailIcon`/`RetryIcon` were already hand-written with exactly those three attributes and now consume it, producing byte-identical markup. The stroke-weight spec no longer excludes the new glyph -- exclusion would leave it unguarded forever. It now asks each family its own question, and pins `DESIGN_FILL_KINDS` as a membership list so both directions go red: a cell silently reverting to stroke, or a cell silently defecting to fill and escaping the 1.75 ruler. The 1.75 baseline is untouched. * fix(web): realign non-record chat text to design 729fa43ce7 The reported symptom -- the turn status word "已完成" rendering smaller than the body text below it -- was real, and not isolated. Recomputing the draft's own CSS over the draft's own HTML (rather than reading its prose) turned up the same shape in three places: cells that should sit on --t-lead had drifted down to the --t-cap/--t-mini rung. The size ladder itself was never wrong; both baselines share a byte-identical tokens.css and all six rungs already matched. What was wrong was which rung each cell drew from. Ten cells realigned: the turn status word (14px/500) and its tick (16x16), the confirm-card head and its title (14px) with the count stepping itself back down to 12px/600, the title dropping to 500 when the card carries options, the option rows rising to 13px on the new baseline, the visual-direction card's head inset (16px), and the reconnect row taking the draft's own #A3A3A3 -- landed as --chat-tool-ink with light and dark scopes at the same value, since the draft carries no dark override for it. Each of the twelve edits was reverted individually by exact line number and each went red on its own; none is dead weight. One revert first struck a comment line and stayed green, which is precisely why the revert pass has to be seen failing rather than assumed. question-form-latest-spec-drift.test.tsx belongs to another lane but uses .qf-chip as its measuring standard with the value pinned to the old baseline, so raising .opt made it unavoidably red. Only its calibration constant moved; a header note records why it must not be put back. * fix(web): make the thinking row read as a tool row at both depths Product ruling 2026-09-02: the thinking row is ours, not the designer's -- the draft has no cell for it -- and the requirement is simply that it be indistinguishable from a standard tool row at the same depth. It was not. Being a details.fold it drew from the foldable family rather than the tool family: 500 weight at the top level, and inside a step drawer the top-level rule stops reaching it, leaving 12px from `.fold > summary` with the weight still inheriting 500. The icon slot was skewed too -- the same defect's third landing point, missed by the earlier survey. Asserted as an equality against the neighbouring tool row rather than against literal values, so a future change to the tool row carries over instead of silently reopening the gap. An anti-vacuity case proves the reference side reads real values first: without it, two `<unset>` reads would agree and the whole comparison would pass while measuring nothing. Size goes on the row box and weight only on the title, mirroring how the tool row splits the same job -- putting weight on the summary would drag the drawer's duration text down to 400, fixing one axis by breaking another. The thinking body is untouched: the diff is pure insertion, and every selector is gated on `> summary` so it cannot reach it. * fix(web): release event streams while the tab is hidden Measured against the real runtime: the conversation page holds two permanent SSE, and a browser gives one origin six sockets. lsof shows that budget is shared across every tab of the profile, not per tab -- four EventSources in one tab plus four in another yields six established connections and two stuck in CONNECTING forever. So a parked Open Design tab takes sockets away from the one actually on screen, and requests on that page queue for 26-35s while the same URLs answer in ~1ms over curl. The shared manager already dropped its stream 30s after the tab hid; the two streams that own their own lifecycle held theirs for the life of the tab. New stream-visibility.ts carries the invariant once -- a stream nobody can see must not hold a socket -- with the same grace window so alt-tabbing does not thrash. Reopening re-fires onReady, which ProjectView already treats as its reconcile point. The run stream is deliberately excluded: dropping live agent output on a tab switch would be a worse bug than the queueing. This is not the packaged app's bug -- desktop and packaged both append Chromium's ignore-connections-limit for loopback before whenReady. It is dev, and it is self-hosted users, who are documented as opening the daemon directly in a browser where plain-text loopback never negotiates HTTP/2. Tests assert exact socket counts, never negative matchers, and the fix was verified by stubbing the binding back to a no-op and watching the same three cases fail again. * perf(web): coalesce duplicate boot reads and bound replay reattach Attribution first, because the reported numbers were not one page load. A clean cold open of the conversation page issues 71 fetch/SSE calls across 39 distinct URLs; the 158 that was reported included a Next dev hot-update firing mid-measurement, which re-ran every effect and produced a near-complete second copy of the list. StrictMode accounts for 11 of the 71 -- identified by identical stacks firing 1-6ms apart, not assumed -- so production boot is nearer 60. Two of the flagged endpoints turned out to be something else. The raw file fetched "ten times" is twice per view: one fetch for the srcDoc path plus the iframe's own URL load, a structural consequence of keeping both iframes mounted, already guarded against StrictMode by mtime-keyed in-flight tracking. Papering a cache over it would hide the architecture rather than fix it. The message id seen "twelve times" is never a GET at all -- it is twelve PUTs, one per buffered save during streaming. Four real duplicates removed via single-flight with ttl 0: join a request still on the wire, retain nothing once it settles. No caller can receive a body it did not itself trigger, so this adds no staleness surface. Two of the four are keyed by workspace identity as well as project, so a workspace switch cannot serve the previous scope's answer. The reattach fan-out was real but the obvious fix would have lost output: reattachDaemonRun resolves only when the stream ends, so a semaphore around the whole call starves live runs of everything until their predecessors finish generating. Only terminal replays -- finite event logs that settle promptly -- go through the limit, and a run the daemon still reports active bypasses the gate entirely. A 30s max-hold stops counting a wedged replay without ever dropping it. Anti-vacuity guards ride along in both specs: distinct projects must not share a single flight, a read starting after the previous settled must hit the network, all five recoverable messages must eventually reattach, and a live run must never be queued. Each single-flight was reverted individually and failed exactly its own assertion. * test(web): catch two specs up to their product rulings, drop dead rules Both failing specs were stale tests, not regressions, and both rulings were found in specs/ rather than inferred from a source comment calling itself a ruling. thoughts-scroll-cap asserted the in-flight thinking cell carries no scroll cap. The spec had not moved since 08-29; the implementation dropped `scroll={!live}` four days later. The ruling is recorded in chat-stream-scroll-research.md in the user's own words -- what was overturned was the fixed height with stepped scrolling and a fade mask, never the cap itself. tool-input-delta-dead-wiring asserted an in-flight tool call renders no row. D3 is struck through in the decision log and annotated superseded (2026-09-02, OPEND-2419): a call renders the moment it is made, regardless of outcome. Flipping the assertion could have turned the case into one that only ever nods along, so it now also carries a leak probe on the heredoc delimiter, which can only originate in the delta frames. The file still guards what it always guarded. Three dead rules removed with producer evidence rather than a grep: direct strings, template concatenation, CSS Module camelCase, clsx branches, e2e selectors, and specs anchoring the name. Two candidates survived that check. `.run-error__description` is equally unreachable from src/ but an e2e still anchors on it -- a selector the same rebuild missed, so that suite is currently broken and the fix needs an owner. And `.doc .nm` never existed in product CSS at all; the live class for that cell is `.artifact-card-doc-name`, which two specs pin. Deleting from the list as given would have taken out working code. * fix(web): bare buttons in the panel take the draft's rendered 400 The old value was `inherit`, chosen from what the draft *declares*: its global button reset sets no font-weight, which was read as "the button follows the panel's typographic baseline". That inference is wrong. Browsers style `<button>` through the `font` shorthand (Chrome: `font: 400 13.3333px Arial`), and a shorthand sets every longhand it covers -- so a button's weight does not inherit by default. Declaring nothing leaves it at the UA's 400, not at the baseline. The draft's own `.tool .fn { font: inherit }` is the counter-example: it is the only way a button climbs back to the inherited 500, and it measures 500. Measured rather than reasoned, in real Chrome over the delivered draft page: 293 buttons read 400x195 / 500x43 / 600x55. The load-bearing control is injecting a class-less button and a span into the same 500 parent and reading both at once -- button 400, span 500. One ruler, one position, two values, so this is not a constant read back everywhere. The span's 500 also shows what inheritance *would* have produced. The reset rule is byte-identical between the measured page and the current baseline 729fa43ce7, so the number carries over. Scope is unchanged: `:where()` keeps this at (0,0,1) so it still loses to any class, and the size, border and padding lines -- each the result of its own earlier per-cell count -- are untouched. typography-baseline.test.ts had encoded the same bad inference, down to a failure message instructing the reader to write `inherit`. Only that one case moved. * fix(web): composer ink and plan-current ink, scoped to the panel Composer: the draft puts body, placeholder and typewriter carousel on 1.7, and the footer icon buttons on the deepest ink with hover changing only the background. Ours had 1.6 and a mid ink whose hover went *lighter* -- so the pointer made a control read as losing focus. The blocking concern was scope, and one part of it was wrong. The annotation sidebar does not consume the editor rules at all: it passes `composer={null}` and renders a bare textarea. The home hero does, so these land as `[data-chat-root]` rules -- an existing hook that ChatPane already stamps on the composer's ancestors and that neither the hero nor the sidebar carries. The hero is untouched. Specificity carries it, not source order. All three layers move together: the writing surface, the static placeholder, and the carousel that sits over the placeholder's position. They are three states of one line of text, and lifting only two leaves a 0.65px jump at the moment they swap. The hover background is also realigned, and it was not on the list -- found while editing the rule the list did name, and included because "colours 1:1" is the standing instruction. Plan: `--plan-current-text` is #353535 in the draft and has been across both baselines. The spec pinning `--chat-text-strong` turned out not to be a product ruling at all -- its anchors are the two cases above it, and this one was a same-day convenience mapping onto an existing token. It now consumes a new seam variable, declared in both scopes at the same value because the draft carries no dark override. Tooltip is deliberately not touched: there is exactly one live tooltip in the product, used by 26 files across the whole app, so its 1.2 line-height cannot move without a scope decision. The dark pill measured earlier was not it -- those are three dead `::after` blocks, all gated on `:not(.od-tooltip)` while every caller carries that class. The shared ruler now expands line-height and font-family. Before this they read back `<unset>`, which is indistinguishable from "nobody wrote it" -- so an equality between two of them passed while measuring nothing. Additive only: `resolved()` yields just the targets a caller names, and none of the 27 existing callers name these two. * feat(web): move the visual-direction countdown and reshuffle per 729fa43ce7 The draft relocates two controls on this card: the countdown moves into the card head's right edge, and "reshuffle" moves out of the footer into the preview's top bar, left of the grid toggle, restyled from a square ghost button into a pill. The footer slot it vacates becomes "skip". The draft changed this in three render points, not two -- the scene page carries the same card and was edited alongside the component page. On our side the countdown was in the footer at 11px, and on the visual card it never appeared at all: that footer is merged, and the merge dropped it. It is now visible there for the first time. Size, weight and ink follow the draft (12px / 400 / --text-soft). The display format does not. The draft renders `30s`; product ruled 2026-09-02 to keep `M:SS` because it reads more clearly. That deviation is annotated in the component, the stylesheet and the spec, so the next alignment pass does not quietly put `30s` back. Measured in real Chrome across five widths: `0:30` is 9.1px wider than `30s`, and the tightest case still leaves 61px before the title, which wraps rather than colliding. Behaviour is unchanged on both paths: the countdown still finalizes the same way, and skip reuses the existing handler -- the merged footer's button already called it. Both call sites are covered. The agent-authored one keeps its own shape: its selector row cannot host the footer, so adding a second skip there would put two on one screen. Collapsing them into one row means widening the delegation rule, which is a separate decision. * fix(web): the tool icon slot is 16px, matching the glyph it holds Every glyph in the execution record already matched the draft byte-for-byte -- paths, sizes, inks, stroke weights, both the tick image and the eight-layer gradient orb. The one real difference was the box around them: the draft sets the slot to 16px, we had moved only the svg inside it and left the slot at 15, so a 16px glyph sat in a 15px box and overhung half a pixel on each side. This has been in the draft since the previous baseline and was never carried over. The draft gates its rule on `:has(> svg)` to spare the leading dot and the plan ordinal. Neither lives in this slot in the product -- the dot was cut and the ordinal is its own element -- but something else does: the thinking row's running state puts an Orb canvas here, not an svg. Copying the condition would leave that state at 15 while the settled state took 16, making the left edge jump between them, which is exactly what an existing spec pins. So the rule is unconditional here, with the reasoning recorded next to it. Two reverse controls carry the change: the mark and ordinal columns must stay 15, since widening the whole leading rail would also pass the positive assertion while enlarging the tick and the orb; and the four glyph fingerprints must differ from each other. The draft supplies a third control of its own -- an empty slot in the same file measures 15px under the same ruler, which is what proves the 16 comes from `:has`. The gap between icon and text stays at 7px against the draft's 8px. That pixel was set deliberately for OPEND-2516 and a spec guards it; the draft's own three rows disagree with each other there (22 / 23 / 24), so the two accounts cannot both hold. Left for a ruling. * fix(web): the shell head keeps one size across all four run states The draft renders this header at two sizes depending on state, and the difference is not intentional: the running word lives inside `.shimmer`, which needs its own font-size for the gradient clip and sets --t-body; once the run settles the shimmer is gone and the plain text falls back to the summary's --t-mini. So the title shrinks by a pixel at the exact moment the run finishes. Measured in real Chrome on both sides: draft and ours agreed at 13px running, 12px settled. Product ruled 2026-09-02 that the four states read as one size. This is a deliberate departure from the draft, annotated as such in both the stylesheet and the spec: neither of the draft's two values is wrong on its own, product chose the consistency. Aligning it back to --t-mini would be revoking a ruling, not fixing a drift. Scoped to `.fold.flat > summary`, which reaches only the outer shell -- the flat variant has exactly one call site and every drawer inside it is a plain `.fold`. The base rule is untouched, so nested foldables stay at 12. The elapsed time on the same row declares --chat-t-cap for itself and does not follow. The four-state check is written as an equality against the running state rather than four literals, so a later change to either side reopens the gap loudly instead of silently. Also records the standing ruling on the icon-to-text gap: 7px stays. The draft says 8, but that pixel was set for OPEND-2516 with a spec guarding it, and the draft's own three rows disagree with each other (22 / 23 / 24) where ours are one column. Product kept ours. * fix(daemon): a failed render check stays out of the visible reply The user asked why the assistant was narrating "the desktop render service is unavailable, so no preview was generated this turn". The answer is that our own prompt told it to. Both live cores carried the instruction -- the classic core said to "say so in your reply and move on", the slim core to "state that clearly". Model-authored rather than host-injected, and provably so: two recorded runs report the same event in different words. A template would emit identical bytes. Nothing in daemon, web or packages concatenates such copy into message content, and there is no i18n key for it. This is not a new product rule. OPEND-2577 already settled the same bug one subsystem over, and its spec opens with almost this question -- "the sentence the user read was not a UI bug; it is what this prompt told the model to write, verbatim" -- and asserts the disappearance of "the image generation service is temporarily unavailable". The contract it set is that operational detail belongs in tool output and daemon logs, never in the visible reply. One difference is honoured. For media the user had asked for an image, so that precedent still owes them a next step. A render check is something we do on our own initiative, so the correct output is silence about the infrastructure. Only the announcement is removed. The model still reports its own static verification, and a test now guards that half specifically so a later edit cannot take it out along with the leak. The single-render budget shares those lines and is preserved -- it is a token guard, not copy. The slim charter ceiling moves one documented step; the wording was tightened twice before spending it. * fix(web): hold the artifact card's loading face until the frame paints The blank card was two things, and neither was the daemon being slow -- curl returns the file in 2.2ms and the four card frames never touched the wire after the first. The visible half is a contract violation in this component. Its own comment says the pending face is for "not loaded yet", but the code dropped it at `verified` -- the moment a HEAD probe returned, tens of milliseconds in -- and revealed a frame that would not paint for another six to sixty seconds. That gap is what the user saw. The frame now mounts and loads exactly as before, hidden, and is revealed on its own load event. Blast radius is one caller: only cards pass `pendingContent`. The two project grids pass nothing, and their CSS already hides the glyph, so holding on for them would display nothing at all -- they are unchanged. The other half is four identical HEAD probes fired at one URL, because the same artifact appears once per turn and each card probes alone. These now join a single in-flight request. Not a cache: the map holds the pending promise and drops it on settle, so a later mount always re-probes and a deleted file cannot leave a stale verdict behind. The merged probe no longer aborts either -- one card unmounting must not cancel another's, and the response is 300 bytes of headers. The 59 seconds themselves are not ours to fix. The artifact loads `https://cdn.tailwindcss.com` as a parser-blocking script, and that host answers zero bytes in 70 seconds from here, so the body never parses. Measured 7 requests after the change, down from 10-11, with the card showing the pixel-liquid face throughout rather than an empty box. The iframe timings that looked like queueing were neither queued nor re-fetched: Chrome leaves the timing segments at 0 for iframe navigations and runs the entry until the child document's load event. * test(web): pin the turn footer's time and canceled mark, fix lying comments Four reported defects, none of which turned out to need a code change -- so this adds the evidence and the guards instead. The two from the gallery README were real once and are fixed. Time now reaches both branches, and the footer wrapper is full-width rather than the 220px shrink that had nowhere to push it to; measured, the time's right edge sits flush with the row's. The canceled turn already renders a grey dot, not a greyed tick -- which is what the draft asks for, since a dot reports a state and a tick claims it passed. The other two were artefacts of how the gallery inlines CSS, and are worth recording because the same shape will recur. The "one shade too light" ink is declared on an ancestor the gallery cell does not have, so the token goes undefined and the fallback shows through; adding that ancestor back in the page snaps it to the expected value. The divider's five wrong axes are one rule that the gallery's selector picker never inlined at all, leaving a bare div's defaults. Chasing either into the product would have made real code worse to flatter a measurement. The new spec covers the reverse half the existing ones left open. Two holes surfaced while writing it: an assertion about the running state was passing because that row does not render mid-stream at all, and an existing negative assertion fell back to an empty string when its selector stopped matching -- it stayed green through a simulated rename. Both are closed. Five comments corrected, each dated to the change that outdated it: three still described a 15px icon column that is now 16, and two more contradicted code sitting a line or eighteen away. * fix(daemon): close the host-failure-narration class, not just its instances Three times now a user has read our infrastructure's status in an assistant reply -- image generation, then the desktop renderer -- so the missing piece was a guard over the class, not a third instance fix. Four more places were telling the model to relay host state the user never asked about: the research contract's stderr rule, a skill relaying provider text verbatim, and two lines in another baking our interpreter version and credential configuration into the deliverable. Each rewrite follows the wording OPEND-2577 already established. One sweep hit was overruled. "If X/Twitter is unavailable, say so" is about the subject of the research the user requested, not our plumbing, and a coverage gap in their deliverable is owed to them -- the same carve-out the previous commit made for an explicitly requested export. The daemon-side redaction changed shape twice on contact with the code. There was no log copy of the message at all, so redacting alone would have destroyed the diagnostic rather than relocating it; the added log line is now the only copy and a test pins the raw path to it. And the web analytics parser buckets export failures by matching words in this message, so flattening it to a fixed string would have silently emptied those buckets -- it redacts paths, loopback ports and pids while leaving every classifying word, with all three buckets pinned. The guard scans directory globs so a new prompt or skill is in scope the day it lands, and every hit needs a written verdict. It deliberately cannot tell the two kinds apart -- whether the user asked for the thing that failed is semantic -- so there is no verdict meaning "narrated host failure, and that's fine": excusing a real leak requires mislabelling it where a reviewer sees it. Testing the detector rather than trusting it found three holes in it: it scored zero on both sentences from the previous fix, it could not see the canonical rule it was enforcing, and substring matching let a leak be appended into its own suppression entry. * test(web): pin four record axes reported as drift, none of which were Four differences came out of the gallery's full-coverage sweep. All four were measurement artefacts, so this adds the evidence and the pins rather than a fix; the record stylesheet is byte-identical to before. The shell head's orb is 24 in the product -- the component passes it and the canvas carries it -- but the gallery has no React and reimplements the drawing script, where the box is hardcoded to 20 and the element's own data attribute ignored. Patching only the canvas size in the live page brought the head from 32 to 36, matching the draft exactly, while the two orbs that really are 20 stayed put. The step rows showing "not started" under a head reading "completed" are a fixture shape, isolated by moving one variable: the same tool calls with a closing todo snapshot mark completed, and without one mark neutral. That mapping is a deliberate ruling -- calling an unclosed step complete "says something on the agent's behalf that it never said" -- and those cells never send the closing snapshot. The thinking paragraph was two different elements paired together: the draft's opening narration against our reasoning body. Measured separately, the draft's own reasoning body matches ours to the value, and so does our narration against the draft's. The claim that a cell reproduced the registered selector gap is also wrong -- no cell in the gallery has that shape at all. The gap itself is real, proven by moving real narration into a drawer and back in a live browser, but the draft writes no rule for that position, so following it would be inventing a value on the designer's behalf. The terminal's 29px belongs to the inside-a-step column, which we have exactly; the cell that measured 7 has a fixture marking its todo complete up front, which sinks the block to the top-level column where 7 is itself a ruling. The reverse controls pin the three standing deviations -- the mark's offset, the summary gap, the stream ink -- so a later alignment pass cannot quietly undo them. * fix(web): sync the /search failure rule, and guard the pair against drift The previous commit rewrote this rule in the daemon's research contract but could not touch its twin in the composer, because seven groups were working in apps/web at the time. The two are not merely duplicated documentation: on a /search run the composer expands its copy into the outgoing user message while the daemon renders its copy into the system prompt, so both reach the model in the same turn. Since that commit the model has been receiving "keep diagnostics out of the visible reply" and "report that error" together. They were written in one commit and have been identical ever since, so the web copy now takes the daemon's wording verbatim. That also drops the provider's name, which the new wording explicitly excludes -- fixing only the stderr half would have left the leak the sentence names. The parity guard lives in e2e/tests because this is a cross-app consistency check and web must not import daemon internals, but the deciding reason is CI reach: e2e_vitest runs when either app changes, while a guard on the daemon side would not run at all for a web-only change -- exactly how this drift got in. It pins the rule's four clauses rather than its prose, since the clauses are the product decision and the wording is not. A literal check rides alongside because the semantic form has a hole the author demonstrated: appending a leak to a compliant sentence keeps all four clauses true. The escape hatch for a future platform-specific difference is written next to it. Two anti-vacuity cases are permanent residents: the judgment is fed the sentences that really did ship before the fix and must say where each one fails, and the extractor must throw rather than return an empty string when the sentence is renamed away. Also repairs the daemon spec the previous commit left red -- it still asserted the deleted wording -- and points it at the parity guard. * perf(web): remove three boot reads that could never have succeeded Cold start on a conversation page drops from 68 requests to 58-61. Attribution came from wrapping fetch and recording call stacks, which is also how two of the five briefed causes turned out to be wrong. The team catalog's three requests were not a permission race and it was not "the second one is the bug" -- all three were. The signed-in account's active workspace is personal, and the daemon answers 403 for any non-team workspace, so every one of them was guaranteed to fail before it left the browser. The catalog now declines locally, and it throws rather than returning empty so each consumer branch stays byte-identical to the 403 it replaces. A personal-to-team upgrade goes to the wire on the very next read. Analytics was not two owners missing each other's window -- measured, they already coalesce. The client drops its memo on every null result so a later opt-in can retry, which means every track() call re-reads the endpoint for the entire life of any session where analytics is off: every user who declined, and every dev build. The retry is now tied to the event that can change the answer. The design-md hook was reading /files with a bare fetch, so it could neither join the read ProjectView already had open nor collapse its own replay. Routing it through the shared reader needed two flags to keep its behaviour: authoritative reads so "no DESIGN.md" stays distinct from "could not read the directory", and a fresh read on explicit refresh so the shared 1s window does not become a cache and freeze the staleness chip -- an existing test caught precisely that. Two of the seven vela status reads are deliberately left alone. That third caller also runs immediately before POSTing a read receipt, so it is an authority question, not a display read; wiring it to the shared reader let a post-sign-in check join a request issued before sign-in and the receipt went to local storage instead of the account. Proven with a probe, then reverted, with the reason recorded at the call site. The plugin catalog is likewise untouched: collapsing identical concurrent reads there does not just remove a request, it makes the same-key ordering race unreachable that a spec explicitly pins. That is a change to the module's concurrency contract and wants a ruling. Two suites needed adapting rather than leaving broken: they drive the shared file reader through once-queued mocks and now have a second legitimate caller, so the hook is stubbed there and no assertion moved. * fix(web): resting option rows and the visual card head take the draft's weight Two of seven reported differences were real. The rest are recorded as pins so the next alignment pass does not raise them a third time. Buttons do not inherit weight -- the UA applies a `font` shorthand -- and the draft's reset only sets font-family, so its option rows rest at 400. Ours declared 500 for itself, which is how it escaped the same correction made for bare buttons earlier. Checked row by row across five cells: the ten resting rows move, and the nine the draft writes 500 for stay, matching value for value. The visual card's head hook was attached to the text-options class only, while that card renders through the picker class, so it never reached the rule that drops option-bearing card heads to 500. The draft's selector keys on the options container, which the visual variant is one of, so its head is 500 there too. Three of the reported visual-card differences were the product being right. The 4:3 preview is a ruling with its own guard -- the catalogue's 96 images are all 4:3, and a portrait card would crop 46% of each. The stacking offset is derived from the card's own width by one formula on both sides, not an independent value; a geometry assertion now fails if one moves without the other. And the four sample tints are our real per-style palette sitting behind real assets, while the draft's flat grey is the backdrop behind four placeholder JPEGs its own README marks for replacement. Two more reported weights were the brief being wrong: the draft writes 500 for the own-answer textarea and the reconnect line itself. The option row's right inset is left alone. The draft is symmetric at 5, ours carries 11 from OPEND-2402, and pushing it back measures no overflow today -- the same fix's wrapping changes cover it and the text column is identical at both values -- but reclaiming that margin is a product decision, not an alignment one. Pinned as-is, including against being collapsed back into the shorthand. Two specs had written "resting equals 500" as a fact; only those cases move, and the sibling constants the draft really does set to 500 are untouched. * feat(web): the design-system creation message is the draft's status card This card was ours to begin with, then deliberately removed in favour of a plain user bubble carrying a dictionary string, with a spec asserting its absence. Product ruled 2026-09-02 to follow the draft, so it comes back and that assertion flips. Both decisions are recorded where the assertion lives, with the draft commit and line -- this position has now been decided twice in opposite directions and the next reader should be able to see that. The width is the one place the draft cannot be copied as written: its 280px rule hangs off the gallery's cell container, which does not exist in the product, while the component itself declares a 320 max. The QA sheet measures 280 x 67.98 and reasons about the description occupying two lines, so 280 is what the designer accepted. It is pinned on the component and the unreachable 320 is not carried over -- keeping it would only suggest a ceiling that can never apply. Measured live: 280 wide, two-line description, 67.98 tall. The four literal colours become seam variables per the component contract, declared in both scopes at one value. The draft carries no dark override for any of them -- every dark block in that file is for something else -- so inventing one was not on the table. The bubble's identical black is deliberately not reused: it flips in dark mode and would drag this card along with it. The existing dictionary key is kept rather than replaced: two other callers still use it for the menu item and a first-turn title fallback, so this adds two keys across all nineteen locales and guards that the old one survives. An anti-vacuity check caught a would-be false pass. The description's weight is inherited, and the ruler only computes rules applied to the element, so comparing it directly read `<unset>` on both sides. It is now two assertions: that nobody declares a weight here (with the same ruler proving it finds one on the title), and that the seam baseline is what it inherits. The revert pass found the hole the seam layer's own documentation warns about: removing only the dark-scope declarations fails one assertion and leaves every pixel check green. * perf(web): give artifact cards their own load budget instead of no budget Artifact cards bypassed the thumbnail gate entirely, and the reason was sound but too broad: the gate suspends itself the moment a project route becomes active so background covers do not compete with the project opening, and artifact cards live on that route, so going through it left them grey forever. Having a budget and yielding to the foreground were one switch; they are now two. The exposure is real. One message can produce as many cards as it produced files -- measured up to 28 on a single message, with no cap anywhere in that path -- and `loading="lazy"` barely holds: 24 cards in a 900px viewport start 16 documents without scrolling. Cards of the same file do not save a request either, because /raw/ answers no-cache, so eight cards of one file are eight round trips whose documents each run the page's scripts and re-fetch its externals. Four rather than the grid's six: the grid's number assumes it steps aside when a project opens, and this lane never does, so it must leave more headroom for the project's own reads. Four is also two rows of the two-column layout, and above the common case -- median two cards -- so the ordinary shape never queues at all. Queued cards show the pixel-liquid face, which is what "not loaded yet" already means here, so the standing rule that a fallback stays an ordinary card face is untouched. The positive assertion pins the exact budget rather than an upper bound, since a ruler that broke and read zero would satisfy `<=`. A second case pins that all twelve sources eventually mount, so throttling cannot become dropping. A `suspendable` flag written along the way turned out to gate nothing -- flipping it left every test green -- and was removed rather than left as decoration. * chore(design): rebuild the mirror gallery and make its ruler honest The checked-in gallery differed from the code by 318 structural blocks, so anyone accepting against it was reading roughly five hundred differences that did not exist. It is regenerated, and the draft side -- previously a local artefact that never entered git, most recently served from a stale commit on a local port -- now has a build script with the draft's sha written into it, taking its sources through git rather than a path someone happened to have. Three fixes to the differ itself. A neutralising rule written for the old matrix page was overriding the draft's own weight declaration at equal specificity. The selector filter ignored linked stylesheets, so the 452KB file holding the visual-direction styles read as "the draft never wrote this" -- and it now scans the page being measured rather than fetching a second copy, because that fetch was observed 404ing silently and emptying the filter, which looked exactly like the property count improving. Numeric wildcarding lets differing durations pair up, with any surviving text difference reported in its own column so a real 2/4-versus-3/4 surfaces instead of vanishing into the unpaired lists. Two more ways the ruler lied, both found by testing it: readings drifted run to run because one cell animates, and cells measured through a crop compared a cropped element against an uncropped one. Six cells the draft added are now populated -- all six turned out to be implemented -- and two fixtures were measuring the wrong thing: the queue rows never passed a steer handler, so they rendered the fallback button rather than the one the draft draws, and the waveform fixture duplicated the draft's 28 bars into 56. The inlining guard reconciles per selector rather than per class name, because a class can arrive through a group rule while its own seven declarations never do -- which is exactly what one cell was doing. Cells missing rules now say so in their own note instead of reporting the absence as a difference. Ten further classes of stale prose are corrected, the worst being cross-references that shifted when the draft inserted cells and now pointed reviewers at the wrong one. * fix(web): artifact cards carry the project-relative path, not the basename Clicking a card for a file in a subdirectory changed the route and then silently did nothing -- no tab, no request, no error -- while its cover stayed grey forever because the frame was pointed at a 404. The cards that did work were in the project root, which was coincidence rather than partial correctness. `deriveFileOps` truncated the agent's absolute path to a basename, on a comment asserting the project file API indexes by basename. Measured against the live daemon, that is false: `provenance.md` answers 404 and `context/provenance.md` answers 200, and both `producedFiles[].name` and the file listing carry project-relative paths. The daemon was right; the truncation was ours. It only surfaces through the fallback branch, taken when a run is cancelled before `producedFiles` is populated. One truncation, five consumers, all confirmed broken: opening, the cover URL, export and share, deduplication -- which merged a root README with one under assets/ and made the second disappear entirely -- and the pairing against captured snapshots, whose labels are project-relative, so a subdirectory artifact could never find its own cover. The text row's open affordance was gated on the same key and was therefore false for every subdirectory file, so those rows had no arrow at all. The resolution reuses the judge that markdown links and record rows already share, and accepts only positive evidence: the resolved project directory as a prefix. It deliberately does not take the file listing and match by name -- a project really can hold two README.md files, and opening the wrong one is worse than opening none, which is a failure mode the record-file-open rules call out by name. Without evidence it falls back to the basename, exactly today's behaviour. Two user-visible consequences, both arguably corrections: a card for a nested file now reads `context/provenance.md`, matching the tab that opens; and same-named files in one turn now produce a card each, which is what the dedupe comment always claimed to do. Files the agent writes outside the project are still not openable. That is left alone on purpose for the same reason as above. * fix(web): the status card's radius follows our scale, and its spec says so Asked whether to copy the draft's literal 14px or use the token that its neighbouring bubble already uses, the answer was to use the token. Our shape scale runs 2/4/8/12/16 and has no 14, so copying would have meant hard-coding an off-scale value for this one card while the bubble beside it sits at 12. The stylesheet was changed without its spec, which left the suite red. The radius now has a case of its own rather than riding along in the box-model one: it is the single axis on this card that deliberately departs from the draft, and burying that in a shared assertion is how a later alignment pass ends up "fixing" it back. The draft's value is kept beside the shipped one, so a future reversal edits one line instead of re-deriving where 14 came from, and a reverse control fails if the two ever become equal. Three type errors from earlier work are also cleared. The worst was `tForLanguageTag(...) as never` -- an assertion that the value cannot exist, which type-checks where it is written and only fails at the next call site, which is exactly what happened when the gallery started using it. It is a non-null assertion now, with the reason recorded. The other two: `as const` on a fixture made an array readonly against a mutable prop, and a context helper was given null where the contract says string or undefined -- a personal workspace has no team id rather than a null one. * test(web): pin four reported defects to the commits that fixed them Three of the four are genuinely fixed and now have regression pins; the fourth is half done and says so. Each conclusion comes from putting the pre-fix implementation back and watching the case fail, not from running the suite and seeing green. The turn-boundary defect and the stacked completion states turned out to be one symptom seen twice: the answers a user gave between two runs were sorted behind both shells rather than dropped, which is why the two completion states ended up adjacent. Both halves fail together before the fix and pass together after, and a preliminary check confirms every element was on screen throughout, so this was ordering rather than omission. The todo pin covers count and order separately, because the report named both: before the fix the shell listed eleven rows against a pill reading nine, with the running step at position nine instead of six. Its fixture copies the event shape out of a real recorded TodoWrite rather than an idealised one. History replay is confirmed in the browser as well as in tests -- 2319 characters of history land in one step with nothing revealing, and the agent's subsequent output still reveals character by character. The existing spec covered the behaviour but passed the flag in directly, so the wiring that decides whether replay happens at all was never exercised; that gap is closed. The upload surface is where it stops. The waiting screen now paints the attachments immediately from local object URLs, and that half is pinned here. The wait itself is unchanged: measured on a real machine the handoff screen held for nineteen seconds, ending exactly when the last upload finished, because the attachment handshake still reads server paths synchronously on the project view's first render. The failing case for that half is deliberately not committed -- it would redden the suite for everyone before its fix exists. * perf(web): recycle artifact card frames by last-seen instead of keeping all Cards mounted a live document and never released it, so scrolling a long conversation left every frame it had ever passed alive: measured on a real machine, twenty frames climbing monotonically and still twenty after scrolling back to the top. Distance from the viewport cannot decide this, and that is measured rather than assumed. Artifact cards live inside a scrolling chat log, so the intersection is clipped by that ancestor before any root margin applies; three observers at 0, 160 and 3000px over the same cards at the same scroll positions returned identical readings. The same measurement shows the existing overscan margin does nothing for these cards -- they begin loading only once genuinely visible. So the policy is least-recently-seen: everything on screen is kept, and off-screen frames are retained eight deep. Eight is one full screen of buffer at the measured layout, which means scrolling down past a card and back never reloads it, and it sits above the ninetieth percentile session, so nine conversations in ten never evict at all. Recency also matches where the cost falls. Remounting is a full reload -- the raw route is no-cache, the page's scripts rerun, its externals refetch -- which is how a card with an unreachable CDN link stayed blank for tens of seconds. Under this policy the just-viewed card is always last to be evicted, so the cheap gesture is free and only a jump back across many turns pays, which is a wait that gesture already implies. Nothing in the frame is lost: pointer events are off, an overlay button takes every click, it is keyboard-unreachable, sandboxed without same-origin so it holds no storage, and it cannot scroll. Slot release now also reclaims settled slots, without which a recycled card would remount holding its old grant and slip past the concurrency budget entirely. Two defects in the policy surfaced from its own reverse controls rather than review: timestamps were recorded on entry, so the card watched longest was evicted first, and per-card eviction from partial snapshots over-evicted where one decision per scroll was needed. Live curve after: rises to sixteen, falls back to eight, and at every sample equals visible plus eight. A recycled card returning shows the pixel-liquid face, with no placeholder or unavailable copy. * fix(web): the feedback panel's translator prop was uncallable by type Its `t` was declared `(key: never, ...)`, which says no key may ever be passed, so the prop could not be used from the day it was written. It went unnoticed because its only external caller asserted its own translator `as never` to match -- two mistakes covering each other, with tsc satisfied at both ends. Removing the cast on the caller is what surfaced this. The vars type was wrong in the same direction: `Record<string, unknown>` is wider than the interpolator accepts, and the extra width is values that cannot be substituted into a string. Both now match the signature `useI18n` hands out and that the settings and design-browser panels already declare. * fix(web): the plan pill's bottom reserve has never actually applied The reserve was written, the class was attached, and a spec asserting that class stayed green -- but the pill still covered the last line, because the value was being erased by the cascade. A skin rule sets `padding: 18px 18px 20px` at equal specificity and later in source order, and that shorthand takes `padding-bottom` with it. What survived was `scroll-padding-bottom`, which a shorthand does not reset, leaving the rule half alive and looking implemented. Doubling the class name lifts it to (0,3,0) so it wins on specificity rather than on where it happens to sit in the import order. The skin rule is untouched; rewriting it would drag along the gap and background it also declares. The 52px is arithmetic the spec re-reads from the stylesheet rather than restating: 12px of pill offset plus its 32px height, and 8px of air. Measured in the browser on one page: removing and re-adding the class moves the bottom padding 20 to 52 and the scroll height by exactly 32, and the last row shifts 32px relative to the pill. Across a real run the padding is observed at both values as the reserve follows whether the turn has a plan at all -- deliberately not whether the pill is visible this instant, which is what stops the reserve from feeding its own scroll position. Streaming stability was checked rather than assumed: sampled every 250ms across a 32 second turn, the padding never recomputes and the last user message holds its viewport position to the pixel. The jump-to-latest threshold is unaffected: at the bottom the scroll position absorbs the same 32px, and away from it the gap grows by 32 against a floor of 320. This does not address the large blank that appears mid-run. That space comes from the tail spacer, which runs an order of magnitude larger, and collapsing it is a deliberate behaviour with its own reasoning. * fix(daemon): carry codex's patch through so its file rows show +N -M Codex file rows have shown a duration where Claude's show line counts, and a comment explained why: codex reports a path and a kind, nothing else. That is still true of `exec --json`. It stopped being true of `app-server`, which became the shipping default the same day the comment was written, and which carries the patch in a required `diff` field. The loss is not where the comment sits. `toExecItem` rebuilds each change as `{path, kind}` before handing it to the shared codex branch, so from there down the wire genuinely looks unchanged and the comment kept reading true. Narrowing the frame to match the older transport is the whole bug: same shape does not mean same information. The counting reuses the rules already in `diffStat` rather than adding a second opinion. Codex's two kinds line up with Claude's two cases, and `add` is the one that would be easy to get wrong: its `diff` is the whole file body with no prefixes, not a unified patch, so reading it as one would report every new file as +0. Matching Claude down to its trailing-newline quirk matters more than being independently right -- otherwise the same file reports two numbers depending on the agent. The patch itself never reaches storage. Tool inputs are persisted whole, so the counts are taken in the daemon and the text dropped; a spec builds a 20k-character patch and asserts the serialised event stream contains neither it nor an `@@`, and stays under 400 bytes. For comparison a Claude write on this machine persisted 47k characters of content. The rollback transport is covered rather than assumed: its recordings still produce byte-identical events, and a diff that is absent, null, or not a string leaves today's behaviour intact. The parity spec now asserts the superset in both directions, so a regression that stops emitting counts cannot hide inside the strip. Three more comments in the same file were describing the older transport, and the repo's own recorded fixture has carried a `diff` since the channel landed with nobody reading it. * fix(web): strike only what is dead, and surface why a tool failed Every step in the list was struck through, including the one with a spinner on it. The cause is not a selector reaching too far -- it is derived per row, and the condition was "abandoned or recalled", where recalled alone was enough regardless of what the row is doing now. It is also not occasional. Our own recall block instructs the agent to re-list the plan whole with finished rows still marked completed, so a turn that picks up an earlier plan recalls every row by construction. Traced through a real recording: eleven steps completed in turn one, all eleven re-emitted in turn two, all eleven struck. Codex reaches the same contradiction by a second path, where the first unfinished row is lit implicitly and can be both running and recalled at once. The condition is now "anything this turn actually touched is never struck": abandoned rows still strike, running rows never do, rows with content under them this turn do not, and what remains -- old business recalled but untouched, or opened once and closed unused -- still does. This overturns two cells of the spec's own table, which had recalled rows striking even while being worked on. Three existing cases pinned those cells; rather than delete them their sampling point moved to the row that is recalled and untouched, which is what they were really there to prove, each with a reverse control so that striking everything cannot satisfy them again. Separately, the failure reason was hardcoded to null one line after the failure itself was computed and one line before the same text was stored elsewhere, with no comment. Two designed outlets were dead as a result. It now carries the text the call returned, untrimmed beyond whitespace, and the row that displays it already truncates to one line -- so the open question is not whether to cut it but how the rest is reached, which is the same question as the button that was never wired. The compound-command label is left alone and recorded: segments are scored by verb and the highest wins, which picks the read half of `sed && rg` and names a file that read fine, while the failure came from the search. That scoring exists to name successful calls and mis-serves failing ones; fixing it needs its own spec. * fix: an empty thinking frame is a heartbeat, not an empty frame to drop Claude sends every thinking delta as an empty string -- the content never arrives, but the frames do, roughly one pair every 1.4 seconds. Yesterday's fix for a retired protocol added a stripper and dropped any frame whose stripped text was empty, which is all of them. The panel has shown minutes of blank ever since. The test for emptiness was asking the wrong question. It now asks whether the upstream sent characters at all: nothing sent is a heartbeat and goes out, characters consumed entirely by stripping is the markup case the previous fix was for and still drops. That distinction already existed in the lifecycle tracer under another name, so this moves an established rule to where it was missing rather than inventing one. The frames are also the transport's pulse. Replayed against a recorded 1150-second run through the real function, the old test left 943 frames with a 300-second silence; the new one restores 1357 and a 73-second worst case, which is what the silence detector was calibrated against. A second drop sat downstream and would have made the daemon fix invisible: the client's buffer also tested the accumulated text for truthiness, so no thinking event ever reached a message and the shell's thinking state could not light up during a live turn. It now records that a frame arrived separately from whether it carried characters, leaving the array identity untouched so a run of empty frames does not churn the message. The guard that empty deltas render no paragraph is kept, and verified by mutation rather than assumed -- the client has two such checks and removing only one still passes, so a spec asserting it needed both removed to go red. The other six thinking-delta producers are unaffected: four already gate on non-empty text, and the shared codex path is covered. * fix: recall the whole task list, and let the pill follow the agent Stopping a run mid-plan and then asking to continue produced a shrunken plan: the two finished steps vanished and only the two open ones came back. The filter that dropped them sits in the daemon, before the prompt is built, so the model never saw them -- no amount of prompt wording could have recovered what was already gone. That filter had no independent reason. It carries no note about token cost or about keeping the model on task; it was simply the literal reading of the feature's original name. What it did carry is a gate -- an empty list means render nothing -- and that gate moves to the render step, asking whether anything is still open, so a fully finished plan still produces no block and the body stays byte-identical. Two pieces of evidence say the completed rows belong there. The block itself already instructs the agent to re-list the plan whole with the finished rows still marked completed, which the filter made impossible to satisfy. And the spec's own table has a row for a step recalled after finishing in an earlier turn -- a row that can only be drawn if the agent re-emits it. Three guards against redoing that work, all placed before the list: the heading no longer promises unfinished items above rows marked completed, a sentence states plainly that the finished work exists and must not be redone, and the invitation to decide is narrowed to the open items so that not-redoing did not quietly become must-continue. The pill was reading the newest snapshot anywhere in the conversation, which is why an unrelated question could still show a step count from a turn that had nothing to do with it. It now shares the primitive the transcript card already uses, stopping at the newest assistant message: if the agent declared no list this turn, there is nothing to show. That is the same rule the recall design states -- what surfaces is whatever the agent chose to re-emit, never the client's own inference. The session-wide reader stays, with both call sites documented as the pinned-card-era lookup that is wrong for a live turn. Verified end to end after the daemon restart: the recalled list arrives with three of four rows marked completed, the agent opens by saying the first three stay done and touches none of them, and the pill and the card report the same count. * fix(web): reclaim the anchor spacer once it is the only thing on screen Sending a message anchors it to the top of the viewport, which needs a screen's worth of room beneath it that does not exist yet, so a spacer supplies it. While the anchor holds, that spacer shrinks as the reply grows. The moment the reader scrolls away it froze -- deliberately, to keep scrolling down from snapping -- and a turn that then produced a thousand pixels of text left a quarter screen of content above two hundred pixels of nothing. Distance from the bottom cannot decide when to reclaim it: a turn starts at zero and grows, measured here from zero to 981px, so any pixel threshold expires within seconds. The question is instead how much of the spacer is actually intruding on screen -- its height less the distance below -- acted on only past 52px, which is the reserve the plan pill already takes and therefore the smallest gap worth moving the page for. That quantity also says something the distance cannot: once it is positive, everything below the fold is ours rather than the reply's. Not oscillating is structural rather than tuned. A frame may move the view at most 24px, less than one trackpad notch, so the collapse can never outrun the reader's smallest deliberate scroll. And the decision is latched: a spacer is asked once whether it should go, then shrinks monotonically, so crossing the threshold repeatedly cannot toggle it. While the anchor is still held nothing changes -- that path swaps growth for shrinkage at constant height, and mixing the two is what would jolt the anchor, so this runs only after the anchor releases. Reported as jitter during a live turn and traced to the probe rather than the change: with every driver removed, two uninterrupted runs of 38 and 37 seconds show the scroll position never moving and the spacer never reversing while the content grows past 1800px. The scroll handler also stops scheduling frames for a spacer too short to act on, which is the idling that would have fed such a loop. One neighbouring guard moved with it. Its premise -- that following still works while a spacer is present -- is unchanged, but it pinned the spacer's height in the one situation this reclaims it, so it now checks following at every step instead of only at the end. * fix(web): restore the balance gate for accounts with no plan behind it An empty wallet in a personal workspace could send freely: an early return meant to spare subscribers had widened until it caught everyone. Its condition asks whether a model was selected, and one always is -- the agent's default fills in when the user picks nothing -- so every send in a personal workspace took it, and because zero is below the warn threshold it swallowed the hard block too. The judgment rotted in two steps rather than one. It began as plan tier crossed with whether that model is unlimited on the tier; one change replaced the local table with a live list and lost the tier half; the next removed the list and left only "a model is set". Each step was locally reasonable and the pair is not. The intent behind the last step is preserved exactly, and it was deliberate: the author rewrote those assertions and renamed them to say we should stop guessing whether a selected model is metered. Every case he wrote uses a paid tier -- the word "free" appears nowhere in that file -- so an account with no plan behind it was never considered. His cases are untouched and still pass. So the gate now engages only where the account is provably free. The tier is still available, through a resolver both callers already use in the same breath as this gate; only the per-model coverage is gone. When the tier cannot be read at all the request is allowed, matching what the old check did when its list was missing, so a failed read can never block someone who paid. Restoring the zero-dollar block unconditionally would have recreated the incident this rule exists to prevent -- an empty wallet is the normal state on an unlimited plan, which is what the original change was called for -- so it is restored only where correctness is demonstrable. One cell of behaviour changes for users: a personal workspace with no subscription and an empty wallet is now stopped before sending instead of failing partway through the run. Low balance on a free tier resolves to a soft warning that stays invisible, since both callers already suppress soft warnings for free tiers by an earlier ruling. * fix(daemon): read the turn boundary from every frame the CLI actually fills Claude Code 2.1.259 leaves `stop_reason` null on the assistant wrapper frame, which is the only place we read it. So `turn_end` never fired, and the per-turn state hanging off it never reset — a second turn's genuine inline HTML artifact was silently swallowed as an echo of a file the FIRST turn had written. Rather than swap one frame for another, read all three and dedupe by message id in `emitTurnEndOnce`: the wrapper frame (older CLIs and argv-compatible forks still fill it), `stream_event` -> `message_delta` (2.1.259 with --include-partial-messages), and the `result` frame (the only boundary a build without partial messages emits at all). Which one arrives is a property of the build in front of us, and the only trustworthy capability check is whether a given frame carried a value. Verified against six byte-for-byte recordings of a real 2.1.259 CLI, kept in tests/fixtures/claude-cli-recordings/ with the flags used to make them. Four corpus guards assert the recordings still have the shapes the tests depend on, so replacing them with hand-built fixtures cannot quietly vacate the suite. * feat(chat): name the file a write is targeting while its arguments stream Writing a 40KB page took the model 196 seconds, and for 140 of them the row said nothing but a running clock: `file_path` arrives in the first ~180 bytes of the arguments, but the row waits for the last byte of `content`. The daemon now scans the argument buffer it already keeps and, the moment the path is provably complete, emits `tool_input_target` — id, name, path, under 400 bytes. The client renders it as an EARLY FORM of the same call, so the verb, icon and file-name button are the existing ones; no new copy, no new branch. The arguments themselves never leave the daemon, and the row upgrades in place when the real `tool_use` lands. Measured against a real 2.1.259 CLI writing 27.6KB: the name appeared 102.8 seconds early, stayed put while the buffer grew from 240B to 27.6KB, and matched the final `file_path` exactly. Nothing half-formed is ever shown — a path whose closing quote never arrives emits nothing, and an in-flight call is not counted as a file operation, because the model has only announced an intention to write. * fix(web): show the low-balance reminder to every plan, not just three of them QA reported a Pro account at $1.79 starting a task with no warning at all (OPEND-2600). Tracing it found the card was invisible on FOUR tiers of a personal workspace, and for two different reasons. A plan-aware early return sat in FRONT of both the hard and soft branches, so any account that was not literally 'free' returned `allow` before the soft tier could be computed. Behind it, the render side filtered on a paid-plan set of exactly {plus, pro, max}, so free, `go`, and an unreadable plan were dropped even when the gate did produce a warning. Product ruling 2026-09-03: a reminder is not a block. A subscriber with an empty wallet still sends — that ruling stands — but they are still told, and so is everyone else. "They have a plan" therefore stops suppressing the reminder while remaining exactly the right reason not to HARD block: an account with no plan behind it has nothing but the wallet. The plan lookup now happens only where it still decides something, at or below zero. A wallet at $1.79 no longer makes any upstream call at all, which is both the fix and a small speedup on the send path. Spec: specs/current/chat-panel-decisions-sheet.md T37-T40. * fix(chat): make the queue's steer button interrupt the run and send The button offered to slip a queued message into the turn already running, by writing it to the agent's still-open stdin. Two measurements retired that idea. Only 2 of 27 runtimes declare `stream-json`, so 25 agents never saw the button at all. And against a real Claude Code 2.1.259, a user message written to stdin MID-TURN was simply never processed — the process stayed alive and idle for 180 seconds — while the same bytes written after the turn's `result` frame started a second turn normally. The daemon closes stdin at that same `result`, so the window we offered and the window the CLI accepts may not overlap at all. Interrupting, by contrast, works on every agent. The button now stops the running turn and sends the queued row immediately, reusing `sendQueuedChatSendNow` — which already tags the superseded run so its late terminal callbacks cannot pollute the replacement, and un-sticks preview comments left mid-apply. The hover copy says so, and the attachment carve-out is gone: attachments could not ride a steering frame, but they resend fine. The capability check went with it. There is no such thing as an agent that cannot be interrupted, so the button no longer has a disabled face to explain. Fixes OPEND-2602. * fix(chat): turn the fork icon the way the design draws it The draft's branch glyph is remix's `git-branch-line` mirrored across y=12: its third node sits at (18,18) and the branch runs DOWNWARD, where ours runs up. Verified point by point — all 92 coordinates match the reflection, the only difference being a float tail (8.417 vs 8.4175) — and it is not a stray export: all six component cells and the footnote carry the flipped path, and the prose agrees, "a divider drops in place, and below it is the new turn". The new conversation is below, so the branch grows down. Added under its own key rather than editing `git-branch-line`, which is an upstream remixicon asset: rewriting a name someone else's icon resolves through would silently change glyphs elsewhere. Three tooltips also went back to the draft's wording — 没帮助, 复制, 新开会话. The buttons themselves needed nothing: the 26x26 hit area, the corner radius, all four state colours and the 2px gap were already byte-identical. Not touched, and left for a product call: nine differences in the tooltip bubble itself (radius, padding, line-height, material, border, shadow, gap, wrapping, and the draft's 100ms fade). Those live on `.od-tooltip-layer`, a primitive shared by the whole app, so the draft cannot be applied there without deciding it governs every other surface too. * feat(chat): give the panel's icon buttons the tooltips the design asks for `data-tooltip` appeared exactly zero times anywhere under components/chat — the execution shell, tool rows, primitives, the error card, the upgrade card, reconnect and audio all shipped with `aria-label` and nothing a sighted user could see. The draft names three of them outright, and those three are now wired: the thumbnail strip's 查看大图, reconnect's 查看详情, and the error card's 联系支持. The conversation-history key was worse than missing: it carried a native `title`, the browser tooltip that appears after half a second in a style no one controls — precisely what the draft's own comment argues against. It now uses the same layer as everything else, points down as drawn, and wears the draft's outlined clock instead of a filled speech bubble. The draft also puts a new-conversation key in the panel header. Ours had the entry buried inside the history dropdown behind the word 新建, so the icon key is back, wired to the same handler, same disabled condition, same analytics. The dropdown item stays for now — a UI test locates it — so there are two doors to one room until product picks one. Nothing was changed on `.od-tooltip-layer` itself. * feat(chat): show tool work while it is happening, not after it ends Two halves of one product ruling — "show a long action as early as we can, and keep a clock running on it so people can feel where it is stuck." **ACP agents (opencode, AMR/vela, and the six others) hid every tool call for its entire life.** Rows were emitted only at the terminal frame, so across 141 recorded local runs, 855 of AMR's 2779 wall-clock seconds had a tool running with nothing on screen — and the hidden time almost exactly equals the total tool time, because a call was invisible for 100% of its span. The daemon had the first frame in hand within 2ms of the agent sending it. Bash was 58% of the loss, not file writes. Rows now open on that first frame and upgrade in place: 57.0s for a shell command, 67.2s for a write, 222.0s for a subagent task, each as ONE row. Across the corpus the path never changed under a row (0/202) and the name changed once (Task to Survey — a title-derived upgrade). **Claude's writes showed a name but no progress.** The path lands in the first ~180 bytes of the arguments while `content` still has tens of kilobytes to go, so the row sat still for minutes. The scanner already walking that buffer now also counts newlines, and the row grows: `+128 −0` on the same counting rule `diffStat` uses, so the number does not jump when the call settles (measured: last in-flight 734, settled +734). Edit and MultiEdit get the name but no count — `−M` is unknowable until `old_string` completes, and half a number is worse than none. The stopwatch needed no new machinery. It was already ticking once a second, independent of upstream frames; in-flight rows simply had no `startedAt` to measure from. Both paths now carry one fixed origin per call. Throttled twice over — 512 content characters for the write counter, 250ms plus a changed-payload gate for ACP — so a burst of identical frames cannot turn into a broadcast: 911 frames produce 350 events, and 1062 delta frames produce 55 counts. Neither is persisted; after a run the same information lives in the settled call, and storing it would give a reloaded conversation two rows for one call. Also corrects `tool-timing.ts`, whose docblock claimed codex emits `tool_use` at `item.completed`. It does not, and did not on the day that comment landed: only `web_search` does. The measurement behind it was real, the attribution was not — half of codex's shell calls are simply instant. * fix(daemon): keep a conversation readable when its artifact refs cannot be read `conversationChatArtifactRefs` carries the comment "a snapshot store problem must never make a conversation unreadable", but the guard it names sat around the ref query only — the owning-project lookup ran in front of it. That lookup reads a different table and can fail on its own, and when it did the throw travelled out of `listMessages` and the caller got no transcript at all. The failure was silent, which is why it survived: `langfuse-bridge` catches a failed message read and reports the run anyway, so a broken lookup looked like a turn that produced no output. Thirteen of its tests were red on this branch for exactly that reason. Artifact refs decorate a conversation. Losing them costs a thumbnail; losing the messages costs the conversation. Also updates the codex normalize expectation, stale since file rows started carrying `od_diff_stat`: a codex write used to show elapsed time where the same row under Claude showed `+N −M`, and counting the diff is what fixed that. Adds the missing control — no diff on the frame means no stat invented, so the older `exec --json` wire still produces byte-identical events. * feat(web): give tooltips the design's surface, and the panel its outlined icons Eight of the ten tooltip properties now match the draft byte for byte — radius, padding, background, text colour, border, shadow, line-height, and the 6px offset from the trigger. Going opaque also drops the backdrop blur, which is a straight improvement over the preview iframe: translucency was losing contrast against whatever the user's page happened to render underneath. Two are deliberately not applied. `white-space: nowrap` would break the UI, so it is guarded rather than adopted. The longest current tooltip is 202 characters (French, the single-file publish description) — roughly 1300px unbroken at 12px — and several tooltips carry unbounded user data such as a filesystem path or a document title. The draft's own comment explains the mismatch: there, a tooltip names an icon-only button in two or three characters. It never contemplated long copy, and `max-width` is why ours survives it. A reverse test now pins the wrap so nobody "finishes" this alignment later. The 100ms fade is unreachable here. Ours is a portal that mounts on show and unmounts on hide, so the node never travels from transparent to opaque and a `transition` on it would be dead CSS. Making the fade real means keeping the layer mounted — a behaviour change, not a value change. Icons: seven glyphs move to the panel-local outlined set, at the same sizes, with every call site outside the chat panel left alone. `Icon.tsx` and the remix map are untouched — the site-wide stroke convention was not adopted. Two of the seven turned out to be same-name-different-glyph rather than duplicates: the composer's palette has asymmetric dots where the status card's is solid, and the queue's remove is a different path from the tool row's delete verb. Play stays filled, because the draft draws it filled. * fix(chat): put a running clock on the image batch, and retire the D3 tests Six tests in the tool-status suite still asserted "a call with no result yet produces no row". That rule (D3) was struck a day earlier — the spec has said "a call gets a row when it is made, not when it returns" since 2026-09-02 (OPEND-2419) — and the in-flight work landed the behaviour the spec already described. Each one now states what it pins, who overturned the old rule, and which neighbouring rule was NOT overturned. B47 was not overturned. It only stopped firing here, because a shell with rows in it is no longer empty; its own guards live in `empty-shell.test.ts` and are green. Nor is the row deleted when a turn ends without it: `ToolRow.pending` already ruled that a call that never came back stays recorded and simply stops being drawn as a spinning orb. Verified by running it — the row settles to a frozen elapsed and a neutral mark, and never reaches the database at all. One of the six was a different bug entirely: a failed row now carries its reason after the name instead of the word "Failed", since `failReason` stopped being hardcoded null. The image batch row had no clock while it was generating. Not an empty slot — the in-flight form has no slot at all, and both data paths returned null (`pendingMediaBatchRow` hardcoded it; the event path demanded every task have an `endedAt` first). It now runs from the earliest task in the batch, applied AFTER the S19 merge — that merge sums settled values, and summing live ones would count the same wall-clock stretch several times over. Also fixes an assertion that could never fail: the failed-turn test asserted its record body was absent, but a failed shell is collapsed and a collapsed shell defers mounting its body, so that read was null no matter what the shell contained. It now expands first and asks the real question. * fix(chat): give the top-up card back when the upgrade card cannot draw `suppressCard` on the insufficient-balance failure means "another surface is already saying this" — that is why the reconnect line uses it. The upgrade card is not that kind of surface: it only renders once a wallet read comes back with a definite number. When the read cannot settle, nothing renders at all, and a run that died over money leaves an empty screen with no way forward. The commit that introduced the hand-off said so in its own message. So the hand-off now holds only while the surface it hands to is actually on screen. `failureCardHandedToAmrBalanceCard` names that distinction, and the white card — with Top up and Retry — comes back exactly when the wallet read settles with no number. The 2026-09-02 "one card, not two" ruling is untouched everywhere the upgrade card can draw: this is the case where it cannot. That hole was live: the P0 recovery spec had been green for five runs and went red here, because its Vela endpoint is a dead port and the read never settles. Two neighbouring fixes ride along. The balance specs clicked send the instant the button rendered, but it is disabled while the transcript loads, and a click on a disabled button is a no-op — so `waitFor` burned its full three seconds and the failure looked like a product bug. The margin was between 1ms and 5ms of load latency; they now wait for readiness. And `isPaidAmrPlan` is gone: it had no callers left, and its name answered its own question wrongly — `enterprise` is a paid plan it called unpaid — which is the exact shape of the bug that hid the low-balance card from four tiers. * feat(chat): let the tooltip fade, and leave one door to a new conversation The draft's 100ms fade could not happen here: ours was a portal that mounted on show and unmounted on hide, so the bubble never travelled from transparent to opaque. It now stays mounted and toggles opacity, with `aria-hidden` keeping the hidden bubble out of the accessibility tree — the thing an always-present tooltip node gets wrong if nobody checks. Keeping it mounted did surface one real regression, caught by an existing spec: the export-screenshot path waits exactly two frames, and two frames into a 100ms `cubic-bezier(0,0,0,1)` the bubble is still about a quarter opaque — it would have printed into the image. Dismissal by activation (click, Enter, Space) is therefore instant, and only hover-out fades. That reads better anyway: a bubble you dismissed should be gone, not dissolving. The draft's timing is kept over the repo default (200/140ms) because this is the chat panel's own draft; the curve is still a decelerate one, so the "no ease-in" rule holds. New-conversation had two doors — a header key and a dropdown item — for one action, one handler, one analytics event. The header key stays, per the draft, and the dropdown item is gone along with its now-dead CSS. Both were gated on the same handler and the same disabled condition, so no state loses the action; three UI specs move to the header key's testid, keeping the step that opens the menu so their "the menu now holds only the list" assertions stay meaningful. The word is unified inside the panel: 新会话, plus the verb the draft itself supplies at `body-components.html:1243` — "新会话从这里开始". So the family is 新会话 / 正在开始新会话… / 无法开始新会话, and one button no longer says "fork" the moment you press it. * docs(spec): record the 2026-09-03 chat-panel rulings and what they cost * feat(chat): number a forked conversation instead of calling it a fork Starting a new conversation from a reply produced "{title} fork" — the last place the word survived after the control labels were unified on 新会话. It now numbers instead: 「商品列表页」→「商品列表页 (1)」→「商品列表页 (2)」. The number is assigned by the daemon, not the client. Reading the project's conversations, picking the number and inserting all happen without an await in between, and better-sqlite3 is synchronous, so no two forks can land on the same number — a guarantee the client could not make. It also gives the CLI the same names for free: `od chat new --fork-after` used to create an untitled conversation, and now matches the UI, which the dual-track rule asks for. Only a suffix WE could have written is stripped before renumbering — one half-width space, half-width parens, one to three digits, no leading zero, at least 1. So a conversation someone named 「方案 (2024)」 keeps its year, and an older 「商品列表页 分叉」 keeps the word and becomes 「商品列表页 分叉 (1)」. Existing titles are not migrated; both shapes will coexist, which is recorded where a later reader will find it rather than left to look like a bug. Gaps are not backfilled: with (1) and (3) present the next is (4), not (2). Reusing a number resurrects a name the user just deleted, which reads as the deletion having failed. `chat.forkedConversationTitle` is gone from all 19 locales — a number needs no translation, and the daemon has no locale to translate with. * feat(chat): open a running command, and stop fighting the reader for the scrollbar The draft has said "执行中展开 → 完成收起" all along (component 11, `body-components.html:1004`), with the in-progress cell annotated "终端实时追加, 限高滚动自动贴底". We only implemented the failed half, so a command that ran for a minute showed one line and a clock while its output sat behind a fold that was not merely closed — a closed fold never mounts its body at all. Opening it exposed two things the fold had been hiding. The terminal jammed itself to the bottom on every new chunk. Scroll up to read a line and the next chunk, 250ms later, yanks you back. It now uses the same follow logic as the thinking card, which tracks the reader's INTENT rather than inferring it from position — inferring deadlocks, because following writes the position back to the bottom and the inference then reads that as "still following", so a trackpad nudge can never accumulate enough distance to escape. That logic could not see the terminal at all, which is the second thing: the box stops growing once `max-height` clamps it, and terminal output arrives as NEW CHILD ELEMENTS, which the one-time `Array.from(box.children)` snapshot never observed. The thinking card slipped past both — its children are fixed and it grows its own height. A MutationObserver closes it. Cost, measured rather than assumed: one batch of new output re-renders the terminal exactly once; five clock ticks used to re-render it six times and now render it once. A reloaded conversation with thirty collapsed command rows carrying fifteen thousand lines between them mounts zero terminal nodes. * feat(chat): give the AMR command row the same foldable, so its live output has somewhere to go Until now the two command-row shapes were split by whether the agent sent a human-readable `description` alongside the command: · Claude family (`{command, description}`) -> foldable, terminal body · AMR / ACP family (`{command}` only) -> one line, no body That split landed exactly backwards against which runtime actually streams partial output. The daemon emits `tool_in_flight` (carrying up to ACP_IN_FLIGHT_TOOL_OUTPUT_LIMIT chars of stdout-so-far) only on the ACP path; Claude's stream-json carries nothing at all between `tool_use` and `tool_result`. So the one link that really has live output was the one with no place to draw it, and the one with a place to draw it never had anything to put there. The draft never painted this state. `执行 <命令>` appears exactly once in the whole file (body-components.html:909) and that instance is settled -- static terminal glyph, a resolved `8.4s`. It does paint running single-line rows elsewhere (:1037), so the gap is specifically exec-while-running. The second clue is in the same line: that button's aria-label reads verbatim 「查看 npm run build 的输出」 -- the draft already calls this row "see the output", it just never drew what comes after "see". This fills that half, on the product's 2026-09-03 ruling to unify the two shapes. Built to be the same row, not a lookalike: the summary keeps :909 verbatim (verb + monospace command + seconds slot), the body reuses the same `div.code`, and open/close runs through the same `lifecycleOpen`, so "open while running -> close when done" and "a reader's own click wins" did not have to be written twice. Two deliberate restraints, both recorded at the call site: the command is not `elide`d (that helper preserves file extensions and would turn `wc -l a.md transcript.html` into something that reads like a different command -- truncation belongs to CSS here), and `lifecycleOpen` carries only `row.pending`, because this branch is guarded by `!row.failed` and adding `|| row.failed` there would be dead code. Cost is measured, not assumed: 500 output lines still cost 501 line nodes and a constant skeleton; the stopwatch ticking five times still re-renders the terminal zero times; and 30 collapsed rows on first paint mount zero terminal nodes. The skeleton is 14 nodes/row here versus 12 for the titled branch -- the extra two are the `<span class=file><code>` pair that sets the command in monospace. That is pinned at 14 rather than rounded up, so the next time it grows we see it. * docs(spec): settle the running-output and fork-title questions, open the failed-file one Three of the four items under 「同日未决」 got answered today; recording them with the evidence, and with the cost, so nobody later reads a ruling as drift and "fixes" it back. T47 (running tool output opens, closes when done) closes the three-way question. Worth writing down that I recommended the wrong branch here: I suggested showing a tail on the row, from intuition, and the product pulled up the draft cell that says 「执行中展开 → 完成收起」 in as many words. The unification across both command-row shapes on top of that is a spoken ruling the draft never painted -- the note says so, and says which two lines in the draft argue for it anyway. T48 numbers a forked conversation instead of calling it a fork. Half-width parens everywhere for now; the product said explicitly not to spend time on the CJK full-width question yet. T49 opens the failed-file-row expansion as in-flight rather than settled, because it is a spoken ruling against a draft cell that says otherwise -- :917 is a single line with a button. Whoever lands it has to say that at the call site. Also split the deferred items out into their own block, so "the product said leave it" stops looking like "nobody got to it". The English past-tense one is bigger than I first described it: the whole verb family reads as finished while the tool is still running. * fix(chat): a row that never came back is not a row that is still running Opening a running command row (T47) read `row.pending`, and `row.pending` means `result == null` -- "this call never came back", not "this call is running right now". Press Stop and the in-flight call never gets its `tool_result`, so `pending` stays true forever: that row stays spread open, and stays open every time the conversation is reloaded afterwards. An `npm install` with a few hundred lines of output takes the screen on its own. The fix is not to clear `pending` when the turn ends. The glyph at the head of the row is picked from it -- `row.pending ? <StatusMark …/> : <toolIcon/>` -- so clearing it paints a finished tool icon on a call that never finished. `closeRunningSegments` already wrote that rule down for the todo half of the same problem, verbatim: marking it complete is saying something on the agent's behalf that it never said. Both quantities were already in hand one line apart. The glyph reads `running ? 'running' : 'pending'`; the expansion read `row.pending` alone. Two adjacent decisions about the same fact, using two different measures -- that was the whole defect. They now share one named `lifecycleOpen` whose docblock says which measure answers which question and why failure is independent of both. Real trigger path, not a constructed one: `ExecutionShell` computes `running = shell.status === 'running' && !shell.stopped`, and on cancel `build-turn-blocks` sets `shell.stopped = true` and calls `closeRunningSegments`, which only walks todo segments. So `running` flips false while `row.pending` stays true -- exactly the shape the new tests feed. Worth recording what the probe found, because I had assumed otherwise: only `canceled` shows this on screen. `failed` and `error` collapse the shell itself, and with `deferBody` nothing inside is mounted at all -- so those two never displayed the stuck row. That is now a test with the reason attached, so nobody "completes" it into three cases and gets a selector miss that reads like a broken toggle. Twenty-six existing tests had to say `running` out loud. They were feeding a pending row with no `running` and asserting the running behaviour -- data that matched both "in flight" and "left over after Stop", with only the first asserted. Making it explicit is what the fix is about, so each file now carries the note rather than a silent prop. * feat(chat): let a failed file row open, so the error text is actually readable The failure reason is deliberately not truncated -- `build-turn-blocks` says so in as many words: a stderr can run to several hundred characters, and how short to cut it is the product's call. It was then pasted into a single line as `{verb} {file} · {reason}`, where CSS ellipsised it away. Handed over, and unreadable. Product's ruling, pointing at the failed *command* foldable: 「能下拉展开吗? 像这样」. So the file row gets the command row's treatment. Stating the basis plainly, because the draft says otherwise and the call site now says so too: :917 paints a file failure as a single line with a button and a duration; only :1018 is `<details class="fold is-fail" open>`. This is a spoken ruling against that cell, not draft fidelity. It also collapses the draft's two failure spellings, which spec S1 has had open as "are these two intentionally different?". They were: the one carrying a reason inlined it and dropped the 「失败」 mark; the one without kept the mark. Now the summary is always :917's line -- verb, filename, 「失败」, duration -- and the reason moves to the body. What is left of the difference is only whether there is any text to show: with text it opens, without it stays the single line. A foldable that cannot open is worse than a row, because the chevron lies. Nothing is lost when collapsed, because failed rows default to open through the same `lifecycleOpen` the command branch uses. The reason is on screen from the first frame; it just sits on the second line. The body reuses `Terminal` rather than growing a new box: 104px cap, its own scrollbar, sticky-bottom following. At this layer a few hundred characters of stderr and a few hundred lines of build output are the same thing -- text the agent handed back verbatim. Two of the new test's own assertions were wrong before the implementation existed, and the fixture guards caught both: `tool_result` pairs by `toolUseId`, not `id`, and zh-CN's write verb is 「新建」. Recording that because a fixture that silently produces no failed row would have made the whole integration case vacuous. * docs(spec): mark T49 landed, add T50, and close out what S1 was asking T49 shipped, and it answered S1 on the way -- the draft's two failure spellings are now one, differing only in whether there is any text to show. Flagging that we collapsed them rather than the designer answering, because S1 was filed under their name. T50 is the regression T47 introduced and what it cost to fix: reading `row.pending` for auto-expansion when that field means "never came back", not "still running". Includes the measured finding that only `canceled` surfaces it, so nobody widens the test to three cases and hits a selector miss that reads like a broken toggle. Three things move into the open list: whether a one-line reason should keep an inline copy (cost: the same sentence twice when expanded), the designer sign-off on S1, and `onShowFailure` having no caller anywhere in the repo -- left in place, not deleted. * chore(mirror): rebuild the gallery so it shows today's rows The mirror page is the only place a person can judge cell-by-cell whether we match the draft, and it is a generated artifact -- leaving it on yesterday's render means a reviewer compares against rows that no longer exist. 54 more `<details>` and the terminal box now appearing on failed file cells is exactly the two rulings that landed today: both command-row shapes fold, and a failed file row opens with the error text inside. * docs(chat): count who actually lives on the raw-command branch, and fix what I got backwards I wrote in yesterday's commit that "opencode's bash input is just `{ command }`" and that Claude's Bash "always" carries a description. Both were written from intuition. Counting the corpus -- 179 langfuse recordings plus the live vela capture in `w123-acp-inflight-frames.json`: claude (stream-json) 47 / 48 carry a description opencode, direct CLI 71 / 71 carry one codex 0 / 569 carry one AMR / ACP (vela -> opencode) none; the recorded rawInput is {"command": …, "timeout": 180000} So the opencode claim was inverted. Direct opencode always sends a description; it is the ACP hop that drops it. The same agent lands on different branches depending on which wire it comes in on, which is worth saying out loud because it is not what anyone would guess. And the branch's largest resident is codex, not AMR: 569 calls across 36 recordings, none of them with a description. That means the change did more than give AMR's live output a home -- it gave codex a body at all, and 569 calls' worth of settled output had never reached the screen. This file's own header already said "codex has no description throughout"; I read past it. Claude's "always" is also not true, just nearly: one call out of 48 arrived as a bare `{"command": "sleep 4"}`. Left as a measured ratio rather than a rule, since a rule is what went wrong here. No behaviour change -- comments and test docblocks only. * fix(chat): bring the send button back to the draft's box, and drop the border and shadow with it The draft gives the send button the same 28x28 box as every other footer icon button and only promotes it with a fill and a pill radius: .composer .bar button { width: 28px; height: 28px; … } .composer .bar button svg { width: 16px; height: 16px; } .composer .bar .send { width: 28px; height: 28px; background: var(--text-strong); color: var(--bg); border-radius: var(--radius-pill); } Product shipped 36x36 with an 18px glyph, a 1px border and a --shadow-xs. None of that came from a decision about the send button -- it is the generic `button` + `.primary` primitive geometry in `styles/primitives.css`, never reconciled against the draft. The earlier stroke-icon pass saw it, called it "another matter", and deferred. This is that matter. It is also a gap the composer row's own "one control system" pass left open: that comment names Send among the controls to unify at 28px, and then the 28px selector list does not include it. So this closes a hole rather than opening an exception. Two things worth putting on the record. The executing pill inherits this box, so it goes 36 -> 28 too. The draft never draws an executing state at all -- three `.send` instances, all resting -- so nothing there argues either way. Both states moving together is the point: leave one at 36 and pressing send would resize the control under the cursor. 13px label in a 28px pill has room. Removing the border made four `border-color` declarations on the stop states dead -- there is no border box left to color. Removed rather than left as decoration that reads like it does something. The test had to read the border and shadow out of the stylesheet text rather than from getComputedStyle: jsdom rejects `border: var(--stroke-thin) solid var(--text-strong)` outright as an invalid shorthand and reports `none` whether or not the declaration is there, which is a vacuous assertion. That trap is written down in the test. * feat(codex): put the search row on screen when the search starts, not when it returns Product red line, verbatim: 「调用前(流式传输时)就要显示在界面上并开始计时, 绝对不能调用完了才出现在界面上」. Swept all four codex tool families against it. Three already comply -- command_execution, file_change and mcp_tool_call all emit at `item.started`, and their `item.completed` handlers are guarded no-ops. `web_search` was the only one that waited: its started branch consumed the frame and emitted nothing, so the row appeared only once the search came back. The reason it was written that way is still true, and it is a trap rather than a mistake: the started frame's `query` is genuinely empty, the query IS the row (`toolTitle` and `searchPattern` both read it), and emitting a `tool_use` there would trip the `codexToolUses` guard and make `item.completed` a no-op -- locking in a blank 「搜索」 row forever. `tool_in_flight` walks around that. It is a generic contract event, not an ACP-only one: it does not touch `codexToolUses`, so the settled pair still lands with the real query, and the client retires the early row into the settled one by shared id. One row, one clock, and the term fills itself in. This is the same shape the ACP family already uses, where `tool_use` is likewise emitted at terminal. Sizing it honestly: there is no `web_search` in the 179 local recordings, so that is not evidence. The nearest measurable call of the same class is claude's `WebFetch` at 7.42s. Seconds, not milliseconds -- which is exactly the blank screen the red line is about. The clock goes in `stampToolTiming` rather than the parser, because the parser is pure and that gateway already owns "fill the timestamp if it is missing" for all 27 adapters. ACP's own `firstSeenAt` is left alone. The id has to be the one `JSON.parse` leaves after codex serialises `id` twice per frame -- the `exec-…` value, not `item_2`. Both frames resolve to the same one, which is what lets the early row retire instead of drawing a second search row. The old test asserted the opposite behaviour. Rewritten rather than deleted, carrying its original reasoning forward, since that reasoning is what dictated using `tool_in_flight` instead of `tool_use`. * test(chat): prove the codex search row survives the trip to the screen The daemon-side test only showed the event leaves the parser. That is half a chain: the event could be emitted correctly and still be ignored downstream, or drawn as two rows. This walks it to the row. Three things it pins: with only the early form on the wire there is already a row and its clock reads 4.0s, not 0 -- "a row exists" and "that row is timing" are different claims and only asserting the first would pass with a dead stopwatch; once the settled pair lands there is still exactly one row; and that row carries the real query, which the early form never had. Worth recording how the first version of this test went wrong, because it looked exactly like a broken fix: fed straight into buildTurnBlocks it drew two rows and no query. The retirement step (`dropSupersededInFlightToolUses`) runs in AssistantMessage, before buildTurnBlocks -- so the test had bypassed the very mechanism the fix relies on, and was measuring a path production never takes. The last case turns that mistake into a guard: skip the retirement step and you get two rows with an empty one first. So if anyone later calls buildTurnBlocks from somewhere new, they are told what they left out instead of shipping a duplicated row. No removal verification on this one, and it should not be claimed: it covers existing web behaviour against a new event shape, so there is no new implementation here to take away. * fix(chat): actually shrink the send button -- the earlier change lost the cascade The previous commit set `.composer-send` to 28px in chat.css and its test went green. On screen nothing moved. `styles/viewer/routines.css` sets the same button to 36px through `.app .composer-send`, which is (0,2,0) against chat.css's (0,1,0) and is also imported later in index.css -- both tiebreaks favour the file nobody edited. Measured in a real browser before touching anything: getBoundingClientRect() returned 36 x 36. Worse than a no-op, in fact -- the icon had dropped to 16px because that is a React prop rather than CSS, so the button was shipping a 16px glyph in a 36px box, matching neither the draft nor what it replaced. The test could not have caught this. It injected only chat.css, so the rule that wins was never in the document -- it excluded the defect from the measurement and then reported a pass. It now loads chat.css and routines.css in index.css order and adds `.app` to the body, and it was confirmed red at 36px before the fix, which is the only reason to trust it green now. routines.css carries a note at the winning rule saying both files govern this button, so the next person to change its geometry does not repeat this. Cost of the box change: the executing pill inherits the height, so it moves 36 -> 28 with the button. The draft has no executing state at all -- three `.send` instances, all resting -- so nothing there decides it. Moving both together is what matters, otherwise pressing send resizes the control under the cursor. Verified after the fix in the same browser: 28 x 28, 16px icon, transparent border, no shadow. * docs(spec): the upgrade card has no dismiss, and record why the ticket says otherwise OPEND-2597's acceptance text asks for "dismiss, then stop prompting for this session". The product read that back today and said it looks wrong -- it should keep showing. Recording the ruling with the reason it is not a close call. That sentence is a dialog-shaped requirement applied to a card. What ships is an inline card in the conversation flow, not a modal: ChatPane says so at the call site, on a 2026-08-26 ruling that a warning you can continue past gets a card and not a dialog, and it does not block sending. It also contradicts T41 head-on, which is the part that settles it. Hiding the card does not change the balance -- the next run still dies on money, and now nothing on screen says why. That empty screen is the exact hole T41 exists to close. And there is nothing to be spared from: the card sits in the flow and scrolls away with the content, so it was never in the way to begin with. * fix(chat): keep Add-to-chat with the selection while scrolling, instead of hiding it Reported: 「选中文本后,"添加到对话"按钮怎么一滚动就消失了? 消失不会再显示吗?」 Both halves were true. Any real scroll called hideBar(), and the only thing wired to bring it back was `selectionchange` -- which scrolling does not fire. This was a deliberate decision with a test pinning it, not a slip. It came from OPEND-2541: the bar is `position: fixed`, so an un-recomputed bar stays put and becomes a ghost pointing at nothing. Hiding it was the fix chosen then. The draft settles which behaviour is right. At 729fa43ce7, components.css:3136 anchors the bar to the selection itself -- `.sel { position: relative }` + `.selbar { position: absolute }` -- so it follows content for free and can never go stale. Following is the drawn behaviour; hiding was an artefact of our `fixed` positioning that got mistaken for a rule. The ghost is still prevented, by re-anchoring every frame rather than by disappearing. Two things had to change together. The scroll handler now re-renders from the geometry it already measured instead of hiding. And concealing no longer clears `geometryRef` -- that was the second half of the bug: the handler bails on `!previous`, so the first hide made every later scroll a no-op and nothing short of a fresh selection could recover. `selectionOnScreen` keeps the half of the old behaviour that was right: once the selection is off screen the bar must go, or edge-clamping parks it on the panel rim over unrelated prose. It measures the selection's whole span, not its first rect, so a selection taller than the viewport still counts as visible when only its middle is on screen. That span logic arrived untested -- honestly self-reported -- and every existing case in this area exercises the degenerate union-rect fallback where first === last, which cannot tell min/max from either endpoint. Added two cases driving real multi-rect `getClientRects()`, and confirmed they are load-bearing: narrowing the helper to `firstRect` alone turns the tall- selection case red. Removal-verified twice over: reverting the component returns the original three failures, and stubbing `selectionOnScreen` to `true` alone reddens the hide/restore pair. The prior test asserting 「关闭,并等待下一次 selectionchange 才重新出现」 is rewritten rather than deleted, carrying its OPEND-2541 reasoning forward, and now also asserts the bar moves by exactly the scroll delta -- "still present" alone would pass for the very ghost that ticket was about. * fix(chat): three reported defects, and one my own last fix introduced Four agents worked these in parallel; I verified every claim before landing. **Media artifact cards (OPEND-2598, OPEND-2608).** One cause, and it is not about media or about retry. `produced_files_json` has exactly one writer in the whole repo -- the browser, computing it inside ProjectView's SSE `onDone` closure and PUTting it back. Leaving the project, or merely switching conversations, aborts the controller; the AbortError path returns without calling any handler, so `onDone` never runs. The daemon still promotes the row to succeeded -- publishing the terminal state while withholding the artifact association that terminal state was supposed to carry. On return the replay path refuses past the five-minute anti-loop window, so the card is unreachable for good. The three null columns are the signature: `upsertMessage` writes `producedFiles ? JSON.stringify(...) : null` and `[]` is truthy, so null means no terminal write ever happened rather than "the diff came back empty". The daemon now writes a floor at the run-terminal chokepoint: one idempotent UPDATE guarded on the column still being null. A floor, not a verdict -- the client sees the pre-turn snapshot and the daemon does not, so the client stays authoritative. It fills only `producedFiles`, leaving the delivery-verification path exactly as it was. Proven at the daemon HTTP boundary with the client deliberately never played, and end-to-end on a real runtime with real claude and nothing but curl -- on HEAD that column can only be written by a client PUT, so its presence is the proof. **Memory (OPEND-2606, OPEND-2607).** The settings page was more optimistic than the daemon: one green master toggle bound to `enabled` alone, while `chatExtractionEnabled` sat false behind a second tab -- and a failed config read painted every switch on. Both now derive from one invariant, that the screen never claims more than the daemon confirmed, with a config we could not read claiming nothing. The memory card existed and matched the draft already; what was missing was anything that produced it. The prompt describes memory the model *applied*, not memory it *wrote*, so a turn that grew the store 22 -> 25 correctly showed nothing. Extraction finishes after the turn ends, so there is no run event left to hang a card on; a bounded poll on the turn's falling edge resolves the written ids to names and emits one host-authored message, which persists and survives reload. Deliberately not a second EventSource -- the toast already holds the one connection this surface can afford. **And one of mine.** `selectionOnScreen`, from the Add-to-chat scroll fix an hour ago, decided visibility by overlapping the selection with the panel -- which silently assumed the panel is measurable. When its rect has no height, the overlap is false for every selection and the bar never appears at all. That is treating "not measured" as "measured false", and it turned up as one red in the full web suite: a scroll-following test that mocks the selection rect and not the panel's. An unmeasurable panel is no longer evidence, with the case pinned so it does not come back. Verified centrally after all four landed: root typecheck, guard, daemon build (server.ts is @ts-nocheck, so its build is the only real check), and the full web suite -- 10,232 passing, no failures. * feat(chat): a batch of visual directions is four, not six Product ruling 2026-09-04 on OPEND-2584: 「VISUAL_STYLE_BATCH_SIZE 先改成 4 吧」. The previous 6 came from a 2026-08-27 ruling about how 「换一批」 walks the catalogue. Recording at the constant why this is NOT "matching the draft", because that reading would be wrong and would come back: chat-panel-feedback.md carries an earlier and blunter ruling that names this very card -- the counts in the draft are mock data, and 「不能因为稿子是 4 张就不做「看全部」」. So four is a number the product picked again, not a spec derived from the drawing. 「换一批」 is untouched; a batch is simply two cards smaller. Six tests were pinned to six. Where a number was really about the batch, it now derives from the constant instead of being written out again -- the keep-two case asserts `BATCH_SIZE - keep.length` rather than 4. Where the number is genuinely independent, it is recomputed and the arithmetic is shown: walking 22 catalogue entries four at a time needs six batches, so 「连点四下」 became 「连点五下」. Two fixtures had to move rather than be renumbered. The stale-entry case fed a six-long previous batch; it now feeds four, keeping its shape of two retired plus two surviving. And the B53 gallery test clicked 「Premium pitch」, the catalogue's fifth entry -- inside a batch of six, outside a batch of four, so the helper simply could not find it. It now clicks the fourth, which still proves the point that matters (what is spread out is this batch, not the whole catalogue) without depending on the batch being any particular size. * fix: four reported defects, one of which no test could have caught Four agents in parallel; I verified each claim before landing. Root typecheck clean, 8,116 web tests passing. **OPEND-2597 — the upgrade CTA sent paying team-Max owners to buy what they already own.** The branch that decides where Upgrade leads reads two bits: plan tier, and whether the viewer can manage billing. The audience bit was truthful. The tier bit was not: `/api/workspace/context` hard-codes `planId: null`, because that context is assembled from vela's workspace directory rows, which carry no plan field at all — and ProjectView passed only that context to the branch, so it was the sole tier source. Every user on the project page therefore resolved to below-Max, and the auto-recharge destination was unreachable in production. Home was never affected; it already passes the projected billing summary, which is exactly what ProjectView now does too. Worth stating why the tests were no help: all of them inject `planId` directly onto the context — the one field production never populates. The suite was green against a shape that does not occur. **OPEND-2588 — a batch turn opened one tab, not all of them.** The ruling was 「打开全部产物 —— 是全部的**主要**产物」, and that qualifier turned out to matter more than the count. The ranking function does three jobs, not two: is this an artifact, which *kind* is this turn's deliverable, and which one of the equally-ranked winners. Only the third is overturned. Opening everything that passed the artifact filter would have let a plan.md take a tab beside index.html — widening the criterion, which the ruling explicitly rules out. That also answers the 16-image worry from OPEND-2571: that turn produces 16 images plus an HTML file, HTML outranks media, so it still opens exactly one tab. A flood needs a turn with 16 media files and nothing higher-ranked. No cap was invented for it. **OPEND-2585 — nineteen seconds of blank screen on batch upload.** First render snapshotted the uploaded server paths out of sessionStorage, and that key is only written after the last upload answers — so the creation gate had to hold until uploads finished, and upload duration was paint duration. The paths are genuinely needed, but by the send, not by the paint: the gate now releases once the project row is persisted, a small handoff module parks the picked files and owns their object URLs, and auto-send reads server paths at dispatch time instead of at mount. Each URL is revoked when its file's server path lands, with a sweep for failures. **OPEND-2500 — next-step guidance after a deck.** Not reproducible: a real deck generation emitted all three markers and rendered them in the design's shape. It also closed the long-open "audit five prompt paths" question — there are not five composers, there is one, and it is not conditioned on project kind. Proven observationally rather than by reading: the accepted markers had to carry that run's nonce, which only this run's prompt could have shown the model. Two agents declined work honestly and both were right to. One wrote a test, found its metric was blind — the assertion's precondition never fires in that harness — and deleted it rather than keep a green reading that proves nothing, flagging that area as unverified. The other skipped `git show HEAD:… > …` for removal verification because peers had uncommitted work in the same files, and neutered its own logic in place instead. * fix(media): associate a generated file that lands after its run has ended The floor added earlier only covers files present in the run's own filesystem diff. A media generation often is not: `od media generate` polls for 25s and exits 0 with "still running" past that, nothing awaits the in-flight promise at run end, and video or long audio routinely take longer. The bytes arrive after the snapshot. (OPEND-2609, and the half of OPEND-2608 left open.) That ordering is asserted, not assumed: the test checks the output file does not exist on disk at the instant `runStatus` flips to succeeded, and that assertion held on every run, red and green. The second finding changed the fix's shape. The client misses the late file too — `onDone` computes produced files against the daemon's artifact paths at that same instant, then persists the result, so the column ends up non-NULL and wrong, usually `[]`, which is truthy. A NULL-guarded floor could never have closed 2609, whose whole shape is a user who IS watching: the audio plays in their project pane. So this had to add rather than backfill. No linkage was invented. `media_tasks.run_id` already comes from the tool-token grant and `messages.run_id` is already on the assistant row; one select bridges them. The association is emitted by the media task, after the wait-notify so `od media wait` latency is untouched, because the task is the only party that knows the bytes landed — the terminal chokepoint by definition cannot. It stays a floor. It only ever prepends, so every client entry survives verbatim and a re-run is a no-op. And it stands aside while the run is still live: a task completing mid-run must not write the column, or the terminal floor reads it as client-owned and drops everything else that turn produced. That was a regression I introduced and the removal check caught — neutering the gate turns exactly that case red. Two guards were deleted for being redundant under the rule. A compare-and-set was a second belt over the post-await re-read; with no await between the read and the update, nothing in this single-threaded daemon can interleave, so it only ever fired when the re-read was already broken. A capacity cap was unreachable and protected against nothing — one entry per completed task. The constraint that makes the re-read sufficient is now written at the statement, so nobody adds an await there later. Known and not closed: a late file still gets no `message_artifacts` ref row. Its bytes are already frozen by the existing snapshot hook, but attaching that snapshot additively needs a different store API than `replaceMessageArtifacts`. The card renders from producedFiles, so the reported symptom is closed; the immutable-preview half is not, and deserves its own change. Also: my previous commit swept in this test's 289-line draft. This is the finished 550-line version with all four cases. * fix(prompts): tell each runtime the name of the plan tool it actually has A user asked, in as many words, 「先用 todo 进行一轮规划」. The agent planned — and wrote the seven-item plan as body text. The turn made three tool calls and none was a plan tool. So it was not disobedience; the plan went out through the wrong channel. Two sentences in our own prompts sent it there. The slim charter said: if the runtime supports task lists use one, **otherwise provide a numbered plan in your response**. That asks the model to self-assess whether it has such a tool, and hands it a sanctioned prose branch for when it decides it does not. Prose was the compliant reading. And it had no way to decide correctly, because the note naming the tool was gated on the Claude stream format. Codex received no tool name at all. The gate's own comment asserted the premise that made this look fine — that codex, opencode and the ACP agents have no such tool. They do: codex has `update_plan`, opencode has `todowrite`, and the daemon already translates both into the canonical TodoWrite the Todos card renders. The wiring was never the problem; nobody told the model the tool existed. So each runtime is now told its own tool's real name, in the sentence shape the Claude note already used. Claude's note is returned by the same constant and is byte-identical. The charter is untouched, so its size ceiling is unaffected; the cost is a couple of hundred bytes on codex and opencode runs, which previously paid nothing. A second prose escape hatch turned up next door: the bundled todo-write atom, which `ensureCoreQualityStages` puts on every pipeline that writes a design artifact, said the agent may use "TodoWrite (Claude Code) or an in-prompt list" — naming a tool codex lacks and reopening the branch, in the same prompt. It now points at whatever plan tool the session exposes. That is not the site this incident hit (the conversation carried no plugin snapshot) and the test says so, to stop it being mistaken for the root cause later. What the new test proves is narrow and stated as such: that the composed prompt names that runtime's real tool. Whether the model then calls it is not something a unit test can pin. One assertion does check wiring — for opencode, whose parser forwards the tool name unchanged, the named tool must satisfy the canonical predicate, since naming one it rejects would render the plan as an ordinary tool row: the same invisible plan, one layer down. Two runtimes were deliberately left out. mimo and the ACP family are structurally capable, but I have no verified tool name for them, and guessing from family resemblance is precisely what the Claude Code 2.1 rename punished. A recorded trace per agent would settle it. No prose-scraping fallback, and it would have been the wrong answer: it would have manufactured a card from a plan the agent never emitted, and hidden this defect instead of surfacing it. * fix(chat): stop a reloaded OD Next task from gluing its runs into one turn Three things the user saw at once after leaving for Settings and coming back: the previous turn's 「已确认」 summary sitting inside the current turn, two 「思考过程」 blocks in a row, and raw markdown. They are not one bug. **The turn-gluing is real, and the trigger is the reload.** That conversation is one OD Next task with three runs, and `strategyTaskRunIndex` has exactly one writer in the repo — the history GET. Nothing on the live SSE path sets it, so the fold that joins runs into one turn only happens once rows come back from `listMessages`, which is precisely what a remount does. Live it never folds; after Settings it does. The fold concatenates N runs' events into one flat list, and the block builder was written for one run: one `doneSeen` latch, one done key, one shell. Run 0 ends with a `<question-form>`, which trips implicit-done, so every later run's text was appended to run 0's still-open prose block and every later tool piled into run 0's shell. That single 2048-char block is the 「已确认」 summary glued to two later answers; the merged shell is the doubled 「思考过程」. The daemon already mints one `done_key` per run and sends it before any model output, so a second one in a stream *is* a run boundary — no contract change needed. At each boundary the ending run gets its conclusion lifted (run 1 emits no done marker, so its answer would otherwise stay buried in the shell) and its shell settled, then the per-run state resets. The invariant is that folding is a view-level join: the folded turn's blocks equal the runs' blocks concatenated. **The raw markdown is not this bug, and is by design.** The only raw `**` and backticks in either path are inside the execution shell, which renders plain text on purpose — the conclusion outside the shell is the part that goes through markdown. Markdown counts are conserved across the fold and no heading renders raw. That matches the user's later screenshot, where markdown was correct while 已确认 was still misplaced. If it recurs it is a separate fault. **The stray dot in 「搜索 . 14 处」 is independent and pre-existing.** A bare `ls` with no positional argument resolves to the literal `.`, and the search row prints it as the target. Present live too. Left for its own change. Also landing here, two rulings from the same session: The first thinking cell no longer reports elapsed. Its number is derived by filling the gap before it, and for the turn's first thought that gap starts at the turn start — the same anchor the shell header uses, so the two showed the same figure one line apart. Later thoughts fill a gap between tool calls and keep theirs. Suppressed at the render layer so the datum stays available to the header and drawer sums that depend on it. And an ACP turn that has produced nothing for sixty seconds now says 「等待首批输出中」 instead of an empty shell. This corrects my own brief: I sent that agent after `waiting_for_first_output`, which turns out to be emitted only by the ACP bridge — Claude never sends it, so the chain I described was not the reported problem. Rendering both cases showed the real gap: the header's clock was never missing, and 「在等什么」 is answered by 「思考中」 for Claude and by nothing at all for ACP. Gated so it can never replace 「思考中」 or revive the withdrawn mid-turn silence hint. Two translations of that key are wrong now that it has its first reader: `tr` says "first input" where it means output, and `th` reads oddly. Not fixed here. * fix(chat): render markdown inside the shell, and stop the reveal corrupting text Product overruled the split that kept shell text plain: 「谁说按纯文本画不是 bug 的?? 都要 markdown 啊」. Narration, thinking paragraphs and abandonment reasons now render markdown like the conclusion always has. The hard part was never the markdown call, it was the per-character reveal sitting on top of it. Its docblock reasoned that attaching to the last `<p>` is safe because a new paragraph is a new element that starts revealing from its own beginning — true only while the block is a flat list of paragraphs. In a markdown tree an element's identity changes as text arrives: `#` renders as a paragraph and one character later `## S` is a heading. The reveal keys its state by element, so every flip dropped what had been shown and replayed text the reader had already read. So it no longer keys on the last block at all. One stable wrapper hosts the whole tree, which is what the thinking lane already does — and is strictly more correct than before, because the reveal already walks the subtree's text nodes in document order across node boundaries. It never needed a per-paragraph host; it needed one that outlives the content. Partial syntax stays visible mid-stream — `**bo`, `**bold`, then bold. The alternative, plain while streaming and markdown once settled, is worse: it replaces every text node at once, so a whole block flashes instead of two stray asterisks. The thinking lane has always rendered this way, so a second policy would be the new inconsistency. **And the streaming test caught a bug we already ship.** `restore()` decided "React has not overwritten this node" by comparing the node's value against the truncated prefix. When a markdown token closes, React's new value often IS exactly that prefix, so the guard misfired and pasted the stale tail back: `先看一下**规` became `先看一下**规规格`, permanently, because React then believes the node is already correct and never writes again. Reproduced with the reveal and the renderer alone, no shell component involved — which is the shape the thinking lane uses today, so **this is live on main** and corrupts transcripts whenever a throttled snapshot lands with a token closing on the truncation boundary. A string comparison cannot distinguish "I truncated this" from "React just wrote it", so it stops guessing: a per-host MutationObserver reports which text nodes React rewrote since the last drain, and those are never restored. No signature change, so the thinking lane gets the fix without knowing about it. Also landing here, three carried-over defects called in by the user: A bare `ls` no longer reports the literal `.` as its search target. The draft has exactly one search row in the whole file and it holds a real term; it draws no directory listing at all, so nothing there sanctioned a placeholder. `.` was not a modest stand-in either — the row renders the pattern inside a file button, so the user saw a dot styled as something clickable. This file states the rule twice already ("don't guess a target", "don't fabricate a clickable file"); that `|| '.'` was the one place breaking it. `rg --files` without a glob had the same fabrication. Turkish said "waiting for first *input*" for a key that reports output — inverted meaning, now fixed. Thai is worse than the "awkward" it was reported as (no word for output at all, and theatrical register), but diagnosing a translation and being able to write one are different things, so it is left for a native speaker with two candidate phrasings recorded. And the OD Next path now carries the plan-tool note. My own brief named the wrong site: the early return in `composeSystemPrompt` is never reached in production, so the fix as briefed would have been dead code. It went into the per-run context block instead, which covers both composers — deliberately not the cache-stable head, where a per-runtime sentence would split the prompt-cache prefix for every task sharing a strategy version. Costs 263 bytes on codex, 0.4% of that turn's prompt assets, and nothing at all for runtimes with no verified tool name. Mirror gallery rebuilt: the shell's DOM changed from sibling paragraphs to one wrapper per narration block, so the comparison page was stale. * feat(chat): 思考中显示实时 token 计数 思考行右侧显示上下箭头 + token 读数,数字随流实时变化。取数走 Claude stream 自带的 thinking_tokens,不是估算 —— 之前仓库里那句「estimated_tokens 走不通」的结论是在看不见系统帧的前提下量的,而系统帧没进日志是因为 handleObject 把它们丢了。 显示规则按产品口径:token 有变化就显示 token,长时间不变才退回计时; 第一段 thinking 永远显示 token;刷新页面时读数不从零涨上来。 - 契约新增 thinking_tokens SSE 事件与 ExecutionShell 的 thinkingTokens 字段 - hasVisibleBrandAssistantEvent 补上 thinking_tokens / artifact_focus 两支: 只带着读数的一轮仍然是空的,它描述这轮花了多少,不是这轮说了什么 - historical-turn-baseline.json 重刷:唯一差异是壳上多了恒为 null 的 thinkingTokens 字段,结构/分张/行归属都没动 - 顺带:zh-CN/zh-TW 队列引导措辞统一为「引导」 * fix(web): 发送后先上屏再做余额预检 (OPEND-2614) 点发送到消息上屏之间只有一个 await:OpenDesign Cloud 的余额预检,而它坐在 setMessages 上面。预检对工作区身份已解析的项目会打两个并行请求,其中 /api/workspace/billing 带 freshness=authoritative,强制一次 Vela 上游读, 不吃缓存 —— 1~2 秒的空窗全在这里,不在渲染。 改成先画后判:用户消息和「进行中」占位先上屏,预检仍在落库和 POST /api/runs 之前结算。被拦截时把画出去的这一轮收回(retractPaintedTurn,三条拒绝路径共用 的同一个漏斗)并照旧进发送队列。收回用的是上屏那一刻的快照而不是按 id 过滤: 重试时画出的数组里含着原有的用户消息和保留的失败尝试,按 id 拼不回来。 两个自己引入的坑一并处理: - setChatSeed(null) 是 ChatPane 的 React key,留在闸门后面等于「先上屏, 1~2 秒后再把面板拆了重建」,会亲手制造 OPEND-2615。与上屏同批。 - 预检窗口内第一次能按到停止了。加了流式标记检查,但不收回 —— 停止本身 已经结算了这一轮,收回会删掉用户自己的消息。 OPEND-2615 不成立:已由 d287845f0e 修复(把钉住的平滑动画去掉)。把那一行 还原回去,chat-anchor-to-top 立刻红 4 条,其中「回复迟迟不来的那一轮」报 scrollTop 4200 vs 3988 —— 正是工单描述的「顶出屏幕」。建议引用该 commit 关单。 * fix(daemon): 机器离线时给出网络卡片和重试按钮 离线机器发起的请求死在 DNS 解析,不是 socket 被重置。 clientEnvironmentFailureDetail 认得 ECONNREFUSED / ENETUNREACH,却不认 ENOTFOUND / EAI_AGAIN / EHOSTUNREACH / getaddrinfo —— 于是这一类掉进最后的 兜底桶:AGENT_EXECUTION_FAILED、retryable:false、正文是 CLI 的生英文, 卡片上只有〔联系支持〕〔导出日志〕,没有重试。用户只能重打一遍 prompt。 run-error-catalog 的 R-054 早就记了这条(「fetch failed 无 cause → stream_error」),一直没人关。 把判据提成具名的 ENDPOINT_NEVER_REACHED_RE,并在注释里写清「解析失败」和 「连接被重置」是同一个原因的两种说法。与 agent 无关,codex/opencode 同样受益。 修后同样的输入:卡片从「任务执行失败」变成「网络环境不对/网络连不上」, 多出〔去设置〕〔重试〕,恢复端点后点重试 2 秒内重跑成功。 * test(web): 队列引导措辞守卫、问题卡描述换行、Plane 工单证据留档 * fix(codex): 让 codex 重新用上原生计划工具,并接上它的推理 token 读数 codex 0.153.0 出厂就是 `tools.update_plan.enabled = false`,于是计划变成了正文 里的散文。真机 A/B(argv 与 daemon 完全一致、同一句 prompt):不带这个开关 `turn/plan/updated` 是 0 帧,带上是 4 帧。两条传输都补上 `-c tools.update_plan.enabled=true`,无条件加,理由同 `codexReasoningSummaryArgs` —— 条件化会动到前缀缓存。 洗清一个此前的误判:失败那条 run 的 `promptTelemetry` 里逐字含有 「Your plan tool is `update_plan`」,模型被告知了名字仍然没调;而 `planToolNoteForRuntime` 从未进过任何发布版,所以「beta .7 还好的」那个包里 codex 是靠自己调的。根因在 CLI,不在我们的 prompt。 推理 token 走 `total.reasoningOutputTokens`(24 次读数 0 次回落),不是 `last` —— 后者是**每次 API 调用**的量,一轮中途会归零。normalize.ts 里把它称作 per-turn 的那句注释是错的,一并改掉。 token↔计时的切换加迟滞,两个门槛统一 20 秒(产品 2026-09-04 拍板)。同一段真实 语料下:单门限 8 秒会翻 38 次;20/20 与 45/20 都是 8 次,而 20 秒在真卡住时早 25 秒接管,所以取 20。claude 的帧密得多(p50 1.4s),20 秒对它从不触发,翻面 仍是 0 次。两个常量故意保留成两个,以后要按 runtime 拆开只需改数。 * fix(chat): 给早期工具行一个真的起点,别让秒表从「参数流完」才起算 早期行本来就有:参数 JSON 一边流,`tool-input-path-scanner` 一边扫,路径可确定 就发 `tool_input_target`,之后按 512 字符节流报行数。缺的是**时间原点** —— 这个事件不带 `startedAt`,而 `stampToolTiming` 只给 `tool_use` / `tool_in_flight` / `tool_result` 盖戳。 两个后果: - `Edit` / `MultiEdit` / `NotebookEdit` / `replace` **只发** `tool_input_target` (改动量在流中途算不出来,`tool_input_progress` 永远不发),这几类的行带着 文件名、秒表是死的。 - 归并时早行没有起点可传给落定行,落定行只好退回「参数流完那一刻」当原点, 整段流式跨度凭空消失 —— 这就是用户看到的那个 `0.1s`。 改成发 `content_block_start` 的时刻,和 `tool_input_progress` 报的是同一个 不可移动的原点。 证据不是读代码:真跑 claude 2.1.260 写了一个 27,458 字节的页面,逐帧打时间戳 再回放进真实解析器 —— 路径在 +25.5s 就可确定,落定 `tool_use` 在 +121.8s, 本可提前 96.3 秒上屏。 `w115` 那条防参数外泄的守卫把事件的键集钉死了,白名单放开 `startedAt` 的同时 加了 `typeof === 'number'`,守卫仍然证明没有参数字节逃出 daemon。 * fix(web): 升级卡念对钱包,并拆掉会把它永久静音的那颗开关 (OPEND-2597) **念错钱包。** 补查走的是 `/api/integrations/vela/wallet`,那条路由请求里没有 任何 workspace 参数 —— 它是右上角那颗账号读数。而发送前的闸门为同一笔钱专门走 `/api/workspace/billing?scope=workspace&freshness=authoritative`,两处注释都点名 不许回落到账号钱包。后果不是数字略有出入:团队钱包 $0、个人账号还有 $12.50 时, 卡会用橙色说「余额可能撑不完下一个任务」,而真相是「现在无法开始新任务」,且他 把个人钱包充满也救不了这个团队。 顺带修了 3 条钉住缺陷的旧测试:项目放在团队工作区却只 stub 账号钱包,正是生产 不会出现的形状。补的是被后端证明过的真实夹具,不是放宽断言。 **拆掉低余额「不再提醒」。** 首页那张弹窗勾选后写 `open-design:amr-low-balance-warn-optout:v1`,而项目页发送前闸门的 soft 档读的 是同一个位,读到就返回 `allow` —— 用户以为关的是首页那个弹窗,实际把项目页的 升级卡也永久静音了。与「升级卡不该有关闭态,余额条件成立就一直在」的裁决直接 冲突(产品 2026-09-04:「拆掉吧」)。 影响面限于 soft 档(硬拦从来不受这个位约束)和发送前那道闸门(跑到一半那条路 不读它)。已经写进用户机器的那个键成为死数据,不做迁移 —— 全仓无任何遥测/诊断/ 设置页在读它,而一次性清理要挑时机、要处理 localStorage 抛异常,还会留一段永远 跑不掉的死代码。 **阈值维持 $2**(产品 2026-09-04:「然后是 $2」)。工单与交付稿里的「额度 < 5 美金」作废;`chat-panel-edge-audit.md` 里那条「$2 → $5 待产品同意」随之关闭, 理由是它会放大触发面。 * feat(chat): 读数自己数上去,记录卡在 done 标记到达时就收起 **读数不再跳变。** 产品原话「token 最好也有个增长的过程,而不是直接从 100 跳到 200」。一天里这条需求改了三次方法:先是「要滚动」,看到实物后「太花哨了,自然 一点」,最后给了止损授权「实在不行就不要动画了,直接数字自增的那种就行,自增 的单位可以随机一些」。落在最后一版:**没有任何 CSS 动画**,只有数字自己往上走。 中间那版(每一位一条 0–9 字带 + transition)整个删掉了,组件、样式、测试一并 清干净,没留下名不副实的守卫。删的理由记在 `CountingNumber.tsx` 头上,免得有人 再加回来:199→200 时个位和十位要**倒着**滚过 9 格、百位正着滚 1 格,方向相反、 距离差 9 倍,而变化最频繁的恰恰是最闹的那一位 —— 这不是调参能解决的。 步长 `remaining / stepsLeft` 自适应(差 40 走大步、差 3 走小步)再乘 0.6–1.4 的 抖动,最后一步精确补齐。**永远不过冲** —— 屏幕上任何时刻都不会出现比已收到读数 更大的数。目标回落(新一段 thinking)直接落定,倒着数等于替 agent 说「它想少了」。 400ms 的预算不是凭手感:上限由上游帧率定,claude 的 `thinking_tokens` p50 是 1.4s(400ms 约占 29%),数不完就追不上真值,屏幕上就是个落后的假数。 **收起提前到 done 标记。** 判据是两个信号相与:共享契约的 `eventsHaveAuthenticatedDoneConclusion`,以及那之后有非空正文块。只用后者会让 隐式 done(`<question-form>` / `<artifact>` —— 那是 `buildTurnBlocks` 内部的 分块判断,不是产品说的 done 标记)也把壳收掉,`stream-cursor-removed` 当场红: `deferCollapsedBodies` 会在收起时把身子丢掉,正文整个从 DOM 里消失。 手动展开不受影响 —— `userToggled` 那个闩本来就靠比对开关值区分自动与手动。 顺带撤掉了收起动画那段 `::details-content` 网格:产品要的是**时机**,没要动画, 而它是这次改动里唯一动到壳身子格式化上下文的东西(`.body` 变成 `overflow:hidden` 包装下的网格项),而里面还嵌着一个限高滚动盒。零成本嫌疑, 先摘掉。 * fix(chat): 封面晚到时把产物卡换成快照,别把整个会话留在活 iframe 上 规格 §4.1 写死了:HTML / prototype / **slide** / document 的卡面只渲染 `<img>` 快照,不再挂该文件的 iframe。用户看到 deck 是活的,不是因为快照没做, 而是**输了 466 毫秒**。 真机数据:打包版里 `opendesign-seed-pitch.html` 的 `capture_state` 就是 `ready`、缩略图字节也在。但 ref 落库 17:13:05、封面 ready 17:13:06 —— 间隔 616ms,而客户端只在 run 终止后 **150ms** 重拉一次(`scheduleConversationMessage Refresh`),之后再也不拉,`cover.ts` 也不推任何东西。于是卡片在整个会话里停在 §6.4 的降级支上,直到整页刷新。 这正是规格第 505 行规定却从未实现的那半句:「pending thumbnail 不出 placeholder,直接走降级支;**后台 ready 后消息投影更新**」。 封面**故意不 await**(「一轮对话不该为了一张缩略图多等几秒」),所以补的是推送 而不是等待:daemon 在 `attachChatArtifactThumbnail` 之后发一个**瘦事件** (只有 projectId / conversationId / messageId,不带 refs),web 收到后复用现有 重拉。让 `listMessages` 仍然是「ref 是什么」的唯一权威 —— 事件重复或丢失最多 多一次 fetch,不会画错卡。降级支原样保留。 红测钉的是**时序**,不是分支:既有用例全都直接把 `artifactRefs` 当 prop 注入, 所以分支一直是对的、时序从没被测过。daemon 侧刻意在 run 已终止之后才订阅 (真实用户处境),先断言此刻 ref 还不是 ready 再放行渲染;web 侧先断言是 iframe 且没有 img,投递事件后断言换成 img 且 iframe 消失,另加一条反向控制 ——别的 projectId 的事件不得触发重拉,否则「见事件就重拉」也能蒙混过关。 顺手拦下一个真 bug:`projectEventToAgentEvent` 是一条**结尾没有守卫的收窄链**, 排除已知类型后直接假定剩下的是 `live_artifact_refresh` 并读 `evt.phase`。新事件 加进联合后会掉进去,变成一张 phase 为 undefined 的假 live-artifact 卡。 * fix(collab): 别把 daemon 已确认的个人项目当成共享只读 (OPEND-2624) `sharedReadOnly` 里的 `unknownStatusReadOnly` 是一条 fail-closed 且**没有出口** 的判据。`statusUnknown` 的条件是 `syncState === null`,而 `CollabClient.get()` 对任何非 2xx 直接 throw、`pollStatus` 吞掉异常 —— 所以 `/collab/status` 只要对 这一个项目持续失败,`syncState` 就永远停在 null。 唯一的解药 `knownUnshared` 读 `cachedTeamProjects(context)`,而那个缓存的 key 含 `role`。实测两个端点的 role 不一致:`/api/workspace/context` 给 `owner` (目录里的真实角色),而 `/api/projects/:id/workspace-scope` 是 `project-workspace-scope.ts:65` **硬编码的 `member`**。两个 key 不同 ⇒ **只要你是 workspace 的 owner/admin,这个缓存必然 miss**,历史上加过的两条 「别 fail-closed」补丁对 owner 全部失效,一次 status 失败就是永久只读: 聊天、新建、上传、编辑、导出全灭。 「为什么同工作区其他个人项目正常」也是这条解释的:缓存 key 不匹配是工作区级的, 但只有在 status 失败时才致命 —— 其他项目 status 正常返回 local_only 就没事。 改法是给判据一个出口:daemon 已经确认这个项目是 `personal` 时,让它压过一次 拿不到的 `/collab/status`。这不是新规则 —— `ProjectWorkspaceScope.visibility` 的契约注释原文就是「visibility answers whether the project itself is a private draft or shared with the team」,而 `materializePulledTeamMirror` 对每一个拉下来 的 team mirror 都写 `visibility: 'team'`,所以本机的 `personal` 严格意味着 「这台 daemon 没有任何记录说它是谁的共享项目」。daemon 的写闸读的正是这一行, 所以这是让 UI 的只读闸和执行闸用同一个权威。工作区级冻结和 materializationPending 两条保守路径原样未动。 红测的夹具把壳层 context(owner)和项目 context(member)**拆开**喂 —— 既有的 `use-project-collab.context-seed.test.tsx` 用同一个 `role: 'member'` 对象喂进去, 所以它天然看不见这个缺陷。403 响应体是从跑着的 daemon 上 curl 实测抄来的。 * fix(chat): 历史内容一挂载就是落定态,不再重播一遍逐字显示 `useCharReveal` 没有「这个宿主刚挂载」这个概念:新宿主一律算 `shown = 0`, 于是 **DOM 里已经有的东西全被当成刚到达的字符**,切成 `.rv` 片段排进动画预算。 触发路径不是边角情况,是默认的「先问后做」流程:`foldStrategyTaskTurns` 把两个 物理 run 折成一条 assistant 消息(run 0 发表单、用户答、run 1 干活);run 1 还在 跑时整条消息的 `runStatus` 是 `running`,`isAssistantMessageStreaming` 因此返回 true;这个窗口里任何一次重挂载,正文块就带着 run 0 的全部历史进场,整个重播。 刷新页面和从设置页返回(`chatSeed` 翻转导致 ChatPane 换 key)各是这条的一半。 `markHistoryReplayLanded` 永远抓不到它 —— 它只标 daemon 重推的增量,挂载时就 已经在 DOM 里的内容根本不走那条路。 判据钉在**首帧**:`.rv` 数为 0,且没有排任何一个等于 reveal 自身时长的 timer。 只断言「最终会显示完整」的测试在改动前就是绿的,钉不住任何东西。 ⚠️ 这条和 2026-08-27 的裁决(「不是真正流式的也保留一个流式效果」)在**唯一 可观测的那个形状上**正面冲突:「历史随宿主一起到达」和「非流式 agent 一次性 吐完、也随宿主一起到达」在 DOM 里逐字节相同,渲染层分不出来。这里执行较晚的 那条(挂载即落定),代价是非流式 agent 的一次性回答不再淡入。要两个都要,必须 由数据层告诉渲染层「这一段是刚到的」,那在 ProjectView 的 createBufferedTextUpdates ——已在文件头标注待拍板。 08-27 那批测试没有被静默删除:8 条「挂载时带内容、期望有 span」改写成「先挂载 再增长」,每条守的性质(预算上限、单位加厚、片段上限、不丢字符、空白不重复) 都还在测,并补了一条反向对照钉住「同一个字符串随宿主到达时现在是落定的」。 * fix(chat): 音视频生成不再画成生图,停掉的历史回合不再自称进行中 **OPEND-2625 音视频被画成生图。** `build-turn-blocks.ts` 里一行 `.filter(task => task.surface === 'image')` 把音频/视频任务**整条丢掉**, 不是「少画一行」而是导致画错:任务被丢掉后拿到空切片,退回解析命令输出, `total` 取 1,`line.mp3` 被塞进 `<img src>` —— 破图。引入者是媒体任务首次接线 那次(`bb4292e82b`),当时这一行只装得下图片。事实一直都在:daemon 的 `media_tasks` 记了 `surface`,路由逐字回传,命令行的 `--surface` 还是必填。 去掉 filter 之后三类任务混进一条全局队列会出新问题:daemon 的批本来按 surface 分组,而取批靠「连着同一个 batchId」认边界,两类批并行在飞时列表交错,游标撞到 第一条异类任务就停、该批剩下的格子永久取不到。所以不是加个 if,而是**每类一条 队列 + 各自游标** —— 纯生图会话的那条队列就是从前那份列表本身,行为逐字未变。 新增的 audio/video 文案与图标在规格里**一个字都没有**,是按工单的「预期」拟的, 待产品过目。D34 那条两形态切换的裁决没动,只在每一档里换文案/图标/单位。 **OPEND-2626 停掉的历史回合显示 Working、步骤回退成 Not started。** 终态其实是 对的:`end` 帧落盘了,`run_status` 也是 canceled,`buildTurnBlocks` 走到 `shell.stopped = true`。错在画这一层,两处各说了一句假话——壳头 `if (shell.stopped) return t('chat.record.running')` 写出「进行中」,和真在跑的 回合**逐字同一个词**;`markFor` 把 `stopped` 落回 `'pending'`,于是三个步骤全部 读成「未开始」。 为什么只有历史回合中招:唯一说实话的那句「已手动停止」在 AssistantFooter 上, 而它 `opacity: 0`,只有最后一轮或 hover 才现形(OPEND-2542)。发过后续消息之后 这一轮不再是最后一轮,那句话在鼠标划过去之前看不见 —— 屏幕上常驻的唯一陈述 就成了「Working 12m 8s」。 步骤记号的名字用「未完成 / Unfinished」而不是「已取消」,因为 `stopped` 有两个 来源:用户按了停止,以及轮次 succeeded 但 agent 收尾没再发一次清单 (`closeRunningSegments` 的原话:「我们只知道它没跑完就结束了,不知道它成没成」)。 对第二种写「已取消」是编一个没发生过的事实。实线圈区别于「从没开始」的虚线圈。 ⚠️ 这一条推翻了 `build-turn-blocks.ts` 里一条旧裁决(「手动停止不是第四态, 壳头仍写进行中」)。依据是那条裁决的前提已经不成立——它当时说「又和紧跟在下面 那行『已取消』自相矛盾」,而那行后来被 2542 改成 hover 才可见。**待产品追认。** 四条钉着旧裁决的既有用例逐条写了翻案理由后更新,没有静默改。 * fix(chat): 滑杆默认值不许越出模型自己声明的范围,轮播箭头不许盖住卡片 **OPEND-2622 声明 1–5 却提交 0。** 0 产生在 web 组件的「默认值进状态」这一条 路:`buildInitialState` 把模型给的 `defaultValue` 原样落进答案、**从不 clamp**, 而拖滑杆和敲数字两条路**都过** clamp。于是**人一旦动过控件值就合法,从头到尾 没动过的题反而是越界的**;屏幕上还同时摆着两份真相(数字框念 0、滑杆停在 1)。 序列化和解析器都是无辜的,它们如实转抄。 修的是「让模型的推荐值服从模型自己声明的范围」,用户自己写下的东西(提交历史、 恢复的草稿)一个字不动 —— 专门留了一例钉住「历史越界标量照原样念」,防止修过头。 撤掉实现复验时发现第三个调用点撤了仍全绿,补了「流式后到的题」一例才让三处都承重。 更根上一层没修:`core-slim.ts` 的 `<question-form>` 契约只列了 `range` 是合法 type,**整份契约从没提过 min/max/step**,而 §5 又要求模型给每道非视觉题一个 合理默认值 —— 等于让模型自由发挥数值、宿主照单全收。要根治得在契约层要求 range 题必须带 min/max,那是另一件事。 **OPEND-2633 轮播右箭头盖住卡片。** 我们自己错了两件: - **11px 被数了两遍**。稿子的 `.vnav { inset-inline: 11px }` 定位祖先是整张卡宽, 而我们的祖先 `.qf-visual-stage` 已经用 `margin-inline: 11px` 吃掉了这条 gutter, 里面又写一次 → 箭头往里挪 11px 扎进卡片区。讽刺的是代码注释自己写着「我们的 定位祖先已经正好是这一沓了」,然后还是按旧祖先写了 11px。 - **`z-index: 6` 是我们自己加的**,稿子的 `.vnav` 一条层叠都没写,`.vopt` 带 4/3/2/1 —— **稿子里是卡片盖箭头**,我们写 6 把关系反过来了。 改后重叠阈值从卡宽 360px 降到 338px。窄于 338px 仍会重叠,但此时按稿子的规矩 是卡片盖箭头而不是箭头切卡片。要在极窄栏彻底不碰得动 `--qf-fan-w`(我们 200px、 稿子 152px,是 2026-08-27 产品裁决横过来的),没动。 * fix(web): 接上前两条修复在 ProjectView 里的落点 这个文件同时是 `1bc480a340`(封面晚到换快照)和 `a17a22e32a`(个人项目被判只读) 的接线处,两条改动在这里没有重叠的 hunk,但**分开提交会让那两个 commit 各自 不完整** —— 前者少了收 SSE 事件后触发重拉的那一支,后者少了把 `projectVisibility` 传给 `useProjectCollab` 的那一行。合并成这一条补上,并在此 写明依赖关系,免得将来二分时把它们当成独立可回滚的点。 - 封面晚到:`handleProjectEvent` 新增分支,复用现有的会话消息重拉;配套一个 ref 破除 TDZ(重拉函数定义在 handler 之后)。 - 个人项目只读:从 `useProjectWorkspaceScope` 取 `projectVisibility` 传下去。 * test(daemon): 把「表单答完之后约束蒸发」这件事钉成红测(暂 skip,等产品裁决) OPEND-2623:用户明确写了 "Do not create or modify files",答完 Question Form 之后系统照样进生产、开始写文件,靠人手动 Stop 才没落盘。 查下来不是「prompt 里漏了一句」,而是**根本没有机制能表达「这一轮不产文件」**。 四道闸门各自单独就够让它落空: - 路由只有 `direct_edit` / `full_plan` 两个值,两条都以「必须有一个可运行入口 文件」收尾; - 计划契约里 `canonicalDeliverable` 是必填字段,「这次不产文件」序列化不出来; - 结局枚举没有「答完了、无需产出」这一档; - `plan_ready` 即自动发车,零条件。 更根上一层:决定要不要进这套编排的地方**压根不读用户说了什么**,只看项目的场景 画像。而 production 阶段实际发出去的 5,270 字节里**没有一个字是用户说的**。 产品其实有一个「不写文件」的载体(Ask 模式的 `CHAT_MODE_OVERRIDE`,措辞已写好), 但两头都断了:UI 入口被 B57 拿掉、Home 固定 design;而 OD Next 路径会把 `composeSystemPrompt` 整个换掉,那段 charter 从不组装。 六条红测分别钉住六个断点,**故意不去让它们变绿** —— 要绿必须先有产品裁决 (做成模式还是意图 / 契约要不要能表达「无交付物」/ 自动进生产要不要闸门), 自行选一种形状就是编产品规则。因此整个 describe 暂时 `.skip`,文件头写清了依据 和解封条件,CI 保持绿。 夹具字符串全部照抄打包版真机落盘的 `strategy_task_runs.final_text`。 顺带记一条:daemon 在四个调用点把 `nativeSessionResume: true` 写死,那是断言不是 校验 —— CLI 上下文被压缩后原话还在不在,从落盘数据看不出来。所以 production 阶段的模型可能连约束都不剩,这只会让结论更糟。 * fix(daemon): 一条 assistant 行只装一个 run 的流,别让后继 run 被吞进上一行 用户报「刚打开一个 project,对话里的结论重复了两遍」。不是画重了,是库里真有 两份:同一个 production run 的事件既写进了 clarification 那一行,又自己存成了 下一行。 ## 第二个写手是 web,不是 daemon - daemon 那侧 run 的 `state.json` 证明 production run 的 `assistantMessageId` 自始至终指向它自己那行,从没指向被污染的那行。 - 被污染那行第 239–1009 条里有 **341 个 `thinking_tokens`** —— 全仓 daemon 源码 搜这个词是**零命中**,唯一生产者是 web 的翻译层(还带客户端时钟的 `at`)。 - 同一条 usage,pos 4 带 `stopReason`(daemon 才加的),被污染那行里没有。 客户端为什么不换行:`consumeDaemonRun` 在任务链继续时**故意不换消息对象**, 三处 `onRunCreated` 把同一条消息重指到后继 run 并继续追加 —— 而契约注释 (`packages/contracts/src/sse/chat.ts` 约 446 行)写的是客户端应当只在**渲染时** 按 `strategyTaskRunIndex` 折叠、不该重指。 ## 现有守卫为什么没拦住 `mergeMessageWriteForDaemonBacked` 是按「**客户端声称的 runId**」判的。在真实 HTTP 边界上把五种形态各跑一遍(每种用一对全新的 daemon 托管行,互不污染): | PUT 形态 | 落盘? | |---|---| | runId=后继 run,runStatus=succeeded | 拦住 | | **runId 省略,runStatus=succeeded** | **落盘** | | **runId=本行自己的 run,runStatus=succeeded** | **落盘** | | runId=后继 run,runStatus=running | 拦住 | | runId 省略,runStatus 省略 | 拦住 | 只要 PUT 不点名后继 run、并附和本行已有的终态,整条后继流就能进来。 ## 改法 按 **payload 里装的是谁的流**判,不按客户端自称的身份判。新增 `payloadCarriesAnotherRowsRunStream()`:一条行的**第一个** done_key 才是它的 run 身份,后面的都是要拦的脏数据;再读同会话其他 assistant 行的自有 done_key 做比对。 不变式:**一条 daemon 托管的 assistant 行只装一个物理 run 的流;客户端写入无论 声称哪个 runId,都不许把兄弟行的 run 流塞进来。** 重试不受影响(重试是同一个 run、 同一个 key、同一行)。 放在服务端而不是客户端,是因为这样**连已经发出去的打包版客户端一起保护**。 ## 不是今天引入的 三个 run 的 `state.json` 里 `appVersionInfo` 是 `0.21.1-beta.7`,会话跑在 17:21–17:51, 而本分支当天那几个 commit 都晚于会话结束。更决定性的:同一个库里 **08-28 还有一例 一模一样的**(`7fd150ee`),那条记录 `appVersionInfo` 是 null,更老的包。 全库 165 条 assistant 行用五种判据各扫一遍(单行 ≥2 个 done_key / 同 key 出现在两行 / 前一条 content 以后一条结尾 / 单行 ≥2 个 run-start 帧 / 部分吞并),受害者都是这两条。 判据四多出的一条是「卡死后重试」,不是吞并 —— 它正好证明**数 start 帧会误伤重试**, 所以判据必须用 run 身份,不能数帧。 ## 两件没做 - **已损坏的两行不会自愈**,这个守卫只拦新的写入。产品 2026-09-05 拍板: 「新的不会就行,历史的先不管了」。 - **web 侧的根治没做**:任务链续跑后,客户端不该再往那条被折叠的消息里持久化, 折叠只该留在内存里给渲染用。服务端这道是最后一道闸,不是病根。 * fix(web): 从折叠回合分叉时,边界落在这一链的最后一条消息 用户在对话末尾 fork,fork 出来的会话只剩第一轮。库里坐实:原会话 position 0,1,2,3,4,两条 fork 都只有 0,1 —— 丢掉了用户填表单那条、澄清阶段的回复、 以及最终结论。 ## 根因:折叠复用了头一条消息的 id `foldStrategyTaskTurns` 把 OD Next 的 run 1..N 合进 `folded[headIndex]`,展开 `...head` 时**从没覆盖 `id`**。于是屏幕上那个气泡显示着三个 run 的正文,却挂着 **request run 的 id**。fork 按 id 切,daemon 忠实执行契约(「copy only source messages up to and including this message」),自然切在 position 1。 真实数据对得上: ``` task_run_index 0 request -> position 1 id home-auto-send-0qzyd9dzs8wn2-assistant task_run_index 1 clarification -> position 3 id 5ba87c0e-… task_run_index 2 production -> position 4 id odnext_assistant_26e1ba4b… ``` 折叠后是 `[u0, merged(id=position1 的 id), u2]`,而 u2(`[form answers…]`)被 `buildChatRenderItems` 藏起来 —— 所以屏幕上「对话末尾」就是那个合并气泡,它的 id 是 position 1 的。`slice(0, 2)` → 0,1。两条 fork 的 assistant 正文都是 1995 字, 正是 request run 那条。 ## 只影响 OD Next 的折叠链 没有 `strategyTaskRunIndex > 0` 时 `foldStrategyTaskTurns` 原样返回,普通单 run 会话点到的就是转录里那一条,不受影响。 还有一条时序:`strategyTaskRunIndex` **只由历史 GET 写入**,SSE 从不写。所以 **跑的过程中**分叉是好的,只有会话被重新拉过历史之后才出问题 —— 和现场吻合 (原会话 09-04 17:21,两次 fork 09-05 01:17,隔了 8 小时)。 CLI 的 `--fork-after <id>` 由操作者直接给、看不见折叠,不受影响。修在 UI, daemon / CLI 的契约保持「按 id 字面切」。 ## 改法 新增具名不变式 `forkBoundaryMessageIndex()`:点击的是折叠气泡时,边界要走到 **这一条逻辑回合在转录里的最后一条物理消息**,而不是它借来的那个头 id。 ## 同一处引起的第二个 bug,一并修掉 `forkFallbackMessage` 以前发的是**折叠后**的消息,正文是几个 run 拼在一起。走 「分叉点尚未持久化」那条路径时,daemon 会把这段拼接追加到已持久化的前缀之上 —— 同一段文字出现两遍。现在发的是边界那条转录消息。 ## 全库扫描 8 个库全扫(7 个打包版 namespace + 开发数据目录),受害者就是这两条 fork。 ⚠️ 扫的时候必须连 `-wal` 一起拷:`app.sqlite` 本体比现场旧 8 小时,**两条 fork 只存在于 WAL 里**。其余 6 个库根本没有 `strategy_task_runs` 表,结构上免疫。 ## 已知遗留(不在本次范围) fork 出来的消息 `run_id` 是 `undefined`(有意的,见 daemon 的 fork 播种代码), 因此永远拿不到 `strategyTaskExecutionId`。所以修好之后,fork 一个 Full Plan 回合 会得到**三个分开的气泡**而不是一个折叠回合 —— 内容完整,分组没复原。 另外同一个折叠 id 还被交给 `onSubmitQuestionForm` / `onAssistantFeedback` / `onContinueRemainingTasks`。**没有证据表明它们出错**,只是形状相同,单独跟。 * test(chat): 按 2026-09-05 的裁决更新输入区那几条判据 合并 main 时产品拍板:项目输入区取 main 的 #7635 / OPEND-2553,本分支按交付稿 `729fa43ce7` 做的那一版作废。下面三个文件里 6 条判据跟着翻面,每条都在原处写清 了「被哪条裁决作废、依据是什么」,没有静默改数字。 **w134 发送键几何** —— 28×28 / 图标 16 → **32×32 / 图标 32**。 ⚠️ 是 32,不是我先前转述的 36。`viewer/routines.css` 里 `.app .composer-send` 先声明 36px,但同一个文件更后面的规则把它压到 32 —— **只读源码会读成 36**,把 两份样式表按 `index.css` 顺序装进来量才是 32。这正是这个文件存在的理由: 2026-09-03 有一轮只改了 `chat.css` 那半边,测试绿了而真浏览器一动没动。那套 「两份样式表一起装再问 getComputedStyle」的机制原样保留,只有数字换了。 32 也和 main 自己的注释自洽:运行态「共用每一行,底.svg 就是这个盒子把箭头 拿掉」—— 发送和运行是同一个 32 方框,不是两档。 **w126 字形** —— 发送键 `ChatSendArrowIcon` → `Icon arrow-up-fill 32`;plus 菜单 的 else 分支(首页)`Icon plus` → `Icon attach`(main 把首页那颗触发器从「+」 改成了回形针)。**聊天面板那一侧全都没动**:`ChatPlusIcon`、`strokeGlyph`、 `ComposerPaletteIcon` 三条判据原样通过 —— 这也是我确认「红的是首页那一半、 不是回归」的依据。 **两条我改的是查法,不是数字**(它们的夹具其实没过时): - **w73 那颗 `+` 的类名**:main 改成了条件拼接 (`triggerLabel ? ' --labeled' : ' od-tooltip'`),按整段字面量搜源码就对不上 了。但聊天面板不传 label,**运行时拼出来仍然是 `icon-btn plus-menu__trigger od-tooltip`** —— 手搭的夹具是对的,过时的是查法。改成分别钉「基础类名还在」 和「不带标签时挂 od-tooltip 这条分支还在」。 - **w126 菜单条目的加号**:main 加了加载态,单行变多行 (`name={attachLoading ? 'spinner' : 'plus'}`)。按整段字面量匹配等于在钉排版, 改成钉真正要守的:仍是共享 Icon 的 plus、仍是 15、仍挂 `plus-menu__item-icon`。 全量:web 1,038 文件 / 10,513 测试 0 失败。 * feat(observability): 聊天区滚动被冻住时自动上报现场 把「聊天区滚不动」从**只能靠用户报障**变成**卡住那一刻自己上报**。只观测,不自愈。 ## 为什么需要它 这个缺陷已经完全刻画、但**触发条件未知**:合成器手里那份最大可滚距离被冻在某个 早期值,再也不刷新。布局是对的(`scrollHeight=2347 / clientHeight=583`),程序 赋值是对的(`scrollTop=1700` 生效、`99999` 正确夹到 1764),**只有真实输入那条路 错** —— 12 下滚轮请求 1440px 只走到 91,从 800 滚一下瞬间弹回 91。内容变三倍、 改 clientHeight、换光标位置,上限都还是 91。 `583 + 91 = 674` 不是巧合:那正是内容 674px 那一刻的正确上限,也就是说合成器的 拷贝在助手消息长到约 516px 时冻住了。唯一能治好的是销毁重建布局盒。 原始坏现场在排查过程中被销毁,复现要从头来 —— 所以先把观测埋下去。 ## 判据:JS 读不到合成器的边界,但读得到症状 写成纯函数吃三个数字,不碰 DOM: - **wheel_stall**:向下滚轮 + 按 layout 还有空间(> 24px)+ 连续 4 次、累计请求 ≥ 240px 而 `scrollTop` 一动不动 - **wheel_snap_back**:向下滚轮之后 `scrollTop` 反而倒退 ≥ 8px(就是 800 → 91 那一幕),一次即可 上报前还要确认**滚轮目标到 chat-log 之间没有任何还能滚的内层盒子** —— 这条 先前是手工排除的「滚动链」,现在由代码自己排除。 ## 上报里带什么(价值不在「发现卡住」,在把现场固定下来) - `compositor_content_px` = 观察到的天花板 + 视口 —— 这次就是 **674**,和 `layout_content_px`(2347)一比就知道冻在哪一刻 - 最近 20 条几何转变的环形缓冲,尤其**「不可滚 → 可滚」那一次**(合成器在那一刻 新建滚动节点,是头号嫌疑时机),外加 `content_px_at_scrollable_on` —— 它和 `compositor_content_px` 相等就说明「滚动节点一出生边界就是错的」 - 挂载时 vs 冻结时的层数差、祖先链的 transform/filter/contain - 是否流式、有没有 question-form 骨架屏、Chromium/Electron 版本 ## 零成本 两个监听器都是 capture + passive;**回调里一行布局都不读**(读 `scrollHeight` 会强制重排,那正是要检测的卡顿本身),几何读取全在 `requestAnimationFrame` 里、 一帧最多一次;滚动驱动的采样限到 250ms 一次(流式贴底每帧都发 scroll 事件); 层普查每个 chat-log 只跑两次(挂载时塞进 `requestIdleCallback`、冻结时);内层 滚动盒排查只在准备上报那一刻跑一次。每个元素只报一次,每会话上限 3 条。 更要紧的是**没找到聊天区时、以及全 app 其它地方滚动时的开销**,这里收紧了三处: - **滚轮监听在找到聊天区之后就从 window 搬到元素本身**。挂在 window 上是为了 「发现」,一旦发现就没必要再听全局 —— `detach()`(切会话、卸载)时才重新武装。 于是页面上别处的滚轮**一个回调都不进**。 - **scroll 的热路径是一次身份比较**。全 app 每一次滚动都会打到这个 capture 监听器上,所以不匹配就立刻返回:没有取时钟、没有分配、没有排任何东西。 - **拿不到 `requestIdleCallback` 就不做层普查**,而不是退化成内联或 `setTimeout`。 这个回调要对最多 600 个元素调 `getComputedStyle`,而它是从 scroll 处理器里 发起的 —— 退化成内联,等于在**首次滚动**时同步解析 600 个元素的样式,正好是 本模块声称不会造成的那种卡顿。`layer_count_at_attach` 因此**缺失而不是昂贵**, 这是对的取舍。 拆卸也补齐了:`detach()` 会取消在飞的 rAF 与 idle 回调、摘掉元素上的滚轮监听、 断开 `ResizeObserver`,不留悬挂引用。 ## 刻意不做自愈 `display:none → flex` 能治好它,但没加:会闪、会丢滚动位置,而且**会把我们要找的 触发条件抹掉**。要不要自愈是产品决定,标待拍板。 这条不是靠注释守的 —— 变异测试里**故意加了自愈代码**(改 display + 写 scrollTop),「never writes to the DOM」当场变红。 ## 红测 19 条,先红(模块不存在)→ 绿 → **8 个变异逐个撤掉实现再红**:判据、snap_back 分支、只报一次、到底保护、转变记录、内层滚动盒排除、切会话重新发现,以及上面 那条反向的自愈守卫。 ⚠️ 只有真机能确认的部分(报告里已标明,单测假装不了):真实冻结时 `scrollTop` 是否真的一帧不动、4 格/240px 这两个阈值对真实触控板是否合适、层普查的数字在 真实 DOM 上是否有意义、以及事件确实发得出去。 ## 已知盲点(没顺手补) - `run_id` / `conversation_id` 为空:`chat-context.ts` 的 `setChatCorrelation` 全 app 零调用(`chat-health.ts` / `chat-protocol.ts` 也都没接线),接起来是 独立一件事 - 流式状态用的是 DOM 启发式(`[data-streaming="true"]`),不是 run 生命周期,同上 - 用户停在半中间且没有自动贴底时,内容变高不发 scroll 事件,那段 `content_grew` 可能漏记 —— 要补得上 MutationObserver,流式期间是真实开销 - 只覆盖主聊天流水,思考区那个 96px 内层框不在范围内 ## 三条守卫测试 上面三处收紧各配一条,并逐条撤实现验红(一一对应,只红自己那条): - 聊天区以外的 scroll / wheel **什么都不排** - 浏览器说不出自己空闲时,挂载**不遍历子树** - 卸载时取消在飞任务并放开元素 * feat(observability): 记下滚动卡住那一刻,界面上还有谁在动 真机探针抓到一次现场,推翻了原来的模型 —— 于是这次补的不是「卡住时的快照」, 而是**亏空是从哪一次内容变化开始出现的**,以及**当时周围各个模块在干嘛**。 ## 现场怎么推翻了「一诞生就冻住」 用户客户端上的被动探针记下了一次 `wheel_snap_back`: 天花板 824 layoutMax 851 scrollHeight 1434 / clientHeight 583 合成器认为的内容高度 1407,布局是 1434,差 27px 连续几轮滚动扫描里,够不着的量**单调增长**、天花板**单调下降**: 第78轮 到851 差0 第79轮 到850 差1 第80轮 到846 差5 第81轮 到842 差9 第82轮 到839 差12 第83轮 到824 差27 不是一次性冻死,是**每次内容变化都少跟一点,亏空累积**。之前见过的天花板 91 (差 1673px)是同一机制掉到底的极端形态,不是另一种缺陷。 而且**冻结那一刻界面上什么特殊东西都没有**:没有 thinking、没有工具行、 没有 question-form、没有错误卡、没有 iframe、没有内层滚动盒,只有一条用户消息 和一条 1188px 高的助手消息。**question-form 骨架屏那条猜测就此排除。** ## 亏空账本(这次的重点) 每一次 `scrollHeight` 变化都**不过滤**地记一条,配上当次的 `layoutMax` 和**是哪个子节点长高了、长了多少**(只在内容高度真的变了的那一帧,读最后 32 个 直接子节点的 `offsetHeight`,而且是在已经读过 `scrollHeight` 的同一次 rAF 里 顺带做完,不额外触发重排)。角色分 `assistant_msg` / `user_msg` / `tail_spacer`。 每一次「向下滚轮但没能前进」记一轮天花板探测。**第一次出现 reached < layoutMax 的那一轮被永久钉住,永不被后来的挤掉** —— 上报里因此能直接指出亏空是从哪一次 内容变化开始的,而不只是「卡住时差多少」。另外记了 `tail_spacer_px`:钉顶机制的 占位块是等量置换,它归零那一刻正是内容开始真涨的时刻。 回放测试直接吃上面那串真实数字(851→850→846→842→839→824,layoutMax 恒为 851), 断言报告把 850 那一轮、内容 1434px 处认成亏空的起点。 ## 并行活动环形缓冲(64 条,满了丢最旧) 兄弟节点挂卸、底部浮层里的胶囊替换、**「回到最新」按钮点亮/熄灭**、日志与祖先链的 class/style 变动、动画与过渡的起止、流式翻转、标签页可见性、日志与其 offsetParent 的尺寸变化,以及作为锚点的「滚动节点诞生」。 上报里给三个切片:全量轨迹、**滚动节点诞生前后 ±500ms**、冻结前 2 秒,外加 `jump_active_at_attach` / `jump_first_active_ms` / `jump_active_vs_scroll_node_ms` —— 「回到最新」只可能在聊天区变可滚之后才出现,它相对滚动节点诞生的先后与毫秒差 是当前头号嫌疑,值得单独拎出来。 ## 成本 变动与动画回调里:两次 `getAttribute` + 一次枚举查表 + 写一个环形槽位。 **零布局读、零调度** —— 这条由测试钉着,往回调里塞一次 `scrollHeight` 当场变红。 帧里最多多读 32 个 `offsetHeight`,且只在内容高度真的动了时才读。 `detach()` 负责拆干净:2 个 MutationObserver、1 个额外 ResizeObserver、 4 个外壳监听器、1 个 document 监听器。 **两样判断为太贵、明说不加**(而不是偷偷塞进去):`.chat-log` 的 subtree childList —— 所以 question-form / 骨架屏**消失**不会被记(出现能通过 `anim_start:skeleton` 看到);以及逐帧轮询标记。 ## 红测 52 条,**33 处逐个撤实现验红**:环形缓冲、每个观察器与监听器、每处拆卸调用、 往变动回调里注入布局读,以及账本这边的增长配对、首次亏空的钉住与不可覆盖、 1px 下限、淘汰、连跑合并、天花板探测、不过滤的内容步、子节点归因、内容变化门、 每个 surface 的账本隔离、角色区分。 ## 只有真机能确认的部分(单测假装不了) - 任何一条活动记录**是否真的与漂移相关** —— jsdom 没有合成器,测试只能证明管路通, 永远证明不了因果。 - 时间戳精度:变动记录自己不带时间,是在微任务派发时打的戳(即造成变动那个任务的 末尾)。同一批内顺序保留、时间戳相同。`jump_active_vs_scroll_node_ms` 还继承了 滚动采样 250ms 节流的量化误差,小于 250ms 的差值只有方向意义。 - jsdom 没有 `ResizeObserver` 和 `AnimationEvent`:`log_resize` / `host_resize` 和 真实的 offsetParent 解析在这里测不到,`anim_*` 靠合成事件驱动。 ## 已知盲点 `MIN_UNREACHABLE_PX` 仍是 24,没动。所以早期漂移(差1、差5)只有在**最终真的发出 一次上报**时才会随报告一起送达;漂移到 12px 就停住的 surface 什么都不发。 要不要把这道门槛调低,是检测灵敏度的产品决定,标待拍板。 * fix(chat): 回合成功却挂红色失败卡 —— 别让服务端的沉默抹掉策略判决 用户在 dogfood 包上撞到:agent 完整回答了问题(明确要求「只输出文字、不要 创建文件」),消息上标着「已完成」,**下面同时挂着一张红色的「任务执行失败」**。 ## 不是 agent 没照做 那一轮 run 本身是成功的:`status: succeeded`、`exitCode: 0`、`error: null`, events 里零错误。被判失败的只有协议层 —— OD Next 要求每条回复带一个 Runtime State 块,而这一轮什么都不产,于是策略任务落成 `blocked`, 原因码 `od_next_protocol_runtime_state_missing`。 把 request 阶段允许的三种声明逐个喂给这条纯文字回答,**全部 blocked**: `clarification_required` 缺表单、`plan_ready` 缺 Plan Contract、 `direct_edit + completed` 缺产物。契约里没有「答完了,没有要交付的东西」 这一档 —— 那是策略层的缺口(别的 module 的 OPEND-2589),这里不碰。 ## 这里修的是显示成泛化红卡这一半 分支上**已经有**对症的卡片(`amr-guidance.ts:901` 的「回复已收到,但没能 记录下来」,19 语齐全),但它永远画不出来:约 150ms 后拉消息列表对齐时, 服务端那一行把本地判决整个盖掉了。 工单说只丢了 `runStatus`。**实际两样都丢**:daemon 落库 29 条事件(其中 14 条 是客户端从来不造的 `diagnostic`),客户端手里只有 9 条, `local.events.length > server.events.length` 不成立 → 服务端事件整体胜出 → error 事件被一起抹掉。这正好解释了为什么用户看到的是**泛化红卡**而不是 「什么都没有」:error 事件还在的话 `isRecoveredAssistantRunError` 会把面板级 报错整个吞掉、一张卡都不出。**所以只补 `runStatus` 修不好。** ## 守的是什么 不是「本地 failed 压过服务端 succeeded」—— daemon 记 succeeded 是对的, 失败的是策略任务不是 run。守的是: > 服务端那一行只带进程状态,**根本没有字段能表达策略判决**; > 它的沉默不是对本地判决的更正,不该被当成更正用。 见证收得很窄,四条同时成立才生效:本地被 daemon 终态投影盖过 `strategyTaskBlocked`、本地已判 failed、两边是**同一个 runId**、 本地有 error 事件而服务端没有。 另一个方向(让 `isRetryableAssistantTerminalFailure` 直接认 `strategyTaskBlocked`)试过并否掉:会让「blocked 但已交付」那一路凭空冒出 一张无码的泛化红卡,是回归。测试里留了这条反向对照。 ## 顺带修好 OPEND-2422 「阻断错误卡缺少重试按钮」是同一处根因的下游 —— `ChatPane.tsx:4063` 整个 动作组挂在 `runFailureUi` 上,它为空时一颗按钮都画不出来。 ## 红测 8 条,先红后绿(实现未动时 4 红)。三段实现各撤一次验红: - 撤「保留 `strategyTaskBlocked`」→ 原因码消失、连续两次对齐掉回 succeeded - 撤「保留 `runStatus`」→ 上面两条 + 整张卡变 null + 找不到重试按钮 - 撤「追加 error 事件」→ 卡出得来但退回泛化文案 没有一段撤掉仍绿。 ## 只有真机能确认的 **刷新之后专用卡不会回来** —— 刷新后客户端没有本地副本,服务端仍然只给 succeeded + 无 error 事件,一张卡都不出。泛化红卡确实消失了,但专用卡是 会话内的。要做成持久的得让 daemon 把 blocked 判决投到消息行上(契约里 `strategyTaskBlocked` / `strategyTaskBlockedText` 早就有、从来没人写)—— **那是产品规则,待拍板。** * fix(observability): 冻结上报被裁切的盒子吞掉了 —— 顺带把探针变成可问的 真机上发生过一次够不着 1493px 的滚动冻结,远超上报阈值,**PostHog 上一条 `client_chat_scroll_frozen` 都没有**。管道是活的(同一条 `reportSafetyEvent` 路径的 `client_long_task` 两百万条、`client_resource_error` 七千条都在到达), 安装也执行了(和 `installLongTaskObserver` 在同一个数组里)。 **为什么没报,是能从代码直接看出来的。** ## 裁切盒被误判成「能吃掉滚轮的内层盒」 `countAbsorbingScrollers` 判断滚轮是否被内层盒吸收时,只看 `scrollHeight - clientHeight > 1`,**从不读 `overflow`**。于是一个 `overflow: hidden`、内容被裁掉的盒子在它眼里就是「可滚内层盒」→ 抑制上报, **并且清零连击计数**。 而聊天记录里这种盒子遍地都是,是设计的一部分: - `.msg.user .user-text-txt` —— `-webkit-line-clamp: 6; overflow: hidden`, **每一条长用户消息** - 折叠代码块 `max-height: 7em; overflow: hidden` - 折叠手风琴、`.action-card`、`.question-form`、`.live-code-box`… 这和证据形状严丝合缝:唯一一次**成功上报**的现场,正是一个没有 thinking、 没有工具行、没有 question-form、没有代码块的会话 —— 没有东西可吸收。 判据改成两件事同时成立:几何上还有向下余量,**且** computed `overflowY ∈ {auto, scroll, overlay}`。顺序刻意是先几何后 computed style: 几何在刚读过 `scrollHeight` 的干净布局上取,祖先链上绝大多数盒子一步否掉, `getComputedStyle` 只有真正溢出的那几个才付费。 `overflow-x` 没有特判,**是刻意的**:CSS Overflow 3 规定 `overflow-x: auto` + `overflow-y: visible` 在计算值阶段会把 `visible` 强制成 `auto`,那个盒子**真的**是竖直滚动端口。自己去读 `overflow-x` 再推「横向专用」 反而会和浏览器行为矛盾。真正只能横滚的写法 computed 就是 `hidden`,自然排除。 同一段逻辑在诊断面 `scanAbsorbingScrollers` 里有**第二份拷贝**,一并合成一份 —— 只修门不修镜子的话,以后在真机上敲 `snapshot()` 会看到一屏被裁切的用户 消息被列成「抑制源」,运维会得出和我们一模一样的错误结论,而这个把手存在的 全部意义就是避免那个结论。 ## 运行时把手 `window.__chatScrollFreeze` 诊断模块自己不可观测,是这次查不动的直接原因 —— 没法问它「attach 了吗? 攒了多少?为什么没报?」。 - `why()` 一句话给判决:`blocked_by=inner_scroller_free` - `snapshot()` 给全部:几何(**读取那一刻的**,另存一份帧回调的陈旧拷贝以便 看漂移)、攒着的滚轮、亏空账本、并行活动轨迹、「回到最新」的时间关系、 以及**十二道闸逐条的 `{ 当前值, 需要值 }`** - `writes.enable()` 打开 `scrollTop` 写入拦截(带调用栈),**默认关**, 复用仓库已有的 `open-design:` 键约定;还原时逐字节还原原始描述符, 且全有或全无 —— 任何一个成员拒绝替换就整个回滚 **不调用时零开销**:安装只多一次对象发布和一次 `localStorage.getItem`, 没有监听器、没有定时器、没有帧、没有几何读。测试钉着这一点:调用 20 次, `addEventListener` / `setTimeout` / `requestAnimationFrame` 全部零调用。 `snapshot()` 自己是昂贵的(强制重排、走最多 400 个后代)—— 那是对的, 它只在有人在看的时候跑。 ## 阈值 24 → 8 真机那次漂移**从 1px 开始**长到 27(0→1→5→9→12→27),24 的门槛把前五轮 全丢掉;漂移到 12px 就停住的场景什么都不发。取整误差实测 ±0.5px,8 在噪声 地板一个量级之上;而且它只在「连续 4 格向下、累计请求 ≥240px 却没动」之后 才被查。 **这个阈值此前零测试覆盖** —— 现在补了三条(12px 漂移会报、1px 取整仍判 「已到底」、snap-back 仍要求真实亏空)。 ## 撤实现验红 把手侧 33 处逐个撤、全部变红;吸收判据两个方向各撤一次:换成只剩几何 (等于修复前)红 3 条,直接 `return false`(抑制机制整个没了)红 4 条 —— 后者证明反向测试真的看得见「把抑制修没了」。 ## 待拍板(没动) 连击计数在「位移 ≠ 0」时清零。用真机那串序列实测,**那一次并没有被它挡住** (第六轮单步掉 15px,走 snap-back 报了);但存在一条窄带:每轮都动 1–7px 且永不稳定时,两条上报路都不触发,天花板一路掉到用户明显够不到底也不会报。 流式持续增高时这是合理场景。「向下挪了 3px 而 1493px 够不着」算不算健康, 是产品判断。 * feat(daemon): 按原始时间线 1:1 回放一条录下来的 run 排查滚动冻结时反复撞到同一堵墙:**它只在真实使用中偶发**,225 次合成试验、 540 轮真实滚轮扫描,全是零复现。而内容增长的**真实节奏**很可能就是触发条件 的一部分 —— 合成页面永远造不出那个节奏。 打包客户端的数据目录里躺着 109 条真实 run、147,782 条事件、5.8 小时录像, 每条事件都带 `timestamp`。**这就是现成的语料,而且回放它零 token。** ## 只替换 agent 子进程,下游全部是真产品 回放挂在 daemon 自己的 run 启动器上,替换的**只有事件的来源**;每一条录下来 的记录都交给活路径同一个 `emit()` / `finish()`。持久化、到 `run.clients` 的 SSE 扇出、run 分析、终态对账、前端消费 `GET /api/runs/:id/events` —— 全部 原封不动,而且不知情。 时间从记录自己的 `timestamp` 还原(daemon 在原始 `emit()` 时的墙钟)。记录 按**单一单调原点**排程,而不是逐个间隔 sleep —— 否则几千条下来会累积定时器 自身的过冲;目标时刻已经过去的记录在同一 tick 内冲刷掉,原始那些亚毫秒突发 (41% 的间隔是 0ms)本来也是这么上线的。 ## 保真度(实测,两层) **时间线**(run 8f451ad3,756 事件 / 374 秒):756/756 帧全达,与录像的时间 误差 p25=3ms、**p50=4ms**、p75=9ms、p99=87ms、max=114ms;总跨度 374462ms vs 录像 374378ms —— **6.2 分钟累计漂移 +84ms(0.02%)**。 **内容**(run 25e62d4b,过真实 UI):回读出来的助手消息与录像**逐字节相同** ——正文 2033/2033、思考 14298/14298;工具事件对得上;`<question-form>` 在 聊天里渲染成了真实的表单。 **没有证明的**:回放与**原始**的 DOM 几何一致 —— 原始会话没人录过 `.chat-log` 的 `scrollHeight`,没有基线可比。只能声称事件时间线近乎精确、 内容完全精确。 ## 只在环境变量下武装,默认完全惰性 OD_REPLAY_EVENTS 指向一份录下来的 events.jsonl OD_REPLAY_DIR `<runId>/events.jsonl` 的目录;下一轮放哪一份写在 同级的 `.selected` 指针文件里,每条 run 现读,不缓存 —— 一个 daemon 不用重启就能换任意录像 OD_REPLAY_SPEED 墙钟倍率,默认 1 OD_REPLAY_MAX_GAP_MS 空闲间隔的钳位,默认 0 = 不钳 不设 `OD_REPLAY_EVENTS` / `OD_REPLAY_DIR` 时这段代码一行都不跑。 * fix(chat): 思考想完之后,把头一格的耗时还回来 用户原话:「即使是第一个 thinking,思考过程中不显示耗时,**但结束还是要显示的吧?**」 以及确认现象:「现在思考耗时好像只有第一次的 thinking 没显示耗时?」 ## 那一格为什么会两头落空 思考行右边只有**一个槽**,规则是「有实时 token 就写 token,没有才写耗时」。 而 2026-09-04 的裁决把**整轮头一格**的耗时压掉了,理由写在 `specs/current/chat-panel-feedback.md:876`: > 头一格没有计时可让(今天刚因「与壳头重复」收走),所以那一格**恒为 token**。 这个前提在两处塌陷: - **AMR 从来就没有实时 token** —— 全仓 `thinking_tokens` 只有 claude 和 codex 两个 生产者,ACP 那条路一个都没有(实测 25 条 amr run 出现 0 次)。「恒为 token」对它 从来不成立。 - **claude 收尾之后 token 也没了** —— tokens 只挂给还在流的那一格 (`group-thinking.ts:106` 的 `if (live)`)。 于是槽里既没有 token 也没有耗时,渲染成一个**空的 `<span>` 占着布局** (`Foldable.tsx:135` 判的是 `!= null`,而 `''` 不是 `null`)。 ## 「与壳头重复」这个理由在收尾后自己消失 跑着时壳头和头一格同起同终(`build-turn-blocks.ts:1501` 的 `isFirst` 分支 + `:1509` 的 `running ? nowMs`),确实是同一个数;收尾后壳头被 `isLast` 推到 `endedAtMs` 变成**整轮**跨度,而头一格只覆盖到第一件带时刻的事,**两个数不再相等**。 ## 改动 一行: const elapsed = muted && live ? '' : formatElapsed(elapsedMs); `live` 核实过是**逐格**的,不是整轮:`groupThinking` 只给队尾那一格置位,含义是 「模型此刻正在往**这一格**里写」。这正是要的开关 —— 它同时驱动那一格的视觉形态 (转球 +「思考中」↔ 脑图标 +「思考过程」)和 React key,所以**耗时出现在那一格 翻成完成态的同一帧**,结构上不可能在还写着「思考中」时漏出来。用整轮 `running` 反而会让两者错拍:格子已经写「思考过程」,槽却还空着好几分钟。 「还在跑的数会不会等于壳头」这条也是关的:非时刻项落在思考之后时 `closeThink` 的 `ownsGap` 会作废整段 → `elapsedMs` 为 null → **连槽都不出**,不是空槽。 ## 既有判据逐条处置(不是删,是判) 两个文件把「当年的现状」钉成了预期。逐条分:守「**进行中**不显示」的**原样保留**, 守「**收尾后**也不显示」的**更新并写明前提为何失效**。 有一条**拒绝转绿**:`amr-thinking-slot-blank.test.tsx` 里那条断言 AMR 头一格必须 有字的用例,它的夹具**是 live 的** —— 断言它非空等于断言「思考进行中显示耗时」, 和裁决直接冲突。改成守卫,并记下 AMR 缺 token 的真因在 ACP 不产 `thinking_tokens`(daemon/协议层),**在渲染层拿耗时去顶 token 的位置就是自造规则**。 ## 撤实现验红(两个方向) - 撤掉修复(`muted && live` → `muted`):**14 红**,正是「想完之后要有数」那一组 - 改成完全不压(去掉 `muted`):**5 红**,正是「进行中不显示」那些守卫 两个方向都咬得住,说明既没修漏也没修过头。`tests/components/chat/` 187 文件 / 1543 测试全绿。 ## 只有真机能确认的 1. **收尾后那两个数的实际差值没量过** —— 整条裁决建立在「不再相等」上,而这是读 代码推的。真机上典型 run 如果第一件工具调用就在开头一两秒,两个数看起来还是会 很像,产品可能仍然认为重复。 2. **AMR 可能仍然什么都不显示。** 夹具是手喂 `elapsedMs` 的;ACP 那条路上这一格的 耗时只有在后续事件带可用时刻时才存在,若 ACP 工具事件没有 `startedAt`, `ownsGap` 会作废整段、**连槽都不出**。**在对用户说「AMR 修好了」之前,必须真跑 一轮 AMR 看。** 3. 转场那一帧的观感(数字与图标同帧出现是干净还是突兀)jsdom 看不到。 4. 交付稿只画了 `thinking-live`,**没有画「思考结束」这一态** —— 视觉处理仍待产品过目。 顺带在 `chat-panel-feedback.md` 那条 2026-09-04 记录后面追加了带日期的更正, 因为那句「恒为 token」是这个前提的共享记录,留着会误导下一个人。 * fix(chat): 模型跑不起来时,把 daemon 已经算出的病因和处方露出来 用户跑 codex 撞到:壳头「运行失败 13s」,底下一张泛化卡「这次没能顺利完成」, 只有〔联系支持〕〔导出日志〕。**连是哪个模型不行都没说。** 而 daemon 那一侧其实全算出来了: error.code AGENT_EXECUTION_FAILED failureCategory model_unavailable failureDetail cli_version_incompatible failureAction switch_model retryable false 上游原句:`The 'gpt-6-astra' model requires a newer version of Codex.` ## 为什么露不出来 「模型不可用」那张卡(19 语齐全,带〔更换模型〕按钮)**挂在错误码上** —— `AMR_MODEL_UNAVAILABLE`。AMR 是我们自己的后端,错误从产生到消费都在手里, 所以能给专属码。 而 BYOK agent(codex / claude / opencode)是**第三方 CLI**,失败以 stderr 文本 和 stream error 的形状过来,只能落在泛化的 `AGENT_EXECUTION_FAILED` 上,细分 信息在 `failureDetail` 里 —— **结构上永远够不着那一行**。 这个缺口在 `amr-guidance.ts:607` 的注释里就写着,还拿 `cli_version_incompatible` 当例子。 ## 改动 `AGENT_AGNOSTIC_DETAIL_FAILURE_UI` 加 5 行,全部指向现成的 `switchModelWithGuidance`:`cli_version_incompatible` / `model_not_found` / `model_not_supported` / `model_disabled` / `local_model_not_loaded`。 **零新增 i18n key、零契约改动、零删除** —— 文案、19 语翻译、`switch-model` 按钮、 埋点全是现成的,只缺表里这几行。 ## 为什么放 agent-agnostic 那张表 原本的理由(「要在 AMR 分支之前解析」)**不完整**:六个 agent 分支条件里有五个 根本不可能和这些 detail 同时出现 —— daemon 分类器在模型分支(`:1059`)之上就 返回了 `AMR_INSUFFICIENT_BALANCE` / `AMR_TIER_UPGRADE_REQUIRED` / `*_AUTH_REQUIRED`(`:945-1055`)。对那五个,两张表行为相同。 **真正成立的理由是 Antigravity**:分类器的 `RATE_LIMITED` 分支在 `:1231`, **排在模型分支之下**,所以 `RATE_LIMITED + model_not_supported` 是真实可达的组合。 从 `DETAIL_FAILURE_UI`(在 agent 分支**之后**解析)出来,它会被 Antigravity 的 限流分支抢先、标题成「速率受限」;从 agnostic 表出来才拿到 daemon 的真实诊断。 另外两条:code 版的同族 `AMR_MODEL_UNAVAILABLE` 本来就在 `AGENT_AGNOSTIC_FAILURE_UI` 里、同一优先级层,把一张卡拆到两层会让「会不会被 agent 分支抢走」取决于 「daemon 恰好有没有结构化码」;而 `DETAIL_FAILURE_UI` 的 docblock 把自己限定为 **覆盖**一个错的或太笼统的 code 映射,这几行没有覆盖任何东西 (`AGENT_EXECUTION_FAILED` 在任何表里都没有行)。 ## 两条约束测试 - **不出重试,且与 verdict 无关** —— 故意**不传** `verdict`,因为 `retryable` / `failureAction` **还没上线到 wire 上**。不修的话这个形状会掉到解析器最后一行 拿到 retry。这样钉住的是「这一行本身就对」,不用等契约补齐。 - **AMR 那条路没被影响** —— 用 `detail: null` 作判别用例。daemon 给那个码配的 正是 `model_not_found`,而它刚进了 detail 表,**只测 detail 那一档绿了可能是 巧合**;只有 code 行能答 null 这一档。 ## 撤实现验红 三个变异,每次都还原并校验校验和:删掉 5 行 → 11 红 2 绿(那 2 绿正是反向对照 和 AMR 测试,与设计一致);改成 `retryWithGuidance` → 11 红,报的是 `expected 'retry' to be 'switch-model'`(证明不重试那几条断言独立承重); 删掉 code 表里的 `AMR_MODEL_UNAVAILABLE` → 只有 AMR 那条红、且只在 `detail=null` (证明它确实隔离了 code 行)。 ## 刻意没做的两件 **`provider_routing_error` 排除在外**,它是这个家族的第六个成员: `modelUnavailableDetail()` 把它发成 `model_unavailable`/`switch_model`,而 `upstreamDetail()` 把**同一个字符串**发成 `upstream_unavailable`/`retryable: true`。 `amr-guidance` 收到 detail 时**不带 category**,加一行会把上游那一半错标。 **要等 `failureCategory` 上线到 wire 才能收**,代码里留了 ⚠️。 **`local_model_not_loaded` 的文案只是勉强合身** —— daemon 对它同样开 `switch_model`,家族卡是诚实的路由,但它字面上的解法是「去 LM Studio 里加载一个 模型」,不是「在这儿换一个」。**没有自造新句子**(那要 19 个 locale),按文件里 既有的 `local_storage_failure` 标记方式标了待拍板。 ## 待另外开单的契约缺口(只记录,未改) 1. daemon 发的 `failureAction: "switch_model"`(`run-failure-classification.ts:1070`) **不在** `RunFailureAction` 联合类型里(`packages/contracts/src/api/chat.ts:50` 只有 `relogin | recharge | upgrade | retry | none`)。 2. `agentVersion: null` —— OD 不记录 agent CLI 版本,所以卡片上说不出「你装的是 X, 需要 Y」。解析器自己的注释说,要拿到它得在每次启动前加一次探测。 ## 只有真机能确认 这几行只决定**判决**,`resolveRunFailureUi` 是纯函数。这条 run 的 `failureDetail` 能不能活着穿过 SSE `end` 帧 → `markErrorRunFailure` → `appendErrorStatusEvent` 一路到 ChatPane 读的 props,**没有任何东西在这里证明** —— 而那条链正是 `RunFailureDaemonVerdict` 的 docblock 说「字段今天会丢」的地方。 * fix(chat): 「问完就交棒」的回合不再被判成「已停止,仍有未完成任务」 用户回答完 question-form 之后,那一回合底下冒出一行「已停止,仍有未完成任务」, 而**同一条消息的壳头写着「已完成 56s」** —— 屏幕上两个互相矛盾的状态。 ## run 从来没被停过 真机那条 run(`441ff961-…`)的末帧逐字:`status: succeeded`、`code: 0`、 `signal: null`、`error`/`errorCode`/`failureCategory` 全 null。 用户提交表单后的下一轮正常做完了 34 个产物 —— **「仍有未完成任务」连事后看都不成立。** 页脚那行只读最后一个 TodoWrite 快照(4 条全非 completed),**从不看 run 是怎么结束的**。 而这一轮以 `</question-form>` 收尾:它的计划**本来就该没做完**,那是等待,不是烂尾。 「答完才出现」是因为 `hideRunStatus` 里有 `hasPendingQuestionForm` —— 表单悬着时整行 被藏住,一提交就翻假、闸门打开。那道闸当初防的是**假的成功**(注释原话), 没人看过它另一头掉出什么。 ## 判据放在契约层,因为有三个面在判完成度 daemon 的 stamp、`db.ts` 的项目卡投影、web 的页脚 —— 而**页脚是自己从 events 重算的**, 不读 stamp。所以只改 daemon 修不好页脚,只改 web 修不好项目卡。 `turnEndedByAskingUser` **不是新产品规则**:它就是 daemon 已有的 `awaiting_input` 规则 (`listPartitionsAwaitingInput`、`run_finished.asked_user_question` 都在用 `emittedRenderableQuestionForm`)。把那个扫描器从 daemon 提到 `packages/contracts/src/api/question-form-markup.ts`,daemon 侧留 re-export 垫片, 6 个导入方和 e2e 的 parity 测试路径都不用动。 它要求的是**可渲染的闭合 `<question-form>`**,不是裸标签 —— 所以产物 HTML 里印了 这段文本不会误判。反向孪生测试逐层钉住:被引号包住的裸标签**仍然**报未完成。 ## 测试抓出了一个真 bug:文档说的收口点其实不收口 第一版把文本收拢在 `captureRunWorkCompletenessSignals` —— 那里的注释明写着 「single choke point」。**错的**:`emitGuardedTextDelta` 把守卫过的文本直接送给 `send('agent', …)`,**绕过 `emitAgentEvent`**,整个 json-event-stream / copilot / ACP 家族都走这条。全链路测试当场变红。收拢点移到 `send` 本身,并在原处留注释说明 为什么不能折在那儿。 ## 是「移动」不是「新增」 `server.ts` 里那个路由局部的 `clarifyingQuestionText` 缓冲被**挪到 run 上**, 而不是加第二个缓冲 —— 于是缺产物守卫和 `finish()` 读同一份。 ## 撤实现验红(逐处,含两道状态闸单独隔离) | 撤掉 | 变红 | |---|---| | contracts 的 `eventsEndedByAskingUser` 判据 | `does not call a clarification turn unfinished` | | daemon 的 `&& !endedByAskingUser` | `runs.test` + `chat-route.test` 各一条 | | `server.ts` 的 `askUserScanText` 累积 | `chat-route.test › does not stamp unfinished work…` | | web 的 `messageEndedByAskingUser` | 原红测 + 2 条 todos 单测 | | **只**撤 daemon 的 `status === 'succeeded'` 闸 | `does not let a rendered form erase unfinished work from a canceled run` | | **只**撤 web 的 `runStatus` 闸 | 「取消后仍报已停止」+「仍提供剩余任务」 | 取消那条守卫原本是**空的** —— `canceled` 在标签排序里本来就压过 `hasUnfinishedTodos`, 只断言标签会永远绿。加了「继续剩余任务」按钮的断言才让它非空。 ## 文案没动(产品的) `assistant.unfinishedLabel` 19 语原样。原样转述建议给产品:**一个只知道 todo 快照的 谓词,没有资格断言「终止原因」;在这一档「已停止」永远是错的。** 这次修复让 「问完交棒」不再落进这一档,但其它落进来的回合(比如 agent exit 0 直接不干了) 措辞仍然在硬说「已停止」。值得产品拍一次。 ## 只有真机能确认 - **纯 stdout 运行时**(antigravity / BYOK / deepseek TUI):它们的文本是 `stdout` 块 不是 `agent` `text_delta`,`run.askUserScanText` 会是空,**daemon 那侧维持现状 (fail-closed)**;web 侧照样修好,因为它读 `message.content`。这是那个缓冲的 既有局限,没有顺手扩大。 - 打包客户端上那条 run 的页脚真的读「已完成」、项目卡不再翻 `incomplete`。 - **「继续剩余任务」按钮在已回答的澄清回合上会消失** —— 这是把 `continuableUnfinishedTodos` 也接上判据的直接后果,判断是对的 (表单本身就是那个「继续」),但**是超出状态词的可见行为变化,值得看一眼**。 * feat(chat): 余额只剩一档提醒 —— 拿掉软弹窗,首页直接放行 产品裁决(用户 2026-09-06 原话):「**软提醒弹窗就是产品告诉我不要这个的, 只用弹那个插画的就行**」,以及首页那一档「**什么都不显示,有余额就允许运行**」。 ## 三个界面的终态 | 界面 | 余额 > $0 但 < $2 | |---|---| | 项目页 | 交付稿那张对话内 `UpgradeCard`(**本来就是**,2026-08-26 的 D-01 已裁决) | | 首页 | **什么都不显示,直接放行** | | = $0 | 不变,仍是带插画的 `AmrBalanceDialog` | 首页原来是 `AmrLowBalanceDialog` —— 一个**挡住这次发送**的居中弹窗,用户得点 〔仍要发起任务〕才继续。现在 `soft` 那个分支整段删掉,**落下去就是放行**, 不是留一个不显示但仍然挡着的空壳。原位留了注释写明「故意没有分支,别再加回来」。 ## 为什么首页至今还留着它,不是漏做 2026-08-26 的裁决 D-01(`specs/current/run-error-catalog.md:303`)逐字写着 「告警可继续的不弹窗,只有卡片;余额不足再弹窗」,但**落点栏只点了 `ProjectView.tsx` + `ChatPane`,没点 EntryShell** —— 首页从来没被那条覆盖过。 而且 `UpgradeCard.tsx` 里那句「那个的去留另记(见规格 T40)」是个**断指针**: T40 讲的是「软提醒不许拖慢运行」,和去留无关。**软弹窗的去留至今没有任何书面裁决**, 这次是第一次。断指针一并修掉(组件注释、CSS 注释、`AmrBalanceDialog`、 镜像页两处注记与两行 HTML)。 ## 测试是改判据不是删 `w116-entry-shell-low-balance-tiers.test.tsx` 保留并翻面:free / pro / go / max / null 各档 soft 都断言**不出任何弹窗**且 `onCreateProject` 被调用。另加两条: - **屏幕上一个 `role="dialog"` / `alertdialog` 都没有** ——「什么都不显示」不等于 「换一张显示」 - **反向对照**:硬拦档照旧弹 `amr-balance-dialog` 且不建项目;`checkAmrBalanceGate` 确实被调用过。**没有这两条,把整段闸门删掉也会全绿。** T40 那条红线用例(套餐读数吊死也不许卡住发送)原样保留。 ## 撤实现验红 把旧行为的形状恢复(soft 分支里等一个决策的 `await` + 一个阻断元素): **9 条里 6 条当场变红**,正好是全部 soft 用例;绿的 3 条是不走 soft 路的。 还原用字节备份 `cp`,`shasum` 前后一致。 ## 顺带落地的两条裁决记录 `specs/current/chat-panel-decisions-sheet.md` 新增「五之五、2026-09-06」: - **T53** 软弹窗去留 + 三界面终态 + 首页静默放行,引用户原话;**并写明代价** —— 首页 $0–$2 彻底静默,任务可能跑到一半停而事前无提示,**产品知情** - **T52** 阈值保持 `$2`、不跟交付稿的「< 5 美金」,依据是用户原话 「<2 就行,不用管设计稿的 5 美金」,并**明写「产品没有给出依据,这里不代为补写理由」** `amr-balance-gate.ts` 的阈值常量上方加注释,标明这是对交付稿的**有意偏离**、 指向 T52,并说明硬拦那条($0)**不是**偏离。 ## 遗留未清(已记进 T53) 死埋点 `chat_low_balance_warn_recharge` / `home_low_balance_warn_recharge` 留着: 它们在 `packages/contracts` 的 `TrackingAmrEntrySource` 联合类型里,而 `ENTRY_PAGE_BY_SOURCE` 是穷举 `Record` —— 删一个值要同时改跨包分析契约、映射表, 还要重建 contracts dist。**牵连大于收益。** 另:`docs/design/chat-mirror/mirror-exec.html` 只手改了 4 处注记,没整页重生成 —— 重生成会带出 +98/−9 的 `tokens.css` 内联漂移(别处留下的陈旧),不该裹进这次改动。 那页的 token 内联仍是陈旧的,下次正经重生成时会一并带上。 `specs/current/chat-panel-edge-audit.md` 仍把这张弹窗描述成现存组件 —— 它自己声明了是 2026-08-25 的带日期盘点稿、以 `chat-panel-next.md` 为准,不是权威源, 这次没动。 * fix(observability): 浏览器自己的滚动锚定不该被判成「滚轮倒退」 探针的 `wheel_snap_back` 会误报,触发方式毫无对抗性:**打开一条长会话 → 滚到中间 → 500ms 一格慢慢往下滚 20 格**。实测 **11 次中 5 次**误报;命中时 20 格里 19 格被判定,而日志全程能正常滚。 (对照:已稳定的长会话上 1708 格滚轮,**0 / 14** 误报,连 stall streak 都没起过。) ## 机制 1. `SCROLL_SAMPLE_MIN_INTERVAL_MS = 250` —— 探针最多每 250ms 才把滚动位置并入 `lastScrollTop`,而且节流是**丢弃**跳过的采样,不是延后。 2. 这 250ms 里,**浏览器原生 scroll anchoring** 因为视口**上方**内容变矮而把 `scrollTop` 调小(**实测一次调了 1036px**,而 `SNAP_BACK_MIN_PX` 只要 8)。 3. 下一格向下滚轮拿去和**过期的基准**比 → 判成「向下滚却倒退了」。 4. **这条路一格就报**,`FREEZE_WHEEL_COUNT = 4` 那套门槛完全保护不到它。 ## 为什么不是「报之前重读一次 scrollTop」 那条治不了:`runFrame` 里的 `geometry.scrollTop` 本来就是当帧刚读的、新鲜的; **旧的是基准**。在 rAF 里再读一次会拿到同一个值,一格都拦不下来;而放到监听器 里读又会强制重排,正好破掉这个模块的立身之本。**成本照付,一个误报都不少。** ## 改法:布局稳定性排除条件 原生 scroll anchoring **只在视口上方内容高度变了的时候**才会修正 `scrollTop` —— 所以「高度动没动」就是把浏览器的记账和用户的手分开的结构性判据。判据复用 `stick-to-bottom.ts` 里 `layoutStable` 的推理,没另造一套;**没有用时间窗** (「基准是不是 250ms 内取的」),因为那种参数离线验不了,而且落在窗口内的 修正照样会被定罪。 `lastScrollHeight` / `lastClientHeight` 和 `lastScrollTop` **绑在一起写** (收成一个 `sampled` 对象,所有 return 路径 spread 它)—— 位置和它所在的布局 必须同拍,否则下一次判定就是拿新位置比旧布局。 **`wheel_stall` 那条四格路刻意不加这个门**:流式期间内容几乎每帧都在长, 一刀切会把「一边流式一边真卡住」整类漏掉。 诊断面 `describeSnapBackRoute` 调同一个谓词并新增 `layoutStable` 字段 —— 否则运行时把手会告诉操作者「这条路已就绪」,而探针其实不会报。 ## 为什么这条比看起来重要 `MAX_REPORTS_PER_SESSION = 3`,而 `attach()` 在报满 3 次后**不再挂载**。 所以误报会**烧光预算**,真卡住时反而抓不到。撤实现验红时这一点是可测的: 去掉门之后,**第一格 anchoring 修正就把 `reported` 锁死了**,后面那次真 snap-back 根本没机会上报。 ## 撤实现验红 - 撤 snap-back 条件里的 `&& stable` → 3 红(算术层、DOM 层、以及「reflow 之后 紧接着那一格仍要报」) - 整支 snap-back 分支删掉 → 7 红(含 drift 回放那几条既有用例) - 诊断面去掉 `stable &&` → 1 红 反向测试两条(算术层 + 走完整探针链路到 PostHog payload),外加一条防修过头的 「内容一直在长时四格路照样要报 `wheel_stall`」。 ## 待拍板(没动) `MAX_REPORTS_PER_SESSION = 3` 本身合理,**不合理的是把「停止上报」和「停止观测」 绑在一起** —— `attach()` 预算耗尽后直接返回 null,于是活动轨迹、账本、 `window.__chatScrollFreeze` 的 `attached` 全部永久失效,而且**静默**,长得跟 「后来没再卡过」一模一样。建议上限只加在 `reportSafetyEvent` 那一步。 ## 顺带发现(没改) 天花板探测用的是同一个过期 `previousTop`,anchoring 修正会写进一条假的 `shortfallPx`;而 `ledger.first` **永不淘汰**,所以「drift 从哪儿开始」这个头号 字段可能已经被污染。**不建议照搬这个门去堵** —— 账本的立意是把内容变化和够不到 的距离配对,要求布局静止会把真正的首次 shortfall 一起杀掉。语义不同,单开一轮。 * feat(diagnostics): 卡住时一键把滚动现场装进诊断包 我们复现不出「聊天区滚不动」,但**同事们能撞到,而且都愿意提供数据**。所以要 一条他们自己就能走完、产出可发送文件的取证路。 ## 一个采集器,三条触发路,一个目的地 目的地是同事**已经会用**的那个 zip(`open-design-diagnostics-*.zip`),不新造流程。 `useDiagnosticsExport` 是设置页「导出诊断日志」和报错卡「导出日志」共用的那个 hook, 补一处就覆盖两个入口。 ## 但走到设置页会毁掉现场 —— 所以必须有第三条路 `App.tsx:4804` 的 `openSettings()` **永远走 `navigate({kind:'home', view:'settings'})`**, 而 `:5213` 把设置渲染成 `appMain` —— **设置是路由不是浮层**。走过去点导出, **聊天区会被卸载,冻结的那个面一起没了**。(浮层形态的代码存在,但没有任何地方路由到它。) 所以加了唯一一条**不导航**的入口:**菜单栏 Help → Export Diagnostics…**。 那条走 main → daemon,全程不碰 renderer;main 再通过 `window.__odCaptureChatScrollForensics`(`executeJavaScript`,5s 超时,失败吞掉) 反向取现场。**原生菜单不重绘页面,所以卡住时够得着**,而且没有新增任何界面元素。 另配一道**冻结时留存闩**,订阅探针已有的 `subscribeChatScrollFreeze`:探针一旦 判定冻结,整份现场当场存进 renderer 内存(30 分钟 TTL,首次冻结优先)。这样即使 之后走到设置页,证据仍在。信封里 `live` 和 `retained` 两个槽都在,**空的时候各自 说明为什么空**。 ## 现场带什么 `summary/chat-scroll-forensics.json`: - **`probe`** —— `__chatScrollFreeze.snapshot()` 原样(账本、十二道闸、活动轨迹、 层普查、祖先链合成属性) - **`composition`** —— 祖先链(由外向内)+ 全部直接子节点,每个带 computed 的 `display` / `position` / `overflow-x,y` / `transform` / `filter` / `backdrop-filter` / `contain` / `will-change` / `content-visibility` / `isolation` / `z-index` / `opacity` / 高度族 / offset 三元 / scroll 三元 / 包围盒 / 在跑的动画数与名字 - **`dom`** —— 聊天区完整 `outerHTML`(8MB 上限,截断会标出来) - **`animations`** —— `document.getAnimations()` 全量 - **`assignment`** —— **判决式的那一条**: `assignment_reached_layout_max`(JS 能到底 ⇒ 滚轮/合成器那一半坏了)/ `assignment_clamped`(滚动盒自己不让走)/ `no_room`(布局真没空间) - **`runtime`** —— Chromium 与 Electron 版本、平台、DPR、窗口/屏幕/visualViewport 尺寸、`zoomInputs`(原始输入,不猜缩放级别);daemon 那侧再盖上权威的 app 版本/渠道/打包与否 - **`writes`** —— `writes.list()`,没开拦截时**明说没开** - **`timeline`** —— 各段耗时。赋值探测永远是最大的那一段,这本身就是顺序证据 ## 赋值探测放在最后,而且必须还原 它排在 probe / runtime / scroller / composition / dom / animations **之后**, 做完就地还原,`finally` 再还原一次。`warnings` 里带一条: **「还原过的 scrollTop 不能当作滚动正常的证据」**。两条测试钉着:一条断言元素 回到 137 且 `writes` 含 4200;另一条让 setter 在**移动之后**抛错,断言 `writes === [4200, 77]`。 ## 为什么用会合点而不是请求体 两条导出路到 daemon 都是**无体的 `GET`** —— 打包版里点击走 renderer → preload → Electron main → 原生保存对话框 → daemon GET,**根本没有 renderer 能附上的 body**。所以 renderer 先 POST 到 `/api/diagnostics/chat-scroll-forensics`(仅本地、24mb 上限),daemon 在**内存里** 存最新一份,导出时排空进 `summaries`。存内存不落盘,于是它不会变成一个 `OD_DATA_DIR` 路径问题。 ## 撤实现验红 13 处逐个撤、逐个确认对应测试变红(含:赋值探测移到 DOM 采集之前、还原逻辑、 祖先链遍历、`outerHTML`、动画枚举、Help 菜单的反向调用、window 钩子的发布、 daemon 排空、空态说明结构、请求体校验)。 顺带撞上那个已知的坑:**web typecheck 绿而 `--filter daemon build` 红** (`express.json()` 推断出的 connect 类型触发 TS2742),补了显式 `RequestHandler` 标注。 ## 残留缺口 **浏览器里**没有不导航的入口,除非屏幕上正好有报错卡 —— 设置页会导航、毁掉现场, 只剩「冻结时留存」那一份,而它要求探针**真的报过**,恰恰是我们还不敢信的那一环。 补它需要在聊天区加一颗按钮,而聊天面板头部正在做 1:1 对齐重构,**没有单方面加**。 打包桌面端(同事们在的地方)由 Help 菜单完整覆盖。 * fix(amr): 余额四格矩阵按产品文档收口(T54–T58) 产品文档第四节「四、升级情况」那张四格表(付费/免费 × 个人/团队 Owner), 这次一次性对齐。五条裁决记在 `specs/current/chat-panel-decisions-sheet.md` 的「五之六」「五之七」。 ## T54 通用「升级」改跳当前环境的 console 套餐页 `<console origin>/dashboard?source=open_design&billing=plan`,不再跳写死的公开 Pricing。origin 复用现成通路(daemon `/api/integrations/vela/status` → `setRuntimeAmrConsoleOrigin`),没造第二份。 **这条同时修掉一个真缺陷**:`amrPlansUrlForProfile(_profile)` 的参数带下划线 前缀、刻意不用,所以 test / local / feature-test 的包**一律跳生产 Pricing**, 而那页选中套餐会带着 plan + interval 回**生产** Vela 直接结账。 ## T55 矩阵管个人工作区:个人版付费档余额 $0 也要硬拦 让位判据从「有套餐 ⇒ 让位」改成「**档次读不出来 ⇒ 让位**」。 `planMayFundRunOutsideWallet`(`!isFreeAmrPlan(...)`)删除,换成 `amrPlanTierUnreadable`(`resolveAmrPlan(...) == null`);`isFreeAmrPlan` 因此 没有生产消费者,一并删除 —— 留着它会以「free 还是那个轴」的名义把老逻辑招回来。 缺陷形状:`isFreeAmrPlan` 只精确匹配 `'free'`,连 `'basic'` 都算「非 free」, 于是个人版 Basic/Plus/Pro/Max 在 $0 落到 soft 档,**四格弹窗一张都不出**。 ⚠️ 推翻 T15 / R-010 / #7190「付费档余额 0 = 不限量,不拦」。 ✅ `cf00c80bd1` 的另一半原样保住:套餐读不出来时放行,由远程兜底。 ⚠️ 代价:个人版 Max 用户 $0 时不能再靠套餐额度直接开跑。**这格只有真机能确认。** ## T56 「找所有者充值」改用产品稿正式文案,删掉「复制请求」 终态只剩 标题 / 正文 / 「知道了」。原来那份是**有授权的临时文案** (§6.V 逐字写「文案由研发拟,产品复核」),这次是正式替换,不是推翻设计。 ⚠️ 代价:这一档回到单出口,能给的只有「该找谁」,不再替他把话写好。产品知情。 i18n 三个 key(`requestTemplate` / `copyCta` / `copiedCta`)从 19 个 locale 删除。 ## T57 Owner 名字拿不到时的降级文案 两个变体两个 key。**现在一定走降级那条**:契约里唯一的 owner 名是 `CollabProject.ownerDisplayName`(**项目级**,且注释自己写着 "STUB"), `WorkspaceCollabContext` 上没有工作区 owner 名。后端补上名字来源后自动生效。 ## T58 Max × Team Owner(第 3 格)出转化弹窗,Upgrade 跳自动充值 那张弹窗**和第 1 格是同一张,文案一字不差** —— 没有新文案、没有新 i18n key、 没有新组件。两格唯一差别是主按钮落点:第 1 格 `billing=plan`,第 3 格 `billing=auto-recharge`。 `AmrBalanceBlockedDialogKind` 的 `null` 那一支整个删除(留着它只会让每个调用点 继续背一条 `?? 'upgrade'` 兜底 —— 首页那条正是这么活下来的)。 ⚠️ **顺带更正一条被当成产品文案的机器描述**:此前记录引用过第 3 格 「未达到 $100.00/月的额度」—— 那不是产品文案,是飞书导出时 AI 为截图自动生成的 **图片 alt 描述**。以图为准,截图上写的和第 1 格一字不差。凡照着那句推出的结论 一律作废。 ✅ 链路另一半同日通了:vela **#1900** 已合并,`?billing=auto-recharge` 现在真的 弹出自动充值设置弹窗。我们这侧发出去的参数不用改。 ## 撤实现验红 四次,逐一对应:`amrBalanceBlockedDialog` 回到 `max → null`(红 5 条)、 弹窗里 `upgradeIntent` 落点分支(红 4)、只撤首页调用点(红 1)、 只撤项目页调用点(红 3)。 **首页此前根本没有分支矩阵覆盖** —— `EntryShell.amr-balance-branches.test.tsx` 是本次新增,那条 `?? 'upgrade'` 兜底就是这么活下来的。 ## 只有真机能确认 Max 档**在 prod 造不出来**,第 3 格今天只有单测;「弹窗真的弹出来了、按钮真的 把浏览器带到自动充值面板」需要一个真 Max 账号走一遍。 * feat(observability): 滚动冻结的复现工具链与滚轮接管(默认关) 三样东西,都服务于同一件事:**我们复现不出「聊天区滚不动」,只能靠同事的真实 现场**。所以先把「怎么留证」和「怎么回放」搭起来,不急着改产品行为。 ## 1. 滚轮接管 —— 默认关,且必须手动打开 `open-design:chat-scroll-takeover` 设成 `'1'` 并重载才生效,否则挂上去也是惰性的。 **为什么默认关是硬要求**:产品原话「**我们要观测旧的实现问题,不要影响**」。 接管会把滚轮从合成器手里接过来自己算位移 —— 那正好会**掩盖**我们要观测的那个 缺陷,让冻结不再出现,而我们既拿不到取证也说不清是修好了还是只是把时序推开了。 所以它只是一个**逃生口**(同事真卡死时能自救),不是修复,更不能默认参与。 ## 2. e2e 回放骨架 `chat-scroll-replay.ts` + `chat-scroll-recording.ts`:把真机采到的滚轮/内容变化 时间线 1:1 喂回去。 ⚠️ **`chat-scroll-wheel-reach.test.ts` 目前是 `test.skip`,这是有意的。** 回放能重放时间线,但**造不出真的冻结** —— 一个从没红过的守卫什么都不证明, 把它留在绿灯里比 skip 更糟。等真现场回来、能稳定复现了再解开。 ## 3. 取证路径的测试补齐 给已落地的 `chat-scroll-forensics.ts` 和 Help → Export Diagnostics… 补上用例。 ## 不在这条提交里 `.chat-log-viewport` 的 grid 轨道候选修法(`minmax(0,1fr)` → `100%/100%`) **故意没有提交**。它是一个**候选修法**,而验证它的那次 A/B 已作废;这个包的 用途是收同事的取证现场,掺一个候选修法进去,万一冻结不再出现,取证和结论 两头都落空。改动留在工作区,等产品拍板。 * chore: 把发布列车抬到 0.21.2 **动机是取证的可溯源性,不是走流程。** 我们连打三个 beta 给同事和 QA, 三次版本号都是 `0.21.1-beta.7`,于是「QA 报了个问题」没法对应到是哪个包。 产品原话:「不然 qa 反馈问题我都不知道是新包还是旧包」。 **为什么版本号就是全部身份**(逐条查证过): - `tools/pack/src/versioning/index.ts` 的 `readRuntimeAppVersion()` 只有两个来源 (`--app-version` 或 `apps/packaged/package.json`),没有 sha 输入口 - `apps/packaged/src/sidecars.ts` 交给 daemon 的身份信息只有 `OD_APP_VERSION` - `AppVersionInfo` / `DiagnosticsAppInfo` 都没有 commit 位 —— **诊断包里也不带** - electron-builder 没配 `buildVersion`,macOS `CFBundleVersion` == 版本号; Windows PE 第四位硬编码 0。**没有任何隐藏构建号可以当区分符** - sha 目前只进了 R2 的 `metadata.json`,而 `publish=false` 的包连这个都没有 **为什么是 0.21.2 而不是 beta 序号**:`open-design-v0.21.1` 这个 stable tag 已经存在,而仓库基线还停在 `0.21.1` —— release bot 的常规节奏本该已经抬上去了, 只是还没做。抬完顺带让 `prepare-beta.ts` 那条「基线必须严格大于最新 stable」的 判据自然成立,`force=true` 不再是必需品。 **17 个 manifest,不是 18** —— `apps/landing-page` 已在 `1d2150007b` 移出仓库。 全集由两个独立方法交叉验证(遍历所有非 node_modules 的 package.json 取 version==0.21.1;以及 `git grep '"version": "0.21.1"'`),结果一致。 workspace 互相依赖全是 `workspace:*`,`pnpm-lock.yaml` 里 `0.21.1` 出现 0 次。 ⚠️ **这次抬版本只能救一个包。** `publish=false` 永远不推进 R2 metadata,而 `prepare-beta.ts` 只在「仓库基线 == metadata 基线」时才递增 beta 序号,基线更大 时固定为 1。所以下一个包是 `0.21.2-beta.1`,**再下一个还是它**。 永久解是把已经躺在打包 job 环境里的 `RELEASE_COMMIT` 接进诊断包 —— 分支 `chore/pack-build-commit` 已备好,未合并。 * docs(specs): 落 T52–T59,并把 §6.V 里被推翻的三处同步掉 ## 决策表新增 - **五之六 T54–T57**、**五之七 T58**:余额四格矩阵的终态与代价(见上一条代码提交) - **五之八 T59**:**交付稿的标注文字与它自己渲染出来的 DOM 打架时,以 DOM 为准** ## T59 首次适用:组件 18 升级卡不显示用量条 交付稿(git ref `729fa43ce7`)自相矛盾,矛盾在两处: - `:5739` 组件 18 自己的说明写「**展示**当前用量与受影响的能力」 - `:5585` 组件 15 解释「这里不报用量」时把用量归属指给 18,写「剩余额度 + **进度条** + Upgrade」 自洽的那一半是 DOM + CSS: - `:3337` 稿子自己的 CSS 注释写「保留旧刻度样式,**当前额度卡不显示刻度**」 - `class="meter"` 在**整份稿子的 DOM 里出现 0 次** - 组件 18 那张卡的实际 DOM 是「剩余额度 $3.20」+ 一句话 + 一颗按钮,**没有条** 那条留着没删的 `.meter` 样式就是物证:曾经有过刻度,后来去掉了,样式没删、两处 说明也没跟着改。产品口述 2026-09-07:「**对的以 dom 为准**」。 ⚠️ 通则不等于可以自行发挥:发现打架**要在决策表记一条**,不能默默按 DOM 做完 就算,否则和「照着标注做」一样不可追溯。 ## §6.V 同步(它是我们自己的规格,不是产品那份不能动的文档) 三处已被后来的裁决推翻,留着就是给下一个人埋雷: 1. 「非 Max · owner 卡和弹窗都直接跳 Pricing」→ 改跳当前环境 console 的 `?billing=plan`(T54) 2. 「Max · owner ── 不弹窗」→ **和第 1 格同一张弹窗,文案一字不差**(T58) 3. 「付费档余额 0 = 不限量,不拦仍然成立」→ **已被 T55 推翻**,个人版付费档 $0 现在也硬拦;让位判据改成「档次读不出来才让位」 另补 §6.V「文案由研发拟,待产品复核」那一条的**复核结果**:改用产品正式文案、 删掉「复制请求」,于是这一档回到单出口(T56/T57)。 * test(amr): 补上 T54 漏在上一条提交外的那个断言 `ChatPane` 会话切换器里那条「AMR 档位升级」动作的用例,断言的还是**生产** Pricing URL(`https://open-design.ai/pricing/`,且 `billing` 为 null)。T54 之后 它应当跟随当前 profile 落到 console 的套餐页。 这条本该和 T54 的代码改动同一条提交,是我分拣文件时漏的 —— 单独看那条 `fix(amr): 余额四格矩阵按产品文档收口` 会是红的,记在这里以免后来人对着它二分。 顺带说明它守的正是 T54 提到的那个真缺陷:渲染 profile 是 `test`,而旧断言要求 跳生产 —— 也就是**非生产的包把人送去生产结账**。现在断言 `https://vela.powerformer.net/dashboard` + `billing=plan`。 * fix(observability): 三处让探针自己变瞎的缺陷 都不是产品缺陷,是**我们的诊断代码在损害我们自己的观测**。而现在整条链路的 用途就是靠同事的真实现场定位滚动冻结,所以它们是高优先级。 ## 一、报满 3 条之后连观测都停了(而且是静默的) `MAX_REPORTS_PER_SESSION = 3` 本身还算合理,**不合理的是把「停止上报」和 「停止观测」绑在一起** —— `attach()` 在预算耗尽后直接返回 null,于是活动轨迹、 亏空账本、`window.__chatScrollFreeze` 的 `attached` 全部永久失效,**而且长得跟 「后来没再卡过」一模一样**。同事装上包,切到第四条会话就变成瞎子。 产品原话:「**为了揪出问题,报一万条都行啊... 定位到问题后再删了呗?**」 所以**整条会话级限流删掉**,不是改成一个更大的数,也不加可配置开关或环境变量 (这是临时取证配置,定位到根因后整套探针会删掉,不要引入新变量)。 **per-surface 的一次锁保留** —— 那是去重不是限流。 顺带查证:`chat-scroll-forensics.ts` 的 `handleFreezeSignalForRetention` 有 `if (retained != null) return`,所以取证快照全会话仍只存第一份。放开上限只增加 PostHog 事件量,**不会**让取证存储无限长。 ## 二、天花板探测用过期基准,污染「drift 从哪儿开始」 和刚修的 snap-back 误报同一个病:`SCROLL_SAMPLE_MIN_INTERVAL_MS = 250` 的节流是 **丢弃**跳过的采样。原生 scroll anchoring 一修正位置,就会写进一条几百上千像素的 假 `shortfallPx`;而 **`ledger.first` 永不淘汰**,那正是「drift 从哪一次内容变化 开始」这个头号字段,**污染一次永久留着**。 **没有照搬 `layoutHeldStill`** —— 账本的立意是把内容变化和够不到的距离配对, 要求布局静止会把真正的首次 shortfall 一起杀掉(真冻结时内容往往正在长)。 新判据 `ceilingProbeAttributable` 问的不是布局静不静,而是**这一帧的落点是不是 滚轮造成的**,两条各自自洽的路: 1. **位置和基准分毫不差** → 无条件收。能改 `scrollTop` 的只有 anchoring、我们 自己的写、和滚轮;位置没动说明前两样都没发生,而滚轮明明来了。 **内容在下方长高只改天花板、不碰 `scrollTop`**,所以「内容在长」这一整类 真冻结全部保住。用精确相等而非容差,是因为 `observeWheelBatch` 判「动没动」 就是 `top !== previousTop`,两边对「没动」的定义不许分家。 2. **位置往回退了,且布局没变** → 才收。往回退的竞争解释只有 anchoring,而 **anchoring 修正必然伴随高度变化**。所以只在这条路上要 `layoutHeldStill`。 拒错一次只少一条 probe;收错一次会把一个**永不淘汰**的字段永久占掉。 ## 三、`syncFollowState` 的恒真守卫,每帧白写一次 scrollTop `if (el.scrollTop !== el.scrollHeight)` —— `scrollTop` 最大只到 `scrollHeight - clientHeight`,**永远不可能相等**,于是贴底跟随时每帧都写一次。 功能上无害,但**它会污染我们用来区分「是我们在写」还是「合成器不动」的写入记录**。 换成 `isPinnedToLogBottom()`,**写入值不动**(仍写 `scrollHeight` 交给浏览器夹取), 变的只有「要不要写这一帧」。 容差取 1px 而不是 `AT_BOTTOM_TOLERANCE_PX`(8px):那 8px 回答的是另一个问题 (「用户算不算还贴着底」),拿它当写入判据,流式期间每帧长高不到 8px 的内容会 一直攒到超过 8px 才被追上,跟随会肉眼可见地一顿一顿。 ## 三个夹具假象(缺陷三暴露出来的) `chat-scroll-preservation` / `chat-scroll-following` / `chat-anchor-to-top` 三条 在合并后变红。逐条判定结果是**夹具假象,不是行为改坏**,共同特征是断言时刻 `scrollTop > maxScrollTop()` —— 一个真实浏览器造不出来的状态。两个成因: - **setter 根本不夹取**(同 `ChatPane.streaming` 那条):断言的是「发生过一次写」, 那次写在真浏览器里会被夹回去、**一个像素都不动**。改成断言真实落点。 - **setter 夹了,但内容变矮不经过 setter**:W105 收占位块让 `scrollHeight` 一口气掉 500,而停在旧底部的 `scrollTop` 没人夹。补 `settleScrollAfterLayout()` 挂在帧回调批次之后(正是浏览器夹取发生的位置), **期望值一个没改**。 **「守卫漏了一个真实需要写的时刻」这条可能性被排除**:占位块是最后一个孩子, 它变矮 → 上限下降 → 浏览器把 `scrollTop` **往下**夹 → 结果是**更贴底**。 夹取只会把人推向底部,永远不会推离。反向情形(占位块收 500 同时内容长 200, 上限净涨 80)守卫读到 `80 > 1` 照写。 ⚠️ **一处覆盖能力的净损失,记在这里**:`chat-anchor-to-top` 的 `blankOnScreen ≤ 52` 原本确实能检出「跟随没写」(旧夹具 + 删掉写 → 红),补上 夹取之后没有了。判断是**那份能力本来就是假的** —— 真机上占位块一收,浏览器自己 就把人夹到底,写不写都成立。该用例的主断言(占位块必须收到 8)不受影响,跟随的 覆盖由另外 5 个用例扛着。 ## 撤实现验红 上限:6 条(含「报满旧上限后仍在观测」—— 实现前第 7 条报告 `undefined`)。 判据二:红测 `shortfall_first_px` 实现前 980(anchoring 假值)、实现后 380; 另有两条反证 —— 换成朴素的 `layoutHeldStill` 会红掉「内容在长时的真 drift」, 只留「位置相等」会红掉回放用例,证明两条路都不多余。 缺陷三:实现前 10 次 `syncFollowState` → 10 次无位移的写,实现后 0 次; 把跟随的写整个删掉,5 个用例仍然变红。 ## 教训 按文件名前缀窄跑不够 —— `ChatPane` 的改动,blast radius 是整个 `tests/components`(658 文件 / 6362 条,已全跑绿)。 ## 只有真机能确认 分数 `scrollTop` 下 1px 容差够不够(jsdom 无布局,几何全是塞进去的整数); 真实 Chromium 的 anchoring 是否总是同步改 `scrollTop` 和 `scrollHeight` (判据二的物理前提);放开上限后的真实事件量;跟随观感是否完全无感。 * fix(chat): 颜色块 / 思考滚动条 / 问卷被误锁三个缺陷(OPEND-2642 2643 2644) ## OPEND-2642 颜色题已确认摘要仍缺色块(回归) **根因:「已确认」摘要有两份实现,而 OPEND-2579 修的是产线永远走不到的那一份。** - `QuestionForm.tsx` 的 `AnsweredValue` → 会画色块 - `AssistantMessage.tsx` 的 `FormBlock`(历史回放块)→ 自己内联 `<b>{value}</b>`, 无色块、无 `.ab.mod-value` 关键事实:`QuestionFormView` 的 `submittedAnswers` 这个 prop **全仓库没有任何 产线调用点**(传参方全是测试)。用户看到的那块「已确认」永远是第二份。 **2579 为什么没挡住**:它的用例直接渲染 `QuestionFormView` 手工喂 `submittedAnswers` —— 走的正是那条产线到不了的路。新用例改成**从 `AssistantMessage` 进**,走 `formatFormAnswers → parseSubmittedAnswers → 摘要` 的真实回放路径。 改法是导出 `AnsweredValue` / `isShortValueAnswer`,回放块改用同一对函数, 注释里写死「值只有这一处画法」。 ## OPEND-2643 思考过程滚动条遮挡正文 **根因两层**: 1. `padding-inline-end: 4px`(注释说「留一点气口」)**从来没生效过** —— 它是 (0,3,0),被灰底容器的 `padding: var(--stream-pad)` 简写 (0,4,0)/(0,5,0) 整条盖掉,右边实际一直是 8px。 2. 8px 也不是让位:Chromium 在 macOS 默认覆盖式滚动条,不占布局、直接画在 padding box 右缘,而 `scrollbar-gutter: stable` 对覆盖式**是空转的**。 改法:`::-webkit-scrollbar { width: 8px }` 让 Blink 退出覆盖式(滚动条变成占 布局的经典滚动条,宽度从内容盒扣),加 `scrollbar-gutter: stable` 防止它中途 冒出来时正文横跳。⚠️ 注释里写死**不要**加 `scrollbar-width` / `scrollbar-color` —— Chromium 121 起它们会让 `::-webkit-scrollbar` 整体失效、**静默撤销这个修复**, 并配了一条守它的用例。 **测试能证明什么**:用共享层叠量尺量「哪条规则赢了」,包括把「4px 被简写盖掉、 实际 8px」钉成事实基线。**证明不了**:jsdom 不做布局也没有滚动条实体, 「字和滚动条不再重叠」**只有真机能确认**(需分别看 macOS 两种滚动条设置和 Windows/Linux 经典滚动条)。 ## OPEND-2644 未提交的问卷被锁住并误标「已回答」 两处缺一不可: 1. **`ChatPane.tsx` 配对放宽** —— `nextUserContentByAssistantId` 老写法只认 **物理相邻**的下一条消息,记忆卡插进来配对就断了。改成从后往前扫,把最近 一次看到的 user 正文发给它上面的助手消息。放宽配对**不会凭空造答案**: `parseSubmittedAnswers` 只认 `[form answers — <id>]` 开头且标签对得上的文本。 2. **`AssistantMessage.tsx` 判据换掉** —— 抽成具名 `questionFormAnswerable = isLastAssistant || nextUserContent === undefined`。 `isLastAssistant` 留在或的前半,是因为流式当轮里 `nextUserContent` 本来就是 空的 —— 它是判据的一个特例,不是替代品。 3. **「已回答」pill** 原来挂在 `locked` 上,而 `locked` 的三种来路里有两种跟 用户答没答过无关。现在只由真实提交答案兑现。 **只改第 2 处会把「答不了」换成「答完了看不出来」** —— 答案落在记忆卡后面, `parseSubmittedAnswers` 认不出来,永远收不成「已确认」摘要。 **意外收获**:撤掉第 1 处时,**历史里所有没答完的问卷都会被重新打开**(那些 消息的 `nextUserContent` 全配不上了)。所以第 1 处不只是让摘要收口,它同时是 「锁住」的判据来源。 ## 撤实现验红 2642:回放块改回 `<b>{value}</b>` → 2 条红。 2643:删掉 gutter + 三条 webkit 规则 → 2 条红。 2644:**分开撤,一处一次** —— 只撤第 1 处红 2 条(摘要收不成、走过去的表仍锁住), 只撤第 2 处红 2 条(表填不了、没有那句「此前回合的表单」)。 ## 上一轮我自己写错的两处,一并更正 1. `opend-2644-unanswered-form-not-marked-answered` 里有一条断言「记忆卡之后 显示『此前回合的表单』」—— **那是修复前的行为**,当时被当成了不变量。现在 改成断言它不出现,并新增一条把那句说明的正确触发条件钉住。 2. 第一版红测的判据本身是坏尺子:`formControlsEnabled()` 拿「卡片上所有 button 都没 disabled」当「表能填」,但底栏那颗「下一步」在必填项填完前本来就是灰的。 dump 出来的 DOM 是 `class="question-form"`(没有 `-locked`)+ 只有 `Next step` disabled —— **修复其实早就生效,是尺子读错了**。改成看 `question-form-locked` 类 + 排除底栏的答题控件,并把这个坑写进 helper 注释。 ## 未做 工单评论里的第二件事(同一回合两组操作栏)查清了但**没动**:那条 memory-applied 是**宿主自己补发的消息**(`ProjectView` 拿 `useMemoryWrittenCard` 的批次 `appendConversationMessage` 一条完整 assistant 消息,所以没有 run_id/run_status 却照样渲染完成状态和操作栏)。要收成「回合附属组件」得改消息编排语义 —— **这是产品裁决**,已在 Plane 上请示。 ## 只有真机能确认 记忆卡是 turn 结束后**异步轮询**出来的(不是同步落库),所以它真实出现的那一刻 问卷能否正常填写并提交、以及提交后刷新/重进项目摘要是否稳定收口,单测覆盖不到。 * docs(specs): 量清「纯问答被判失败」那条裁决的边界,并记下它盖不住的一条真缺陷 为把 beta.7 现场(task `odnext_c4ee010be6b748dc9b92984946bc10a8`)钉成可回归的 形状,写了一条红测(**故意留红、未提交**),顺着它把判定链逐跳查清了。 **结论:那条红测断言的是「还没设计的产品行为」,不是缺陷。** 实测证明「接受纯文字回答」和既有的「拒绝把 silent no-op 洗成 completed」两条 互斥 —— 放开 `deliverableValid` 要求后红测转绿、既有绿测立刻转红,而两条 fixture 除了 agent 那段散文**输入完全相同**。唯一剩下的杠杆是按散文内容猜,正是 `chat-panel-issue-log:58` 那条裁决点名禁止的(「不做关键词猜测」)。 ⚠️ **但同一个坑里挖出一条不在该裁决覆盖范围内的真缺陷**: **真干了活、却不产生新 artifact 的 Direct Edit**(删文件、改名、只读审计,或 artifact 记账漏算的编辑)—— `validateRunDeliverable` 一律给 `no_artifact`,于是走进 和纯问答一模一样的终态 blocked。**这里用户明确要的是改动,agent 也确实做了**, 和「纯问答没交付物」是两件事,**该单独立项**。 另记:同链上另外三种合法产出的同类坑、一处规范自相矛盾(`general-orchestration.md:496` 说澄清轮不输出 machine block,而 `od-next-strategy.ts:752` 说每轮都必须有)、 前端那条 succeeded→failed 重映射为何不用单独改(以及为何**不能只改前端**), 以及唯一需要翻现场持久化事件才能定死的一点。 * fix(chat): 把 .chat-log-viewport 的 grid 轨道换成确定值(滚动冻结候选修法) `grid-template: minmax(0, 1fr) / minmax(0, 1fr)` → `100% / 100%`。 **这是假设,不是已证实的修复。** 产品拍板放进包里,理由是「免得到时候阻塞上线」。 ## 假设 `1fr` 是**不确定轨道**:尺寸是剩余空间的一份,所以轨道要在拥有它的盒子之后的 另一趟里定尺寸,里面那个滚动盒再被拉伸到轨道最终定下的值。`100%` 直接从这个 viewport **已经确定**的内容盒解析(它自己的高度经 `.chat-log-wrap` 的 `flex: 1` 确定,再往上由 `.split` 的 grid 轨道确定),于是这一格第一趟就是对的,之后不再被 修订。 猜的是:滚动节点在轨道尺寸修订落地之前就建好了,而那次修订没有把绘制属性标脏。 **这条因果链没有建立。** ## 已知的缺陷形状(三次真实现场) 天花板被冻在一个早期的内容高度上(实测 91+583=674、824+583=1407、25+583=608 —— **天花板 + 视口 = 冻结那一刻的内容高度**),程序性写 `scrollTop` 仍然有效, 只有销毁并重建那个布局盒才能解除。 ## 怎么判它对不对 **读 `client_chat_scroll_frozen`**:如果带着这条规则的包仍然在报,假设就是错的, 这一行该换成下一个候选需要的写法。这也是为什么本次同时放开了探针的会话级上报 上限 —— 判据要靠事件量,不能报满三条就变瞎。 ⚠️ **代价要说清**:如果冻结从此不再出现,我们**分不开「真的修好了」和「只是把 时序推开了」**。这是产品知情后的取舍。 ## 等价性 代码注释声称「跨两种书写方向和五种布局状态,计算几何(含 used track sizes)与 `elementFromPoint` 探针逐字段与 `minmax(0, 1fr)` 相同」—— 那是**实测得来的**, 不是假设。`chat-log-viewport-definite-tracks.test.ts` 守的是 CSS 文本契约 (轨道保持确定、不退回 `1fr`/`minmax()`、`0e8bbdaa69` 的 rtl 滚动条沟槽验收 不被破坏、百分比轨道依赖的「祖先必须是确定包含块」这个前提仍然成立)。 **它证明不了修复有效** —— jsdom 不做布局,没有 used track size、没有滚动边界、 没有合成器,假装能量的测试就是假绿。假设的证伪路径是遥测事件,不是这个套件。 * chore: 抬到 0.21.3 上一个包是 `0.21.2-beta.1`。因为特性分支必须 `publish=false`,R2 的 beta metadata 永远不推进,而 `prepare-beta.ts` 在「仓库基线 > metadata 基线」时把 beta 序号 固定为 1 —— 不抬 patch 位,这个包还会叫 `0.21.2-beta.1`,和刚发出去那个撞名。 **每要一个可区分的包就得抬一次**,这是 `publish=false` 路线下唯一不碰 `release_version` 覆盖(那条会锁死 beta 发布线)的办法。永久解是把已经躺在打包 job 环境里的 `RELEASE_COMMIT` 接进诊断包 —— 分支 `chore/pack-build-commit` 已备好, 未合并;⚠️ 合之前要先补 `release-stable.yml` 那四个 build job 看不到该变量的缺口。 * docs(specs): 滚动冻结——活现场实测,候选修法当场证伪,键盘同样走不动 包 0.21.2-beta.1,两次真实冻结现场,用 Electron 主进程 inspector + `webContents.sendInputEvent` 注入真滚轮测量(JS 合成的 WheelEvent 不走这条路)。 **推翻了一条即将发布的「修复」**:`grid-template: 100%/100%` 加在活的冻结实例上, 滚轮纹丝不动。它在 `5a538991a0` 里,**建议撤**。 **把缺陷范围收紧了一格**:键盘 PageDown 同样死在 6px,而 JS `scrollTo` 能到 859.5, `scrollTop` 写入拦截全程为空。所以既不是「我们的代码在拽回去」,也不只是滚轮 —— scroll unification 之后滚轮/键盘都走 cc scroll tree,卡住的是那个 ScrollNode 的 bounds(停在 589),Blink 侧的 1442 是对的。 **它是彻底冻死不是滞后**:追加 1000px 内容,布局上限涨到 3114,滚轮仍只到 6。 **排除**:CSS 容器查询(第二次现场 DOM 里一个 artifact card 都没有)、祖先链合成边界 (全 none)、嵌套滚动盒吃滚轮(0 verdicts discarded)、残留 transform、overflow 切换、 will-change / translateZ 上下线、滚动盒自身高度微调、占位块钉 0。 **当前最可疑**:滚动盒用 ResizeObserver 观察自己、回调里又写占位块高度——一个长在会冻的 盒子上的自喂环,且 `origin/main` 没有这一条(它只观察子元素)。 **顺带记两条**:① 探针每个日志元素只报一次,同会话第二次冻结遥测拿不到; ② `display:none` 那一格不要再跑——答案早知道,唯一作用是终结现场,今天就这么浪费了一个。 * docs(specs): 滚动冻结——grid 包装盒证伪,平滑滚动可解冻而瞬时直写不能 **H1 证伪**:把 `.chat-log-viewport` 还原成 origin/main 的 flex 形状,照样冻 (wheelReached 31.5 不动,layoutMax 从 439 长到 1450)。8/31 那两次结构改动 (新造 viewport、flex→grid)全部洗清。天花板值不固定,它就是「助手消息刚开始长的 那一刻的内容高度」。 **★ 切出一条精确分界**:`scrollTop = N` 瞬时直写**不解冻**(自动探针每 12 秒做一次, 冻结纹丝不动),而 `scrollTo({behavior:'smooth'})` **解冻**(产品点「回到最新」后 量到 wheelReached 1449.5 = layoutMax)。和「JS 能到底但滚轮/键盘不行」自洽: 瞬时直写只走 Blink,动画滚动由 cc 驱动、会强制重新同步陈旧的 scroll tree。 由此得到一个**无闪屏**的止血手段:判定冻结 → 自动平滑滚动一次,先上报再自愈。 ⚠️ 附一条量测纪律:常驻注入式探针会把用户画面每 12 秒「滚到底再滚回来」,产品当场 以为是 agent 在乱操作。只读采样可常驻,注入输入必须单次手动触发。 * Revert "fix(chat): 把 .chat-log-viewport 的 grid 轨道换成确定值(滚动冻结候选修法)" This reverts commit 5a538991a0. **在活的冻结现场上当场证伪了。** 2026-09-07,打包版 `0.21.2-beta.1`,通过 Electron 主进程 inspector 把 `grid-template: 100% / 100%` 加到一个正在冻结的实例上: ``` gtBefore 583px / 442px → gtAfter 583px / 442px (几何一个字段没变) before {top:6, sh:2685, ch:583, layoutMax:2102} after {top:6, sh:2685, ch:583, layoutMax:2102} 注入真滚轮 12 格 → 仍然只到 6 ``` 而且**对照是干净的**:同一次会话里,先给同一个元素写一条**与当前算出值完全相同**的 内联 `grid-template`(纯样式改动、语义零变化),滚轮同样不动 —— 所以"随便碰一下样式 就能解冻"这个替代解释也被排除了。 **同一轮还证伪了它所在的那个盒子**:把 `.chat-log-viewport` 用 `!important` 整个还原成 `origin/main` 的形状(`display:flex` + `.chat-log{flex:1 1 0%}`),照样冻 —— `wheelReached` 全程 31.5,而 `layoutMax` 从 439 长到 1450。所以 8/31 那两次结构改动 (`77859f01f7` 新造 viewport、`0e8bbdaa69` flex→grid)都不是成因。 留着它有两个坏处,都不值当: 1. 提交消息把它写成"候选修法",发出去会被当成修复; 2. 它是后续观测里一个多余的变量 —— 而这个缺陷的判据本来就要靠 `client_chat_scroll_frozen` 的事件量来读。 那条随它落地的 `chat-log-viewport-definite-tracks.test.ts` 一并删除:它守的是 "轨道必须保持确定值"这个契约,而该契约的前提(这么写能修好)已经不成立。 完整的实测记录(含九种干预的解法矩阵、键盘同样走不动、平滑滚动可解冻而瞬时直写不能) 见 `specs/current/chat-panel-issue-log-2026-08-28.md`。 * fix(diagnostics): 取证信封被全局 4mb parser 静默截断 `/api/diagnostics/chat-scroll-forensics` 的请求体被 `server.ts` 的全局 `express.json({ limit: '4mb' })` 截断了 —— 取证路由注册在它**之后**,所以路由链上 那个 24mb 的 `chatScrollForensicsBodyParser` **是死代码**。 **为什么这条致命**:信封里聊天区完整 `outerHTML` 单份上限就是 8MB,而它同时装 `live` 和 `retained` **两份**。也就是说 —— **越是长到会卡死的对话,越传不回来, 而且失败是静默的**。整条取证路就是为了拿这类现场,对它们正好是瞎的。 修法照仓库自己的先例:按路径**前置注册**到全局那行之前(`/api/library/ingest` 128mb 和 `/api/brands/:id/extract-from-html` 32mb 都是这么做的)。**全局 4mb 没动** —— 调大它等于放宽所有路由的攻击面。路由链上那个 parser 一并删掉,并写清它为什么不在 那儿:留着只会让人以为那行决定 limit,而这正是这个 bug 能潜伏下来的原因。 **红测走真实 express 挂载**(现有两条测试全绿但全瞎 —— 它们绕过挂载直接调 handler, 所以 parser 顺序错了照样绿):真 `startServer` + `node:http` 打真 socket,发 6mb。 修前**确定性 413**(`PayloadTooLargeError: request entity too large`),修后 200; 撤实现重跑**逐字复现同一条失败**。另加一条护栏钉住全局仍是 4mb,防止有人图省事调大它。 顺带在信封里补记滚轮接管开关的原始读值(`runtime.chatScrollTakeover`):读现场的人 此前无法排除「这台机器是不是把接管打开了」。刻意**不**复用 `chatScrollTakeoverFlagSet()` —— 它把「键不存在」「值像开其实没开」「storage 读不到」压成同一个 false,而这三件事 对读现场的人是三个不同的事实;读不到就明说 UNKNOWN,不猜。 * fix(chat): 上游过载的报错卡不再把 JSON 原文摊给用户 用户在打包版上撞到上游 529,失败卡里出现整段原始 JSON: `json-rpc id 4: opencode event stream: {"id":"evt_…","properties":{…},"sessionID":"ses_…"}` —— 而真正该说的那句话就埋在里面(`Our servers are currently overloaded`)。 **四层叠加**:vela CLI 把 opencode 的 `session.error` 整段 JSON 拼成**诊断串** → daemon ACP RPC 前面加 `json-rpc id 4: ` → daemon ACP session 的 `fail()` 把这一整串 当 message 发出、`code` **写死 `AGENT_EXECUTION_FAILED`** → web 没有映射命中,描述位 **回落到原文**。 **分类器其实认出来了**(实测喂截图原文:`upstream_5xx` / 可重试),**但 UI 映射表里 没有这一行** —— `amr-guidance.ts` 自己的注释早就点名说这是已知缺口。本次补上 `upstream_5xx` / `provider_high_demand` 两行,**用的是仓库已有的 S10 文案** (`fatal_rpc_error` 那档在用同一句,19 个 locale 现成)。**没有新文案、没有新 key。** 影响面参照 `docs/design/run-errors/error-ux-design.md` 的 S10:每月 11,200 次、 占失败 8.8%、2,056 台设备。 红测夹具是截图原文**逐字**(含 vela 拼的 `(event=…, session=…)` 尾巴),另有一条自检 断言那四段碎片确实在夹具里(证明量法非空转)。撤实现验红命中同一条。 **留下三个更大的口子,只列不改**(需要单独立项): ① `acp/session.ts` 那颗写死的 `AGENT_EXECUTION_FAILED` 服务**全部 9 个 ACP runtime** (amr/vibe/devin/hermes/kilo/kimi/kiro/trae-cli/reasonix),它们的上游报错一律不问 `classifyAgentServiceFailure` —— 而 json-event-stream 路和 Claude 路都问; ② 另有 22 个 failure_detail 同样没人认领,命中就摊原文; ③ `ChatPane.tsx` 里 `runFailureUi` 为 null 时直接 `: rawError`,**跨全部错误类型**, 映射表加行救不了。 ⚠️ 版本事实:打包版是从 `main` 出的,而 `main` 上**没有兜底句**,只要没命中映射就必然 摊原文;本分支有 08-27 的兜底,同样输入只会变成一句空话。**这个泄漏在 main 上更严重。** * fix(chat): 零位移的上滚手势不该关掉跟随;并加两个冻结假设的 A/B 开关 两件事共用 `ChatPane.tsx` 顶部同一个 import 块,拆开会留下「导入了但没用」的中间 提交(`noUnusedLocals` 会红),所以合在一条里。下面分开说。 ## 一、跟随被零位移手势误关(用户 2026-09-07 亲测) 复现:进一个内容很少的会话 → 往上滚几下(**滚不动**)→ 之后的流式输出**不再吸底**。 **根因是两把尺子**:wheel/touch 监听里用的是「可滚动余量**严格大于 0**」 (`scrollHeight > clientHeight`),而状态机其余部分用的是 `AT_BOTTOM_TOLERANCE_PX = 8` 的容差。手势那一侧更严,于是**它先松手** —— 而它是**事前**的(快速流式下浏览器会把 滚轮吃掉、连 scroll 事件都不发,所以必须在位移之前判定),一旦松了,后面 `nextFollowIntent` 再正确也回不来:`escaped` 是个 latch,只有「主动下滚并真的到底」 能清。 **真机数据坐实了这一档**:打包版 `0.21.2-beta.1` 上只读采样,「刚进会话」那个状态出现 **108 个样本**,几何恒定 `scrollHeight 589 / clientHeight 583` —— **余量 6px,正好落在 (0, 8] 这个出 bug 的区间**。另有 37 个样本是 `583/583`(余量 0),而余量 0 那一档**改前 就已经是好的**。所以用户说的「界面没什么内容滚不动」,真机上不是 0,是 6。 ⚠️ 那 6px 是**真实的内容溢出**(盒模型里的 padding/margin),不是高 DPI 取整噪声 —— 取整误差是零点几像素而且会抖,恒定 108 次的 6px 不是。这条写进了 docblock,因为它决定 下一个人该去查盒模型还是去查 `devicePixelRatio`。 ⚠️ 同时写明门槛的**来源**:8px 是从「挣脱 := `!isAtBottom`」推导来的,手势侧和判定侧 必须同一把尺子;6px 落在 8 以内是**验证**不是来源 —— 哪天量到 12px,该改的是别的东西, 不是把 8 调大。 修法:新增纯函数 `upwardGestureCanEscapeBottom()`,判据换成「**这一格手势在物理上有没有 可能产生一次离开底部**」。两处调用点(滚轮 `:2833`、触屏 `:2857`)换用它。 **撤实现验红两次**:换回旧判据 → 零位移那两条红;换成 `return false`(「永远不松手」的 假修法)→ **既有的**「滚轮往上拨一下就停手」「手指下拉也算停手」4 条红 —— 证明「用户 真的滑走仍要停止跟随」没有被牺牲,而且是被既有用例接住的。 **同类零位移场景走了一圈**:已在顶部继续上滚(顺手修了)、已在底部继续下滚(`deltaY>=0` 本来就 return)、`useThinkingFollow`(没挂 wheel/touch,纯位移驱动,无入口)。 **拖滚动条和键盘 PageUp/↑ 不经过这两个监听,没有零位移保护,也没人复现过 —— 留着没动。** ⚠️ **对取证面的副作用,先记一笔**:改前短会话里滚轮一响就 latch,后续流式增长**一次 `scrollTop` 写入都没有**;改后跟随保持,写入记录里会多出一串。而「是我们写回去的」vs 「合成器根本不动」正是靠这份记录区分的 —— 拿这个包复现冻结时,写入数量比旧包多**是本 提交造成的,不是新信号**。 ## 二、两个滚动冻结假设的 A/B 开关(默认全关 = 现状) 冻结还剩两个嫌疑,都改不了 CSS 就能测、必须动代码。做成运行时开关,**一个包测两个**: - `open-design:disable-chat-log-self-resize-observe` —— 摘掉「滚动盒观察自己」那条 ResizeObserver(回调里会写尾部占位块高度,构成自喂环;`origin/main` 没有这条) - `open-design:disable-msg-enter-animation` —— 停掉 `msg-enter` 入场动画(`fill: both` 会把 transform 永久留在正在增高的元素上) 照 `chat-scroll-takeover.ts` 的形状(`open-design:` 前缀 + 刷新生效 + 读不动当关), **没有另起机制**。只有字面量 `'1'` 算开。 **「默认行为不变」是证出来的,不是推的**:不设开关时滚动盒仍在观察者名单里且纯可视 高度变化仍能翻起状态;不设属性时 `.msg` 的 `animation` 仍解析成 `msg-enter … both` (喂整张展开后的 index.css,jsdom 真层叠,所以「后面某张表又盖回来」也照得出); `'true'`/`'on'`/`' 1'` 一律按关;两开关都关时 `install()` 在根节点上不留任何属性。 **打开各自会失去什么**(写在模块 docblock 里,真机 A/B 前必读): H2 → 「只改可视高度、不改内容高度」这类变化失去唯一通知源(输入框长高/软键盘/窗口竖向 缩放时不再重新贴底);内容驱动的跟随不受影响 —— 这也正是 `origin/main` 的行为。 H3 → 消息少了 200ms 淡入;且动画留下的单位 transform 消失后,`.msg` 不再是绝对定位后代 的包含块、也不再新建层叠上下文,消息内部若有错位**先怀疑这条**。 ⚠️ **滚动盒身上不止一个 ResizeObserver**:`QuoteBar.tsx` 也 observe 它。H2 只摘跟随那条, 所以开关打开后滚动盒**仍然被观察着** —— 若真机 A/B 显示冻结依旧,那条是下一个要看的。 * chore: 抬到 0.21.4 上一个包是 `0.21.2-beta.1`(0.21.3 那次在打包中途被我取消了 —— 当时刚发现取证信封会被 全局 4mb parser 静默截断,发一个取证传不回来的包没有意义)。 因为特性分支必须 `publish=false`,R2 的 beta metadata 永远不推进,而 `prepare-beta.ts` 在「仓库基线 > metadata 基线」时把 beta 序号固定为 1 —— 不抬 patch 位,这个包还会叫 `0.21.2-beta.1`,和已经发出去那个撞名。**每要一个可区分的包就得抬一次。** 永久解仍是把已经躺在打包 job 环境里的 `RELEASE_COMMIT` 接进诊断包 —— 分支 `chore/pack-build-commit` 已备好未合并;⚠️ 合之前要先补 `release-stable.yml` 那四个 build job 看不到该变量的缺口。 * docs(specs): 记 R-051 只止了血、未对齐设计稿 S10(产品拍板「先这样」) `0.21.4-beta.1` 里补的 `upstream_5xx` / `provider_high_demand` 映射,解决的是 「把 JSON 原文摊给用户」这个 P0,**用的是仓库已有的邻近文案,不是设计稿 S10 的文案**。 差四处 + 一个中间态:供应商名插值、「不是你的问题」、「已自动重试过」、〔更换模型〕 按钮,以及「自动重试 2 次都失败后才出卡、期间显示正在重试 1/2」。 完整对齐要新增 key + 19 个 locale + 供应商名的数据通路 + 接模型切换器的按钮 + 重试 计数中间态,体量远超止血本身。产品 2026-09-07 拍板先止血、对齐单独立项。 **这是对设计稿的有意偏离,记录在案以免后来人以为是漏做。** 按仓库规矩不另开 issue。 * fix(daemon): ACP 这条路从不问错误分类器,9 个 runtime 的上游报错全是裸的 `acp/session.ts` 的 `fail()` 只产出两种形态:JSON-RPC 分支给 `AGENT_EXECUTION_FAILED`, **其余所有 fail 点给裸 `{ message }` —— 连码都没有**。两条都从不调 `classifyAgentServiceFailure`,而 json-event-stream 路和 Claude 路都调。 影响面是全部 `streamFormat: 'acp-json-rpc'` 的 runtime:amr / devin / hermes / kilo / kimi / kiro / reasonix / trae-cli / vibe。 ## 先拍快照再改 44 条真实语料(现有测试 / `run-error-catalog.md` / 用户 `0.21.2-beta.1` 截图原文)冻结成 落点表,改前改后逐条 diff: - **分析轴(`failure_category` / `failure_detail` / `failure_stage` / `retryable` / `user_action`)44 条一条没动。** - 码轴动了 15 条:上游过载 → `UPSTREAM_UNAVAILABLE`;401/403 类 → `AGENT_AUTH_REQUIRED`; 429 / session limit → `RATE_LIMITED`。其中 A3 那条改前**连码都没有**。 - 没动的 29 条里有关键守卫:握手判决先盖章的两条仍是 `AGENT_CLI_SESSION_REFUSED`; `exit code 401` / `line 502` 这类噪音仍被 `STATUS_CTX` 挡住;16 条分类器返回 null 的 保持今天行为。 `evidence_level` 有 13 条从 `legacy_text` 变成 `structured_code` —— 不是巧合: `run-failure-classification.ts` 里那三个 structured-code 分支**对 ACP 一直是死代码** (码从来没送到),喂进码后才激活,而它们当初就是照着「和文本分支同判决、只差 evidenceLevel」写的。 ⚠️ **唯一一处码/detail 分歧变大的**:`insufficient balance` 码变 `RATE_LIMITED`, detail 仍是 `amr_insufficient_balance`。缓解:① AMR 自己走不到(账号分支在更前面拦截); ② 另外 8 个 runtime 的卡面会从「原文兜底」变成限流卡;③ **json-event-stream 和 Claude 两条路今天就是这个行为** —— 这是在向已评审的既有行为对齐,不是新增一类错判。 只放 `UPSTREAM_UNAVAILABLE` 一档等于自造分类器里没有的规则,故未采纳。 ## 落点与取舍 改在 `server.ts` 的 ACP 专属 `send('error')` 桥接处,**不改 `session.ts`** —— 桥接处是唯一同时喂 SSE 和 `run.error` 的点(那段 docblock 自己写着这是「两个面能一起 纠正的最后一处」),也是唯一拿得到 runtime 身份的地方,还天然避开 AMR 账号分支和 resume 抑制分支。 **刻意不读 stdout/stderr tail**(json-event-stream 路读):ACP runtime 的 stderr 是它自己 的日志(vela 会打请求 URL、provider 名、重试),拿那个决定用户看哪张卡风险太大。只看 agent 写进 JSON-RPC error frame 的东西。 分类失败时**按引用原样返回**(测试用 `toBe` 而非 `toEqual` 钉住),完全退回今天的行为; 覆盖非对象 / null / 空白 message / 循环引用 details / 已有具体码五种情形。 `message` / `retryable` / `details` 一个字节没碰,`run.error` 前后完全一致。 ## 顺带发现(未改) **ACP 的协议违规被判成「去登录」**:`session.ts:1329` 拼的 `invalid session/new response: …` 含子串 `invalid session`,而 `integrations/vela-errors.ts:183` 把它当 AMR 鉴权失败。纯协议问题 → 用户被告知去登录。 实测最小触发就是字面量 `invalid session`(单空格)。本次改动对它无影响(冻结表 C5 钉住)。 * fix(chat): 找所有者充值弹窗整个是透明的,而且还压不住输入框(OPEND-2722) 两个独立缺陷叠在同一张弹窗上,合起来的效果就是工单说的「未正常弹出」。 ## 一、缺主题接缝 —— 弹窗画不出来 `AmrOwnerTopUpDialog` 用 `createPortal` 挂到 `<body>`,但没带 `--chat-*` 接缝。 CSS 自定义属性按 **DOM 树**继承,而 `--chat-*` 只在 `[data-chat-root]` 子树里定义 (`ChatRoot.module.css` 的 `.vars`/`.root`)—— portal 出去就脱离了那棵子树,遮罩、卡片 底色、投影、圆角**全部解析失败**,文字裸浮在页面上。**它不报错**,现有按 testid 断言 存在性的测试照样绿。 同一个坑 2026-08-27 已在 `SupportDialog` 踩过并修好。修法**逐字照抄**它(`chatSeam()`, 同样三行、同样形状),没有另起机制。`inline` 仍跳过接缝,免得陈列页多出第二个 `data-chat-root`。两个调用点(`ProjectView` / `EntryShell`)都走 portal 形态,由组件层 一并覆盖,并有测试钉住。 ## 二、`z-index: 40` —— 画出来了也压不住 同屏实测:输入框固定层 45(`chat.css:1395`)、同侪模态 `.staged-preview-modal` 1200 (`chat.css:2964`)、右上角那簇真机量到 150。`SupportDialog` 当初就为此抬到 **1500**, **这张从没抬过**,而守它的测试只守 `SupportDialog` 一个文件。 抬到 1500,和同族对齐 —— 依据是 `SupportDialog` 自己的注释:1500 是为了压过同侪模态, 不是「刚好够用」的数。 守护测试一般化成 `chat-overlay-layer.test.ts`,覆盖整个 `components/chat/`, **判据写死为三条同时满足**:`position: fixed` + 覆盖全视口 + **画了背景**。第三条是关键 —— 全屏但透明的层是点击捕获器,职责就是待在东西**下面**(如 `composer-toolbox-standalone-backdrop` z=89);画了背景的才做出「我后面的东西都被压暗且失效」这个承诺,而被打破的正是它。 被排除的每一个(QuoteBar、QuotedRefs、PlanPill、AnchoredMenuShell、UpgradeCard 的 `::after`、两个 `overlayInline`)都单独钉了测试,**判据将来放宽会当场变红**。 一般化是**证明**过的:往目录里丢一个低 z-index 的假弹窗,扫描当场发现、红 5 条,再删掉验残留。 原 `support-dialog-layer.test.ts` 已被完全涵盖,删除。 ## 量法自检(这两条都踩过同一个坑) ⚠️ **jsdom 不做 `var()` 替换** —— 量背景色是**假绿**判据:变量解析对了它照样报 `rgba(0,0,0,0)`。接缝那条因此改成量「每一枚被消费的 `--chat-*` 是否解析出非空值」+ 排版基线 `font-weight`,并**显式断言背景色是不可用判据**;层级那条则只读 CSS 文本里的 字面整数,不碰任何 `var()` 依赖的计算值。两条都先证明尺子在**修复前**能读出错误值。 ## 全仓 portal 普查(干净的否定结果) 48 个 `createPortal` 逐个对照 14 个消费 `--chat-*` 的 CSS Module 和 20 个全局类: **只有 4 个 portal 带 `--chat-*` 内容,现在四个都有接缝**(composer 固定层、QuoteBar、 SupportDialog、本次)。其余用的是全局 `:root` token,portal 出去仍然有效。 ## 关联工单的结论(未改其状态) - **OPEND-2720「点击升级无法跳转 Pricing」不是缺陷**:非 owner 本就不外跳 (`ProjectView.tsx:2991-3009` 注释逐字:「任何非 owner → 不外跳:账单动作 B 会拒」, 与 §6.V 一致);owner 现在也不跳公开 Pricing 了(T54 改成 console 套餐页)。 报告人看到的「点了没反应」**正是本条缺陷** —— 弹窗弹了,只是透明的。 - **OPEND-2719 一半是本条,一半是有意设计**:入队是故意的 (`ProjectView.tsx:8175-8195` 停的是**完整载荷**,因为输入框已清空,只恢复文本会静默 丢掉暂存附件 —— 注释写着),不能拿掉;「没弹窗」那一半随本条修复消失。 ## 顺带发现(未改,需单独决定) `packages/components/src/dialog.module.css:11` —— **共享 `Dialog` 原语的遮罩是 `z-index: 100`**,同样低于 150。它有 **14 个消费者**,其中一个是 `AmrBalanceDialog` —— 本家族里给有账单权限的人看的那张。同样的缺陷低一层,但抬共享原语是 14 个消费者的决定。 另有 5 个画了背景、全屏、低于 150 的遮罩(插件市场 60、首页确认 80、自动化 80、 插件导入 100、连接器抽屉 100)。 * fix(chat): 三处让聊天区「看起来坏了」的缺陷(原文泄漏 / 导轨死区 / 进会话钉顶) 三件事共用 `ChatPane.tsx` 顶部同一个 import 块,拆开会留下「导入了但没用」的中间提交 (`noUnusedLocals` 会红),所以合在一条。下面分开说。 ## 一、用户可见面永远不再显示原始错误文本 报错卡的描述位原本在没有映射命中时**回落到 `rawError`** —— 也就是把 daemon 传来的原始 错误摊给用户。刚补过一行映射(`ca8e255550`),但**只要这条回落还在,映射表补得再全总有 漏网的**,而已知还有 22 个 failure_detail 没有映射行。 **判据从「落到哪条分支」换成「这段字是谁写的」**:任何来自一次 run 的字符串一律走兜底句, 新增 `resolveRunErrorCardDescription()`(`amr-guidance.ts`)。这样映射补不补都不影响, 结构上堵死。 摸底结论:`rawError` 共 5 个消费点,**只有 1 个会到用户可见面**(描述位);标题位永远是 key;逐条消息的红色 error 药丸和「错误详情」折叠 08-27 就已下线。 **文案一个字没新写**,复用 08-27 已有的 `chat.runError.fallbackMessage`,19 个 locale 现成。 **原文仍然可达**:`appendAssistantErrorEvent` 照落 `events.jsonl`,〔导出日志〕照打包 (`diagnostics-export.ts:95`),测试钉住每张卡都带导出与联系支持。 ⚠️ **界线写进了注释**:藏的是 **JSON-RPC 传输信封**(事件 id、`sessionID`、`properties`、 本机端口与项目路径),**不是失败本身** —— 卡照出、标题照说、按钮照给。 ⚠️ 一条既有断言被**故意翻面**并写了原因:旧判据是「来源是不是这一轮」,来源指向别的助手就 原样放行;而那个槽只有两种来源,`setRunError(err.message,…)` 装的**永远是原文**。判据收敛 成「有没有来源助手」后这条必然翻面。它原本要保护的东西(来源为空 = 我们自己写的人话)由 同文件上一条用例继续钉着。 ## 二、右边缘 20px 的隐形死区吃掉滚轮 `ChatMessageRail` 是一条 **20px 宽、整个 log viewport 高**的绝对定位覆盖层。指针落在上面时 滚轮对聊天记录**完全无效,上下两个方向都死**。而 `.chat-log` **故意没有滚动条** (`scrollbar-width: none` + `::-webkit-scrollbar{display:none}`,注释明说导轨就是替代品), 所以用户按肌肉记忆把指针停在右边缘,正好落进死区,屏幕上没有任何线索。出现条件只是 「≥2 条用户消息」。 ⚠️ **根因不是 `overscroll-behavior: contain`** —— 反证过:改成 `auto`、track 滚到底再发 滚轮,日志仍然纹丝不动。真正原因是结构性的:**导轨是 `.chat-log` 的兄弟节点,不是祖先**, 而 Chromium 沿祖先链找滚动容器。那条 CSS 是红鲱鱼,未动。 修法:新增纯模块 `rail-wheel.ts`,track 在**这个方向**上还有余量就先吃,**剩下的转发给日志**。 短对话(track 不可滚)全额转发,长对话 track 先吃、到底后余量转发 —— 比今天更符合直觉 (今天到底后那部分滚轮凭空消失)。 ⚠️ **React 18 把 `wheel` 注册成 passive**,`onWheel` 里 `preventDefault()` 是空操作,而取消 默认正是整个机制(track 是 `overflow-y:auto`,不取消就「原生滚 + 手动滚」双份位移)。 所以改用 ref 挂原生监听 + 显式 `{ passive: false }`。**这一条验成了行为而非断言**:jsdom 同样 强制 passive,把常量翻成 `true` 会让 `defaultPrevented` 变假、测试真的变红。 另需 `railWheelDeltaPx` 归一化 `deltaMode` —— 因为现在是我们自己写 `scrollTop`, Firefox 某些平台一格是 `deltaY: 3`,不归一化就是每格 3px。 顺带修 `is-retracted`:原本只改 `opacity`,于是点完跳转后**看不见却照样吃悬停和点击**。 nav 和 track 都要关(`pointer-events` 虽可继承,但 track 自己声明了 `auto`,只关 nav 不够 —— 有专门的撤实现验红证明这条不冗余)。⚠️ **解除不靠 `mouseleave`**:元素刚被设成 `none` 会不会 补发一次,规范没要求、各引擎不一;赌错就是**导轨永久卡在收起态、再也不亮**,比原缺陷更糟。 改成收起期间用 `document` 的 `pointermove` 自己判指针是否离开 nav 矩形。 ## 三、进会话有时停在顶部(用户 2026-09-07:「有时候在最底下有时候在最顶部」) ⚠️ **不是本分支引入的。** 用 144 种进会话时序的差分矩阵跑了三遍:撤掉缺陷三的守卫、 甚至撤掉本 range 内 ChatPane 的**全部四处**改动,**最终落点逐行相同**(只有写入次数不同)。 所以头号嫌疑 `isPinnedToLogBottom` 与 `upwardGestureCanEscapeBottom` **都不是真凶** —— 旧写法写的是 `el.scrollHeight`、当场被夹到 `maxTop`,新守卫跳过的正是那些**写了也不动**的帧。 **真凶**:`settledTailUserIdRef` 的三档语义里 `null` 是一句**结论** ——「这条会话我看过了, 没有用户消息」。而 `ProjectView` 在会话 id 一到手就挂 `ChatPane`(`:12914`),转录随后异步取, **id 和转录永远不可能同一 commit 到达**。那几拍里空转录被落定成 `null`,下一拍历史一次到齐, `isNewTailUserTurn(null, 尾条id)` 为真 → **一份刚读进来的旧历史被判成用户刚发的新一轮** → `releaseFollow()` + 钉顶接管。 「有时底有时顶」由此解释:钉顶那一帧若排版已落定,停在最后一条用户消息上沿(最后一轮回复短时 看着就像贴底);未落定则矩形全挤在 0,量成 0 → 停在最顶。 修法:新增 `transcriptSpeaksForConversation()`(`anchor-to-top.ts`),用同一把闸同时管 「落定」和「表决」。**没有碰跟随的写入判据**,缺陷三的修复原样保留。 同一条规矩仓库里已写过一遍 —— `conversationMessageCount` 的注释:转录没落到这条会话头上时 `messages.length` 不作数(那边症状是列表里的幻影「0 msg」)。同一个错误的另一个出口。 ⚠️ **「为什么 0.21.2 上没有」没有证出来** —— 它不在 `0.21.2 → 0.21.4` 的 diff 里。推测是本 range 内某处(观测限流放开、思考区滚动条改成占布局、问卷 `interactive` 判据放宽)动了排版 时机,把一个**本来就存在**的竞态从「多数落在底部」推到了「多数落在顶部」。**只有真机能确认。** ⚠️ **留下一个已知行为变化**:转录读取窗口内发出的那一轮,钉顶会被推迟;若那一轮恰好是该 mount 的第一次落定(首页发起 + 创建会话后立刻发送的竞态),这一轮会不钉顶、退回贴底跟随。 **请在真机上过一遍「首页发起第一轮」。** ## 时序夹具的共同要求 三条里有两条的红测都必须**能表达「判定发生在排版之前」**:几何分两拍喂,挂载时 `contentHeight === clientHeight`(对应真机 583/589)、矩形全在 0,`settleLayout()` 之后才给 终态。**一上来就给终态几何的夹具照不出这类缺陷。** ## 只有真机能确认 指针物理停在那 20px 上时 `wheel` 的 target 是不是导轨(jsdom 无命中测试,这正是症状本身); `pointer-events: none` 之后点击/悬停是否落到底下的流水;双份位移是否真的消失; 滚轮接管替换掉浏览器平滑动画后的手感;以及上面点名的「首页发起第一轮」。 * chore: 抬到 0.21.6 跳过 0.21.5 —— 那个号被实验分支 `exp/disable-overscroll-features` 占了(滚动冻结 A/B 的 处理组包 `0.21.5-beta.1`),避免同名不同物。 本包相对 `0.21.4-beta.1` 新增:ACP 错误分类接线、找所有者充值弹窗的主题接缝与层级、 以及三处聊天区缺陷(原文泄漏堵死 / 导轨 20px 死区 / 进会话钉顶)。 ⚠️ 「进会话钉顶」经差分矩阵证实**不是本分支引入的**(撤掉本 range 内 ChatPane 全部四处 改动,落点逐行相同),但它在 `0.21.4-beta.1` 上可见,本包修掉。 * docs(specs): 余额族归交付稿管,不跟新文案文档(T60);并更正 admin 角色那条错误事实 产品 2026-09-07 裁决:余额 / 额度 / 充值 / 升级这一族的权威源是**交付稿组件 18**, 不是 09-06 那份《报错文案｜精简版》。原话「不能用以前那种白色报错卡……余额的一律对齐 这两个视觉稿卡片」。 ✅ 核实:我们当前就是**逐字一致**的(`chat.upgrade.balance` / `whyLow` / `whyOut`), 这一族无需改动。新文案文档给这一族的是通用话术并删掉了 `{balance}` 具体数字, 相对交付稿是倒退。 同时重新确认 2026-09-02「不存在第二张白色通用报错卡」继续有效 —— 新稿给这一格写了 标题+正文,而接棒的升级卡没有标题行(T59),没有地方放也不该放。 ⚠️ **更正一条我先前给出的错误事实**:`admin` 角色**是存在的**(`CollabMemberRole` 三档,全仓在用),我先前说「代码里没有 admin」是把余额弹窗按账单权限分的两档误当成了 角色轴。 但 admin **确实不能充值**,且是后端强制:我们 `collab.ts:480` 与 vela `packages/shared/src/workspace-context.ts:268` **逐字相同**(`readable && isOwner`), vela 服务端还在 `billing/http/routes.ts:1765` 拦。而且是有意的 —— 同处 `canManageMembers` / `canInviteMembers` / `canManageSharedResources` 全含 admin, **只有账单与自动充值排除它**。所以新稿「请联系团队管理员充值」会把用户指向一个 充不了值的人,保持 T56 的「所有者」。 * docs(specs): 升级卡改成按轮次锚定的存档件,不再是当前余额的实时读数(T61) 产品 2026-09-07 裁决:软档那张升级卡 ① 只在一轮结束后出现、运行中不出现; ② 出现后锚定在那一轮下面,第二轮运行期间不许挪走;③ 第二轮结束仍不足则另出一张; ④ 值是那一刻的存档,不随后续余额改写。 原话:「它就好像历史记录一样,存档在当时状态了,不能说我干个啥把当时的失败态搞丢了, 我往回看那一轮为啥失败了根本没有依据和想不起来啊」。 **这是语义变更**:卡片从「当前余额的实时读数」变成「这一轮为什么停下来的凭据」。 记在案是为了防后来人把「不随余额刷新」当成 bug 修回去。 ⚠️ 与 2026-09-02「升级卡各只有一张」不矛盾 —— 那条管的是同一时刻同一档不要两块 UI, 本条管的是不同轮次各自一张,两者正交。 ⚠️ 第 ④ 条体量未定:若卡片今天派生自实时钱包状态,刷新后要么消失要么显示当前余额, 两种都不满足「凭据」;真正存档可能要落进会话记录,跨 web/daemon/contracts。 ①②③ 是纯渲染层先做,④ 视调研结论单独立项。 * docs(specs): 文案对齐的三处口径——S21 保三态、S17 放放、S29 插值槽不改(T62–T64) 产品 2026-09-07 逐条裁决: - **T62 S21 保持三态**:文档一格 vs 我们三个可分辨状态(伪造角色标记 / 空输出 / 工具死循环)。抄同一句等于悄悄合并三个状态,是产品设计不是文案活。已落地: 只对最字面对应的 `outputInvalid` 采用新文案,另两个标题不动。 - **T63 S17 先放放**:我们没有这个状态,那两个 key 是死键、无任何映射引用; 真实 401/403 走的是 S04 那张卡。S17 是否 ≡ S04 留给产品。连带「被移出团队」 「客户端版本过旧」也没有分流(vela-errors 只有 3 个码,全仓不读 HTTP 状态码)。 - **T64 S29 插值槽不改**:标题已按新稿改,正文不采用——组件 22 是一行状态不是卡, 没有正文槽,要新增两个插值槽 + 改结构。计数今天已贯通到 UI,只是形态是一行。 另:S01/S02/S04 标题判定为「无待拍板项,只缺接线」(产品文案已给全,我们缺的是 标题不传插值 + `title.signInRequired` 一键服务两格要拆),已派单实施,不在此表。 * feat(chat): 报错文案按产品新稿对齐第 1 批,并给标题接上插值 权威源:产品《Open Design 报错文案｜精简版》(飞书 `docx/S1Ucd1frUo7opCxGLbRcj3XTnvh`, 最后修改 2026-09-06)。抬头自陈「原文中的按钮仅供核对」,**所以本次范围只有标题和正文**。 ## 第 1 批:20 个 key × 19 语种 = 380 条 zh-CN 逐字对齐产品原文(全角标点已逐条核过),其余 18 个是它的忠实翻译。 覆盖 S09 限流、S10 上游不可用、S11 连接中断、S18 账号停用、S19 智能体退出、 S20 内容过长、S21 输出异常、S01/S02/S04 正文、S29 重连、S31 检查更新失败。 ## 给标题接上插值(这一批唯一的代码改动) `ChatPane.tsx` 原来是裸的 `t(runFailureUi.titleKey)`,**不传变量** —— 新稿 S01 标题要 「未检测到 {智能体}」,照抄会把**字面的 `{agent}` 摆到用户脸上**。 新增 `runFailureCopyVars`,标题(`:4150`)和正文(`:2242`)**同吃一份**。 刻意不给标题另造 `titleVars`:两处名的是同一条失败、同一个 agent,各取各的只会给 「标题说 Claude、正文说 Codex」留一道缝。`RunFailureUi` 一个字段没加。 ## 拆 `title.signInRequired` 一个键原本同时服务 S02(本地 agent,新稿要「{智能体} 尚未登录」)和 S04(Cloud, 新稿要「Open Design 尚未登录」),装不下两句话。拆成 `.other` / `.amr`, **旧键从 union、`types.ts`、19 个 locale 彻底删除** —— 不留「落到随便哪一边」的可能, 并有源码级守卫钉着。三个调用点各自落位:amr → `.amr`;antigravity(终端登录)→ `.other`; 通用兜底 → `.other`。 ## ⚠️ 一条自己揪出来的假绿 原本用「S02 的标题 ≠ S04 的标题」证明拆键成功。撤实现验红时发现:**AMR 的 agent 标签 恰好就是 `OpenDesign`**,共用一个键时两句仍然不相等,那条断言照样绿。补了 `expect(s04).not.toContain('OpenDesign')` 才真能红。 ## 按裁决跳过的(T60 / T62 / T63 / T64) - **余额族整族不动**(T60):权威源是交付稿组件 18,`chat.upgrade.*` 已逐字一致; 新稿给这一族的是通用话术且删掉了 `{balance}`,相对交付稿是倒退。 - **S21 保持三态**(T62):文档一格 vs 我们三个可分辨状态,抄同一句等于悄悄合并。 - **S17 先放放**(T63):我们没有这个状态,那两个键是死键,真实 401/403 走 S04 那条路。 - **S29 正文不改**(T64):组件 22 是一行状态不是卡,没有正文槽。 - **S12「已有 {N} 秒」不采纳**:与产品 2026-09-04「因重复而收掉思考区计时」冲突。 - **S07 `{retryAt}`** 保留:新稿删掉它会让 `formatModelWindowRetryAt` 整条解析链变成死码。 ## 被更新的既有用例 7 个文件。其中 `run-error-ladder.test.ts` 那条「S19 每个语种都保留 `{agent}` 插值位」 是钉**旧稿**的,新稿没有插值位 → **反转成「都不带插值位」**,守的是「半退回的旧译文 偷偷把槽加回来」,手法与 `cliSessionRefusedMessage` 的 `{version}` 守卫一致。 `mirror-exec.html` 只含本次那 3 行(重生成会带进约 145 行无关 CSS 漂移,已剔除; 手工版与重生成版的文案字符串计数完全一致,已核)。 * fix(ui): 六个全屏遮罩压不住同屏 chrome,共享弹窗原语也在其中 产品裁决 2026-09-07:「那都修掉」。 ## 缺陷 画了背景的全屏遮罩做出的承诺是「我后面的东西都被压暗且失效」。这六个都压不住: | 文件 | 选择器 | 改前 | 改后 | |---|---|---|---| | `packages/components/src/dialog.module.css` | `.backdrop` | 100 | **1500** | | `styles/home/plugin-marketplace-demo.css` | `.plugin-marketplace__modal-backdrop` | 60 | 1000 | | `styles/home/home-hero.css` | `.home-hero-confirm__backdrop` | 80 | 1000 | | `styles/home/tasks.css` | `.automation-modal-backdrop` | 80 | 1000 | | `styles/home/plugins-view.css` | `.plugins-import-modal__backdrop` | 100 | 1000 | | `styles/workspace/drawer.css` | `.connector-drawer-backdrop` | 100 | 1000 | 同屏参照:输入框固定层 45、`.workspace-tabs-chrome` 120、右上角那簇真机量到 150、 同侪模态 `.staged-preview-modal` 1200。 ## 分档不是拍的 普查了全应用 36 个全屏遮罩,发现**应用里本来就有一档「应用模态」= 1000** (`BrandPickerModal` / `FigmaImportModal` / `LibraryPreviewModal` / `LibraryUploadModal` / `NewBrandModal` 五个 `.backdrop` 都在这一档)。五个全局遮罩放进**已有的档**, 它们各自独占一屏,没有谁需要压过另一张模态,1200/1500 是越权。 **共享原语是唯一的例外,1500 是推导出来的**: - 它没有自己的屏 —— 从 `EntryShell` 和 `ProjectView` 两处渲染,而且**会嵌在别的模态里**: `NewProjectPanel` 的删除确认活在 `NewProjectModal` 的遮罩(920)里,100 时**那个确认框的 遮罩画在了它自己的父弹窗底下**。 - 数值来自同一个闸门的另一条腿:`AmrOwnerTopUpDialog` 与 `AmrBalanceDialog` 是**同一个 三元表达式的两条腿**(同一个余额闸门,只按账单权限分叉),owner 那条已在 1500。 **一个闸门的两条腿不能差两档**,否则同一个时刻会因为你是谁而长得不一样。 `Dialog` 的消费者实测是 **17 个**(不是 14 —— 三个用多行 import,单行 grep 漏了): 13 个吃原语的遮罩、3 个自己往上escalate(1700/1700/1800,未动)、4 个用 `includeChromeClassName={false}` 完全不吃。**没有任何一个是故意压低的。** ## 守护测试 新增 `tests/styles/app-scrim-layer.test.ts`,按目录与 `components/chat/` 那条分工 (各自断言扫描到零个对方的文件,谁将来放宽范围都会红)。 判据四条同时满足:`position: fixed` + 覆盖全视口 + **画了背景** + **不是 `pointer-events: none`**。第三条把「点击捕获器」排除掉(全屏但透明的层职责就是待在 东西**下面**);第四条是本条新增 —— 我的范围够得着 `app-wash.css` 的 `body::before`, 它满足前三条却是 z −1 的装饰,没有它守护测试首轮会要求把整个应用背景抬到 150 以上。 尺子**只读 CSS 文本里的字面整数** —— jsdom 不做 `var()` 替换也不实现层叠, `getComputedStyle` 在这里会空转假绿。夹具先证明它读得回 60/80/100 这些**改前的真值**。 改前 13 条红(6 个缺陷 × 地板 + 分档,加同闸门两腿同档),**其余 30 个遮罩全绿** —— 尺子会区分,不是见谁红谁。逐个还原逐个验红,每次只红它自己那几条。 ## 未动,已记录 `.connectors-panel-embedded .connector-drawer-backdrop`(z 6,`position: absolute`)是 **故意压低**的,注释写着「so it does not stack above the settings modal」。它是**另一个 选择器**,抬基线够不着它;已在守护测试里钉成有意排除。 `.project-search-backdrop`(400)在地板之上,按判据不算缺陷,但它是 920 档以下唯一 剩下的遮罩,记在这里。 * fix(chat): 余额卡被压扁 / 卡改成按轮次存档 / 撤掉等待文案 / 两个白开销类名 ⚠️ **前置说明**:这几件都要改 `ChatPane.tsx`,而那个文件的 hunk 已随上一条提交 `611ab085f7`(文案对齐)一起进去了 —— 那条消息只描述了文案。本条描述的是同一个文件 里其余几件的意图。**看 `ChatPane.tsx` 的改动请连着这两条一起读。** ## 一、余额卡只显示一半高度(QA 2026-09-07) **根因不是底部让位不够,是 flex 把它当成了泄压阀。** `.chat-log` 是定高的列向 flex 滚动容器。flex 项默认 `flex-shrink: 1`,内容超出时浏览器 **先压扁子项、压不动才溢出**。绝大多数行压不动 —— 它们 `overflow: visible`, `min-height: auto` 解析成内容撑出的最小高度(flexbox §4.5 自动最小尺寸)。 但升级卡为了裁住右上角辉光和圆角写了 `overflow: hidden`,而**非 visible 的溢出会让自动 最小尺寸变成 0** —— 它成了整根流水上唯一压得动的那一项,一个人吃下全部负空间, 收缩到只剩自己的内距,再被自己那句 `overflow: hidden` 把下半截裁掉。 真实浏览器实测(已滚到最底):卡自然高 111.5px → 实际画出 **32px**,裁掉 79.5px; 加上修复后画出 111.5px,`scrollHeight` 918 → 998,**正好把被吃掉的 80px 还回来**。 三种可能都排掉了,有数为证:**不是 padding 不够**(20px 让位一分不少在那儿); **不是被钉住**(它是流水的直接子元素,符合 T51);**不是滚动冻结** (`scrollTop` 恰好等于 `maxScrollTop`,滚到头了还是半截)。 修法 `.chat-log > * { flex-shrink: 0 }` —— **归容器不归卡**:「会被压扁」不是余额卡的 毛病,是任何在这根流水里裁自己溢出的东西都会中的招,而圆角卡本来就该裁。补在卡上 只救这一张,下一个写 `overflow: hidden` 的还会中,而且照样长得像那张卡自己的渲染 bug。 `.chat-log-tail-spacer` 和 `.chat-virtual-spacer` 早就各自写了 `flex: 0 0 auto` —— 这条只是把它们各自的补丁提成整根流水的契约。 **52px 那笔账一个字没动**:底部让位只为**浮在流水上方**的东西算(药丸与 Jump 共用同一个 绝对定位浮层位),余额卡是流水里的一行,不需要让位。四种组合实测过,卡在不在**不改变 底部空间**;`w95-reserve-vs-anchor-spacer` 钉的「地板 + 顶补恒定」未受影响。 ## 二、升级卡改成按轮次锚定的存档件(T61 ①②③) 产品原话:「它就好像历史记录一样,存档在当时状态了,不能说我干个啥把当时的失败态搞丢了」。 改前:读数写在一个与轮次无关的 state 上,渲染在 `<ChatRows>` **之后**的尾部子节点 —— 所以**运行中就会出现**,而且新一轮的消息追加在它上面、卡跟着往下跑,永远只有一张。 改后:读数带上锚点(`amrBalanceCard = { balanceUsd, anchorMessageId }` **合并成一条 state, 让「只写一半」在语法上不成立**);账本 `lowBalanceTurnCardsRef` **只增不删**,锚点那一轮 进终态才记账;卡画在那条助手消息**紧下面**,位置由 DOM 顺序保证,不做位置计算。 「一轮结束」= daemon 三个终态 `succeeded`/`failed`/`canceled`,**外加**「`runStatus` 缺席 但已落 `endedAt`」(非 daemon 模式建消息时 `runStatus` 本来就是 undefined),与 `runtime/todos.ts` 同一条。**失败和被停止都算结束** —— 那恰恰是最该留凭据的两种。 ⚠️ **一条推翻既有设计的判断,已报备**:「余额恢复后旧卡还留不留」不在产品给的四条里。 按「不能把当时的失败态搞丢」做成**留着**,这推翻了原注释「上一轮缺钱、这一轮跑通了, 卡就该下去」。 ⚠️ **T61 第 ④ 条(存档)未做**:刷新后「跑到一半死在钱上」那张卡的数字仍是**现查的当前 余额**(失败事件不带余额)。充值后回看会写成「$20.00 / 余额可能撑不完下一个任务」, 数字是今天的、句子是当时的。已单独立项。 ⚠️ 删掉了一条自己写的假绿用例(「放行时锚点也一起撤掉」撤实现仍绿),测试文件里留了 说明。 ## 三、撤掉「等待首批输出中」,继续显示「思考中」 产品口述 2026-09-07。**这是同一条设计原则被撤的第二次** —— 稿子 `error-ux-design.md:21` 第 3 条「等待要有回音」,它的第一次实现 S12「已等 411 秒」 在 2026-08-27 就被撤过(原话:「改回进行中…但背后的探测逻辑先保留,后续可能会用到, 只不过用别的展现形式」)。本次照 S12 的既有形状:**撤文案、留探测、留钉子**。 ⚠️ **状态一行没删**。`waitingForFirstOutput` 才是那一行存在的原因:ACP 那一家 (vela/devin/hermes…)在首个 token 前**一条会落行的事件都不发**,删了它屏幕会退回 **完全空白**,而不是少一句话。只删了已无读者的显示层管线。 i18n key 留着退回死键:产品说的是换展现形式不是不再发生;而且 `locales.test.ts` 有一条 专钉它翻译质量的用例(土耳其语曾写成「等待首批**输入**」,正好写反)——**留着 key 才 留得住那条测试**。 ## 四、两个零消费的类名 `is-scrollable` / `is-scrolling` 在**全仓 CSS 里没有任何规则选中**,却各自驱动一次 setState:后者由 650ms 空闲定时器管,**每次滚动手势开始一次、停手后再一次**,各触发 一次重渲染 + 一次属性改动,零渲染收益。 `is-scrolling` 整条删除;`is-scrollable` 按产品意见**改成常驻写死**(`.chat-log` 从创建 起就是滚动容器,「是不是滚动容器」不随内容变;原来那个类表达的其实是「此刻有没有超出 视口」,名字与语义对不上)。 ⚠️ **第四个产地是 grep 找不到的**:ResizeObserver 回调里**内联**了同一段逻辑(没有调 `syncScrollable`)。那才是 H2 那条 A/B 测试真正的出口。顺带收益:那段内联逻辑**在每次 resize 通知里同步读 `scrollHeight`/`clientHeight`**,即在回调内部强制 layout;现在读全部 推迟进 `scheduleFollowSync` 的 rAF —— 对 H2 怀疑的那个「自喂环」本身也是减负。 ⚠️ **换掉观测点是这件事的前提,不是附带**:那两个类是 H2 A/B 测试唯一的 DOM 出口, 直接删会把我们调查滚动冻结的一只眼睛弄瞎。新观测点改成直接量 `.chat-log` 的 `scrollTop`(RO 回调唯一且直接的产物),**零生产代码新增**,并先证明这只新眼睛看得见 缺陷(在未改动的代码上强制摘掉自观察 → 变红)才动的刀。开/关两边结论与改前逐条一致。 ## 决策记录 T60(余额族归交付稿)、T61(按轮次存档)、T62–T64(S21 保三态 / S17 放放 / S29 不改), 以及 `run-error-catalog.md` §6.Z(R-051 只止血未对齐 S10)。 * fix(chat): 那一轮的余额存进它自己的失败事件,不再每次现查(T61 ④) ⚠️ **本条同时补齐 `f31c9b9b07`** —— 那条提交在这项工作在飞时把它的一半扫了进去 (带走了红测与 ProjectView 的新函数,没带走 contracts 字段声明与 effect 接线), 导致 HEAD 自己编译不过(5 条 `Property 'amrBalanceUsd' does not exist`)。 **补齐前不要拿 `f31c9b9b07` 单独出包。** ## 缺陷 「跑到一半死在钱上」那一轮,刷新之后卡还在,**但数字是「现在的余额」** —— `ProjectView` 那个 effect 只要失败消息 id 有值就现查钱包,而刷新后这个 id 是从**已落库 的消息**重新算出来的。 充完值再回看那一轮:「剩余额度 $20.00 / 余额可能撑不完下一个任务」—— **数字是今天的、 句子是当时的**,两边对不上,比卡直接消失更误导。 产品要的是凭据(T61):「它就好像历史记录一样,存档在当时状态了」。 ## 修法:写进那条已落库的失败事件(方案 a) `PersistedAgentEvent` 的 `status` 成员加 `amrBalanceUsd?: number`。事件存的是自由 JSON blob,daemon 对 status 事件**按引用原样 push、不做字段校验**,web 读回时裸 cast —— 不用数据库迁移。 **先例就在同一个函数里**:`chat-events.ts` 的 `appendErrorStatusEvent` 本来就会把后到的 事实(`code` / `failureCategory`)合并进同一条 error 事件。客户端补写派生数据不是新惯例。 ## 为什么不是「让 daemon 判定时发出来」(方案 b) 我原本认为 b 更干净(数据在产生它的一侧被记录)。**这个判断在这个仓库里不成立**: 余额**不是 daemon 在失败时手上就有的东西** —— 它同样要去读一次,而且读的是 web 已经 钉好身份的那个钱包(团队 vs 个人,`amr-balance-gate.ts` 那段注释是拿真账号打出来的)。 代价对比:b 要改约 6 处、跨 2 个 app,因为 **daemon 自己的 SSE→落库映射是白名单** (`chat-run-messages.ts:460` 只留 `kind`/`label`/`detail`),多发一个字段不会自动落库, 要在 daemon 和 web 两处各开一次口;还要在一条**已经在失败的路**上新增一次网络往返和 一个「读不到怎么办」的失败态。**换来的覆盖面完全一样。** ## 落地要点 - `amrInsufficientBalanceFailure` 一次返回 `{ messageId, archivedBalanceUsd }`,两者读**同一条 事件** —— 不给「id 取这条、数字取那条」留缝。 - `stampAmrBalanceUsdOnFailure` **就地改那一条,长度不变,不碰 `runStatus`/`endedAt`, 已有数字就原样返回同一引用** —— 三条都是为了活过 `mergeMessageWriteForDaemonBacked`(按数组长度判缩短、按终态判回退)。 - effect 加「有存档就不问钱包」分支。顺带**减少**一次钱包读:重开历史失败会话不再查。 ## 尺子自检 + 撤实现验红 修复前基线跑,尺子读出的正是缺陷本身:`expected '20' to be '0.35'`。 第三条红测的 `[undefined, undefined]` 额外说明:那条失败消息**本来就被 PUT 了两次**, 写路是活的,缺的只是字段。 另有一条**反向对照**修复前后都绿(「没存档过的那一轮照旧现查」)—— 有它才能说 「存档过就不查」是存档起的作用,而不是这一页根本发不出那次查询。 撤实现两处、逐条对应:撤「有存档就不查」→ 前两条红、第三条仍绿;撤「写回」那一行 → 只有第三条红。 ## 两条边界 1. **「跑通了但余额低」盖不住**,刷新后仍会消失 —— 那一轮**没有 error 事件可挂**, 要盖住得给 `messages` 加顶层字段(类型化列,要 `ALTER TABLE`)。**有意不做。** 2. **失败时客户端不在场**(run 在 daemon 里跑挂而窗口已关):第一次读数发生在重开时, 存下来的就是那一刻的余额。**改前这一格每次都错,改后是错一次然后冻住** —— 不是新引入的错,但值得知道。真要修只能走 b。 ## ⚠️ 一个会骗人的验证坑,记在这里 **`pnpm --filter @open-design/web typecheck` 会假绿。** 改过 contracts dist 之后, 不带 `--force` 的 `tsc -b` 会用陈旧的 `.tsbuildinfo`,上面那 5 条错误**第一次跑一条都 没报**。判 contracts 相关改动一律用 `tsc -b --noEmit --force`。 * fix(daemon): 鉴权判定三处误判——平台凭据、协议违规、工具输出 产品裁决 2026-09-07:「跟 amr 相关的都要修」「工具输出肯定不算吧?」。 三条共同的病:**裸子串匹配**。而 `collectFailureText` 把 `error` / `agent` / `stderr` 事件全收进语料,于是任何地方冒出那几个词都能把用户送去登录页。 ## 一、R-053:平台自己的凭据坏了,却让用户去登录 `run-error-catalog.md:215` 早就在册:「平台自己的 provider 凭据坏 `upstream_provider_unauthenticated` | **被误判成用户鉴权** | 「Sign-in required」(**错**) | 用户可否自救:**不可**」。 上游原话是「Upstream provider credentials are missing or invalid」——说的是**平台的**凭据, 而裸的 `includes('unauthenticated')` 把它当成了用户的。用户重新登录一百次也没用。 改后落 `UPSTREAM_UNAVAILABLE` / `upstream_5xx`,**web 侧本来就认** (`amr-guidance.ts:1643` 与 `:1267`,19 个 locale 现成)——不需要新码、不需要新文案。 顺带把同一个 vela switch 里的兄弟 `upstream_provider_forbidden` 一并归位(它原本落在 不透明的「Task failed」上)。 ## 二、协议违规被判成「去登录」 `acp/session.ts` 报错时拼的 `invalid session/new response: …` 含子串 `invalid session`, 被当成 AMR 鉴权失败。**纯协议问题 → 告诉用户去登录。** ## 三、工具输出被判成「你要登录」(推翻冻结表 D1) `npm ERR! you are not logged in` / `gh: not authenticated` / `curl 401 authentication required` / Figma MCP token 过期 —— 用户看到「请登录」会去登 AMR,而坏的是他 shell 里 的 `gh`。**让用户做一件没用的事。** ⚠️ **D1 那行没有独立理由**,只有组标题 `adversarial: text whose service-signature may not be the real cause` —— **作者自己的自认**。真正的理由在引入它那个 PR 的正文:那次的 主张是「只动码轴、不重新审判分类器语义」,这个错判是它**之前**就有的,只是被顺手对齐了码。 准确的码指向一张不准确的卡,卡还是不准确的。 ## 判据:让它表达真正想认的东西,不用排除法 **7 个子串在 vela 仓里根本找不到出处** —— `not authenticated`、`login missing`、 `sign-in-again`、`sign-in required`、`signin required`、`expired token`、 `token has expired`(最后一个只存在于我们自己的测试夹具里)。和上一轮的 `invalid session` 是同一个物种:凭直觉写的同义词,从来没有任何真实报文长那样。**全部删除。** `authentication required` 有出处,但那是 bifrost 的 per-user MCP 凭据库 —— **另一个主体的凭据**,也删。 活下来的三条判据,都在说「这行报文的说话人是谁」: 1. **一个码是一个完整的码** —— `VELA_AUTH_CODE_PATTERN` 用边界前后瞻, `upstream_provider_unauthenticated` 和 `mcp_auth_required` 是**不同的码**,不是这些 码加了前缀。 2. **`session` 是名词还是标识符的一截** —— `AUTH_SESSION_NOUN` 让 `session/new`、 `sessionId`、`session_token_ttl` 是名字,`invalid session`、`Session expired.` 是名词。 3. **归属**:报文自己点名了凭据归属人就信它;谁都没点名,daemon 才可以补上「是 agent 的」。点名有且只有两种形态:**工具调用信封**(词表复用已有的 `isToolErrorText`)和 **程序自报名**(`gh:` / `curl:` / `npm ERR!` 这种 Unix 约定,是形态不是名单)。 ⚠️ **「按来源分层」这条路走不通,查证后放弃**:`collectFailureText` 把所有来源拍成一个 扁平字符串;而且 D1 **根本不走 stderr** —— 它是 opencode 把工具失败塞进 JSON-RPC error frame 送来的,ACP 桥接按设计只读 error frame。 ## ⚠️ 反向用例逮住两次真的过度收紧(不是演习) - `dsh: MISSING_CREDENTIAL: llm-deepseek: no API key…` —— **agent 自己穿着工具的外衣**, 和 `gh: not authenticated` 位置、标点完全一样。**只有名字能分。** 所以加了 `OWN_AGENT_COMMAND_NAMES`(36 个,每个 shipped adapter 的 id + bin)—— **是我们自己人的白名单,不是工具黑名单**:方向反过来才成立,daemon 没起过的一律算外人。 它没法在模块加载期从 `registry.ts` 派生(会成环),所以写成字面量 + **一条漂移守卫 读真实的 `SHIPPED_AGENT_DEFS` 比对,漏一个就红**。 - `Unauthorized: OAuth token has expired` —— **状态短语被当成了说话人**。严重度标签 (`Error:` / `warning:`)和状态短语一律拒绝:它们说的是「有多糟」「服务端答了什么」, 不是「谁写的」。 ## 落点与冻结表 工具鉴权失败落**既有的** `tool_error`,不需要新码 —— `mcp_auth_required` 今天就落在 那里,现在这一族归到同一个落点。web 走通用卡,**那颗「登录」按钮没了**,工具原文留在 折叠诊断区。⚠️ 放任它掉进 `process_exit/fatal_rpc_error` 会显示「模型服务商报错」—— 那是另一种甩锅,`tool_error` 严格更好。要一张专属的「某个工具没登录」卡需要新 detail + 文案 ×19,**那要产品拍板,未动**。 新建第三张冻结表 `tool-vs-agent-auth-snapshot.test.ts`(33 条),每个 `*Before` 都是**实测** 值,并把「改前分类器」反向重建出来对拍 —— 基线不是谁的一句话。 `acp-service-failure.test.ts` **只有 D1 一行变**;`balance-vs-rate-limit-snapshot.test.ts` **零变化**。 **余额分支未动**(产品说 BYOK 那边先不管)。 ## 已知残留(写进表里,未硬造判据) `Authentication required for Figma. Visit …/oauth to connect your account.` —— **什么都没自报**:没信封、没前缀,"for Figma" 是散文。生产里它包在 `mcp_auth_required` 信封里发(已覆盖),裸着出现时任何判据都只能猜。 另记一处**测试里的假引用**:`vela-errors.test.ts` 曾声称 `apps/cli` 在 `run_test.go:180` 渲染 401 —— **那个文件不存在**。事实对但形状错,已更正为真实的 `ParseAPIError` 路径。 顺带发现 `details.kind: 'amr_account'` **全仓没有任何消费者**,web 完全按 `error.code` + `failureDetail` 路由 —— 任何走 `details` 的方案都会是隐形的。 * fix(chat): 低余额那一档整档撤掉,余额 0 那张卡和弹窗都保留(T66) 产品裁决 2026-09-07。给出软档那张卡的截图后: > 「**这个要不先不要了,跟产品说了一下,不要这个了**」 追问范围后: > 「**余额为零的那个卡片要显示的,并且也要弹窗的**」 ## 终态 | 档 | 终态 | |---|---| | 余额 `> 0` 且 `< $2` | **什么都不出**,直接放行 | | 余额 `= $0` | 卡 + 弹窗都在,拦住发送(**既有行为,核实为保留而非新增**) | | 跑到一半死在钱上 | 保留(T61 的凭据) | ## 从判定层摘掉,不是从渲染层挡掉 `AMR_LOW_BALANCE_WARN_USD` **删除**(核过没有其他消费者:不在埋点、不在契约、不在任何 闸门分档,唯一读取方就是它自己那两处比较)。余额 `> 0` 现在直接 `allow` —— **没有第二条比较,这条路上一次套餐读数都不发。** 「什么都不出」因此是**判定层没有第二条线的结果**,而不是呈现层补写了一个 `null`。 把阈值调成 0 也能让卡不出现,但那会让「软档」这个概念以看不出来的方式活着。 ## ⚠️ `soft` 混装了两件事,所以是换名不是改名 - ① 余额 `> 0` 但低 —— **这次撤掉** - ② 余额 `= 0` 但硬拦让了位(**T55**:档次读不出来,由 Vela 入场兜底)—— **一个字没动** ②今天出 $0 那张卡、不拦、不弹窗。撤掉①之后 `soft` 就名不副实了,所以②改名 **`empty_not_blocked`**,并在类型和分支上写死「只在 `balance <= 0` 可达,正数永远到不了」。 ## `whyLow` 保留,19 个 locale 一个没动 它还有一条活的来源:一轮跑到一半死在钱上、而**停下来时钱包还剩一点**(T61 的凭据, 如 `$0.35`),`UpgradeCard` 按 `balanceUsd > 0` 走的正是这句。有红测钉着 (`w62-mid-run-balance-wiring.test.tsx`「余额还剩一点的那一档,念的是真实读数,不是 0」)。 ## 红测与验红 新增 `t66-low-balance-tier-retired.test.tsx`,**故意不 mock `checkAmrBalanceGate`** —— 喂钱包读数、判定用真的,否则「$1.20 该算哪一档」就掉在判据外面了。 - 先红:`$1.20:流水里不出现任何余额卡` → `expected '1.2' to be 'none'` - 撤实现①(把低余额档接回去)→ **16 条红**(t66 六条 + w116 十条) - 撤实现②(把硬拦档出卡那句 `if` 短路掉)→ **反向用例单条红**,证明它不是恒绿 **硬拦档是保留不是新增**,证据:那条反向用例「$0:卡在、弹窗也在、发送被拦」 **在改动之前就是绿的**;既有用例 `ProjectView.amr-balance-card.test.tsx:501` 也早就在。 删掉 `w116-amr-low-balance-card-tiers.test.tsx`(整份都在测「低余额卡对所有档位可见」, 那张卡没了)。它唯一还成立的红线 ——「这条路上不许多打一次套餐读数」—— 搬进了新红测, 档位扫描也作为回归护栏保留下来。 ## 受影响的既有裁决 **T52 整条作废**;T51 适用范围缩小到硬拦档;T53 前半作废、后半(首页什么都不显示) 升为全局;**T61 ①②③④ 全部保留**,只是少了一条来源;2026-09-02「各只有一张」现在 只剩「额度耗尽」那一张;OPEND-2600 整条作废。四行都加了回指。 顺手把 `chat-panel-edge-audit.md` 两处指向已删常量的过期行标掉 —— 其中一行是 「2 → 5 待产品同意」的行动项,留着会有人去改一个不存在的常量。 ## ⚠️ 一个改前就存在的自相矛盾,未动,值得产品看一眼 `empty_not_blocked` 那一档:余额 **$0**、档次读不出来、**run 照跑**,而卡上写着 「**现在无法开始新任务**」。原来的 `soft` 分支同样如此。按「保留既有行为、不自造规则」 处理,但它需要产品看真机截图后单独裁一条。 * fix(desktop): 关掉内层滚动容器的橡皮筋回弹(滚动冻结的缓解) 产品裁决 2026-09-07:「**直接关掉**」。 ## 为什么 Electron 40 → 41 把 Chromium 从 144 跳到 **146,整个跳过了 145**,而 `kOverscrollEffectOnNonRootScrollers` 的默认值**正好在 145 从 DISABLED 翻成 ENABLED** —— 已拉 `branch-heads/7559`(M144)与 `7680`(M146)的 `cc/base/features.cc` 逐字核实。 它管的是「非根滚动容器撞到滚动边界时怎么表现」:145 之前只有整页会橡皮筋回弹, 之后聊天区这类内层容器也会。 我们在追的缺陷:聊天区的滚动范围被**永久冻**在某个早期内容高度上 —— 布局全对、 JS 程序性滚动能到底,**但滚轮和键盘都到不了**(scroll unification 之后两者都走 合成器)。位置(滚动边界)、平台(macOS 弹性 overscroll)、版本窗口三样都对得上。 ## ⚠️ 这是缓解,不是根治 **因果链没有建立** —— 合成页面 89 个用例(精确复刻几何、顶部 overscroll、普通滚轮 与触控板 precise deltas、真实节奏、反复重建会话、RO 自喂环、`fill:both` 残留 transform、初始余量扫 0~100、向上格数扫 3~40)**一次都没撞出来**,而那个 harness 的量法是可信的(负对照:挂一个 `preventDefault` 的 wheel 监听,当场判成冻结)。 **判据仍然是 `client_chat_scroll_frozen` 的事件量**:带着这一行还在报,说明这条线 错了,该把这两个 feature 放回去、回到候选列表找别的。这也是为什么同一批把探针的 会话级上报上限整个删掉了 —— 判据要靠事件量,报满三条就变瞎的话这条判据立不住。 ## 代价 macOS 上**所有内层滚动区失去橡皮筋回弹**(整页仍然弹)。产品知情并选择了它 —— 相对「滚不动」这个代价可以接受。 ## 落点 `apps/desktop` 与 `apps/packaged` 两处都加,理由同旁边那条 `ignore-connections-limit` 的注释:打包外壳可能比它捆绑的 desktop 构建活得久。 必须在 `whenReady()` 之前 —— Chromium 在会话初始化时就消费这些开关。 实验分支 `exp/disable-overscroll-features`(处理组包 `0.21.5-beta.1`)随之失去意义, 其 A/B 对照不再需要跑。 * feat(chat): 下线意图澄清里的设计风格选择卡片 (OPEND-2760) 提示词侧不再让 agent 出「设计风格」这一类 question-form: direction-picker / discovery-question-form 两个 atom 的 SKILL 与 daemon/contracts 的 prompts 同步删掉该问法。前端 visual-style-catalog 与 visual-style-deck 保留但不再被澄清轮引用,组件代码加注释说明可能找回。 用户裁决:「这些代码先讲提示词干掉, 组件代码注释, 后续可能要找回」。 od-next 策略分支核对过,其澄清轮本来就不枚举问题类型,无需改动。 * fix(chat): 报错卡片统一主 CTA 为切换到 OpenDesign Cloud (OPEND-2772, OPEND-2745) 2772:BYOK/自带 CLI 的各类报错原本各出各的卡片 —— 独立的 AMR 推荐卡叠在 错误卡下面,一屏两张卡两个主按钮。现在合并成一张:主 CTA 一律是「切换到 OpenDesign Cloud」,铺到所有会由用户自己的模型服务引发的报错码。 删掉 AmrGuidance 组件与 .amr-card__* 局部样式,推荐语并入统一卡片。 2745:宿主自己写的卡片(余额、报错)此前会被当成一次 run 渲染,于是跟着 出「进行中 / 已完成」这类运行状态。新增 assistantMessageNeverHadARun 把「这条消息从来没有过 run」判出来,该行整行不渲染。 用户裁决:「2772 的『统一』是『铺到所有报错』, 主 cta 都是切换至 cloud」。 * fix(chat): 团队成员充值弹窗按设计稿重做,并补回个人档的升级入口 (OPEND-2720) 弹窗侧:AmrOwnerTopUpDialog 原本没有 banner,标题 12px 左对齐、CTA 只有 58px 宽。按设计稿重做为 480 宽卡片 + 480x205.71 出血 banner(复用既有的 /upgrade/cloud-signin-aurora.jpg,与 AmrBalanceDialog 同一张,不新增资源)、 18px 居中标题、满宽 40px 主按钮,owner 名字加粗。新增的 4 个 --chat-* 变量 亮暗两个作用域都定义。CTA 的样式覆写写成 .modal .cta,靠特异性压过共享 Button 基类,不依赖打包顺序。 升级入口侧:workspaceUpgradeUrl 此前一律要求 canManageBilling,而该权限 是 readable && role==='owner' 的团队语义。个人 workspace 只有一个成员、 钱包就是本人的,这道闸把用户自己的付款路径删掉了,弹窗弹出来却没有落点。 新增 canReachWorkspaceBillingEntrance 放在 buildWorkspacePermissions 旁边 (团队仍由该权限位把守,B 端也会服务端拒绝),弹窗分支与链接解析共用它, 两边不会再各说各话。 说明:打包版走 vela directory 分支,个人档 role 解析为 owner,因此线上 不受影响;本地 tools-dev / 自建 daemon 走「请求头即权威」分支才会踩到。 * docs(chat-panel): 同步裁决表、边界审计与运行错误清单 记录本轮四条裁决:设计风格卡片下线、报错卡片统一 CTA、宿主自写卡片不报 运行状态、个人档升级入口的权限语义。 * chore(specs): 把 Plane 工单证据附件移出仓库 18 个附件(截图 + 一个诊断 zip)共 40MB,其中 13 个单文件超过 CI 的 1MB 变更文件上限,Static gate 因此常红。这些附件的权威源本来就是 Plane, 仓库里没有任何地方按文件名引用它们 —— 只有一句话指向 manifest。 manifest.md 保留:它记着每个附件对应哪个工单、当初取到没取到, 要看原图去 Plane 拿。本地副本在 ~/Documents/od-plane-evidence/。 * fix(prompts): 把「视觉方向不是一个可以问用户的问题」补回 discovery 首层 (OPEND-2760) 2760 下线设计风格卡片时,把 `direction-cards` 从问题类型清单里删掉了, 但同时也删掉了唯一那条无条件禁令,只剩「有活跃设计体系时不许发」那条带 前提的。于是类型没了、禁令也没了 —— 模型完全可能自己即兴发一个方向选择 表单,而那正是 2760 要消灭的东西。 放在 discovery 的 core-directives 首层(「read first — these override anything later」),不放在 system.ts:那条带前提的句子在 ACTIVE_DESIGN_SYSTEM_VISUAL_DIRECTION_OVERRIDE 里,只有存在设计体系时才 入 prompt,怎么改都救不了没有设计体系的那条路径。也不放「Structured clarification」段:daemon 侧那段被 slim 变体跳过,而 slim 是生产默认值。 措辞只点行为、不点已下线的类型名 —— `question-form-visual-style-retired` 那条守卫连否定句都不许留(「一句『不要用 X』同时也在告诉模型『有个 X 可以用』」)。末句保留 `brand` 问题的豁免:它问的是「有没有品牌/参考来源」, 不是方向选择器,几条测试钉着它。 快照 15 处 totalChars 各 +429,恰好是走 discovery 层的 15 个场景; 不走该层的 5 个场景一字未变。 * fix(chat-mirror): 验收陈列页一直在拿回退字体量几何 mirror-exec.html 全文没有一条 @font-face,也不引外部样式,而 measure.mjs 用裸静态服务器托管它 —— 它声明的 "Albert Sans" 从来没被加载过,所有几何 读数都是在 PingFang SC 上量的。对稿子的 geom 差异 680,其中 61 条是这个 系统性偏差造出来的假差:22/90 格读数受影响,格 16/17/87/27/66/71 报的 「实现没对上」全部是假象(同一颗按钮被重复报了 3 次),而格 43 有一条真 差异一直被错字体正好抵消掉。 不把字体字节提交进去:同一份字节 apps/web/public/fonts/ 里已经有了,再复制 一份进 HTML 是 +423KB,还会撑破 CI 的单文件 1MB 上限。改成工具进仓库、 字节留本地: - inline-fonts.mjs 从 base.css 现场解析 @font-face 整段搬过来,只把 url() 换成同一份字节的 data: URI。描述符一个字不抄,「逐字一致」由构造 保证 —— 包括 JiduMono Pro 那个只有 Regular 一份字节却要声明成 500 的 描述符(两处只改一半就是坏的)。带 --strip 还原。 - check-fonts.mjs 量数前的前置闸。判据是差分(同一段文本带/不带该字族 的宽度必须不等)加一个反向对照(不存在的字族差分必须为 0),不用 document.fonts.check() —— 它在零 @font-face 时返回 true,真空成立, 正好放过这次要抓的坏法。 - 生成器不注字体,改为在页顶留一条「还没上字体」的横幅,并让注入块把它 藏掉 —— 「有字体」和「横幅不见了」因此是同一件事的两种表现。横幅走正常 文档流,而 geom 是格内相对坐标,动不到任何一格的读数。 页面同时带上了内容跟进:提交版是很久以前生成的,这次重新生成把 tokens.css 后来落地的那几段带了进来。 * docs(collab): 写明项目页那个 role='member' 是只读态的承重实现 它看起来像「还没接上真实角色」的占位符,实际是「创建者可写 / 非创建者只读」 的全部实现:role 钉在 member ⟹ privileged 恒 false ⟹ canMutate 退化成 selfCreated。谁把它「修好」成真实角色,工作区 owner 就对工作区里每一个项目 都可写(包括不是他建的),只读态当场消失,而且没有任何测试会红。 同一条路径也不许改成去查目录或等 /api/workspace/context:只读态在首屏渲染 路径上,先渲染错的身份再纠正同样算回退。 两处一起写,免得只改一边的人看不到另一边:生产者(project-workspace-scope) 和消费者(workspaceResourceAccess)各一段,互相点名。 真正的缺陷不在这个硬编码,而在付款入口误用了它 —— 一个声明过「我不解析身份」 的上下文被拿去判身份,导致团队 owner 在项目页被降级。那条链另行修复。 * test: 修两条 CI 红,一条是误提交的红测,一条是编出来的夹具 **od-next coordinator**:那条红测是更早一次调查里「故意留红、明说不提交」的 (07bd6d9149),被我在提交 2760 时按文件名一起扫进了 501eb5640a —— 那次提交 对 od-next 只动了这一个测试文件,零源码改动,提交说明自己还写着「od-next… 无需改动」。 它断言的也不是仍然成立的不变量,而是被裁决推迟的产品行为: chat-panel-issue-log-2026-08-28.md:58「不隐藏失败卡、不做关键词猜测。未来若要 支持 Design 模式纯问答,需显式 structured intent,作为独立产品设计」。实测复核 过:放开 deliverableValid 之后这条仍然 blocked(第二道 fail-closed 闸挡着), 而邻居那条「拒绝把 silent no-op 洗成 completed」立刻转红 —— 两条 fixture 除了 agent 那段散文输入完全相同,只有靠猜文字才能分开,正是裁决点名禁止的。 改成 it.skip,正文原样保留,docblock 记下裁决和实测结论。 **e2e AMR 认证收敛**:不是 2772 波及,真凶是 ff2b46fe7f(鉴权判定三处误判)把 子串匹配换成了归因判据。而假 vela 发的「Your authentication token has expired. Please sign in again.」这句话在真实 vela 仓库里零命中 —— 是夹具编出来的。 换成实测验证过的真实报文(vela API 401 → CLI ParseAPIError →「API request failed with status 401: unauthenticated」),断言一个字没动,守卫反而更强了。 改回旧夹具能复现 CI 那条失败,因果链是量出来的。 无产品代码改动。 * fix(chat): 项目页的付款入口改读权威工作区身份 (OPEND-2720) 真机六格矩阵挂了两格,根因是一个「声明过自己不解析身份」的上下文被拿去判 身份:项目页的 workspace-scope 走本地快路径,role 恒为 member(那是「创建者 可写 / 非创建者只读」的实现,见该处注释),而余额弹窗分支、卡片 URL、弹窗 URL 三处都从它读 role。 后果: - 团队 owner 在项目页被判成 member,拿到一张没有升级按钮的「请联系团队所有者 充值」—— 他自己就是所有者(矩阵 B 格) - 个人档 max 用户,卡片跳 billing=plan、弹窗跳 billing=auto-recharge,两者 各说各话(矩阵 C 格),源码注释早就把这称作缺陷 修法是 merge never swap,不是换掉上下文:新增纯函数 workspaceBillingAuthorityContext(scoped, authoritative),只采纳 role 一位, 并用 scope 自己的 lifecycleState/memberStatus 重算权限(冻结的项目不会因为 「你是 owner」被解冻);要求权威上下文的 workspaceId / workspaceType / workspaceMemberId 三者全等且成员在职,否则原样返回 scope。属性测试遍历各种 权威候选,断言结果的工作区身份永远等于 scope 的 —— 「绝不掉回个人钱包」那道 防线的前提是身份能被换掉,而这里没有能换掉它的入口。 daemon 源码一行未改:scope 继续走零网络的本地快路径,只读态判定不受影响。 新增守卫钉住「非创建者进入别人建的项目 = 只读」这条此前零测试保护的不变量, 并断言该判定不发起任何网络请求(把 fetch 换成会抛的 spy 验的)。 顺带修好一格:个人项目在「环境里选中另一个工作区」时,弹窗以前会把人送去别的 工作区的账单页,现在钉在项目自己的工作区上。 * test(e2e): 三条 UI P0 判据跟上已裁决的行为 **余额那条不是 2772 弄红的** —— CI 时间线钉死:f8bd7d5dc0(09-04 10:44)绿, bd5ddea74e(09-04 14:48,OPEND-2597 把升级卡的回填改指 /api/workspace/billing?scope=workspace)之后,a553a7fa31(09-05 02:02)就红了, 而 2772 是 09-07 才落地的。夹具原先没给账号级钱包接口打桩,回填读失败,测试 一直在跑「钱包读不出数字就把白卡还回来」那条 fallback;2597 改指的那个接口夹具 恰好有桩($20.00),fallback 就不再触发。 「Top up」入口本身没被删(ChatPane.tsx:4349-4388),变的是什么时候画那张卡: 余额不足时白色报错卡把回合让给升级卡(T60 产品裁决「额度不足和额度耗尽,升级卡 各只有一张,不存在第二张白色通用报错卡」),充值卡只在升级卡接不住时回来。 失败那一刻的 CI 无障碍快照就是这个形状:只有 Balance left $20.00 + 一颗 Upgrade,没有白卡也没有 Cloud CTA。判据改成钉住这个已发布的形状。 **另外两条确实是 2772 弄红的**::728 / :896 那两条「不推荐 AMR」期望 0 个 Cloud CTA。T68 裁决「铺到所有报错」正是要把它铺开,所以断言翻成 1。2772 更新了 8 个单测文件却一个 e2e 文件都没更,这是漏网。同族还有 :888 那条 zh-CN 页面却 断言英文按钮名(翻转前就恒真),一并改成 zh-CN 名。 **api-empty-response 不是 flaky**:8d0b542d0a 把共享弹窗遮罩的 z-index 从 100 提到 1500,盖住了 z-index 120 的标签栏,点击卡在可操作性检查上 113 秒才超时, 报出来的 page.goto 只是超时展开后的下一个动作。补 suppressWhatsNew。 无产品代码改动。 * fix(e2e): 给导轨开合的点击加超时上界;去掉账单身份里那条死判断 **导轨点击**:`openNewProjectModal` 把 `ensureRailOpen(page).catch(() => {})` 包起来,注释写着「绝不允许它让流程失败」。但里面那个 `toggle.click()` 是裸调用, 而 playwright.config.ts 全文没设 `actionTimeout`,于是吃 Playwright 的默认值 0 (无上限)—— 点击一旦被遮挡就不会 reject 给外层 catch,而是一直挂到整条测试 超时,失败还记在超时展开后的下一个动作上,完全指不到真凶。实际发生过一次: 共享弹窗遮罩的 z-index 从 100 提到 1500 之后盖住了 z-index 120 的 chrome, 一条 UI P0 因此耗掉 120 秒。 定成 T.short(本机 3s / CI 6s,现成常量,自带 CI 缩放)。不取 T.medium 是因为 test:ui:extended 那条 lane 预算就是 10s,10s 的上界不成其为上界。点击前一行刚 断言过可见,剩下只有 stability / hit-target 轮询,而本仓库 UI 过渡预算约 200ms, 3s 有一个数量级余量。仓库里已有同形先例(app.test.ts:1005)。 **账单身份**:workspaceBillingAuthorityContext 原先要求权威上下文的 memberStatus 是 active 才采纳角色。产品目前没有「移出成员」的入口,这个条件在现实中不可达; 即便将来可达,残留影响也只是被移出的人还看得见一个升级链接,而钱的动作后端另有 强制。去掉,注释写明理由而不是留个哑口。 顺带补了一条真正承重的守卫:采纳角色不许复活已关闭的成员 —— scope 自己报 removed 时,即便采纳了 owner 角色,权限位仍为 false。它和原有的「采纳角色不许 解冻」是同一道防线的两半。两条都撤实现验过会红。 身份三位全等那条一个字没动,属性测试照旧全绿。 * test(e2e): 只读判据跟上 OPEND-2624 的裁决;八条 spec 补上更新弹窗抑制 **只读那条不是回退,是判据过期。**project-management-flows:426 断言的是 「scope 已答 personal、/collab/status 还没答 → 仍须只读」,而 a17a22e32a (2026-09-04,OPEND-2624)故意改掉了这个行为:daemon 一确认 personal 就立刻 给写权限,不再吊在 status 上等 —— 修的正是「用户自己建的私人草稿被显示成 共享只读,聊天/上传/编辑/导出全灰」。那次加了 jsdom 裁决测试,却没同步改这条 e2e。它此后一直靠抢跑维持绿:抢在 React 把 scope 响应上屏之前读一次旧 DOM。 trace 显示这次预览渲染花了 126ms,抢输了,首跑和重试都输。 两个 SHA 之间这条链的产品代码逐字节相同(collab/、ChatPane、ChatComposer、 FileWorkspace、FileViewer、App、composer 全部 diff 为空),所以不可能是产品 造成的行为差异。判据反转,416/417 那两条 fail-closed 原样保留 —— 它们是真的 (scope 未落定 → workspaceContextLoading → 只读)。新写法用 not.toHaveAttribute 会一直轮询到属性消失,顺带把竞态本身也消掉了,不是换个方向再赌一次。 **更新弹窗抑制**:CI 上 daemon 把自己认成打包版(app-version.ts 的 linux 分支 判 execPath 含 /opt/,而 runner 的 node 在 /opt/hostedtoolcache/),channel 因此 解析成 stable,真去 R2 拉了发版卡片;再叠上 8d0b542d0a 把共享弹窗遮罩 z-index 从 100 提到 1500、盖住 z-index 120 的 chrome,点击就永久挂在可操作性检查上。 两个条件缺一不可,失败还记在超时展开后的下一个动作上,完全指不到真凶。 逐个核过「这个 spec 的路由网能不能吃掉 /api/whats-new」,四条已被自己的兜底大网 挡住(design-systems-manager / settings-media-providers / visual-entry / visual-navigation),给它们再加是噪音;真正暴露的八条已收掉。也确认了没有任何 spec 是故意要看这张卡片的。 mock-factory 里那句「fixture 也装了这条路由」原本只对 vela-status 成立,紧跟在 suppressWhatsNew 后面容易被读成两条都装 —— 点明 whats-new 不由 fixture 装, 否则下一个人会照着把这八处删掉。 daemon 那条 typecheck:ProjectWorkspaceScope 有 unbound 和 unavailable 两个 context 为 null 的变体,原代码只排除了一个。 * fix(prompts): 把设计风格选择整题下线,并修好那条永远不会红的守卫 (OPEND-2760) 前两轮只删掉了 `direction-cards` 这个类型。抓 daemon 真实写给 agent 的 stdin 字节发现,线上默认路径(slim)里还留着两处:一道 `tone` 心情多选题 (editorial / minimal / playful / tech / luxury / brutalist / human),以及 把「brand or visual style」列进澄清优先级。产品裁决原话是「把提示词里让 agent 感知到 question-form 能出设计风格的那些提示词下掉」,追加「tone 也下掉」。 **上一轮补的那句禁令从来没到过模型**:它落在 discovery 层,而 `server.ts` 默认 `promptCoreVariant: 'slim'`,`system.ts` 把整层 gated 在 `!isSlimCore` 后面。实测删掉它,默认路径抓包一个字节都没变。所以这次删掉它, 并退役 `system-prompt-api-mode.test.ts` 里那条要求提示词包含 'Do not emit a direction question-form' 的断言 —— 那条来自 #2579,当年方向 选择器还在,是搭便车的历史遗留。仓库自己的原则写着「连否定句都不许留:一句 『不要用 X』同时也在告诉模型『有个 X 可以用』」。 **守卫过去永远不可能变红。**它写的是 not.toMatch(/`tone`/),而 core-slim 是模板字符串,源码里的形态是 \`tone\`(反引号被转义),两者永不相交。修法不是 逐条补转义(那要求以后每个人都记得补),而是先把源码还原成模型真正读到的样子 再匹配,整份文件一次性摆脱这个盲区。同时发现第二类同形失效:按短语找的正则 会被行内反引号打断(`visual-style` catalog),另给一个去反引号的读法。 还有个比转义更致命的覆盖面问题:`tone` 那条以前只扫两份 discovery.ts,而那道题 真正住在 core-slim.ts —— 少扫的恰好是唯一有货的那份。现在按 PROMPT_PATHS 七条 全扫,并补上题 id / 散文点名 / 本地化文案三种形态。 证据(同一台 daemon、同一个项目、同一条请求上成对 before/after,所以别人在飞的 改动在两次抓包里都在、做差抵消):`tone` 2→0,`visual style` 1→0,字节 46,156→45,938,差 218 = 23+67+128,和三处删除逐字符对得上;完整文本 diff 只有 这三行。classic 路径另抓一对:`视觉调性` 1→0。快照 17 行 totalChars,零其它变化。 保留的两处是正面指令,不是选择器:core-slim「无设计体系时自己从 direction library 里选,不要再问用户」、directions.ts「按 brief 的 tone 挑」。 * test(e2e): 让 e2e 的 daemon 自称 development,并把更新弹窗抑制挪进共享 fixture CI 上的 daemon 会把自己认成打包版:app-version.ts 的 linux 分支判 execPath 含 /opt/,而 GitHub runner 的 node 就在 /opt/hostedtoolcache/node/…/bin/node。 channel 因此兜底成 stable,whats-new 那条真去 R2 拉了发版卡片;再叠上共享弹窗 遮罩 z-index 从 100 提到 1500 盖住 chrome,点击就永久挂在可操作性检查上。 这正好违背 app-version.ts 自己 33-37 行写的意图:「development/CI builds resolve to no card so the card never intrudes on tests」。 不碰 app-version.ts 的 /opt/ 判定(那是产品代码、影响打包版身份识别),改成在 e2e 自己起 daemon 的环境里设 OD_RELEASE_CHANNEL=development。设在 runToolsDevJson 这个唯一咽喉处 —— Playwright worker 套件、Vitest smoke 套件、 collab-cluster、artifact-render-parity 全从这里过,而且它本来就管着同一类 env (CODEX_HOME / OD_DATA_DIR / OD_MEDIA_CONFIG_DIR)。只在 e2e/lib/ 下,开发者的 pnpm tools-dev 和打包版都不受影响。常量排在 process.env 之后、extraEnv 之前: 外部 shell 值拖不进卡片,而想测发布通道的 spec 仍可自己传。 证据不是「我设了变量」:新测试直接 import harness 的 env 组装函数和 daemon 的 resolveAppVersionInfo/whatsNewSourceUrl,首条就是红基线(/opt/ 路径确实解析成 packaged 且真的拿到卡片文档);另外真起了两次 daemon —— 默认 → channel development 且 /api/whats-new 空,对照组 OD_RELEASE_CHANNEL=beta → channel beta 且拿回真实 R2 卡片。macOS 默认那次单独不能证明什么(macOS 两种情况都不算 打包版),beta 那个对照才是证明值真的穿过了整条链。 顺带查出 channel 共有六个消费者而不是两个:whats-new、installer-apply 观测 (e2e 下无状态,惰性)、langfuse 桥、诊断导出、任务观测导出,以及「关于」面板 的展示文本。前四个是遥测归因,方向一致(CI 不再自称 stable);「关于」面板是 唯一测试可见的,但读它的三条 spec 都自己打桩了 /api/version,没有任何断言依赖 daemon 解析出来的 channel。 弹窗抑制挪进 suite 的 auto fixture(auto fixture 先于 spec 的 hook 建立,想看 卡片的 spec 后注册可以盖掉)。八个 spec 里逐个加的调用保留:fixture 只绑内置 page,自己开新 page/context 的 spec 盖不到 —— 这正是 applyStandardMocks 也留着 自己那份的原因。两条防的是不同场景:设 channel 让 daemon 根本不去取卡片(CI 的失败),fixture 防的是 daemon 真给了卡片时页面还是看不见(本地恰好被认成打包 版,或机器上带着 OD_WHATS_NEW_URL —— 那个变量会直接盖过 channel 判断)。 * fix(collab): 给「这两个上下文是不是同一个人」一个名字,修掉它造成的五处缺陷 项目页的 workspace scope 走本地快路径,role 恒为 member(承重结构,是「创建者 可写/非创建者只读」的实现);壳层的 /api/workspace/context 给真实角色。两侧 context 的其余位都一样 —— 缓存 key 里的 canShareProjects/canWriteSyncedFiles 只看 memberStatus+lifecycleState 不看 role —— 所以两侧 key 有且仅有 role 一位 可能不同,真实角色是 owner/admin 才错位。这正是「为什么只有 owner 中招」。 这已经是同一根因的第 5、6、7 次,每次都是某人在某处顺手拿 role 比 key。所以 先给它一个能被测试钉住的名字:workspacePrincipalKey / isSameWorkspacePrincipal 放在 contracts,和 workspaceBillingAuthorityContext 并排(后者本来就在手写这个 比较,现在也改成走它,于是全仓只有一处定义)。docblock 列了全部七处已知实例, 「你为什么没走这个函数」在评审里答得出来。 刻意不比 memberStatus / lifecycleState:两侧描述的是**不同对象**的状态 —— scope 的 lifecycleState 是从项目 resourceState 推的,壳层报的是工作区的。 一个活跃工作区里的冻结项目,两者本来就该不一致。那是身份的状态,不是身份。 修掉的五处: - AvatarMenu:在项目页点一个被套餐锁住的模型,tooltip 写着「升级即可使用」, 点下去什么都不发生。它既要合并权威身份(团队 owner),又要改用 canReachWorkspaceBillingEntrance(个人档豁免)—— 只做一半就只修一半。 :301-303 那句「个人工作区不受影响」的注释从 356c8c364f 落地第一天就是错的, 一并改对。 - projects.ts:437 团队 owner 从目录卡片点开某些项目直接报「项目不存在」, 硬失败无兜底;:591 首开团队项目的渐进快车道对 owner/admin 完全死掉。 - project-display-cache:owner 在项目页改了分享状态,首页网格的快照永远不被 标脏,回首页看到旧状态 —— 唯一会给用户看错数据的一条。标脏和 patch 两个 入口都改,只改具名那个会在另外两个入口留同样的 bug。 - useProjectWorkspaceScope:bootstrap 已经付过钱的 scope 种不进去,每次开项目 多一次 GET 加一段 fail-closed 骨架。 两个夹具是生产中不可能出现的形状(scope 端点返回 role:'owner',而 daemon 那条 路由只有一个分支、永远写死 member),改成真实形状之后,两条一直在绿的既有用例 当场变红 —— 它们此前是靠假夹具过的。新的根不变量测试用 buildWorkspacePermissions 推导权限而不是手写,免得夹具再悄悄漂回去。 daemon 源码一行未改,只读态判定不受影响,不引入任何网络等待。 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-07 17:08:24 +00:00
PerishFire	8ab7c3d5f1	feat(standalone): establish the exact lifecycle and Terminal carrier (#7716) ... * feat(standalone): add shell-neutral exact lifecycle * feat(terminal): add native exact cold-start carrier * test(terminal): exercise mutable exact channel heads * feat(standalone): model synced blobs and Shell updates * feat(terminal): exercise the complete Shell lifecycle * feat(release): add the independent exact Terminal line * test(exact): run the full local Terminal release line * feat(terminal): harden exact Sidecar lifecycle * feat(standalone): prove exact update transactions * refactor(standalone): separate shell lifecycle dimensions * refactor(e2e): decouple terminal exact drivers * refactor(terminal): isolate exact sidecar fixture host * feat(terminal): gate handoff on physical retirement * refactor(release): gate exact activation on public acceptance * test(terminal): formalize guarded lifecycle algebra * fix(terminal): guard shell installer handoff * feat(terminal): add exact bootloader handoff * feat(terminal): integrate exact sidecar lifecycle * refactor(exact): rename validation channels * test(terminal): harden exact release acceptance * fix(postinstall): build standalone dependencies first Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(ci): build the native Terminal scene Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(ci): cover exact convergence handoff routing Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(exact): isolate terminal validation from main CI * fix(terminal): complete shell update confirmation Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(exact): bind acceptance to installed manifest Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(standalone): block occupied shell installs Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-09-03 03:50:34 +00:00
Marc Chan	1d2150007b	chore: remove extracted landing-page from the monorepo (#7727) ... * chore: remove extracted landing-page from the monorepo The marketing site now lives in a separate repository. Drop the Astro app, its GitHub workflows/scripts, and the remaining monorepo coupling so this workspace no longer builds or deploys it. * fix: drop leftover landing-page coupling from Teams and skills Point development enterprise URLs at the deployed marketing origin, remove nextjs-app skill outputs that no longer emit a page, and stop advertising apps/landing-page in plugin marketplace metadata. Generated-By: looper 0.12.0 (runner=fixer, agent=omp) * fix(ci): restore DSH installer E2E Vitest routing Removing dsh-bootstrap-identity dropped the only planner route from tools/release/resources/dsh-bootstrap/ to web_tests_required, so installer-only PRs skipped e2e/tests/dsh-installer-version-policy.test.ts. Generated-By: looper 0.12.0 (runner=fixer, agent=omp) * docs: drop leftover landing-page paths from template assets The skill contract no longer advertises the extracted Astro app, but styles.css, compose.ts, and example.html still named deleted apps/landing-page sources. Describe the standalone template behavior instead and keep the bundled plugin example in sync. Generated-By: looper 0.12.0 (runner=fixer, agent=omp) * docs: keep landing-page off review and test surfaces Add apps/landing-page to the forbidden-surface review list and stop naming the extracted path in plugin registry acceptance tables. Generated-By: looper 0.12.0 (runner=fixer, agent=omp) * fix: drop leftover landing-page refs and bump plugin version Stop naming the deleted apps/landing-page in the landing-deck demo and plugin-registry plan. Bump example-open-design-landing to 0.1.1 and keep the official catalog version aligned with the bundled manifest. Generated-By: looper 0.12.0 (runner=fixer, agent=omp)	2026-09-03 03:21:08 +00:00
nettee	ff2cc80f33	chore(amr): use default Vela agent runtime (#7726)	2026-09-02 09:32:03 +00:00
lefarcen	09bd500d43	fix(plugins): enforce HTML preview contracts (#7707) ... * fix(plugins): enforce HTML preview contracts * fix: fail closed on preview contract I/O errors	2026-09-01 14:17:59 +00:00
lefarcen	1c1ecae470	fix(web): preserve HTML preview state across edit handoffs (#7592) ... * fix(web): preserve HTML preview state across edit handoffs * test(web): align reload race coverage with URL handoff * test(e2e): target canonical active preview frame * fix(preview): complete URL edit handoff parity * fix(e2e): classify preview round-trip parity * fix(preview): close edit handoff readiness gaps * fix(preview): close remaining handoff regressions * refactor(preview): centralize runtime state contract * test(preview): isolate parity audit runtime	2026-08-31 01:32:49 +00:00
nettee	df84ae5b9e	refactor(web): remove unused component islands (#7591)	2026-08-29 14:18:01 +00:00
nettee	60be43c132	chore(repo): remove accidental Bun lockfile (#7589)	2026-08-29 14:17:38 +00:00
lefarcen	1e34ca4059	fix(daemon,web): report analytics for daemon-started Runs and mid-write Labs toggles (#7514) ... * fix(daemon,web): report analytics for daemon-started Runs and mid-write Labs toggles An OD Next task runs as several physical Runs — the user's request, then the repair and production stages the daemon starts itself. The Run analytics lifecycle was installed inline in POST /api/runs, so only the stage a client asked for ever reported: volume, success, failure, cancellation, duration and artifact counts were all computed on the request stage alone. Walking every Run-creation site rather than only the one the report named found three more callers in the same position — scheduled Automations, live-artifact refreshes, and POST /api/chat. Extract the lifecycle into routes/run-analytics-lifecycle.ts and install it from internalRunCreation.start, which is now the only way a physical Run starts. Its analytics argument is required, so a new caller has to state its identity — including stating that it has none — instead of silently dropping the Run, and a guard check keeps the bypass from coming back. A daemon-created Run inherits its caller's identity and its task lineage from the Run that caused it, resolved through the same deterministic fallback the lifecycle itself applies. Reading the source Run's recovery record instead would race: the lifecycle re-reads host facts before capturing, so a short Run hands off before its own record exists. Also split the Labs mounted guard. It sat in front of the toggle event and the dialog's save pill as well as this component's state, so leaving the section while the write was in flight lost the event and left the pill on "Saving" for a preference the machine already held. * refactor(daemon): move the run analytics lifecycle to its owning domains Review follow-up. `createRunAnalyticsLifecycle` takes no Express request or response, so by `apps/daemon/AGENTS.md` it is a reusable daemon service and belongs under `src/services/`, not `src/routes/`. The run/project record shapes it shares with the run routes describe a Run, not an HTTP exchange, so they move to the runs domain. The seam also carried a second copy of the analytics facts, with its context, snapshot and rollout fields widened to `unknown` so the two definitions could drift. `RunAnalyticsFacts` is now declared once by the lifecycle and reused by `InternalRunCreationService.start`. Consolidating immediately surfaced what the weak copy had been hiding: the route was passing a snapshot shape the lifecycle did not actually accept, and the test was passing an analytics context missing four required fields. Both are now typed at the choke point. * fix(web): keep a late Labs save from taking the shared indicator Review follow-up. Letting the Labs write settle after unmount fixed the stuck "Saving" pill but handed an older request the ability to relabel a newer one: hold the Labs PUT, switch section, start another save, release. The old completion wrote `saved` over the newer save and its timer then forced `idle`, which is worse than the pill it was fixing. `SettingsDialog` owns one indicator for every section and already refuses to let a superseded save win — its own path checks `autosaveLatestRef` and its idle timer is a compare-and-set. Labs bypassed both, and its timer wrote `idle` unconditionally. The dialog now hands out a claim when a writer takes the indicator, and only the current claim may settle it. Labs captures its claim when the write starts, not when it finishes. Comparing the displayed value would not do: a newer section can legitimately be showing the same `saving` the older write left behind. The analytics event still fires after unmount — that half was never about the indicator. * fix(daemon): make the run analytics seam impossible to opt out of by omission Review follow-up. The choke point documented an invariant it did not enforce: `analyticsLifecycle` was optional and invoked with `?.`, so a future factory could build the service, satisfy the new `.runs.start` guard, and still emit neither `run_created` nor `run_finished` — the exact failure this PR exists to close. `RunAnalyticsFacts.requestAnalyticsContext` had the same gap: the contract says a caller with no attributable identity passes `null` explicitly, while the type let it drop the key instead. Both are required now. A harness that wants silence injects a no-op lifecycle and says so. Making the context required immediately caught a service spec that had been omitting it. * fix(web): preserve autosave ownership across async saves	2026-08-28 01:45:59 +00:00
lefarcen	7f65c795d9	refactor: share one structural HTML injection-point locator (#7422) ... * refactor: share one structural HTML injection-point locator #7410's root cause was two copies of the same lookup drifting apart: the srcDoc path anchored on the real `</body>` while the daemon copy still matched the first one in the text. This puts the locator in `packages/contracts` and points every injector at it — daemon preview bridges and containment base, web srcDoc and export paths, desktop PDF/artifact/deck capture, and the brand build. Rebuilt on `main` rather than rebased onto it. This branch was cut before #7421 and carried its 28 commits, so a rebase replayed them against a main that already had them and conflicted on the first one; replaying 17 commits through that would have been the easy way to silently drop one of the fixes. The net change is the same 26 files, and only four of them had also moved on main. The shared module is the daemon implementation as merged, not a reconstruction. Verified as equivalence before the daemon's copy was deleted: against `main`'s `apps/daemon/src/routes/project/index.ts` on identical inputs, 2,544 repository HTML files × 7 lookups and 15,000 generated adversarial documents × 6 lookups produce byte-identical answers — 0 divergences. The generated corpus is built from every hazard #7421's review rounds turned up, which is the comparison that would have caught the drift this PR exists to prevent. Three call sites finished their migration on the way: `daemonSanitizeTitleInDoc`, `assembleExample` and the collab-sync title read all located `<title>` structurally and then searched for its close as text, so `</title >` and `</title\n>` were missed and a `</title` inside the open tag's own attributes could match first. All three go through `findRealElementRange` now. `findRealElementRange` itself built its shadow with `toLowerCase()`, which is not length-preserving; it uses `asciiLower` like the rest of the module. `pnpm guard` gains an "HTML structural boundaries" check that fails any new hand-rolled boundary lookup outside the shared module — the safeguard #7421's rationale comment once claimed and did not have. Validation: 100 daemon route/containment specs (#7421's full set, now running against the shared locator), 45 contracts specs, 817 web runtime specs including the jsdom differential oracle, guard exit 0 with the new check reporting, daemon and contracts typecheck clean. * fix: finish the title migration in srcdoc and the prefetch reader Two from review, both the same leftover: the open tag was located structurally and then the close was searched for as text. I had claimed this migration finished in three call sites and it was five — a sweep of the repository for `indexOf('</…')` found exactly these two remaining, and nothing else (the other hits are `<artifact>` / `<PANELIST>` marker streams, which are not HTML). `sanitizeTitleInDoc` used `indexOf('</title>')`, which accepts one spelling. A document titled with `</title >` fell through to the next `</title>` in the source — here one inside an authored script string — and the rewrite spanned everything between, splicing into author content exactly as #7410 did. `readRealTitleText` used `indexOf('</title')` with no boundary check, so `</title-page>` ended the title. Both go through `findRealElementRange` now, and with it the `toLowerCase()` shadow both were building, which is not length-preserving. Two specs. The `</title >` one is red on the previous commit. The `</title-page>` one is green on both — `indexOf('</title>')` happened to skip it too, since it demands the full spelling — so it is regression cover rather than a red spec, and it is worth having because the new code reaches that case through a different rule. Writing them cost three wrong assertions before one held, all mine rather than the code's: the title text is rewritten by `sanitizePreviewTitle`, so the raw authored bytes are not observable in the output, and `b</title>` — my second attempt at something that would be — is a substring of the sanitized `a-title-page-b</title>`. The spec asserts the sanitized title itself now. Validation: 819 web runtime specs, 100 daemon route/containment specs, `pnpm guard` exit 0 with the structural-boundary check reporting, web and daemon typecheck clean.	2026-08-27 04:53:21 +00:00
lefarcen	204ee7a06d	fix(daemon): explain an ACP handshake rejection instead of retrying it (#7303) ... * fix(daemon): explain an ACP handshake rejection instead of retrying it An agent CLI that answers `initialize` and then refuses `session/new` / `session/load` surfaced as a bare `json-rpc id 2: Internal error`, and the retry policy treated it as transient — so the run failed, retried, and failed identically while the user read a JSON-RPC frame. Classify a handshake-numbered protocol error as `session_init` / `install_cli`, keep every later protocol error on `child_close`, and lead the user-facing message with the CLI and its detected version. The raw line stays appended because `run.error` is also the classifier's input. * fix(daemon): route the ACP handshake guidance onto the path users hit The guidance copy was only reachable through `rewriteKnownAgentStreamError`, which the ACP failure path never calls. An ACP agent's error goes `attachAcpSession` -> `fail()` -> the bridge's `send('error', payload)`, and that callback forwarded the payload verbatim; the close handler then returned on `acpFatalErrorObservedBeforeCancellation && hasFatalError()` before the stderr-tail rewrite further down. So a Kimi user still read `json-rpc id 2: Internal error`. Rewrite the payload at the bridge instead. That one object is the whole user-visible surface of an ACP failure: `send` streams it to SSE clients and `design.runs.emit` reads `run.error` out of it, so correcting it there fixes both surfaces at once. `withAcpHandshakeFailureGuidance` rewrites only the message fields, and only for a handshake-numbered JSON-RPC error, so `AMR_MODEL_UNAVAILABLE`, promoted opencode errors, and post-session protocol errors keep the shape their own handling depends on. The raw line stays embedded because `run.error` is also the classifier's input. Cover it through the full server run cycle with a fake ACP CLI that answers `initialize` and rejects `session/new`, asserting on what a client and the telemetry pipeline actually observe. Against the pre-fix tree the run error is the bare `json-rpc id 2: Internal error`; against the pre-PR tree the daemon also opened `session/new` twice. * fix(daemon): read the handshake failure's cause, not just its id Running a real Kimi CLI while signed out produces `json-rpc id 2: Authentication required`. The handshake reading keyed on the JSON-RPC id alone, so that user was told their CLI version was incompatible and they should update or reinstall it — a prescription for a problem they did not have, in place of the one sentence that pointed at the fix. The id answers *when* a failure happened; it can never answer *why*. Split the two questions: `isAcpHandshakeRpcErrorText` stays structural, and `isAcpCliSessionRefusalText` is what the copy and the `install_cli` verdict now hang off — handshake numbering AND no cause with a remedy of its own. The "has its own remedy" half reuses `classifyAgentServiceFailure` rather than growing a second signature list: it is agent-agnostic, already covers auth / quota / upstream, and carries its own suite. It is deliberately unrelated to, and narrower than, `isCliNotInstalledText` — that predicate answers "was the binary even there", which a CLI that already answered `initialize` has plainly settled. A handshake failure that names its cause now keeps its own text and falls through to the branch that owns that cause, so telemetry and copy agree: an unauthenticated handshake is `auth` / `login`, a throttled one is `rate_limit`. A bare refusal (`Internal error`, `Method not found`) is unchanged and still gets the CLI guidance and the retry suppression. No pure-function test could have caught this: the helpers were consistent with themselves. The wiring test drives a fake ACP CLI that rejects `session/new` with `Authentication required` and asserts on the text a signed-out user actually reads. * test(daemon): pin the category each named handshake cause is filed under Verifies the routing claimed in the PR body rather than asserting it. Caught one: `insufficient balance` has its own `insufficient_balance` category, not `rate_limit`. * fix(chat): name the ACP session refusal instead of writing its sentence The guidance this PR added reached the user as a paragraph the daemon composed: "The Kimi CLI (0.38.0) accepted the connection but refused to start a session. … Details: json-rpc id 2: Internal error". That is the wrong layer, and it showed: - The daemon has no locale. The string went straight into `run.error` and the chat rendered it verbatim, so a Chinese UI put a Chinese title over an English body. No amount of rewording fixes that; only moving the sentence to the client does. - The paragraph restated the raw agent line, which the card's details block already prints — the same text twice in one card. So the daemon now NAMES the failure and stops there: `AGENT_CLI_SESSION_REFUSED` plus `details: { kind: 'agent_cli', action: 'update_cli', agent, agentCliVersion }`, with `retryable: false` because a build that refuses `session/new` refuses the identical request identically. `withAcpHandshakeFailureGuidance` stays the single invariant point (the ACP bridge payload feeds SSE and `run.error` at once) and now stamps only the structured half; the stderr-tail fallbacks wrap their payloads in it too, so no path is left composing prose. `run.error` keeps the agent's `json-rpc id N: …` line byte for byte. It is the classifier's input — rewriting it degrades this failure class to `unknown` in telemetry — and it is what the details block shows, so leaving it alone is also what removes the duplicate. The web maps the code to localized copy in `resolveRunFailureUi`, resolved before every other branch because the copy is not a fixed sentence: it names the CLI build the daemon detected, and falls back to a version-less wording when there was none (the same rule the rolling model-window copy follows). The version rides to the client as data, on the status event next to `code` / `failureDetail`. Three keys in all 19 locales. Red first, on the path users hit: the wiring suite (real `startServer` + a fake ACP CLI) went red on `run.error` being the English paragraph, and a new ChatPane render spec went red on the raw line appearing twice in one card. Both green here. Verified in a real browser against a local runtime: the same failed run renders in zh-CN and in en from one persisted event. * test(daemon): stop the wiring suite pinning a racy CLI-version probe CI run 32683047377 caught this on the previous head: the wiring test demanded `0.38.0` inside `run.error` and got a version-less sentence, because `getDetectedRuntimeVersions` is a process-wide cache that `probe()` clears before each probe and refills after — a concurrent `/api/agents` refresh can leave it empty exactly while a run is failing. Locally it always won the race; on CI it did not. The new assertions inherited that: `details.agentCliVersion` was pinned to an exact string on both wiring cases. Assert the property that actually holds instead — the version is either the one the daemon detected or absent, never some other value — and say in the helper why presence is not asserted here. Both copy paths (version present, version absent) stay covered deterministically at the layers that own them: the payload unit suite and the two web suites. Making detection itself deterministic is a separate finding, still open on this PR, and deliberately not fixed here. * fix(daemon): let the classifier, not the wording, name a handshake refusal Three review findings, one shape: the ACP handshake verdict was being decided in more than one place, so the places disagreed. 1. The handshake reading sat inside `isAgentProtocolErrorText`, whose JSON-RPC arm matches only `json-rpc id N: Internal error`. A CLI that refuses `session/new` with `Method not found` or `Invalid params` skipped it entirely and was promoted to a retryable `fatal_rpc_error` on `child_close` — the no-auto-retry behaviour this PR claims never applied to it — or, once the payload rewrite had stamped its code, fell all the way through to `unknown` / `finalize`, which is exactly the untriageable bucket the module docblock says the rewrite must never produce. The wording an agent picks for its own rejection is not a signal. The handshake branch now sits AFTER every cause branch instead of inside the protocol one, so precedence is a fact of the control flow rather than a promise: whatever auth, rate limit, balance, upstream, prompt size, or CPU already claimed keeps it, and only an unexplained refusal reaches the last line. Ids 3 and up never enter it and keep the transient treatment they have always had. 2. `handshakeFailureNamesItsOwnRemedy` knew only the three `classifyAgentServiceFailure` classes, so every other cause the run classifier can already advise on was rewritten into the CLI-upgrade copy. A user whose content was too long read "your CLI version is incompatible" while the same run was filed as `prompt_too_large` / `reduce_context`. `isAcpCliSessionRefusalText` now IS the classifier — it runs `classifyRunFailure` over the text and reports whether that reading is the handshake refusal — so the card the user gets and the bucket the run lands in cannot prescribe two different fixes. The id-only helpers moved to `runtimes/acp-handshake-id.ts` so the classifier can read the id without the id-reader having to reach back into the classifier. 3. The guidance read the process-wide detected-version cache at FAILURE time, while `probe()` cleared each entry before re-reading it. Any `/api/agents` refresh overlapping a failing run decided whether the user was told which build refused them; CI caught it (run 32683047377) and the assertion was loosened instead of the race closed. Both halves are closed. A probe now publishes its reading once, at the end, and only when no later probe has already published, so the cache holds the newest COMPLETED reading rather than the state of one in flight. And the run freezes the version it is spawning with, so failure-time guidance reads the run and never the live cache. Coverage is at the wiring layer, not just the predicates: the fake ACP CLI gained named gates so a run's handshake and a concurrent `/api/agents` refresh can be held open together and the failure built at the exact moment the cache is mid-probe — deterministic, no sleeping on wall-clock timing. The wiring suite's CLI-version assertion goes back to strict. One deferral found by the existing suite and now pinned: a handshake-numbered frame carrying an OS-level crash banner (Windows STATUS_ILLEGAL_INSTRUCTION from the bundled opencode) reports a child that died, not one that refused, and stays with the crash reading. * test(daemon): describe the overlap the gate test actually constructs The comment said the failure is built "at the precise moment the cache is blank". That was the pre-fix window; the cache no longer goes blank mid-probe, which is half of what the test proves. Say what it now holds open — a probe in flight — and name both halves it exercises. * fix(daemon): drop the duplicate detection import that blocks startup `getDetectedRuntimeVersions` was imported twice — once standalone and once inside the `./runtimes/detection.js` group — so the module has two declarations of the same lexical binding. Node's ESM loader rejects that outright with `Identifier 'getDetectedRuntimeVersions' has already been declared`, i.e. the daemon could not boot. The suite never caught it: vitest transforms through esbuild, which tolerates the duplicate, so 179 tests passed against a module real Node refuses to load. Verified by importing server.ts under Node directly — SyntaxError before, gone after. * fix(daemon): report the CLI build this run actually started, on both surfaces A version-specific refusal (`AGENT_CLI_SESSION_REFUSED`) names the CLI build that refused, so the user knows which one to change. Two things could make that name wrong. **The persisted event dropped it.** `send()` stores every run event on the assistant message before emitting it, and `runSseEventToPersistedAgentEvent` serialized only `detail` and `code`. The live card named the build; a reloaded one fell back to the version-less sentence — exactly when the user comes back to act on it. The mapper now lifts `error.details.agentCliVersion` out of the frame, validated as a non-blank string, because `details` is a pass-through bag that also carries the agent's own JSON-RPC `error.data`. **The spawn-time capture could name a different executable.** `getDetectedRuntimeVersions` answers per agent id and says nothing about which binary the reading came from. A user who repointed the CLI after Settings last listed agents (Settings writes `KIMI_BIN`; PATH changes) ran one build and was told to change another. The capture now resolves through `ensureDetectedRuntimeVersions` with the same `configuredAgentEnv` that produced this run's `agentLaunch` — cached when the launch identity is unchanged, re-probed through the same bounded `--version` read when it is not, and taken before the spawn marks so preflight work is accounted to preflight. Both are pinned end to end in `acp-handshake-failure-wiring.test.ts`: one test reads the conversation back through the messages route a reloading client calls, the other repoints `KIMI_BIN` between detection and the run and reads the two fake CLIs' invocation logs to establish which child actually ran before asserting what the failure reports. * fix(daemon): keep a runtime that never started out of the CLI-refusal verdict An ACP handshake rejection was decided on the JSON-RPC request id alone, so any failure numbered 1 or 2 became "this CLI build cannot open a session; change it". AMR is the population that reaches this path, and what it runs underneath is OpenCode: when vela's bundled OpenCode child fails to come up it reports `start opencode server: opencode exited before readiness: exit status 3` from inside `session/new`, which arrives handshake-numbered while saying nothing about the agent CLI's own build. Two things went wrong at once. The user was told to replace a perfectly healthy CLI, and the automatic retry that actually recovers a startup race was withdrawn — `process_exit / agent_protocol_error / session_init`, `retryable: false`, `install_cli`, with the ACP wrapper stamping `AGENT_CLI_SESSION_REFUSED` on top. A startup race clears on the second attempt; a CLI-build verdict never does, so the two must not collapse. `isManagedRuntimeStartupFailureText` names the distinction: a CLI reporting that a runtime IT manages never came up has named the moving part itself, so its build is not the only variable left. The markers are vela's own wrapper text, already trusted by `isCpuUnsupportedCrashText` for the crash-banner sibling of this shape and now shared with it. Both deferrals now read the same way: the handshake frame is the envelope, not the evidence — a child that DIED (crash banner) or one that never STARTED (readiness) is not a refusal. Also stops this suite's runtime from being a property of the host. The wiring cases drive `GET /api/agents`, which probes every shipped runtime and resolves binaries from PATH plus the machine's toolchain directories, so a host with real agent CLIs installed turns each refresh into a dozen real spawns: ~2.8s here, ~28s on a reviewer's machine — past the 20s test timeout for the mid-refresh case, which waits on two. `isolateAgentDetection` points `OD_AGENT_HOME` at an empty per-test directory, detection's own mechanism for scoping the search, so the only CLI anything can find is the fixture's. Same route, same probe path, same deterministic gates and overlap assertions; the file drops from 109s to 14s and the mid-refresh case from 30s (timing out) to 1.2s. * revert(daemon): drop the CLI-version half of the handshake-refusal card The copy wanted to name the build that refused, and the chain that followed ended in the launch path: the version had to be frozen before the spawn, freezing meant awaiting a `--version` probe there, and an await before `spawn()` sits after the run's only pre-spawn cancellation guard. Stop clicked during that window finishes the run as canceled, the probe then resolves, and the child is spawned onto an already terminal run that nothing will signal. The whole sub-branch goes rather than a second guard. What it bought was `(0.38.0)` in a sentence that already read correctly without it; what it cost was a run the user asked to stop starting anyway. Removed: the pre-spawn `ensureDetectedRuntimeVersions` await, `run.spawnedAgentCliVersion`, and the version half of `agentFailureIdentity`; detection's probe generation guard; `agentCliVersion` persistence, its `PersistedAgentEvent` field, its web pass-through, and the `{version}` copy variant in all 19 locales. `server.ts` no longer touches the run lifecycle at all — its diff is four `send('error', ...)` call sites and one helper. Detection's generation guard fixes a real, independent daemon bug (for the length of every `/api/agents` refresh the daemon cannot report the version it detected). It ships as its own PR, and naming the build in the copy follows it. Kept: the localized `AGENT_CLI_SESSION_REFUSED` card in 19 languages, no auto-retry for a handshake-stage refusal, `run.error` exactly equal to the agent's own line, auth/quota/upstream/managed-runtime-startup each keeping their own verdict, and ids 3+ staying out of the branch. The cases that asserted a version number now assert the same behaviour without one, plus `not.toHaveProperty('agentCliVersion')` and a locale guard against a stray `{version}` placeholder, so a partial re-land cannot slip half of this back in.	2026-08-25 06:04:55 +00:00
lefarcen	fe94564a71	fix(daemon): stop sending Kimi 0.37+ an MCP transport it rejects (#7313) ... Kimi Code CLI 0.37.0 replaced the stdio branch of its ACP `session/new` MCP handler with a throw: {"code":-32603,"message":"Internal error","data":{"details": "ACP stdio MCP server open-design-live-artifacts does not declare a runtime identity"}} OD attaches a stdio MCP server (`open-design-live-artifacts`) to every `mature-acp` runtime, so every Kimi run on 0.37+ failed at the handshake — which is why the observed failure rate is 84–92% rather than flaky. The message names a "runtime identity" but no accepted value exists. Kimi validates `session/new` against a zod union whose stdio member declares no `type` key, so an explicit `type: "stdio"` is stripped by validation and the handler then sees no `type` and throws. Verified against the published tarballs by driving a real ACP handshake: 0.35.0 and 0.36.1 accept a stdio entry with or without `type`; 0.37.0, 0.37.1, 0.37.2 and 0.38.0 reject both spellings. Only http/sse survive. So the session now withholds stdio MCP servers from builds that reject them, judged against the version the agent reports in its own `initialize` result — the build that is actually about to parse `session/new`, and therefore more current than any earlier `--version` probe. Which builds reject is runtime-def data (`acpStdioMcpRemovedInVersion`), following the `acpMcpEnvFormat` precedent, so hermes / trae-cli / reasonix declare nothing and keep a byte-identical payload. Kimi 0.37+ runs lose live-artifact tooling, which is unreachable on those builds either way; a session that opens without MCP beats one that cannot open at all. 0.36.x keeps the capability. Co-authored-by: lefarcen <ontf116@gmail.com>	2026-08-24 13:33:10 +00:00
lefarcen	d85e78ab7d	fix(runtimes): reach a working agent CLI past a broken shim (#7153) ... * fix(runtimes): reach a working agent CLI past a broken shim Resolving an agent's name on PATH only proves a file exists there, never that it runs. Detection stopped at the first hit, so a wrapper orphaned by a half-finished `npm i -g` shadowed a perfectly good CLI of the same name in a later search directory — and because the not-invocable branch dropped the resolved path, the picker (which renders an unavailable agent only when it carries one) hid the agent entirely. The user saw "scan found nothing" with no way to act. Detection now walks past candidates that cannot be executed, and reports the path it tried when every candidate fails, so the row stays actionable. Also on this chain: - `@open-design/dsh-runtime` pinned its DeepSeek Harness peers to one exact release candidate, so it became uninstallable the moment upstream shipped the next one. Peers now take ranges. `scripts/guard.ts` gains a narrow, logged exemption for external-host plugin manifests — their peers describe a host this repo neither installs nor controls, which is the one case where an exact pin is wrong rather than reproducible. - The DSH installers pinned only the entry package while its ~190 siblings used caret ranges over prerelease floors. Once a newer release candidate existed, the transitive tree floated onto it and its mutually exclusive peer sets sent npm into an ERESOLVE backtrack that never converged. Both installers now freeze the resolution window alongside the pin. - The rescan notice counted agents the list never renders, so it announced "3 available" above two rows. * fix(runtimes): make detection's chosen executable the one spawn sites use The candidate walk taught detection to skip a binary it cannot execute, but every other resolution — chat, the connection test, the memory summariser, companion install — called `resolveAgentLaunch` with no skip list and got back the first file that merely exists on PATH: the broken shim detection had just rejected. Settings advertised the agent as installed while each turn exec'd the wrapper, so the fix only ever reached the picker. Detection is the only stage that spawns anything, so it is the only one that learns which candidate works. It now publishes that winner, and resolution prefers it over a fresh first-hit walk. An explicit `*_BIN` override and a packaged built-in still outrank it, a winner whose file has since vanished is ignored, and detection clears the entry before each pass so a rescan after a repair never resolves against a stale one. This restores the invariant the file already documented — detection probes the exact path the runtime will spawn — which the walk had broken. Reported by @mrcfps in review. * fix(runtimes): keep the remembered executable inside the live candidate set The winner map made resolution stop being a pure function of the current environment. It only checked that the remembered file still existed, so a path learned in a richer environment survived an emptied PATH, a sandboxed OD_AGENT_HOME, and any other narrowing of the search — resurrecting a binary the caller could no longer see. That is not just a test artifact: `GET /api/integrations/vela/status` must answer `amr-runtime-unavailable` when the vela binary cannot be resolved, and it started answering "ready" instead, because an earlier detection in the same process had remembered a path. The memory now reorders candidates rather than introducing them: it applies only when the live search already offers the remembered path. An emptied PATH, a sandbox, and an uninstalled CLI all keep meaning "not found", while a broken shim shadowing a working binary is still resolved to the winner. This also settles the scope question raised in review — no separate cache key is needed, because the candidate set already carries the resolution scope. * fix(runtimes): treat a launcher whose target is gone as not invocable A stale global npm wrapper on Windows is a `.CMD`, which OpenDesign runs through `cmd.exe /d /s /c`. When the package behind it has been uninstalled, cmd.exe starts, node starts, and only then does node fail to load the script the wrapper names — a plain exit 1 with MODULE_NOT_FOUND on stderr. None of the spawn-level signals the classifier looked for (ENOENT / EACCES / ENOTDIR, exits 126 and 127) can occur along that chain, so detection read the dead wrapper as a healthy CLI that merely disliked `--version`, stopped the candidate walk on it, and never reached the working `dsh.CMD` later on PATH. Classify invocability from the launcher's own vocabulary as well: cmd.exe's 9009 (the Windows analogue of POSIX 127), node's missing-module report, and cmd.exe / PowerShell's missing-command and missing-path reports. Exit status alone still means nothing — a CLI that runs and exits non-zero is a real answer from the right binary and keeps its place in the walk. Drop the win32 early return from every case in the fallback suite and write fixtures per platform, so `dsh.CMD` resolution through PATHEXT and the cmd.exe wrapping are exercised natively. The orphaned-wrapper regression is reproduced on every platform — the defect is a classification bug, not an OS API one, and the daemon suite only runs on Linux in CI. * fix(runtimes): carry forward the dead paths, not detection's winner Detection published the candidate it settled on and resolution preferred it over the first live PATH hit. That pinned the daemon to one binary for its whole lifetime and let it silently outrank the caller's own PATH: a CLI that became visible earlier afterwards — a fresh install, a version manager swapping shims, a caller resolving under its own environment — could no longer be reached. The daemon suite caught it on a machine that has a real `vela` installed: `chat-route` and `connection-test` inject a fake agent CLI ahead of PATH per case, and the remembered winner outranked it, so 15 cases spawned the machine's real CLI instead of the fixture. CI never saw it because its runners have no such CLI to remember. Carry the proven-dead paths forward instead. Skipping them keeps every candidate still standing in plain PATH order, while chat, the connection test, the memory summariser, and companion setup still avoid the shim detection rejected — which is the whole point of publishing anything. * docs(runtimes): say why detection keeps its own launcher-error list `isCliNotInstalledText` in run-failure-classification.ts reads similar output, and the next reader will reasonably ask why the two are not one. They answer different questions: that one buckets a finished run for telemetry, where over-matching costs a mislabelled event, while this one decides whether to abandon a binary mid-resolution, where over-matching sends a working CLI's user to a different install. * fix(runtimes): accept the dsh release line, not one release candidate This branch moved the installers to 0.1.0-rc.8 and left the agent def naming 0.1.0-rc.6 as the only supported version, so following our own one-line install produced "0.1.0-rc.8 has not been tested with this OpenDesign build" in Settings on a clean machine. That is the same pinning defect the installers had, one layer up. `dsh` publishes a stream of release candidates whose sibling packages peer-require each other, so the version our installer hands the user moves with upstream. Version policies can now declare the release line they accept alongside the exact versions exercised, and DeepSeek Harness declares its own. A version off that line still warns — the point is to stop pinning, not to stop checking. Add a cross-boundary guard for the drift itself: the installers and the agent def cannot import each other, so `e2e/tests` reads both and fails when an installer pins a version the daemon would not accept. * docs(contracts): correct what shim-broken now means The reason's docstring said "exit 126/127", which stopped being the whole story once detection learned to read a Windows wrapper's stderr: a `.cmd` starts an interpreter successfully and reports the missing target there, so no POSIX exit code appears at all. * test(runtimes): cover the launcher signatures no fixture can produce `launcherTargetMissing` recognises six ways a launcher says it never reached its target, and until now two of them had any coverage — the two a POSIX shell can print. cmd.exe's wording, PowerShell's, and exit 9009 were load-bearing for the Windows fix and untested anywhere. A fixture cannot close that gap. POSIX masks exit statuses to eight bits, so a shell asked for 9009 reports 49, and /bin/sh does not speak cmd.exe. The daemon suite runs on Linux in CI, so driving the classifier directly is the only way the merge gate can catch a typo in a signature the fix depends on for the platform the bug came from. Extract the catch arm verbatim as `classifyVersionProbeFailure` — same branches, same order, no behaviour change — and feed it the rejection shape `promisify(execFile)` actually produces. Verified by mutation: deleting the 9009 branch reds one case, deleting the stderr branch reds six. The suite also pins the constraint from the review by name: exit 1 with an ordinary argument complaint, with no stderr, or with wording that belongs to run-failure telemetry ("not installed") all stay `spawned`. That last one is why detection keeps a narrower list than `isCliNotInstalledText`.	2026-08-24 13:04:31 +00:00
PerishFire	84381efab9	feat(ci): add global hash skip planning (#7185) ... * feat(ci): add global hash skip planning * refactor(ci): remove superseded hash skip cache * refactor(ci): keep scope trust in planner * fix(ci): run scope goldens for planner changes Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(ci): publish hash state after successful validation Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-08-21 00:12:33 +08:00
Joey-nexu	f1a0b60c6c	chore: unify product name display to OpenDesign repo-wide (#6998) ... * chore: unify product name display to OpenDesign repo-wide Rename the user-facing product name from "Open Design" to "OpenDesign" across documentation, web/desktop UI strings, i18n locales, prompts, plugin/skill/design-system content, changelogs, and specs, matching the landing-page rename already in flight. Deliberately excluded so installed-app identity stays untouched: - packages/release PRODUCT_NAME and everything derived from it (app bundle names, installer/registry identity, updater feeds) - tools/pack, tools/release, apps/packaged, landing page (PR #6983) - mocks/ recorded traces and LICENSE - test fixtures and comments that encode real on-disk install paths (Open Design.app, Program Files\Open Design, AppData paths) Validated with pnpm guard, pnpm typecheck, and targeted web/desktop/host test runs over the renamed strings. * fix(web): keep two-letter author monogram for CamelCase brand names authorInitials split words on whitespace only, so the renamed single-token author name "OpenDesign" produced a one-letter monogram. Treat lower-to-upper CamelCase boundaries as word breaks so the avatar fallback stays "OD". * fix(release): restore spaced Windows source artifact names in win.ps1 tools/pack still derives builder outputs from the unchanged PRODUCT_NAME ("Open Design"), so the asset script must look for the spaced filenames. Matches the mac/mac-intel/linux asset scripts, which were already kept on the original names. --------- Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com>	2026-08-18 07:09:45 +00:00
PerishFire	3f670090d7	ci: narrow daemon core merge validation (#6126) ... * ci: narrow daemon core merge validation * ci: preserve runtime definition shadow	2026-07-27 15:51:57 +00:00
PerishFire	9db0d308e5	ci: establish guard library boundary (#6119)	2026-07-27 13:19:58 +00:00
PerishFire	43a8a92eae	ci: add daemon UI P0 capability shadow (#6112)	2026-07-27 10:54:44 +00:00
PerishFire	783391e9fa	ci: narrow packaged leaf merge validation (#6104)	2026-07-27 09:12:28 +00:00
Marc Chan	7787556cf1	fix(daemon): full ACP tool transcript and richer usage telemetry (#6057) ... * fix(daemon): full ACP tool transcript and richer usage telemetry Map all ACP tool_call frames to canonical tool_use/tool_result for run.events, PostHog run_finished, and Langfuse spans. Preserve artifact_count via Write/Edit normalization, tighten path extraction, forward truncated results, and emit real tool startedAt. Enrich usage scanning (thought_tokens, anthropic vs openai cache semantics), canonical tool-family PostHog props, analytics recovery finish snapshot, and shared content-tool redaction. * fix(daemon): prefer ACP kind over noncanonical tool names Normalize recognized ACP kinds (e.g. kind:read + name:read_file → Read) before emitting tool transcripts so Langfuse content-tool redaction matches canonical families and does not leak file contents. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): fail-closed redaction for unknown ACP tool payloads Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): flush open ACP tools as errors on session fail When a session dies mid-tool (timeout, exit, RPC error), emit pending tool_use/tool_result pairs with isError so transcripts stay complete. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): redact ACP Bash stdout in tool transcripts Execute tools can dump private files (e.g. cat .env); replace Bash tool_result content with a length summary before the canonical transcript ships so Langfuse cannot receive raw execute output. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): redact Linux home paths in Langfuse Bash tool spans Extend local-path masking for ACP Bash partial redaction to cover /home and /root (not only /Users and Windows Users), so Linux home paths do not leak into Langfuse tool inputs when content telemetry is on. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): redact custom ACP tool names before Langfuse telemetry Sanitize path/token-like kind:other tool names at transcript emit and canonicalize non-allowlisted names for Langfuse span labels, toolName metadata, and redaction placeholders so untrusted custom names cannot leak even when content telemetry is off. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * test(e2e): force-click unstable comment targets in preview iframe UI P0 project-workspace timed out on comment attachment when Playwright kept waiting for hero-title stability under auto-fit zoom / bridge inject. Click once visible with force so the critical flow stays reliable. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): merge partial usage frames in reverse analytics scan Keep provider_usage for thought/cache-only trailing usage events while continuing the reverse scan to the latest primary input/output/total record so run_finished and Langfuse do not drop complete token counts. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): flush open ACP tools before AMR no-output fail Clean-flush pending non-think tools on successful session/prompt before evaluating emittedConcreteToolEvent so missing terminal tool_call_update does not mark a productive run as acp_no_visible_output. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): merge partial primary usage and flush tools on ACP abort Require both input and output before ending the reverse usage scan so output-only or input-only trailing frames still merge earlier counters. Flush deferred open ACP tools as errored on abort so user-canceled runs keep complete tool transcripts for Langfuse/PostHog. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): hash path-like ACP toolCallIds before telemetry Adapters can embed user paths in toolCallId (e.g. read:/home/alice/.env). Hash those values at tool_use/tool_result emit so Langfuse span ids and metadata.toolCallId cannot leak secrets, while keeping the raw id as the local frame-correlation map key. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): always hash ACP adapter toolCallIds for telemetry Identifier-shaped secrets (sk-proj-*, ghp_*, JWTs) passed the prior allowlist because they contain no path characters. Hash every non-empty adapter toolCallId before tool_use/tool_result emission so Langfuse span ids and metadata.toolCallId cannot leak tokens. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): keep reverse usage scan open for missing cache fields When a newer usage frame already has input+output but omits cache counters, continue scanning older frames so cache_read/cache_creation still merge into run_finished and Langfuse. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): retain flushed ACP tool IDs against late terminals Keep acpToolRunEventState entries after flushOpenAcpTools so a racy tool_call_update cannot recreate the same id and emit a second tool_use/tool_result pair after timeout, abort, or prompt flush. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): block kind:other Bash-like tool names Custom ACP tools with kind:other must not emit Bash/shell/execute/terminal names, which would unlock Langfuse partial redaction and leak rawInput. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build) * fix(daemon): fail closed on Bash names without execute kind ACP tools missing kind must not preserve name/title Bash labels that unlock Langfuse partial redaction; only recognized execute-family kinds may emit Bash. Generated-By: looper 0.11.0 (runner=fixer, agent=grok-build)	2026-07-27 04:08:27 +00:00
PerishFire	f9a6e18c11	feat(ci): promote the certain-exempt docs core to merge-queue trust (#6047) ... * feat(ci): promote the certain-exempt docs core to merge-queue trust Split the exempt surface into a certain-tier core (docs/, apps/landing-page/, .vscode/, .idea/, .github/ISSUE_TEMPLATE/, LICENSE, CODEOWNERS) and the medium residue (global markdown regex, workflow exacts, nix). A merge-queue group confined to the core now drops to the unconditional floor lanes instead of running everything; replaying the last 398 first-parent merges puts that at 12.3% of queue traffic. The promotion is backed by a new floor-lane guard check, "certain-exempt surface consumption": no skippable-lane source may reference a certain-exempt path (dot-relative literals flagged everywhere; bare repo-relative literals flagged outside test fixtures). guard.ts gains --list-checks as the machine registry, and the rule-table invariant test now requires every certain rule's guard field to resolve to a live check. * docs(ci): record the scope confidence methodology in specs/current/ci.md The living framework for confidence-tier changes: medium-tier cheap loop vs certain-tier deliberate loop, the three-sentence promotion discipline, guard strength levels and floor placement, evidence recipes (replay, offline plan, queue trace extraction), tooling graduation criteria, and the open questions deliberately left undecided. Indexed from AGENTS.md and .github/AGENTS.md required reading. * fix(ci): narrow certain-exempt fixture handling Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): pin the trae-cli consumption exception to the daemon-lane wiring The review round established that apps/daemon/tests/runtimes/trae-cli.test.ts genuinely reads docs/agent-adapters.md. Its exemption from the consumption guard was justified by a wiring fact (the ci.yml daemon lane runs only project-watchers.test.ts) stated as prose, which would rot silently if the lane ever widened. Make the exception conditional on that exact ci.yml needle: when the daemon lane changes, the exemption disappears and the guard reports the read, forcing reclassification instead of trusting a stale rationale. * docs(ci): codify exception-precondition binding in the methodology Backfill the pattern the first review round produced: guard allowlist entries justified by local definitional facts may stay prose, but entries justified by remote mutable facts (lane wiring, gate topology) must be conditional on a checked precondition so the exception dies loudly with its premise. Records the trae-cli/daemon-lane needle as the worked example. * fix(ci): fold static paths in exempt consumption guard Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): require exclusive daemon test wiring Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): recognize daemon pnpm selector forms Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): tokenize daemon workflow test commands Generated-By: looper 0.11.0 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-07-27 03:22:21 +00:00
PerishFire	14fcc411cd	feat(ci): confidence-tiered scope rule table with merge-queue shadow evaluation (#6029) ... * chore(scripts): make root scripts/ test-free and purify the guard entrypoint Root scripts/ is now source-only, enforced by a new "scripts test-free" guard check (any *.test.{ts,tsx,js,jsx,mjs,cjs} under scripts/ fails pnpm guard). The root guard script becomes a pure tsx ./scripts/guard.ts invocation instead of chaining a hand-maintained node --test file list. Script behavior-contract coverage follows the boundary e2e/AGENTS.md already declares for e2e/tests/scripts/: the fork PR approval security tests migrate there (converted to Vitest, 24 tests passing), and the remaining script unit tests are deleted — five of them (batch-design- system-test, check-design-system-package-quality, plugin-previews-diff, plugin-previews-gc, migrate-to-plugins/example) were orphans no runner ever executed; the guard-chained checker tests covered logic whose repo-wide enforcement remains in guard.ts checks. Coverage with a real test claim gets rebuilt in e2e/tests/scripts/ on demand. * test(ci): pin characterization goldens for scopes.ts scope detection Golden tests run scripts/scopes.ts as a subprocess exactly the way ci.yml does, with gh stubbed through the existing OPEN_DESIGN_GH_NODE_SCRIPT seam (hermetic stub materialized per run), and pin the complete 20-key output plan for a matrix of changed-file sets across pull_request, workflow_dispatch (hot/full), and merge_group events. They deliberately pin current quirks (skills/*.md arming daemon+web without the ui-critical fallback; e2e/ui/*.md arming ui_p0 with workspace validation off; dispatch-hot skipping the workspace_validation re-derivation) so the upcoming rule-table restructuring can prove behavior preservation byte-for-byte. * refactor(ci): restructure scopes.ts into a confidence-tiered rule table Scope detection becomes data plus a pure evaluator: every changed file is classified by an additive rule table (union of matched effects, minimum confidence across matched rules), and an evaluation context brings a trust threshold — files below it, or matching no rule, escalate fail-closed to the full radius. Today's behavior is exactly the degenerate case of this structure (all rules medium, certain set empty): pull_request/hot believes everything, the merge queue believes nothing and stays full. The characterization goldens pass unchanged, byte-for-byte. The exempt surface becomes an explicit empty-radius rule instead of a special case, so exemptions can be split, rated, and promoted per rule. Promotion to "certain" requires a guard field naming the enforcing check (enforced by a rule-table invariant test). New offline entry points for rule iteration: `plan --context pr|merge-queue|full --files ...` evaluates without any GitHub environment and prints { plan, trace }; `rules` lists the table. Every evaluation now returns a decision trace (per-rule hit counts, per-file escalations, and an ifTrustAll shadow plan that shows what medium-confidence rules would have allowed — the evidence stream for future certain-tier promotions); github-output mode logs it and writes a step-summary table without touching the frozen 20-key output contract. The legacy dispatch-hot asymmetry (no workspace_validation re-derivation) is preserved behind an explicit option and pinned by the goldens. * feat(ci): evaluate merge-group union diffs at the certain threshold with shadow trace The merge queue now resolves the queued group's union diff (compare base_sha...head_sha from the merge_group event payload) and evaluates it through the rule table at the "certain" trust threshold. While the certain rule set is empty every file escalates and the queue keeps running everything — the goldens pin this byte-for-byte — but the evaluation's ifTrustAll shadow column now records, for every queued group, what medium-confidence rules would have allowed: the evidence stream that future certain-tier promotions will cite. Queue lanes derive from the evaluated outputs (ci_mode stays reported as "full", but lanes are no longer unconditionally forced), so promoting a rule to "certain" later is a pure rule-table change with no further structural work. Fail-safe behavior is explicit and tested: resolution errors and empty resolutions fall open to the full plan without failing the scopes job (queue throughput must never depend on this evaluation), while pull_request resolution failures keep failing the run as before. Changed-file resolution no longer filters out removed files (manual hot runs previously did): deleting a runtime source file must trigger the same validation scopes as editing it. This is the only behavior change, and it is strictly fail-closed. * fix(ci): preserve guard contracts and fail closed on compare limits Restore the eight guard behavior suites in the e2e script lane and make merge-group compare resolution treat GitHub's 300-file ceiling as incomplete. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): enforce extension-agnostic script test boundary Match every suffix after .test. and cover TypeScript, MTS, and non-test filenames in the e2e script suite. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): route script contract tests to e2e Ensure changes under e2e/tests/scripts arm E2E Vitest with the same daemon and web scope effects as their root script counterparts, and pin the behavior with a PR golden.\n\nGenerated-By: looper 0.11.0 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-07-24 05:18:39 +00:00
PerishFire	20c6c0a6ed	ci(e2e): shard the full UI functional pool into a merge-ready matrix (#5883) ... * ci: benchmark deduplicated UI merge sentinel * ci: benchmark restoration-hosted sentinel * ci: benchmark distributed P0 sentinel * ci: benchmark split P0 sentinel * ci: serialize split sentinel benchmark * ci: finalize deduplicated UI merge topology * ci: prototype all-shades UI domain topology * ci: bound full UI runtime by shade * test(e2e): stabilize full UI suite * fix(web): unclip DS picker popover and propagate patched project metadata Two regressions surfaced by re-enabling the full UI pool: - The New Project design-system popover lost its portal and was clipped by short viewports and the modal body. Render it through createPortal with a viewport-aware anchor that flips upward when space below runs out. - After a working-dir pick, onProjectMetadataChange forwarded only the metadata onto a stale project copy, so ProjectView.currentProject's recency comparison let an older useProjectDetail snapshot shadow the accepted PATCH and the picker label never updated. The callback now carries the daemon's authoritative post-patch project (fresh updatedAt included), matching the design-system switch path, and ProjectView hands it straight to onProjectChange. * test(e2e): repair remaining stale full-suite UI contracts Second repair batch for the failures surfaced by full diagnostic run 29480362163, plus one CI-invisible case that was serially skipped behind the BYOK failure in the same file: - Point the working-dir metadata spec at a directory that exists on the runner instead of a hardcoded absolute path, and assert the label from the picked path (this spec is red without the ProjectView patched-project fix). - Navigate back to All project files before asserting the plugin-folder cards, since a finished run auto-opens the produced file tab. - Resolve the create-run response race in real-daemon-run's sendPrompt via a single waitForResponse alongside the click. - Refresh selectors and copy for entry topbar, home hero rail, chat todo autoscroll, project management, workspace keyboard, design files, manual edit, restoration, and DS picker clipping flows to match the current UI contracts while keeping each spec's oracles. * ci: distribute the full UI suite over a generic 8-shard matrix Replace the diagnostic four-domain P0/P1/P2 serial topology with a single all-shades Playwright invocation per shard (--shard=N/8, two fully parallel workers, 20-minute cap) and drop the scheduled trigger; full runs stay manual until the merge-queue wiring lands. Update the workflow topology guard accordingly. * ci: serialize full UI shards and widen the matrix to twelve The eight-shard two-worker experiment left six light shards healthy (260-477s test steps) but both shards holding runtime-heavy files degraded: repeated two-minute timeouts with retry recovery in one, and a consistent create-run response starvation failure in the other. This matches the earlier finding that runtime-heavy scenarios cannot share a runner under two fully parallel workers. Run each shard with a single worker and rebalance to twelve shards; fully-parallel stays on only for test-granularity sharding. * fix(web): preserve prompt-extracted plugin inputs across apply reconcile The active-plugin apply reconcile rebuilt the inputs from the bind-time optimistic snapshot, so edits the user typed during the apply roundtrip (already extracted into active.inputs by handlePromptChange) were silently reverted to defaults — the submitted pluginInputs then disagreed with the visible prompt. Merge the apply result's defaults into the current inputs inside the functional updater instead, mirroring the guard the prompt-text reconcile already had. * test(e2e): stabilize home gallery flows for all-shades execution Generic all-shades sharding executes tests in orders the shade-filtered domain topology never produced, exposing a home-surface remount window: the async projects fetch can mount or remount HomeTemplatesReveal after a test starts interacting, collapsing the gallery (inert) under the test's cursor. Stabilize the shared helpers instead of individual specs: - gotoEntryHome arms a projects-list response waiter before navigating and holds until it settles. - revealHomeTemplates requires the revealed state (or a true pass-through) to survive a settle window, retrying when the wrapper mounts late; a card's isVisible() is true inside the collapsed container, so openHomePluginDetails now always routes through the reveal path. - The browse-registry spec reveals before clicking. - The DS-picker options moved out of the new-project-modal subtree with the portal fix; query the page-level popover per the clipping spec's convention. - real-daemon-run's sendPrompt reports on timeout whether POST /api/runs was ever issued, so the CI-only BYOK failure can be split into swallowed-click vs unanswered-request on the next reproduction. * test(e2e): make BYOK availability hermetic and reveal remaining gallery clicks The BYOK missing-provider spec could only pass on machines with a real `opencode` binary: daemon detection maps byok-opencode's availability through the `opencode` agent's configured cli env, and the web composer refuses to POST /api/runs for an unavailable agent (the sendPrompt diagnostic confirmed "was never issued" on CI). Point the helper's agentCliEnv at the fake opencode runtime — the run still fails pre-spawn on the missing provider config, so the fake binary never executes. Also route the two remaining collapsed-container gallery clicks (the browse-registry starter journey and the detail-use force-click) through revealHomeTemplates; an inert container swallows force-clicks silently. * ci: probe a 24-shard full UI matrix against the four-minute wall target The first green 12-shard run put eleven shards at 141-354s test steps but concentrated the contiguous runtime-heavy chain in one 894s shard, setting a ~16-minute wall tail. With ~3568 total test-seconds and ~90s per-job overhead, 24 shards should land every job near four minutes. * ci: settle the full UI matrix on twelve shards The 24-shard probe stayed green but proved the runtime-heavy chain is a serial group (test.describe.configure serial in real-daemon-run), which Playwright keeps atomic within one shard: the tail stayed ~16 minutes while the extra twelve cold starts raised aggregate runner time from ~76 to ~102 minutes. Twelve shards dominate; lowering the wall below the serial-chain floor is a de-serialization follow-up, not a shard-count knob. * test(e2e): drop serial mode from shard-splittable files Playwright keeps a serial group atomic within one shard, so real-daemon-run's file-level serial made its ~16-minute chain the floor of the full UI matrix wall regardless of shard count. Every test in the three serial files already performs its full setup per test (config reset, route stubs, own project), so serial only added skip-after-failure and shard atomicity. Verified order independence by running each file's two standalone shard halves locally (fully parallel sharding, one worker): 21/21, 57/57, and 12/12 across the halves. * test(e2e): settle the projects fetch in real-daemon-run home navigation With serial mode gone, the plugin-authoring spec runs after arbitrary shard predecessors, so the daemon holds more projects when it navigates home; the late-resolving projects list re-renders the hero and left the shortcuts trigger unstable for the whole click timeout on CI. Port the projects-settle waiter already used by entry-chrome-flows into this file's gotoEntryHome. * test(e2e): name the plugins-load gate in the plugin authoring spec The home shortcuts trigger is disabled while the plugins list loads, and this spec's mid-flow reload re-fires that fetch after gotoEntryHome's settle has already passed — on CI the click then times out opaquely for 120 seconds. Arm a response waiter across the reload and assert the trigger's enabled state explicitly, so a slow or hung /api/plugins fails with the actual cause named. * test(e2e): enter plugin authoring through the plugins page create button The home shortcuts trigger sits disabled on CI runners while a home plugin apply hangs (plugins list resolves, the pending-apply gate never clears); three reproduction attempts confirmed the anomaly is CI-only and independent of this journey. The create button on the Plugins page drives the same queuePluginAuthoring flow, and this spec's oracle is the generated scaffold plus its action cards, so route the entry there and track the disabled-trigger anomaly separately. * ci: let configure-ci-parallelism drive full UI shard workers The single-worker override predates the repairs that explained the two-worker instability (BYOK agent availability and the reveal remount race, both test-side and since fixed), so it was pinning throughput on a stale diagnosis. Drop it and let the repo's nproc/2 convention apply — two workers on the four-core ui_hot profile — halving the per-shard test step if the runtime holds. * ci: probe three full UI workers against Blacksmith's actual vCPU capacity The ui_hot profile resolves to blacksmith-4vcpu runners that reportedly provide six actual vCPUs while nproc's cgroup view says four, so the nproc/2 convention derives two workers and idles capacity. Pin three workers for this probe and print the CPU topology alongside for verification. * Revert "ci: probe three full UI workers against Blacksmith's actual vCPU capacity" This reverts commit 63c8296ae0ead2c3dadfbfda41f6e068d58331ef. * ci: skip the critical fallback for pure packaged-leaf changes Playwright starts tools-dev web (daemon + web runtimes) and never launches the desktop, packaged, or tools-pack entrypoints, so PRs confined to apps/desktop, apps/packaged, or tools/pack were paying the two-job critical fallback (5.4-13.4 minutes of wall each) for coverage their package tests and preflight already provide — seven of the eight fallback PRs in the latest 100-merge sample were such false positives. Add a fail-closed ui_critical_validation_required scope: it clears only when every non-exempt changed file sits under one of those three leaf roots. tools-dev, any transitive package (including the undeclared metatool edge), scripts, runtime resources, unknown roots, and mixed leaf + runtime changes keep the fallback armed; root manifests keep enabling P0 with the existing critical/P0 mutual exclusion; merge-group full mode is unchanged. * test(e2e): align question-form specs with inline Studio discovery Rebasing onto main picked up #5496, which moved clarification forms inline into the chat flow and removed the legacy Questions workspace tab. Re-point the submit-persistence spec at the inline form, and fix the oracles that no other lane had verified since: the answered summary echoes the picked visual-style card title (not the option label), and the submitted answer message carries the card title plus its value id. * test(e2e): absorb post-rebase drift in BYOK gating and zh-CN hero copy Two more contracts only the full pool guards moved under the rebase: - The composer's BYOK gate silently swallows submits until the incremental /api/agents stream has delivered byok-opencode's availability, so a fast submit races the stream (the sendPrompt diagnostic reports the POST was never issued). Retry through that window; runErrorCard reads the last card, so swallowed attempts cannot shadow the provider-validation oracle. The gate erroring instead of waiting while agents are still loading is a product-side follow-up. - The home hero title copy changed in every locale; re-point the zh-CN P2 smoke at the current translation. * test(e2e): align gallery specs with the all-types default slice The Community gallery now defaults to an All category pill (#5759) instead of pre-selecting Deck: assert the new default state in the hero and category-tab specs, and have the facet-filter spec pick Deck explicitly before asserting the deck-only visibility set. * test(e2e): align the first-run reveal spec with the all-types default slice Same #5759 drift family as the entry-chrome-flows gallery specs, missed by the first sweep because it lives in home-hero-rail: the revealed gallery now shows the All pill selected instead of hiding it with live-artifact pre-selected. * docs(e2e): add UI test stability rules distilled from the full-pool work Capture the invariants a UI test must hold to stay green under the generic sharded full pool, learned from stabilizing that suite and two rebases: - order independence (no serial groups; setup is per-file, not universal), and that neither shade-filtered local runs nor merge-path P0 prove it; - retry-only passes are an order-leak/readiness signal, not flake; - settle async surfaces (best-effort waiter + a state-survives-a-window check) before interacting; - an enabled control is not a ready control when a streamed precondition (e.g. BYOK-OpenCode agent availability over the /api/agents SSE stream) gates it; - never force-click into inert/collapsed reveal containers; use actionability, not visibility, as the readiness signal; - hermetic agent availability via route mocks (with the terminal SSE `done` event) or fake CLI runtimes + agentCliEnv, never host binaries; - realign stale oracles against the product and confirm them in the lane that actually executes the case, since a merged PR does not verify P1/P2 or unregistered-file P0 oracles; - name failure causes so a CI-only reproduction carries its own evidence. Cross-linked from the top-of-file coverage-status pointer. * test(e2e): realign BYOK missing-provider spec to the #5745 client-side preflight main #5745 added a client-side BYOK preflight that blocks a missing-provider run before any POST and opens the execution Settings section, instead of letting the run reach the daemon and fail there. Rewrite the spec to the new "blocked before spawn" behavior: submitting opens the execution-mode dialog, no create-run request is issued, and no artifact is produced (persisted across reload). This drops the now-obsolete daemon-failed-run assertions and the SSE-availability retry loop, which the preflight makes unnecessary. * docs(e2e): explain why the functional config ignores visual specs Clarify that visual-*.test.ts are owned by playwright.visual.config.ts and its playwright_visual lane, so excluding them from the functional config is intentional scope (it keeps a bare test:ui or the full-pool shard run from executing visual specs without their visual config), not a disabled lane. * fix(web): portal the New Project brand-preview flyout with the popover The earlier DS-picker unclip portaled the popover list but left its companion brand-preview flyout on the old inline `position: absolute` against the trigger wrapper. Once the popover moved to a body portal, the flyout for a finalized `user:<id>` brand was still clipped by the modal body and no longer anchored to the popover. Portal the flyout too and place it beside the popover with the same viewport-aware logic (right of it when the 320px card fits, else flipped left, then clamped), mirroring the popover's up/down vertical anchor. Red spec: e2e/ui/new-project-ds-picker-clipping.test.ts "finalized-brand preview flyout is not clipped by the modal body" — red with the popover portaled but the flyout inline, green with this change.	2026-07-20 09:25:09 +00:00
PerishFire	925db8d2af	ci: move nix and docker off the merge validation path (#5682) ... * ci: move nix and docker off the merge validation path Core ci.yml / Validate workspace / merge_group no longer schedule or require Nix flake check or Docker image builds. Packaging lives on two standalone workflows: nix.yml (flake check) and docker-image.yml (PR smoke build + tag/release publish). Update scopes, topology tests, and agent docs. * fix(ci): detect Docker publish from release inputs, not workflow_call event Reusable workflow callers keep their own github.event_name (usually workflow_dispatch), so matching event_name == workflow_call never fires and stable GHCR publish would silently smoke-build only. Gate publish on tag push or non-empty release_version / publish_latest inputs instead. * fix(ci): keep smoke-only Docker sha tags off the publish path Gate pr-/manual-sha metadata tags on publish != true so release-stable workflow_dispatch callers do not push extra manual-sha-* tags to GHCR.	2026-07-15 08:47:03 +00:00
Leon Aburime	8d20f5566b	feat(guard): catch @ts-nocheck files with unresolved relative imports (#5164) ... * feat(guard): catch @ts-nocheck files with unresolved relative imports `// @ts-nocheck` disables all type checking for a file, including TS2307 "Cannot find module". That silently hides broken relative imports: a barrel move or file rename can leave a @ts-nocheck module importing a path that no longer resolves, and `pnpm typecheck` stays green while the module fails to load at runtime. tsc also never verifies the specifier of a dynamic import() even in a fully-checked file. Add a guard check (wired into `pnpm guard` and its unit-test list) that re-establishes the one guarantee @ts-nocheck removes: every relative import / export-from / import-type / dynamic import() specifier in a @ts-nocheck TypeScript source must resolve to a real module on disk. NodeNext .js -> .ts mapping, extensionless directory-index barrels, and asset extensions are all handled; string literals in comments/expressions are ignored (AST-based). Clean on the current tree: 33 @ts-nocheck files, 0 violations. * fix(guard): resolve .mjs/.cjs imports extension-specifically Review follow-up (#5164): resolvesRelativeSpecifier mapped .js/.mjs/.cjs to one broad candidate list, so `import './x.mjs'` passed whenever `x.ts` existed and `./x.cjs` whenever `x.ts`/`x.mts` existed — but NodeNext emits .mjs only from .mts and .cjs only from .cts (a same-basename .ts emits .js), so those imports fail at runtime. That was a false negative in the guard's core promise. Split candidates by requested JS extension: .js -> [.ts,.tsx,.js,.jsx], .jsx -> [.tsx,.jsx], .mjs -> [.mts,.mjs], .cjs -> [.cts,.cjs]. Add fixture assertions for the accepted matches and the rejected .mjs/.cjs mismatches. --------- Co-authored-by: LA <la@LAs-MacBook-Pro.lan>	2026-07-14 03:20:35 +00:00
open-design-crew[bot]	323246a64c	Website Clone: first-party Home entry, fidelity, real-clone example cards + tracking (#5178) ... * Add Website Clone home entry with bundled web-clone skill and root-relative asset preview fix * Retrigger CI * Open the site entry after website-clone turns * Harden web-clone skill asset and color fidelity Recon now scrolls the full page and captures @font-face rules, real font/image resource URLs, computed section palette, and resolved root variables. Asset harvest is rebuilt on the browser network stack so cross-origin CDN images, fonts, and media (hotlink-protected included) all land locally, with a self-hosted fonts.css and an originalUrl→localPath manifest. Clone audit gains --recon --strict fidelity gates (fonts self-hosted, images downloaded, key section colors exact) that exit 2 on violations, and SKILL.md makes all three a mandatory delivery gate. * Default web-clone mode to faithful reproduction when unconfirmed A real nike.com run showed the agent silently downgrading to visual-homage mode (placeholder brand, typography blocks instead of photography, approximated palette) because the user skipped the turn-1 confirmations and the site was a copyright-heavy commercial SPA. Fidelity is the point of this scenario: default to faithful reproduction, land real assets first, record trademark/copyright replacements as a pre-deploy checklist for the user to decide in Step 6, and never skip script recon just because the target looks bot-sensitive. * Streamline web-clone runs: skip discovery with URL, exempt brand constraints, actionable playwright setup Three run-path optimizations for the Website Clone scenario: 1. POST /api/projects derives metadata.skipDiscoveryBrief for web-clone projects whose pending prompt already carries the target URL — the URL is the brief, so the turn-1 question form no longer stalls the run (an explicit client flag still wins). Covered by project-create-web-clone-discovery.test.ts. 2. Prompt composition skips the design-system authoritative block and craft rules for intent=web-clone runs: the fidelity target is the original site, not the project brand; brand application belongs to the skill's Step 6 replacement phase. 3. The plugin's playwright-loader now also resolves from the process cwd (so 'npm i -D playwright' in the project root works for scripts staged under .od-skills/) and fails with exact fix commands; SKILL.md documents the staged-path resolution and forbids downgrading to eyeballing because of missing deps. * Swap the copyright guardrail for faithful reproduction on web-clone runs The official designer prompt's 'don't recreate copyrighted designs — help the user build something original instead' bullet made web-clone agents silently rebrand clones (Nike → placeholder brand, original SVGs instead of real photography) even after the skill mandated faithful defaults: a system prompt guardrail outranks skill blocks. For intent=web-clone runs the bullet is swapped for a faithful-reproduction rule that routes trademark/copyright caution through a pre-deploy replacement checklist (NOTES.md) the user owns. Prompt tests guard both directions of the substitution. Also: recon now captures scroll-feel signals (scroll-behavior, scroll-snap rule count, sticky/fixed census) and SKILL.md makes matching the original's scroll behavior (smooth-scroll libs, snap, sticky) a fidelity requirement. * Extract web-clone into a shared global skill referenced by ref The Website Clone workflow (SKILL.md + 14 recon/harvest/audit scripts + references) moves from the example-web-clone plugin into the global skill registry at skills/web-clone/. example-web-clone now references it via od.context.skills:[{ref:'web-clone'}] instead of shipping its own copy, so the upcoming per-site clone example plugins can all share one skill rather than each duplicating a 16KB SKILL.md and its scripts. Pinned-plugin skill resolution (server.ts) previously only loaded a plugin's LOCAL ./SKILL.md; a {ref} skill loaded nothing, so the body never entered the prompt and the scripts never staged. It now falls back to resolving the ref against the global registry, loading the body and registering the skill dir for cwd staging. Verified end-to-end in a live run: skills/web-clone stages to .od-skills/web-clone-<hash>/ with SKILL.md + all scripts. guard.ts residual-JS allowlist follows the scripts to their new home; a structural test locks the manifest<->skill contract. * Add 7 Website Clone example-prompt cards for the Home clone rail nexu.io, open-design.ai, anthropic.com, vercel.com, resend.com, linear.app, raycast.com — each a thin example plugin that references the shared web-clone global skill (od.context.skills:[{ref:'web-clone'}]) so none duplicate the workflow. Each seeds the composer with a faithful-clone prompt for its URL and ships a self-contained example.html preview built from a real recon capture of the target homepage, so the gallery card shows what the card clones. They surface under the Website clone chip's example-prompt rail (verified in a live desktop run) and inherit the chip's intent:'web-clone' metadata, so clicking one runs through the full fidelity path (skip discovery, brand exemption, faithful reproduction, script recon/harvest/audit). * Polish clone example-card previews with a framed hero capture The first pass inlined a downscaled full-page screenshot cropped mid-content — it read as a raw screenshot dump. Each preview is now a crisp above-the-fold hero capture (1440x900 DPR2, 16:10) presented inside a browser-window chrome (traffic lights + host URL pill) on a brand-tinted gradient, so the gallery card reads as an intentional site preview. Verified by rendering the previews headless. * Cache the plugin list so Home remounts don't grey the create rail HomeView re-fetched + parsed the large /api/plugins payload on every remount, leaving the create-rail chips disabled for 1-2s each time. A module-level cache (listPluginsFresh, 10s TTL) serves warm mounts without the network round trip so pluginsLoading clears within a frame; the first render stays cheap (empty list) to keep the click off the critical path. Also hide the base example-web-clone plugin from the example rail (the per-site clone-* cards are the real examples). * Ship real self-contained clones as example-card previews + align seed prompt Each clone-* example.html is now a real, self-contained reproduction of its target site (inlined CSS/fonts/images via document.styleSheets serialization so CSS-in-JS/Next.js SPAs like Vercel/Raycast capture correctly, oversized icon sprites dropped, rasters downscaled to stay under the 5MB preview cap, plus a scroll-reveal motion layer). Preview renders the real HTML; Remix copies it into a project as index.html. Manifests reuse the base web-clone useCase.query with a {{targetUrl}} default per site, so picking a card seeds the same preset prompt with the URL filled in instead of the marketing description. * Shrink clone example previews ~33% (dedup + drop EOT + WebP) Three lossless-to-near-lossless passes on the self-contained clones: - Dedup repeated data-URIs (same image used in <img> + css url() N times): store each once as a :root CSS var, point url() at var(), hydrate img[src] from the var via a tiny script. Resend alone shed 1.8MB. - Drop leftover EOT/fontobject font data-URIs (IE-only, redundant with woff2). - Re-encode inlined raster images to WebP (~50% smaller than JPEG at equivalent quality) via cwebp q72. Total across the 7 cards: ~23MB → ~15.5MB, every card now under 3MB (was up to 5MB). Image hydration + fidelity verified by headless render. * Lead create rail with Website clone; seed example cards with just the URL - Move 'web-clone' to the front of CREATE_RAIL_ORDER so Website clone is the first create-rail card, ahead of Slides (deck). - Website-clone example cards (Clone Nexu, Clone Vercel, …) now seed the composer with the same short 'clone this site: <url>' scaffold the chip uses (localized webClonePromptSeed prefix + the card's targetUrl), e.g. 'Website URL to clone: https://nexu.io', instead of the multi-paragraph build spec. Picking the chip with an empty composer already seeds the bare prefix for the user to paste a URL after. - Fix a test-only regression from the Home plugin-list cache: the module-level visible-plugins cache leaked a case's mocked /api/plugins payload into later cases via listPluginsFresh, greying the rail / stranding scenarios on 'Template None'. Add resetPluginsCache() and clear it in a global afterEach. * Track web-clone example-card picks (example_prompt / example_open_project) The Website-clone example cards (Clone Nexu / Vercel / …) had no analytics on pick or remix, so the site-clone funnel could not be broken down per example. Wire the two clicks the contracts already type (埋点文档 row 116): - useExamplePlugin → ui_click area=chat_composer element=example_prompt - duplicateExamplePlugin (Remix) → element=example_open_project Both carry chip_id (web-clone) + plugin_id (example-clone-<site>) + plugin_type for per-site breakdown. The created project's own project_kind=web_clone (already derived from metadata.intent via projectKindToTracking) still rides project_create_result / run_created, so 'how many projects are website clones' is answerable without extra work. No contracts change — the element enum and the web_clone project_kind already existed. Adds a behavioral test asserting both events fire with the right triplet + attribution. * Mirror web-clone copyright-guardrail swap into contracts/BYOK prompt PR #5178 blocking review (nettee/looper): the daemon prompt special-cases intent='web-clone' (faithful-reproduction rule) but the contracts prompt stack — which apps/web uses for API/BYOK runs — imported OFFICIAL_DESIGNER_PROMPT directly and never routed web-clone, so BYOK website-clone runs kept the original 'build something original' guardrail. Daemon and BYOK now behave identically: - contracts/prompts/official-system.ts: add COPYRIGHT_GUARDRAIL_BULLET, WEB_CLONE_COPYRIGHT_GUARDRAIL_BULLET, renderOfficialDesignerPrompt (mirrors the daemon renderer; contracts base has no execution placeholders so it only swaps the bullet). - contracts/prompts/system.ts: composeSystemPrompt routes the charter through renderOfficialDesignerPrompt({ webCloneFidelity: metadata.intent==='web-clone' }). - Add system-prompt-web-clone.test.ts covering both modes + the byte-identical bullet guard. * Complete web-clone BYOK prompt parity + rebase relative JS asset refs Two remaining blocking issues from PR #5178 looper re-review: 1. contracts composeSystemPrompt still appended the active-design-system 'authoritative' block + visual-direction override unconditionally, while the daemon suppresses both for intent==='web-clone'. A BYOK web-clone run with an active design system was still told the design system wins, fighting faithful reproduction. Gate both sections behind !isWebCloneRun; add contracts tests asserting web-clone BYOK prompts drop the design-system guidance. 2. rewriteInlinedScriptAssetRefs only handled root-relative literals. When js/app.js is inlined into the HTML entry, a sibling lookup like fetch('./data.json') / new Worker('./worker.js') / import('./chunk.js') resolved against the HTML root instead of js/. Take the source script path and rebase confirmed relative refs against it (mirrors the CSS pass), membership- confirmed; add unit cases for ./sibling, ../parent, and escaping/missing. * Website-clone examples: plain text prompt cards, drop embedded HTML + Remix The 7 site example cards embedded a full self-contained clone of each target site (anthropic.com, vercel.com, …) as example.html and offered a one-click Remix that copied that markup into a project. Shipping verbatim copies of other companies' sites is an IP risk, so replace them with plain text prompt cards: - Delete plugins/_official/examples/clone-* (7 dirs, incl. the example.html reproductions and the Remix-enabling preview.entry). - Add a 'web-clone' entry to HOME_PROMPT_EXAMPLES (en + zh-CN, others fall back to en): 7 text cards that fill the composer with 'Website URL to clone: <url>'. With the site plugins gone, the web-clone chip's preset rail is empty so these static text cards render instead. Clicking one fills the URL prompt and (via the existing usePromptExample) still fires ui_click element=example_prompt chip_id=web-clone — no plugin_id / no Remix / no example_open_project. - Remove the now-dead webCloneCardTargetUrl seed override; refresh stale comments. - Rewrite HomeView.web-clone-tracking test for the text-card path (asserts text cards render, no plugin-preset / no remix affordance, and the pick still tracks). The base example-web-clone skill + web-clone run behavior (intent, fidelity prompt, discovery skip) are unchanged. * Give web-clone example cards a site logo + domain, not raw prompt text The 7 Website-clone examples rendered as near-identical white boxes each showing 'Website URL to clone: https://<site>' — visually flat and hard to scan. Render them as a logo gallery instead: each card shows the site's own favicon (resolved at render time via a public favicon service — no third-party brand assets are bundled) in a rounded tile above the bare domain (nexu.io, vercel.com, …). A blocked/failed icon fetch falls back to a lettered monogram tile. Click behavior is unchanged: the full 'Website URL to clone: <url>' prompt is still what fills the composer and fires ui_click element=example_prompt. Non-URL prompt examples (other chips) keep the plain text card. * Web-clone examples: keep only open-design, add kimi Legal review flagged brand-copy risk in the example rail. Drop the nexu / anthropic / vercel / resend / linear / raycast site prompts and keep just open-design.ai plus kimi.com (official Kimi partnership). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 03:28:06 +00:00
XingliGe	390fcf88f3	fix(plugin-previews): keep Community gallery previews in sync with shipped plugins (#5262) ... * fix(plugin-previews): validate baked preview metadata against shipped plugins The Home Community gallery renders whatever data/plugin-previews/manifest.json names, and nothing kept that metadata in sync with reality: #4815 deleted 19 example plugins but left all 19 manifest entries behind, #4040 shipped a card showing another plugin's imagery, a failed re-bake silently leaves the old clip serving outdated content, and durationMs recorded the intended walk time rather than the encoded file (23 entries carried holdMs > real duration, so the card's idle loop pointed past the end of the clip). - add scripts/check-plugin-preview-manifest.ts to pnpm guard: every manifest entry must name a shipped plugin, own its clip keys (<id>/<hash>/... or the legacy <id>.<hash>....), carry a coherent fingerprint, and never share a clip with another entry; prune the 19 orphaned entries it caught - bake validation (BAKE_VERSION 5): reject blank clips (whole-clip luma range via ffprobe signalstats), record durationMs from the encoded file, clamp holdMs to it, and write a bake-report.json naming skipped/stale/blank plugins instead of swallowing the failure - strict mode (--strict / PREVIEW_STRICT=1) fails the run when a bake left broken metadata behind; the pre-merge validation workflow now runs strict while the post-merge/nightly publishers stay lenient * fix(plugins): make the hyperframes example self-contained The example loaded cdn.tailwindcss.com (a render-blocking head script the page never used — every style is inline) plus Google Fonts. Inside the sandboxed gallery iframe or on a slow network the stalled script showed a long blank instead of the composition, and the CI bake raced the webfonts. Drop both: the page now renders from local system font stacks with zero external requests, so the live preview, the detail iframe, and the baked clip all show the same content. * fix(plugin-previews): address review — fail fast on probe errors, widen strict trigger paths - probeClipMs/clipLumaRange now throw instead of returning null: ffprobe is required validation infrastructure, and a swallowed probe error silently disabled exactly the checks this PR adds. A thrown error becomes an 'error …' skip, is recorded in bake-report.json under 'errors', and fails strict mode — while the routine skips every sweep has (non-html plugins 404ing the preview route) still never trip strict. - bake-plugin-previews-pr.yml now also triggers on plugins/community/**, .github/actions/bake-previews/**, and itself, so community-plugin preview changes and bake-recipe changes cannot merge without the strict pre-merge validation. * fix(plugin-previews): bake static pages as a held still instead of skipping forever The strict pre-merge bake on this PR caught five manifest entries that could NEVER refresh: example-dating-web, example-html-ppt-zhangzara-8-bit-orbit, example-frame-logo-outro, od-new-generation, example-orbit-notion. All five are (near-)static pages — the CDP screencast only delivers frames when something repaints, so they produce 1-4 frames and the old 'frames < 5' guard skipped them on every bake, nightly included, leaving their committed entries permanently stale (their old clips are the 103-210ms degenerate files in the manifest today). Encode <5-frame captures as a still instead: hold the last frame for the idle-loop span (half before the trailing repeated concat entry, half inherited by it, summing to ~HOLD_MS). Only a zero-frame capture is a real failure now. The blank-luma check still rejects stills of nothing. * fix(plugin-previews): never persist a manifest entry without a fingerprint When the preview fingerprint fetch failed, the loop still rendered and — on an otherwise successful bake — persisted an entry with hash: null and un-fingerprinted keys: metadata the content-hash reuse skip can never match again and the new manifest guard rejects. Treat a missing fingerprint as an infrastructure error instead: skip the plugin, record it under errors in bake-report.json (strict mode exits non-zero), and leave any committed entry untouched for the next sweep. --------- Co-authored-by: Tuola Ge <gexingli@refly.ai>	2026-07-08 03:44:05 +00:00
XingliGe	643b5a64b2	Add web-clone skill (#5063) ... * Add web-clone skill * Fix web-clone report command order * Fix web-clone workflow paths * Fix web-clone post-cd paths * Fix web-clone network capture * Fix web-clone root override docs * Fix web-clone notes path * Align web-clone reference paths * Use init output for web-clone project path * Preserve web-clone init failure status * Handle non-ASCII web-clone names --------- Co-authored-by: tuolaji <tuola@tuolajideMacBook-Air.local>	2026-07-03 06:57:37 +00:00
lefarcen	59bca72f7e	feat(export): programmatic screenshot-based PPTX/PDF export (#4604) ... * feat(export): programmatic screenshot-based PPTX/PDF export Replace the prompt-driven "ask the agent to run python-pptx" PPTX export with a deterministic, programmatic pipeline. The daemon renders each deck slide to a pixel-perfect PNG via the desktop's bundled Electron Chromium (reused over sidecar IPC — no second headless engine, so the packaged app does not grow) and assembles a one-image-per-slide .pptx (PptxGenJS) or raster .pdf (pdf-lib). - sidecar-proto: RENDER_SLIDES message + DesktopRenderSlides{Input,Result} - daemon: deck-export.ts assembler (decode + pptx + pdf), POST /export/pptx and /export/pdf-image routes, desktopSlideRenderer wiring - desktop: deck-capture.ts renders the deck off-screen and captures one PNG per `.deck > .slide` (skips presenter-mode .mini-slide clones) - web: exportProjectAsPptx() fetch+blob download; ProjectView swaps the prompt path for it - cli: `od export pptx|pdf` dual-track closure - remove the now-dead build-pptx-export-prompt lib + test Tests: deck-export assembler unit tests + exportProjectAsPptx web tests. Screenshot mode ships first; editable-rebuild modes are follow-up. * chore(nix): refresh pnpm deps hash * fix(export): deck PDF blank pages on opacity decks + image export capturing the modal Two pre-existing deck-export defects surfaced while validating the new export: - Vector PDF (Print-ready) left blank pages for decks that show one slide at a time via opacity: DECK_PRINT_CSS forced each .slide onto its own page but never reset opacity/visibility, and CSS transitions animated opacity from 0, so inactive slides printed blank. Force opacity/visibility/animation/ transition in print media (both the web and desktop DECK_PRINT_CSS). - "Export as image" captured Open Design's own format-chooser modal: the host compositor snapshot ran after the modal opened, so the overlay leaked into the PNG. Capture the clean preview before showing the modal; the cached snapshot is reused so opening the modal never re-captures over the overlay. * feat(export): dual-mode renderer + reuse screenshot for image/PDF export Unify all screenshot exports on one off-screen renderer and make them viewport-independent: - Renderer (deck-capture.ts) now has two modes: deck → one 1920x1080 PNG per slide (optionally just the slide at `index`); page (no `.slide` sections, e.g. a website) → a single full-document PNG at natural size. Adds `index` to the render input and `mode` to the result. - Image export now renders through the daemon off-screen renderer (deck → the current slide at fixed size; website → the whole page as one long image), so the exported size no longer depends on the preview pane and can never capture Open Design's own UI. Falls back to the host/iframe snapshot on web. - "Export as PDF" (UI) now produces a pixel-perfect screenshot PDF that matches the preview (same renderer as PPTX/image), falling back to the vector print path on web or on failure. - New POST /export/image route; PPTX on a non-deck returns a clear 422. * feat(export): smart full-page image capture + PDF back to print-view default Full-page image export now auto-selects the capture technique (users only see "full page"): - captureBeyondViewport (one clean off-screen pass, no fixed-element duplication) when the output fits the machine's real GPU texture limit — queried at runtime via WebGL MAX_TEXTURE_SIZE, not hard-coded — and below-the-fold content actually rendered. - scroll-segment stitch otherwise (too tall, or blank-below-fold scroll-driven pages like parallax landings): scrolls a viewport at a time, captures each frame, and stitches by real scroll offset into one long PNG. RAM-bound (a plain buffer, not a GPU texture), capped by a memory budget; encoded with a tiny dependency-free PNG encoder (node:zlib) so it bundles cleanly into the ESM packaged main and has no Skia dimension cap. - Output scale derives from the window DPR / actual captured chunk, fixing a double-scale bug (DPR x clip.scale) that produced 4x-sized images. PDF "Export as PDF" reverts to the print-ready vector path (instant, selectable text) as the default; the pixel-perfect screenshot PDF stays available via `od export pdf`. * fix(export): PDF defaults to the CJK-safe screenshot path, not vector printToPDF Chromium's vector printToPDF embeds no fonts in the packaged runtime and drops CJK glyphs entirely — a Chinese page exported to "PDF" lost all its Chinese text (only Latin survived). The off-screen screenshot renderer (already used for image/PPTX) rasterizes the real browser render, so CJK is always correct. "Export as PDF" now produces a pixel-perfect screenshot PDF that matches the preview (one page per deck slide, or the whole page for a website), falling back to the vector/browser print path only on web or on failure. Verified: a Chinese site that lost its text under vector printToPDF renders fully under the raster path. * perf(export): stitch scroll-segments with Electron's native PNG encoder The scroll-segment path was slow (~100s for a long parallax page) because of a hand-written PNG encoder: a per-pixel JS BGRA→RGBA loop over tens of millions of pixels plus zlib.deflate of a ~110MB high-entropy buffer. Replace both with Electron's native image pipeline: stitch chunks as BGRA with one Buffer.copy per chunk (capturePage already returns BGRA, which is what createFromBitmap wants — no channel swap, no per-pixel JS) and encode once via nativeImage.createFromBitmap(...).toPNG(). createFromBitmap is a CPU bitmap, not a GPU texture, so it is not bound by the texture limit. Removes the hand-written PNG encoder (crc32 / chunk framing / node:zlib). Measured on a long parallax page: image 44s→17s, PDF 101s→19s (~5x), and the native encoder also compresses better (55MB→26MB PNG). * fix(export): render the image only on Save, after the format is chosen Image export was rendering eagerly when the modal opened (a holdover from when the capture had to run before the modal to avoid catching the overlay). Now the desktop path renders off-screen and can't see the modal, so capture moves to the Save click: open modal → pick format → Save → render + encode + download. The Save button shows the "Saving…" state during the render; for the web-only host-compositor fallback the modal is hidden during the brief capture so it can't leak into the image. The snapshot is cached, so switching format after a render re-encodes without re-capturing. * perf(export): raster PDF embeds full pages as JPEG (52MB -> a few MB) The screenshot PDF embedded full-page captures as PNG, so a photo-heavy long page produced a ~52MB PDF. Full pages now render as JPEG (quality 82) — visually near-identical for web screenshots but ~10x smaller. Deck slides stay PNG (crisp text/graphics); image export still uses a lossless PNG source the client re-encodes to the user's chosen format. Threads a `pageImageFormat` hint through the render input; the desktop renderer encodes page mode as JPEG (CDP captureScreenshot format:jpeg / nativeImage toJPEG) and the daemon assembler embeds with embedJpg vs embedPng per image. * feat(export): pre-pass for reveal-on-scroll + deck image as one long image Two improvements found while testing real landing pages: 1. Pre-pass before full-page capture: freeze animations/transitions and scroll the whole page once (then back to top) so reveal-on-scroll content (IntersectionObserver / AOS / lazy images) is triggered and holds. This is the standard full-page-screenshot technique. Result: pages that previously came back blank-below-the-fold (and fell to the duplicate-prone scroll- stitch) now succeed with a clean single-pass captureBeyondViewport. Verified: a reveal-on-scroll landing page renders fully in one shot (no black, no duplicates); only pure JS-scrollY parallax (which re-hides at scrollY=0) still falls back to scroll-stitch. 2. Image export of a deck now stitches every slide top-to-bottom into one tall image (the "whole deck as one picture") via the native BGRA stitch, capped so a long deck can't exceed the bitmap limit. Ordinary pages remain a single full-page capture; a specific slide index is still honored if given. * fix(export): show the loading toast at the start (not after) + track real completion The "Exporting" toast was set inside the promise's .then(), so for a multi-second screenshot export it only appeared AFTER the export finished — looking frozen the whole time. Now fireShareExport shows a loading toast immediately, clears it on success, and shows an error toast on failure. The loading toast TTL is raised to 60s so it survives a long export, and PPTX threads its real promise (was fire- and-forget) so the toast reflects actual completion. Adds fileViewer.exportFailed across all locales. * fix(export): detect scroll-driven pages by comparison, not by color The blank-below-fold heuristic (flat-color fraction) was unreliable: a dark- themed page that renders fine (Mindloop, 89% near-black below the fold) looked "blanker" than a scroll-driven page that genuinely fails (Luxury, 78%), so the black middle slipped through and exported with a black band. Replace it with a color-independent comparison: render the document's MIDDLE band two ways — scrolled into view (real content) vs captureBeyondViewport at scroll 0 (what the one-shot produces). If they differ significantly, the page is scroll-driven and we use scroll-segment stitch; otherwise the clean one-shot. Verified: Luxury now exports full content (stitch), Mindloop stays a clean one-shot, dark designs are no longer false-flagged. * fix(export): recognize nested-`.slide` decks (export all slides + show PPTX) A deck whose slides are `.slide` nested under `.deck-viewport`/`.deck-stage` (not direct children of `.deck`/`body`) was missed: PDF/image exported only the first slide and the PPTX option was hidden, even though the slide pager showed "1 / 9". - Renderer: find slides via `.slide` anywhere, filtering out presenter-mode clones (`.mini-slide`/`.overview`/`.thumb`) in-page, instead of the rigid `.deck > .slide` selector. showSlide now also sets `visibility:visible` and toggles the common active-slide classes (active/visible/is-active/current) so decks that hide via `visibility:hidden` and gate reveals on `.visible` render every slide; animations are frozen so reveals reach final state instantly. - UI: PPTX export shows whenever the artifact is deck-like (incl. the content-detected `.slide` decks that drive the pager), matching the pager. Verified on a nested-`.slide` deck: PPTX = 9 slides, image = 9 stitched, all with content (previously only slide 1). * perf(export): cache /raw/ assets + halve per-slide round trips Two performance wins for screenshot export (covers + live preview benefit too): 1. /raw/ now emits ETag + Last-Modified + Cache-Control: no-cache, and answers conditional GETs with 304. Covers, live preview, and the screenshot export window all load project HTML + its fonts/CSS/images through /raw/, and in the packaged app the hidden export window shares the same Chromium session/cache as the web UI — so a second load reuses already-downloaded bytes instead of re-fetching every asset. The validators are derived from file size+mtime, so any agent rewrite changes them and busts the cache immediately (no-cache keeps it always-revalidate, never silently stale). Previously /raw/ sent no cache headers at all, so nothing was reusable. 2. Deck slide capture merges the slide-show DOM toggle and its two-frame settle into a single executeJavaScript round trip (showSlide returns the settle Promise) instead of two separate main<->renderer hops. Output is identical; the loop is measurably faster and the saving scales with slide count. Tests: apps/daemon/tests/project-raw-cache.test.ts covers the validators, 304 on If-None-Match / If-Modified-Since, cache-bust after rewrite, and the streamed media path. The merge is correctness-preserving by construction (same DOM ops, same two-frame settle). * perf(export): hand rendered images to the daemon as files, not base64 IPC The desktop renderer used to return every rendered slide/page as a base64 data URL inside the JSON IPC reply. For large images (photo-heavy decks) that means a 1.33x base64 blow-up plus JSON.stringify/parse of a multi-MB string plus a multi-MB socket transfer across the desktop->daemon sidecar bridge, with a matching RAM spike. The pixels only exist in the desktop process (it owns the Chromium that captures them), so they must cross to the daemon — but they should cross as a file on the shared filesystem, not as base64 in a JSON message. Now the daemon picks a unique scratch dir under its data root (<RUNTIME_DATA_DIR>/export-render/<id>), passes it as `outputDir` in the RENDER_SLIDES request, the desktop writes the images there and returns their paths in `slideFiles`, and the daemon reads them back and deletes the dir in a finally. desktop only ever writes to the absolute path the daemon handed it, so this works identically in dev and packaged (desktop never infers the data root). A unique per-request id means concurrent exports never collide. Base64 data URLs remain a fallback for older desktop builds that don't honor outputDir. - sidecar-proto: DesktopRenderSlidesInput.outputDir + DesktopRenderSlidesResult.slideFiles - deck-capture: emitImages() writes files when outputDir is set (all 3 paths: deck per-slide, deck stitch, full-page incl. scroll-segment) - deck-export: readSlideFiles() reads the handoff files (companion to decodeSlideDataUrls) - import-export-routes: create/own/clean the scratch dir; prefer slideFiles Tests: readSlideFiles unit tests; a route-level test that asserts the renderer is handed an outputDir under the data root, the image returns, the scratch dir is deleted after the response, and concurrent exports each get a unique dir. * chore(export): one-line per-phase timing logs for screenshot export A slow export now leaves a diagnosable trail instead of guesswork: - desktop `[od-export] render`: load / assets(fonts+images) / prepare / render phase breakdown + total, plus mode and whether the handoff used files. - daemon `[od-export] assemble`: renderer(IPC) / read(file handoff vs base64) / assemble(pptx/pdf build) + total + byte size. These immediately surfaced that a slow image export was dominated by the artifact's own in-browser compile (Babel/Tailwind CDN) and uncacheable external media — not the export pipeline (file read was ~2ms). One info line per export. * fix(export): normalize PDF page size to points; honor --title in CLI output name Addresses review feedback on PR #4604: - buildScreenshotPdf sized each PDF page by the captured image's pixel dimensions, so the nominal page size scaled with the capture's device pixel ratio (a 2x retina capture produced a page twice as large as 1x). Normalize each page to a fixed longest-side in points (960pt; a 16:9 slide => 960x540pt, matching PowerPoint) with the image's aspect ratio. The image still embeds at full pixel resolution, only the page's points change. - `od export pptx --title "X"` forwarded the title to the server but always saved the local file under the source HTML's basename. Name the output after the slugified title when --output is not given. Tests: PDF page-size normalization assertion (loads the PDF, checks 960pt not the 1px capture size); sidecar-proto render-slides IPC validation (outputDir, enum, boolean, unknown-key rejection, minimal round-trip). * test(export): cover the server Content-Disposition filename branch The exportProjectAsPptx happy-path test only exercised the no-header local fallback name; production always returns a Content-Disposition. Add a test that pins the branch the desktop download actually uses (server filename wins). * feat(export): support arbitrary-aspect decks (not just 16:9) Screenshot deck export no longer assumes every deck is 16:9. The renderer measures the deck's authored slide box (the rendered rect of the first slide with layout, so fit-to-viewport decks report the stage they actually paint), sizes the capture window + pinned stage to it, and clips capturePage to it. The measured pixel dimensions flow to the PPTX assembler, which derives the slide layout from the real aspect ratio (13.333" wide, height = width/aspect) instead of hardcoding LAYOUT_16x9 — so 4:3, square, and portrait decks export correctly-proportioned slides and PDFs instead of being letterboxed or clipped. Falls back to 1920x1080 / 16:9 when the slide box can't be measured or is out of a sane range, so existing 16:9 decks are unchanged. Verified: demo-deck measures 1920x1080 (16:9, unchanged); a 1024x768 deck measures 4:3. Tests: PPTX layout follows 16:9 / 4:3 / 9:16 aspect (asserted via the slide cx/cy in presentation.xml). * fix(export): capture off-screen carousel slides (translated-strip decks) showSlide only toggled the active class/opacity, so decks that paginate by translating a flex-strip container (e.g. html-ppt-zhangzara-grove) left slide 2+ off-screen and capturePage kept grabbing the first viewport region — exporting the wrong slide or a blank page. showSlide now reports where the active slide actually landed; if it is off the top-left capture stage, showDeckSlide restacks just that slide into the viewport (clears ancestor transforms + pins it fixed at 0,0) and re-settles before capture. This branch only runs when the slide is genuinely off-stage, so transform-scaled fit-to-viewport decks (active slide already at 0,0, and which DO rely on an ancestor scale) are never touched. Verified: a 3-slide flex-strip carousel — slide 0 stays at 0,0 (untouched), slides 1/2 detected off-stage (x=1920) and restacked to 0,0 before capture. * fix(export): gate PPTX on a host runtime; unify + center the image toast - PPTX export has no web-only fallback (it needs the daemon's Electron-Chromium screenshot renderer), so a web-only deployment showed a PPTX button that always failed with 501. Gate `showPptxExport`/`canPptx` on `isOpenDesignHostAvailable()` so the action only appears where it can succeed. Image/PDF keep their web fallbacks and stay shown. - Image export showed an in-modal spinner and a separate, non-portaled "saved" toast that rendered off-center (its `position:fixed` resolved against the preview pane's transform). Route image export progress through the same portaled, viewport-centered `exportToast` used by PPTX/PDF: close the modal on Save, show a loading toast, then success/error — one consistent, centered toast style. Removes the now-dead imageExportBusy/imageExportCapturing/savedToast. * fix(export): screenshot the current deck slide; never drop slides when stitching Two more review findings on the screenshot export path: - captureExportImageSnapshot() routed deck snapshots through the daemon without a slide index, so /export/image fell into the stitch-whole-deck branch even for "Copy screenshot" and "Export as image" — which both promise "the current preview". Pass the active slide index for decks so both capture the current slide. Stitching the whole deck into one long image is reserved for an explicit action (a follow-up modal toggle). - stitchDeckSlides() capped the output at DECK_STITCH_MAX_H by stopping the loop and still returning ok:true, silently dropping trailing slides (~13+ on a 2x capture) — partial-success data loss. It now captures slide 0 to learn the native size, picks one uniform downscale so all `count` slides fit under the cap, and stitches every slide (long decks just get a smaller per-slide size). * fix(export): drop dead `scale` param; keep deck PDF slides PNG (not JPEG) Two more review findings: - The render-slides contract accepted a `scale` field (validated in sidecar-proto, forwarded by handleScreenshotExport) that the desktop renderer never read — a broken protocol surface on the feature's first release. Remove it from the proto, the daemon route, and BuildDeckRenderInputOptions; the capture resolution comes from the measured stage size and host DPR. (No scale multiplier is needed today; if one is added later it must actually be applied in the renderer.) - The deck branch derived its image encoding from `pageImageFormat`, so the screenshot-PDF path (which sets pageImageFormat='jpeg') made deck slides lossy JPEG — contradicting the contract ("deck slides stay PNG; JPEG is a full-page page-mode optimization") and adding compression artifacts to text-heavy slides. The deck branch now always encodes PNG; only `page` mode honors JPEG. * fix(export): no silent truncation for tall pages; deterministic deck slide index - The full-page scroll-stitch path clamped the document height to the RAM budget and returned ok:true, silently dropping everything below the cap on very tall pages. It now refuses with a clear "page is too tall — export as PDF instead" error instead of returning a truncated image as success; pages within budget still stitch their full height. (Decks downscale to fit since they are discrete slides; a continuous page is failed rather than seam-spliced at reduced scale.) - Deck screenshots now always send a concrete slide index (slideState?.active ?? cached ?? 0) so a fresh open — or a deck detected only from `.slide` markup that never emits od:slide-state — captures the current slide instead of falling into the stitch-whole-deck branch. * fix(export): explicit page-vs-deck signal; surface semantic export failures Two review findings: - Treating any `.slide` element as proof of a deck was too broad for the generic /export/image and /export/pdf-image routes — an ordinary page with carousel or testimonial `.slide` markup would skip full-page capture and stitch those elements as slides. The caller now passes an explicit `deck` flag (the web knows `effectiveDeck`; PPTX is deck-only): `deck:false` forces full-page capture, `deck:true` forces slide capture, and the `.slide`-count heuristic remains only as the no-signal fallback (e.g. the CLI). - `exportProjectImageDataUrl()` returned null for every non-OK response, so a semantic failure (e.g. the daemon's new "page is too tall — export as PDF") was treated as "renderer unavailable" and silently downgraded to a partial visible-viewport screenshot. It now returns a discriminated result; the caller only falls back to a web capture when the off-screen renderer is genuinely unavailable (501/no-host/network) and surfaces the real error otherwise (Copy screenshot + Export as image both show the message). Plumbs `deck` through sidecar-proto, the daemon route/options, exports.ts (image + pptx + screenshot-pdf), FileViewer, and ProjectView. Proto test covers deck round-trip + rejection. * fix(export): harden the file handoff (path confinement) + narrow unavailable Three security/contract findings on the render-slides file handoff: - sidecar-proto now rejects a non-absolute `outputDir` (was: any non-empty string), so a malformed render-slides request can't make desktop main mkdir + write outside the daemon scratch area. Negative proto test added. - The daemon canonicalizes every returned `slideFiles` path and requires it to stay under the canonical `renderOutputDir` before reading — a buggy/malicious renderer response can no longer make /export/{pptx,pdf-image,image} read and stream back arbitrary files (path traversal / symlink escape). Returns 502 on an out-of-scope path; handoff test proves an out-of-tree path is refused and its bytes never reach the response. - exportProjectImageDataUrl wrapped the whole flow in one try/catch, so a 200 with a corrupt/unreadable payload was reported as `unavailable` and silently downgraded to the viewport screenshot. The `unavailable` path is now narrowed to transport-level failures (the fetch itself); a bad 200 payload returns a semantic `error` so the real failure surfaces. * fix(export): CLI page/deck flag; reject out-of-range slide index Two review follow-ups: - `od export pdf|pptx` now accepts `--deck` / `--page` and forwards the signal in the request body, so the CLI hits the route with the same page-vs-deck semantics the UI uses (which sends effectiveDeck). Previously the CLI fell back to the daemon's `.slide` heuristic, so an ordinary HTML file with carousel markup could export as a deck from the CLI but a full page from the UI. (PPTX stays deck-only server-side; the flag matters for PDF.) `--deck` and `--page` are mutually exclusive; omitting both keeps the heuristic fallback. - renderDeckSlides rejected nothing for an out-of-range `index`: it fell back to range(count) and the daemon returned slide 0 with 200 for image export, so asking for slide 99 of a 3-slide deck silently returned slide 0. It now fails with a clear "slide index N is out of range" error. * fix(export): If-None-Match precedence; renderer IPC outage -> 502 not 400 - rawRequestIsFresh fell through to If-Modified-Since even when the request sent a non-matching If-None-Match, so a same-second rewrite (ETag changes, but Last-Modified is identical at second granularity) could 304 changed bytes when both headers were sent. If-None-Match is now authoritative when present (RFC 9110 §13.1.3) — freshness is the ETag match alone. Regression test sends a stale ETag + the current If-Modified-Since and expects 200. - A rejection from desktopSlideRenderer (a 600s requestJsonIpc) — missing desktop process, broken socket, timeout — landed in the outer catch and became 400 BAD_REQUEST, making renderer outages look like caller errors to retries / monitoring. The IPC call is now wrapped and translated to 502 UPSTREAM_UNAVAILABLE, matching the !rendered.ok branch; the outer 400 stays for real request-validation / assembly errors. * fix(export): full-page stitch corrupts on fractional DPR (125%/150% scaling) scrollSegmentStitch rounded the device pixel ratio to an integer (`Math.round(size.width / PAGE_W)`), so on non-retina display scaling (1.25x, 1.5x) the output width and every row offset were wrong — the stitched full-page screenshot (/export/image and the raster PDF page path) came back cropped horizontally or with vertical gaps/overlap even though the page rendered fine. Derive width/height/placement from the REAL captured device width and its true (possibly fractional) ratio instead. Extracted scrollStitchGeometry / scrollStitchRowOffset as pure helpers with a non-integer-DPR regression test (1x / 1.25x / 1.5x / 2x). * fix(export): broaden deck slide selector; content ETag for transformed HTML - The renderer only recognized `.slide`, but shipped decks use other slide contracts the print/export path already supports (e.g. html-ppt-zhangzara-creative-mode uses `<section data-screen-label=...>`), so an explicit deck export of those silently downgraded to a single full-page capture. Broaden SLIDE_SELECTOR to the pdf-export family (`.slide, [data-screen-label], .deck-slide, .ppt-slide`), and when `deck === true` finds no slide surfaces, fail fast with a clear error instead of capturing a page. - /raw/ revalidation used the source file's mtime ETag even when the response is substituted by a transform (Vite dev-entry -> dist/index.html, or preview bridge injection). A change to dist/index.html with an unchanged source entry could then return a stale 304. Compute a content ETag from the actual sent bytes for transformed HTML; assets/fonts/images/streamed media keep the fast mtime ETag + early 304. Regression: rewriting only dist/index.html returns 200. * fix(export): gate PPTX on explicit deck; page-mode DOM intact; stitch RAM budget Four review findings: - PPTX action was gated on the `.slide` regex (`effectiveDeck`/`looksLikeDeck`), so ordinary pages with carousel/testimonial `.slide` markup surfaced PPTX and were forced through the deck renderer (hardcoded `deck: true`). Gate show/canPptx on the EXPLICIT deck signal (`isDeckArtifact`: deck renderer / kind / presentation) instead; real decks keep PPTX, pages don't, and `deck: true` is now always correct. Image/PDF stay on the broader signal (they handle pages). - renderDeckSlides ran prepareDeck (hide chrome + freeze animations) BEFORE deciding page vs deck, so page-mode exports rendered on a mutated DOM (content using generic `.notes`/`.overview` classes vanished). Split the non-mutating slide count from the deck-only DOM prep; page mode now captures the original document. - stitchDeckSlides capped only output height, so a wide/high-DPR deck could still allocate >1 GiB (8192px stage @2x => W~16384 * 30000 * 4). Add a RAM byte budget (320MB, like the page stitcher): downscale by min(heightScale, byteScale). - sidecar-proto render-slides test now covers the `index` field (success + reject negative / fractional / non-number). * fix(export): image/PDF deck flag from explicit signal, not .slide heuristic The image and screenshot-PDF exports still passed `deck: effectiveDeck` (the `.slide` regex), so an ordinary HTML page with carousel/testimonial `.slide` markup exported only the current card instead of the full page. Drive both off the explicit `isDeckArtifact` signal (same as PPTX): a real deck → per-slide, a page → full-page capture. Extracted `shouldCaptureAsDeck()` as a pure helper with a regression test (page + slides + deck:false => page, not per-slide). * fix(export): screenshot PDF download must prompt Save As (.pdf in allowlist) The default Export PDF flow now streams a .pdf download via exportProjectScreenshotPdf, but the will-download Save As hook only intercepted .pptx + image extensions — so PDF silently wrote to the OS Downloads folder while PPTX/images prompted. Add .pdf to SAVE_AS_EXTENSIONS with a PDF filter, and extract saveAsDialogOptionsForFilename() as a pure helper with a runtime test (PDF/PPTX/image prompt; uppercase matched; other extensions pass through). * fix(export): single-shot guard for image export (no double-click duplicates) The toast-based image export closes the modal and starts the save without an in-flight guard (the old in-modal busy/disabled states were removed), so a fast double-click / Enter-repeat on Save could enqueue two concurrent exports (duplicate captures, downloads, and fireImageExportResult bookkeeping) before the modal-close re-render removed the button. Add an imageExportInFlightRef guard that returns early on re-entry and resets in finally — mirrors the existing screenshotInFlightRef pattern. * fix(export): If-Range guard on /raw/ stream; block image-modal reopen mid-export Two non-blocking correctness issues: - /raw/ honored Range unconditionally even with the new ETag/Last-Modified, so a client resuming a cached font/media download after the file changed could splice stale + fresh bytes. Gate Range on If-Range (RFC 9110 §13.1.5): serve 206 only when the If-Range validator (ETag or date) still matches the current file, else fall back to a full 200. Regression test: stale If-Range + Range returns 200 with the new full length. - The image-export single-shot guard covered handleImageExportSave, but reopening the modal mid-export reset the shared request/result refs, mis-attributing or dropping the in-flight export's analytics result. openImageExportModal now no-ops while an export is in flight. * fix(export): drive image/PDF deck decision off the viewer signal (effectiveDeck) The desktop screenshot image/PDF paths were gated on isDeckArtifact while the vector-PDF fallback (and the viewer's own prev/next/Present) use effectiveDeck. That diverged: a metadata-free `.slide` deck rendered as a deck in preview but exported as a single full page on a desktop host, yet as a deck via the browser fallback — same artifact, different output depending on host. Drive image + screenshot-PDF off effectiveDeck (the viewer's deck decision), so export matches what the user sees and is host-independent. PPTX keeps the narrower isDeckArtifact: it is deck-only with no vector fallback, so it can't diverge, and it must not offer slide export for incidental carousel markup. Removes the now-dead isDeckForExport binding. * test(web): update image-export specs for capture-on-Save modal flow The image-export modal was redesigned in this PR from eager-capture-on-open (preview + live format re-render + in-modal alert + disabled-until-ready Save) to capture-on-Save unified with the PPTX/PDF portaled-toast flow: the dialog just picks a format, and Save closes it and runs the single capture behind the export toast. The 9 specs in file-viewer-image-export.test.tsx still drove the old eager flow and failed in CI (Web workspace tests). Updated each to click Save before asserting capture, pick the format before Save, assert the portaled toast (role=alert error text unchanged) instead of the removed in-modal alert, and replaced the obsolete "preparing label" spec with one proving no eager capture happens on open or on format change. * fix(cli): od export honors the server Content-Disposition filename The web download helper prefers the daemon's Content-Disposition filename and only falls back to a locally derived name. `od export` ignored it and always synthesized the name from --title/basename, so the two surfaces could write different filenames for the same export. Parse the header (RFC 5987 filename* and plain filename, reduced to a hardened basename so an odd header can't steer the write outside the cwd) and prefer it when --output is not given, keeping the title-slug/basename fallback. Mirrors apps/web/src/runtime/exports.ts. * fix(export): detect runtime-managed decks; image=whole deck; de-dup long pages QA found three blocking export-fidelity issues on this PR: 1. Horizontal decks export only slide 1 (image: all such templates; PDF: some). Runtime-managed decks (`<deck-stage>` web component with slotted `<section data-screen-label>` children toggled via `data-deck-active`) carry no literal `class="slide"`, so the viewer's `looksLikeDeck` regex misses them and the UI sent an authoritative `deck:false`. The host then force-captured page mode (`mode:'page', slides:1`) — a full-page shot of whatever slide was visible. PDF same path: `deck:false` skips the host DECK_PRINT_CSS, so decks without their own `@media print` print one page. Fix: a broader EXPORT-only signal `sourceLooksLikeExportableDeck` / `deckExportSignal` mirroring the host's slide-surface family (`.slide`/`[data-screen-label]`/`.deck-slide`/`.ppt-slide`) plus `<deck-stage>`. Kept OUT of `effectiveDeck` so the host's deck-stage- incompatible prev/next nav is not surfaced as a dead "— / —" control. 2. "Export as image" of a deck returned the current slide only. It now stitches every slide into one long image (matching the slide count the viewer reports); Copy screenshot / Mark-Draw capture keep the current slide via `captureExportImageSnapshot({ wholeDeck })`. 3. Long-page image/PDF export duplicated a fixed/sticky hero down the output: the scroll-segment stitch captures the viewport per offset, so a pinned element was copied into every segment. `preparePageForCapture` now neutralizes `position:fixed`->absolute and `sticky`->static before measuring/capturing, so each renders once (captureBeyondViewport already de-dupes; applied uniformly for consistency). Red specs: exports.test.ts (deck detection), neutralize-positioning.test.ts (fixed/sticky normalization). * chore: re-trigger CI on updated main — needs-validation gate moved to merge_group (#4714) * fix(sidecar): decode IPC frames with StringDecoder (multibyte UTF-8 corruption) Exported CJK artifacts intermittently showed `???` / `◆?` (U+FFFD) in place of a character — e.g. "拥挤" rendered as "拥���", "交付边界" as "交付���界". The bad character varied between exports, the source bytes on disk were correct, and the daemon /raw/ serve was byte-identical, so it was not a font or storage problem. Root cause is in the generic JSON-IPC transport. Both the server and client socket readers did `buffer += chunk.toString()` into a STRING. A render request carries the full artifact HTML over the desktop IPC; when the payload spans multiple `data` events, a multibyte UTF-8 character (CJK = 3 bytes) straddling a chunk boundary is decoded per-chunk, turning each partial half into U+FFFD. Small payloads never hit a boundary (hence "works in my repro, breaks on the real file"); large real artifacts do, at whichever character lands on the split. Fix: feed each chunk through a per-connection `StringDecoder("utf8")`, which holds an incomplete trailing byte sequence until the next chunk completes it. Verified end-to-end against the QA "Blog Post" artifact in a packaged client: "拥���" → "拥挤" after the fix. Red spec: a ~1.3 MB CJK payload round-tripped through createJsonIpcServer/requestJsonIpc (forces multi-chunk delivery) is now byte-exact; it fails on the pre-fix reader. * fix(export): vector deck PDF rendered only the first slide A deck exported via the vector PDF fallback (POST /export/pdf → exportPdfFromHtml) collapsed to a single page: only the runtime-active slide appeared. Decks gate visibility with `.slide:not(.active){display:none!important}` (specificity 0,2,0); the host DECK_PRINT_CSS `.slide{}` rule (0,1,0) cannot win that cascade, so every non-active slide stayed `display:none` in print. Fix: before printToPDF, mark every slide surface active (the same class set the screenshot path toggles in deck-capture's showSlide), so the deck's own `.slide.active` styling applies to all slides and DECK_PRINT_CSS paginates them one per page. Shadow-DOM `<deck-stage>` decks are unaffected (their own `@media print` already lays out every slide). Verified with an offscreen printToPDF of a 12-slide `.slide`-class deck: 1 page -> 12 pages, each a distinct centered slide. * fix(export): screenshot PDF fails fast instead of masking errors as vector PDF Per review: the raster-PDF path fell back to the vector `exportProjectAsPdf` for EVERY non-ok screenshot result, so a semantic failure (bad deck routing, a 422, a renderer-side 502, "page too tall", unreadable output) silently handed the user a different (vector) PDF — the exact fidelity/CJK-glyph class of bug the screenshot path exists to avoid. exportProjectAsPptx now returns the same tri-state as exportProjectImageDataUrl: `{ok:true}` / `{ok:false,unavailable:true}` (501 or transport — caller may fall back) / `{ok:false,error}` (semantic — must surface). The PDF action only falls through to the vector path on `unavailable`; a semantic error throws and is shown in the export toast (onErr now prefers the export's own user-facing message). * chore(nix): refresh pnpm deps hash * fix(export): guard deck capture against stale-frame duplicate pages QA saw a deck export with duplicate pages (e.g. two identical 目录 pages, a slide silently missing). Root cause is a compositor race: after showing slide i, `capturePage()` can return the PREVIOUS slide's frame when the new slide hasn't painted yet (more likely on slower / loaded machines and slides with heavier reveal content), so the loop emits an exact duplicate of the prior page. The source has 12 distinct slides and live navigation is fine — the race is purely in the offscreen capture loop. Fix: after each capture, compare a cheap sampled checksum to the previous slide's; if byte-identical (which can't happen for distinct slides), wait for more frames and re-capture (bounded, 4 attempts × ~60ms). Two genuinely-identical adjacent slides exhaust the retries and emit once. Applied to both the per-slide (PDF/PPTX) and stitch (whole-deck image) loops. Test: imageSignature distinguishes captures by content and length. (The race itself is timing-dependent and not reproducible on a fast/idle machine — both file:// and packaged-http exports of the reported deck render 12 unique pages here — so the guard hardens the failure mode rather than relying on local repro.) * fix(export): paginate tall pages for raster PDF instead of refusing Per review: the single-image RAM/texture guard in capturePage refused any page taller than the budget with "page is too tall — export as PDF instead". That is right for /export/image, but /export/pdf-image routes ordinary-page PDFs through the same branch — and since the screenshot-PDF path now fails fast (no silent vector fallback), a long landing page exported as PDF hit a self-contradictory hard error and regressed tall-website PDF export. Fix: the PDF path (`jpeg`) now paginates a too-tall page into a multi-page raster PDF — captureBeyondViewport per texture/RAM-bounded chunk, one image per chunk, which the daemon assembles into one PDF page each. /export/image (png) keeps its refusal (it has nowhere to paginate to). tallPageChunkHeights extracted + tested. Verified offscreen: a ~20400px page → PDF path returns 3 paginated pages (ok/page), image path still refuses. * fix(export): capture deck slides via CDP (structural fix for duplicate pages) Replaces the pixel-compare/retry guard (88d21c7) with a structural fix, per review feedback: comparing each capture to the previous slide is the wrong abstraction (it can't tell a stale frame from two genuinely-identical adjacent slides, and wastes retries on the latter). Root cause: the deck path used `webContents.capturePage()`, which grabs the last COMPOSITED frame and can return the previous slide's frame when the just-shown slide hasn't composited yet — emitting an exact-duplicate page. The page path never had this because it uses CDP `Page.captureScreenshot`, which renders the CURRENT DOM to a fresh frame. Fix: deck capture now uses CDP `Page.captureScreenshot` too (attach the debugger once around the deck loop; fall back to capturePage if it can't attach). The captured pixels always reflect the slide just shown — no compare, no retry, no identical-slide edge case. Animations/transitions are already frozen (prepareDeckStage), so each slide is captured at its final state, never a mid page-turn frame. Removed imageSignature + the retry loop. Verified: 12-slide deck still stitches to 12 distinct slides at the correct dims. * fix(export): current-slide capture of runtime decks uses the visible slide Per review: deckExportSignal makes runtime-managed decks (<deck-stage> / data-screen-label) exportable, but the current-slide path (Copy screenshot / annotation capture) still resolved the slide index as `slideState?.active ?? 0`. Those decks are deliberately kept out of effectiveDeck, so the viewer never receives their active-slide bridge and slideState is null — meaning Copy screenshot always off-screen-rendered slide 0 instead of the slide on screen, inconsistent with the PPTX/PDF fix on the same templates. Fix: planDeckImageCapture() decides per capture — whole-deck (Export as image), ordinary pages, and tracked .slide decks render off-screen (with the active index when tracked); an untracked deck's current-slide capture skips the off-screen path and falls through to the visible host snapshot (which IS the current slide). Tests: planDeckImageCapture unit cases (exports.test.ts) + a FileViewer regression — Copy screenshot of a data-screen-label deck with no tracked slide uses the host snapshot and does NOT off-screen-render slide 0. * fix(export): don't mask post-response failures / debugger-less tall PDF as fallback Two review edge cases: - exportProjectAsPptx wrapped resp.blob() + triggerDownload() in the same try/catch that maps to `{unavailable:true}`, so a corrupt body or a client-side download failure (after a 200) was reported as "renderer unavailable" — letting the PDF caller silently downgrade to the vector path. Only the fetch (transport) and 501 now map to `unavailable`; post-response failures return `{error}` so they surface. Unit test added. - capturePage's no-debugger fallback still returned "page is too tall — export as PDF instead" for the PDF path (jpeg). Pagination needs CDP, and we only reach this branch when the debugger can't attach, so it now surfaces a distinct retryable error instead of telling the user to switch to the format they already chose. (The debugger attaches in normal packaged exports; this is a rare transient.) * fix(export): distinguish CDP attach failure from later CDP command failure Per review: when the debugger attached but a later CDP command threw (a real Chromium/GPU/clip error), the broad catch swallowed it and the too-tall PDF refusal reported "renderer is busy, please retry" — hiding the actionable error and sending users into a pointless retry loop. The retryable busy message is only correct when the attach itself failed. Track the caught CDP error (cdpError) separately: the too-tall PDF branch now surfaces the real CDP error message when the debugger was available but a command failed, and reserves the retryable "busy" message for true attach contention. * fix(export): reject `od export pptx --page`; test the tall-PDF error split Two review items: - CLI: `od export pptx --page` advertised a page mode that can never work (the daemon forces deck mode for /export/pptx). Reject `--page` for pptx with a clear contract error pointing at `od export pdf --page` instead of silently ignoring it. - Lock down the cdpError split with a regression: extract tooTallPdfErrorMessage and unit-test both branches — attach failure → retryable "busy" message; attached-but-CDP-command-failed → the real Chromium/GPU error surfaces (and neither tells the user to "export as PDF", which they already chose). * fix(export): keep current-view captures viewport-based; reject weak If-Range Two review items: - planDeckImageCapture sent ordinary-page Copy screenshot / captureViewport annotation through the off-screen renderer (useOffscreen:true, no index), which renders the WHOLE document instead of the visible region — a regression for screenshot/annotation viewport semantics. Now: Export-as-image (wholeDeck) and tracked-deck current-slide still render off-screen; an ordinary page's current-view capture (and an untracked deck's) falls back to the visible host snapshot. Tests updated. - ifRangeAllowsPartial accepted weak entity-tags for a 206, but RFC 9110 §13.1.5 requires a strong validator and our /raw/ ETag is weak (W/"size-mtime"). A same-size rewrite / mtime collision could splice stale + fresh bytes under a matching weak tag. Now any entity-tag If-Range falls back to full 200; only the date form authorizes a range. project-raw-cache.test.ts pins it (weak-ETag If-Range → 200, fresh date → 206, stale date → 200). * fix(export): resolve imported-folder project files via metadata.baseDir Per review: the new screenshot export routes (and the vector /export/pdf) read the source with readProjectFile() and no metadata, so it fell back to <OD_DATA_DIR>/projects/:id and returned FILE_NOT_FOUND for imported-folder projects (whose workspace lives at metadata.baseDir) even though the file renders in the UI. Thread project metadata through: BuildDeckRenderInputOptions and BuildDesktopPdfExportInputOptions gain a `metadata` field passed to readProjectFile; handleScreenshotExport and the /export/pdf route load it via getProject(db, id)?.metadata. HTTP regression added: an imported-folder project (created through /api/import/folder) hitting /export/image now returns 200 with the rendered image instead of 404. * chore(nix): refresh pnpm deps hash * Show PPTX export for detected decks * Fix deck export detection for page captures * Route CLI image export through screenshot renderer * Route legacy image export through screenshot renderer * fix(export): per-viewport PDF pagination + parallax-faithful image capture A long non-deck page exported to PDF came out as one giant page, and the same page exported as an image dropped its scroll-pinned text. Both stemmed from the page-capture path: PDF assembled one PDF page from a single tall capture, and the image path flattened fixed/sticky positioning (fixed->absolute, sticky->static), which deleted parallax headline/foreground text. - PDF: add a `paginate` render-slides input. A non-deck page now captures one image PER VIEWPORT, top to bottom, and the daemon assembles a multi-page PDF (one screen per page). Decks still paginate per slide; page-mode only. - Image: capture each viewport live at its real scroll offset and stitch into one tall image, keeping fixed/sticky CSS as authored -- the SAME capture logic as the PDF path, differing only in assembly. Drop the captureBeyondViewport one-shot and its isScrollBound heuristic (it rendered the whole document at scroll 0 and got parallax/reveal-on-scroll content wrong), and drop the fixed-neutralization step (it dropped pinned text). Adds paginateViewportBand unit coverage and a paginate IPC round-trip/rejection case; removes the now-unused neutralizeFixedAndStickyPositioning helper and test. * fix(export): capture deck-stage at authored size; share pptx in contracts Addresses two review findings on the screenshot export surface. - deck-stage fidelity (blocking): the <deck-stage> runtime fits its canvas to the viewport with `transform: scale(...)` by default and documents that PPTX export must set the `noscale` attribute so the DOM is captured at the authored slide size. The renderer never set it, so a deck whose authored canvas differs from the 1920x1080 capture viewport was measured + captured at the preview- scaled size. prepareDeckStage now sets `noscale` on every <deck-stage> (a no-op for plain `.slide` decks). - contract boundary: `pptx` was a first-class CLI/daemon export format but the shared `EXPORT_FORMATS` in `@open-design/contracts` still declared only `['pdf', 'image']`, so the capability was typed through an ad hoc local union. Add `pptx` to the shared contract, import it in the CLI instead of a local duplicate, and route `pptx` through the generic `/export` route (to the screenshot renderer) alongside `image`. * fix(export): route CLI --format pdf through the raster screenshot PDF path `od export --format pdf` still posted to the generic `/export` route, whose desktopArtifactExporter renders vector PDF via printToPDF() and drops CJK glyphs in the packaged runtime. The web UI was deliberately switched to the raster `/export/pdf-image` path for that reason, so the CLI diverged from the UI on the exact decks/pages this feature targets. Route all three CLI formats through the screenshot renderer (pdf → /export/pdf-image, matching the UI). Extract the format→route mapping into a pure `exportRoutePath` helper so it is unit-testable without executing the CLI entrypoint, and assert no format falls through to the vector `/export` route. * fix(export): route generic POST /export pdf through the raster screenshot path The shared ExportRequest contract advertises `pdf` as part of the screenshot- rendered export surface, but the generic `/export` route still sent `format: 'pdf'` to desktopArtifactExporter's vector printToPDF() path, which drops CJK glyphs in the packaged runtime. So a contract caller hitting POST /export got the lower-fidelity PDF while the dedicated /export/pdf-image route, the UI, and the CLI all use the raster screenshot PDF — the API surface was internally inconsistent. Route every /export format (pdf included) through handleScreenshotExport so the generic endpoint matches the dedicated routes and the contract; drop the now unused desktopArtifactExporter / buildDesktopArtifactExportInput wiring from the route. Add an HTTP-level regression asserting POST /export with format:'pdf' runs the screenshot renderer and streams back a real (%PDF) raster PDF. * Restore editable PPTX export * Clarify authored slide measurement * Enable PPTX export from browser * Stabilize large editable PPTX text * Use workspace root for PPTX export resource * Let CLI exports auto-detect decks * Avoid tracking generated PPTX bundle * Fix generic export deck routing * Fix deck export routing regressions * Add CLI page-mode export flag * Preserve authored deck capture DOM * Load PPTX vendor bundle from gzip resource * Harden export CLI and PPTX bundle loading * Preserve editable PPTX slide background images * Preserve export render sizing contract * Classify screenshot export request errors * Preserve freeform slide deck exports * Preserve UTF-8 export filenames * Align export routing and CLI JSON contract * Preserve export compatibility paths * Keep PDF export on screenshot renderer * chore(nix): refresh pnpm deps hash --------- Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com>	2026-06-29 13:15:14 +00:00
Tom Huang	29b138f7a3	feat(brands): turn any brand into a reusable design system (#4691) ... * Implement brand management routes and CLI support - Added `brand-routes.ts` to handle HTTP endpoints for brand operations: listing, extracting, retrieving details, deleting, and serving logos. - Introduced `brands-cli-help.ts` for CLI commands related to brand management, including usage instructions for listing, creating, retrieving, and deleting brands. - Updated `cli.ts` to integrate brand commands into the existing CLI structure, allowing headless management of brands via the command line. - Created supporting files for brand metadata handling, including `design-md.ts` for rendering brand information in markdown format and `index.ts` for the brand engine API. - Implemented `prefetch.ts` to fetch and process brand material from specified URLs, ensuring a streamlined extraction process. - Enhanced server setup in `server.ts` to register brand routes and manage brand-related data effectively. This commit establishes a comprehensive framework for managing brands within the application, facilitating both HTTP and CLI interactions. * Enhance memory management and onboarding experience - Introduced canonical profile labels to ensure consistent handling of user input in profile forms, preventing duplicate entries. - Updated the `parseProfileBody` and `captureProfileFromForm` functions to utilize the new canonical label matching. - Added a memory callout section in the onboarding view to highlight the benefits of memory usage, including personalized responses and reduced setup questions. - Implemented new UI elements in the onboarding view to improve user engagement with memory features. - Expanded i18n support for new onboarding messages related to memory benefits across multiple languages. * Refactor onboarding flow and enhance design system integration - Updated the onboarding process to include a new brand extraction step, replacing the previous newsletter step. - Adjusted the tracking logic to reflect the new onboarding steps, ensuring accurate analytics for user progress. - Improved the UI for the onboarding view, including new input fields for email collection during the brand extraction phase. - Refined the EntryShell component to remove outdated comments and clarify the onboarding renderer's purpose. - Enhanced CSS styles for the onboarding steps to improve layout and user experience. - Updated internationalization strings across multiple languages to reflect changes in the onboarding flow and brand extraction messaging. * Add brand management features and enhance font handling - Introduced new modules for managing brand assets, including `chrome.ts` for headless Chrome operations and `fonts.ts` for self-hosting web fonts. - Implemented `prefetch.ts` to streamline the brand material extraction process, allowing for efficient harvesting of colors, fonts, and logos. - Enhanced the brand system with new schema definitions in `schema.ts` to support brand color and font management. - Developed the `engine` module to integrate brand building and rendering processes, including token derivation and artifact generation. - Improved the overall structure and organization of brand-related files for better maintainability and scalability. * Enhance brand extraction and project management features - Updated `brand-routes.ts` to include new dependencies for project management, allowing for the registration of brand-related projects. - Modified the `extractBrand` function to support project ID and system files, improving the brand extraction process. - Enhanced the CLI commands in `cli.ts` to handle project IDs during brand creation, enabling better tracking of brand projects. - Updated the server setup in `server.ts` to register new project-related routes. - Improved the UI components to display project information associated with brands, including buttons for opening projects in the `BrandDetailView` and `BrandsTab`. - Added new metadata fields in the contracts to support project tracking and management for brands. This commit establishes a more robust framework for managing brand projects, enhancing both backend and frontend functionalities. * Enhance onboarding profile management and memory persistence - Added new canonical profile labels for 'Organization size', 'Use cases', and 'Discovery source' to improve user input consistency. - Introduced `OnboardingProfileState` type to manage onboarding profile data more effectively. - Implemented functions to build and persist the onboarding profile body to memory, ensuring user selections are saved accurately. - Updated the `OnboardingView` component to handle profile persistence during navigation and submission steps. - Enhanced tests to verify that user selections are correctly persisted to the memory profile. This commit improves the onboarding experience by ensuring that user inputs are consistently captured and stored, enhancing overall user engagement with the application. * Reflow brand extraction into an agent-driven, live flow Replace the deterministic SSE prefetch/preview/system pipeline with an agent-driven extraction: POST /api/brands now reserves the brand and stands up a backing project with the target site open in an in-app browser tab plus a seeded prompt, so the agent measures, synthesizes brand.json incrementally, and the user can clear anti-bot walls by hand. New /preview and /finalize routes let the agent render the kit page live and register the resulting user:<id> design system, so extracted brand facts persist as a structured, reusable brand kit instead of a one-shot deterministic guess. Adds the brand-extract skill (SKILL.md + brand-kit.html template), kit-render engine, brand-extraction-engine tests, brand project covers in the Designs tab, onboarding extract handoff, and the matching od brand extract/preview/ finalize CLI subcommands and contract updates. Co-authored-by: Cursor <cursoragent@cursor.com> * Sediment finalized brands into structured memory Reflow a finalized brand into the memory store (brandToMemoryEntries + reflowBrandToMemory) so future chats can ground vague requests in the brand's palette, type, voice and rules. finalizeBrand now wires through the runtime dataDir and best-effort persists the brand, MemoryChangeEvent gains a 'brand' source, and the brand kit render hardens its inline JSON escaping. Adds brand.previewEmpty / brand.viewDetails across all locales. Co-authored-by: Cursor <cursoragent@cursor.com> * Implement logo fallback and imagery support in brand extraction - Introduced a deterministic logo fallback mechanism to ensure that brand extraction processes can retrieve and save site logos, even when the agent fails to do so. - Enhanced the `startBrandExtraction` and `finalizeBrand` functions to utilize the new logo fallback, allowing for better handling of logo assets. - Added support for imagery samples in brand validation, enabling the inclusion of representative images in the brand kit. - Updated the brand kit rendering to include self-hosted fonts and imagery, improving the overall presentation of brand assets. This commit strengthens the brand extraction workflow by ensuring that logos and imagery are reliably captured and displayed, enhancing the user experience in brand management. * Enhance memory management with rule proposal and verification features - Introduced new functionality for distilling annotations into rule proposals, allowing users to suggest rules based on in-canvas annotations through the `od memory rule suggest` command. - Implemented a verification system that programmatically enforces compliance with active rules during artifact generation, ensuring that all active rules are covered in the self-verify scorecard. - Added endpoints for managing verification outcomes, including listing, removing, and clearing verification records, enhancing the transparency of the verification process. - Updated the memory management system to support the retrieval of active rule entries, ensuring that only linked rules are considered during verification. - Enhanced tests for both rule proposal generation and verification processes to ensure reliability and correctness. This commit strengthens the memory management capabilities by integrating rule proposals and verification, improving the overall user experience in managing design rules and ensuring compliance. * Distill review annotations into memory and enforce self-verify scorecard Add distillAnnotationsToMemory to mine inline preview comments/highlights/ marks into durable feedback + rule memory via a dedicated distiller prompt, threaded through the existing extract pipeline with an 'annotation' change source. Tighten the self-verify prompt (daemon + contracts) to state the daemon programmatically checks the scorecard, so a missing or uncovered scorecard on an artifact turn is an enforcement failure. Cover the rule suggest and verification-history routes with tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Apply brand design system through web config on "Use in new chat" Thread onApplyDesignSystem from the entry shell into BrandsTab so the brand's registered design system is applied via the web config channel instead of a bare daemon PATCH that left the Home composer stale. Add a transient home-intent latch + event so the Brands tab can request the Prototype chip on the already-mounted HomeView, which consumes it once the plugin catalog loads. Co-authored-by: Cursor <cursoragent@cursor.com> * Wire annotation distillation into background memory extraction Add a background distill pass that mines inline review annotations (comments / highlights / drawn marks) from a turn into durable memory alongside the general LLM extraction, surface an `annotation` memory toast source in the web UI, and cover the flow with a unit test. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix brand design system not applying to composer on "Use in new chat" Selecting a brand's "Use in new chat" applies the brand's design system as the default and fires the Prototype chip intent in the same synchronous click handler. HomeView consumed that intent inside the event listener, so `pickChip` ran before React committed the config change and seeded the composer's design-system field from the stale (empty) default — the composer showed "No design system" instead of the brand until a reload. Split the intent handling: the listener now only bumps a tick, and a separate effect consumes the chip after the re-render lands, so the seeded design system reflects the freshly-applied brand. Add the previously-untracked home-intent latch test coverage. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): rework Brands into Brand Kit and add Home create entry Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): harvest real cover/hero images for the Images module The brand kit's Images gallery only populated when the extraction agent remembered to save imagery — so a forgetful or bot-blocked agent (and the pre-imagery "Open Design" brand) left it empty. Add a deterministic, server-side imagery fallback (imagery-fallback.ts), mirroring the logo fallback: it parses og:image/twitter:image, large <img> (highest-res srcset/<picture>), <link rel=preload as=image>, and CSS background-image hero blocks, fetches candidates with browser-shaped headers, decodes PNG/GIF/JPEG/WebP dimensions to keep only big representative images (dropping icons/sprites/logos/tracking pixels), dedupes by content hash, and saves up to 8 of the largest into imagery/ with labeled samples. finalizeBrand runs it as a timeout-bounded, failure-tolerant safety net (injectable so tests stay offline) when the agent captured too few samples, first adopting any on-disk images. The extraction prompt and brand-extract SKILL now explicitly direct the agent to harvest the site's large/cover/hero images, filtered by rendered size. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(qa): implement deck layout validation and safety checks Add a new QA module for validating the layout of generated brand decks to ensure robustness against clipping and truncation issues. The `analyseDeckLayout` function checks for critical layout invariants, including the presence of `.slide` sections, correct container types, and necessary runtime layers. Introduce `assertDeckLayoutSafe` to enforce these checks during brand system rebuilds, preventing the deployment of decks that fail validation. Additionally, create comprehensive tests to verify the functionality of the new layout validation features. * fix(brands): apply deck shrink-to-fit synchronously so slides never clip The no-clip runtime scheduled its fit pass through requestAnimationFrame, whose callbacks are throttled while the deck is offscreen or occluded. A slide could therefore stay unscaled — and clip its content — until first paint. Fit synchronously on resize/load/fonts-ready with a trailing setTimeout settle pass for late reflow, removing the rAF dependency. Verified at the previously-broken 1024x620 viewport: container-type:size, zero truncations, runtime auto-applies scale (Problem 0.71, ASK 0.87, Product 0.97, Competition 0.97) and frame clip count drops to 0. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): let New Brand modal embed scrollable brand reference picker Add a fillHeight mode to BrandReferencePicker so the heading, quick-pick row and controls stay pinned while only the gallery scrolls inside a bounded-height parent. Wire it into NewBrandModal with a stable, spacious dialog and refresh the related newBrand/brandPicker copy across all 18 locales. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): enhance brand extraction with deterministic seed harvesting Introduce a new `seed-fallback` module to provide a server-side deterministic palette and typography seed during brand extraction. This ensures that the brand kit's initial display includes a harvested logo, an approximate color palette, and font families, improving the user experience by reducing the all-skeleton appearance during the first paint. Update the `startBrandExtraction` function to utilize this new module, allowing for a more seamless and visually appealing brand extraction process. Additionally, enhance the `BrandReferencePicker` component to reflect loading states and errors during brand extraction, ensuring users receive immediate feedback on their actions. Update related tests to verify the idempotency of the `finalizeBrand` function, ensuring that re-finalizing a brand correctly reuses the existing design system without duplication. * feat(brand-extract): enhance BrandReferencePicker and localization updates Updated the BrandReferencePicker component to reflect loading states and errors during brand extraction, improving user feedback. Added a new localization key for the brand extraction process and updated existing translations in English, Simplified Chinese, and Traditional Chinese to enhance clarity and user experience. Additionally, introduced new styles for better interaction with brand assets in the brand kit template. * feat(brands): wire in-page lightbox/masonry/asset preview + refine seed Brand-kit preview improvements for the live extraction kit: - brand-kit.html: add in-page overlay system (sandboxed iframe has no top-nav) — clickable image lightbox with prev/next, a "view all" masonry modal, and a full-page asset preview modal that loads system/artifacts/<kind>.html in an iframe. Defer auto-reload while an overlay is open so it never yanks the modal out mid-interaction. - seed-fallback.ts: prefer vivid mid-luminance hues for the seeded accent/accent-secondary, and drop icon/symbol faces (Remix Icon etc.) from the typography seed so specimens never render glyph soup. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): wire in-page lightbox/masonry/asset preview + refine seed Brand-kit preview improvements for the live extraction kit: - brand-kit.html: add in-page overlay system (sandboxed iframe has no top-nav) — clickable image lightbox with prev/next, a "view all" masonry modal, and a full-page asset preview modal that loads system/artifacts/<kind>.html in an iframe. Defer auto-reload while an overlay is open so it never yanks the modal out mid-interaction. - seed-fallback.ts: prefer vivid mid-luminance hues for the seeded accent/accent-secondary, and drop icon/symbol faces (Remix Icon etc.) from the typography seed so specimens never render glyph soup. Co-authored-by: Cursor <cursoragent@cursor.com> * i18n(web): add brandPicker.opening across remaining locales + picker test Completes the brand-reference picker i18n key that was committed only for en/zh-CN/zh-TW, so every locale satisfies the typed Dict, and lands the BrandReferencePicker extraction-feedback test left untracked by the concurrent worker. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(EntryShell): enhance AMR cloud card visibility post-detection Updated the EntryShell component to ensure the AMR cloud card remains visible after detection settles, even when the AMR runtime is unavailable. This change prevents the card from disappearing and allows it to degrade gracefully to fallback content and sign-in flow. Additionally, added tests to verify the new behavior, ensuring a better user experience during onboarding. * feat(library): OD Library asset registry + OD Clipper extension Add a global, cross-project asset registry (OD Library) and a Chrome MV3 capture extension (OD Clipper), wiring the full HTTP + CLI + Web UI three-track loop per specs/od-clipper.md. - contracts: LibraryAsset/Source/Kind, ingest, search, pairing, task DTOs - daemon: 6 additive SQLite tables, content-addressed owned storage, the idempotent registerLibraryAsset hook (hash dedup + append-source), programmatic enrichment (mime/size/image dims/domain/tags), pairing tokens with a persisted extension-origin allowlist, /api/library/* routes, and /api/tools/library/{search,apply} for in-task agent reuse - cli: `od library list|get|rm|search|import|pair` - web: Library tab (grid, source badges, filters, search, live SSE updates, extension pairing affordance) - clipper/: standalone MV3 extension (background SW, content toolbar, popup) - skills/library-curator: utility skill for agent-driven asset reuse Origin middleware now honors paired chrome-extension:// origins (seeded from SQLite on boot) and exempts the pairing-confirm handshake. Enrichment AI stages (caption/OCR/embedding) are recorded as skipped pending a configured model. * feat(brands): programmatic-first design system extraction + rename Make brand extraction two-phase so a usable design system is ready the moment the user enters a URL — the instant "aha" — instead of waiting on the AI agent: 1. PROGRAMMATIC-FIRST (synchronous): startBrandExtraction now harvests the site deterministically (logo, palette, typography, one-line description, cover imagery, source URL) via prefetchBrand, synthesizes a valid design system with brandFromMaterial (no LLM), and finalizes + registers it before returning. finalizeBrand is refactored into a reusable finalizeBrandCore shared by both the programmatic path and the agent path. 2. ASYNC AI ENRICHMENT: the seeded agent prompt is reframed to enrich the already-usable design system and re-finalize in place (same user:<id>), updating every artifact/template. Bounded + best-effort: a blocked/unreachable origin skips phase 1 and stays `extracting` for the agent to drive. Gated on userDesignSystemsRoot so the legacy agent-only path stays intact for tests. Also rename the user-facing "Brand Kit" surface to "Design System" across en + zh-CN strings, project names, and the enrichment prompt. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(library): enhance asset import and management features - Updated the `import` command to allow multiple local files and remote URLs, with restrictions on supported formats. - Added new commands: `apply` for copying assets into project design files, `edit-as-page` for converting HTML assets into editable projects, and `figma` for exporting Figma captures. - Introduced sidecar functionality for storing derived data alongside owned assets, including Figma capture IR and element HTML. - Enhanced server configuration to support larger ingest payloads for asset captures. - Improved error handling and user feedback during asset import and application processes. * feat(asset-management): enhance asset dropzone and introduce chat-to-design feature - Updated the DesignSystemAssetDropzone component to improve file preview handling with new functions for creating and revoking object URLs. - Adjusted CSS for better layout and spacing in the asset dropzone. - Added a new "Chat to design" button in the LibrarySection component, allowing users to send selected assets to the Home chat composer for project creation. - Updated localization strings across multiple languages to reflect changes in asset import terminology. - Enhanced the HomeView component to handle asset staging from the chat composer. * feat(library): enhance asset application with element markup support - Updated the `applyLibraryAsset` function to include an `includeElement` option, allowing the capture of element markup alongside assets. - Modified related components (e.g., `ChatComposer`, `LibrarySection`, `FileWorkspace`) to handle the new element markup feature, ensuring both asset paths and optional element paths are returned and processed. - Introduced a new function, `fetchLibraryAssetElementHtml`, to retrieve the captured HTML for element-pick assets. - Enhanced the UI to display element markup inline within the chat composer, improving user interaction with captured elements. - Updated API contracts to reflect changes in asset application responses, including optional element markup paths. * feat(library): enhance asset filtering and preview handling - Updated the LibraryPicker and LibrarySection components to implement a badge-aware kind filter, allowing for more precise asset filtering based on badge kind. - Introduced a new `matchesKindFilter` function to streamline the filtering logic across components. - Enhanced the DesignSystemAssetDropzone to ensure proper handling of image previews, addressing issues with broken thumbnails under React StrictMode. - Added CSS styles for kind badges to improve asset representation in the UI. - Implemented tests for the DesignSystemAssetDropzone to ensure correct preview lifecycle management. * feat(library): hydrate single asset on SSE ingest Add fetchLibraryAsset(id) so the Library grid can merge just the one asset an `ingest` SSE event references instead of refetching the whole list on every capture. Returns null on miss/error. * feat(clipper): richer in-page image picker Collect CSS background-image url()s in addition to <img> (so hero/section art painted as backgrounds is no longer silently missed), defer thumbnail decode to visible cells via IntersectionObserver, draw downscaled canvas thumbnails instead of second full-res decodes, and add locate-on-page highlighting so a picked image can be traced back to its DOM source. * feat(library): implement lazy loading for thumbnails and enhance asset filtering - Introduced a `LibraryThumb` component to lazily load heavy content (images, videos, iframes) only when they are near the viewport, improving performance. - Added a debounced search feature to optimize asset filtering, reducing unnecessary network requests during rapid input. - Enhanced the asset filtering logic to track active filters using a ref, ensuring efficient updates during live events. - Updated the `snapshotCardRects` and `cardIdsInBand` functions to support improved hit-testing for drag-and-drop interactions. * feat(library): lazy picker thumbnails + debounced search Extend the Library grid's lazy-thumbnail + 250ms debounced-search pattern to the composer LibraryPicker so opening it no longer fires one full-bytes request per asset, and tidy the clipper content-script image collection. * feat(clipper): compress and budget capture inlining Re-encode large raster images to downscaled WebP and inline smallest-first within a fixed budget, dropping only the secondary Figma IR past a safe body size, so an image-heavy page (e.g. a news front page) always saves as an editable HTML capture instead of 413-failing the ingest. * test(library): LibraryPicker debounce + lazy-thumbnail coverage Cover the composer picker's 250ms debounced search and its lazy <img> mount (deferred until the card is in view), matching the grid's perf test. * feat(design-system): enhance asset handling and UI for design systems - Updated the CLI to support additional asset kinds, including 'design-system'. - Enhanced the DesignSystemProvenance type to include source URLs, improving provenance tracking. - Modified the design system generation jobs to correctly summarize source links and GitHub repositories. - Updated UI components to reflect changes in asset handling, including new source link management in the DesignSystemFlow. - Improved tests to cover new functionality for adding source links and ensuring proper handling of design system assets. * refactor(library): rename 'design-system' to 'brand kit' and enhance thumbnail loading - Updated labels and filters in Library components to replace 'design-system' with 'brand kit'. - Introduced a shimmer skeleton for lazy-loaded thumbnails in the LibraryPicker to improve user experience during asset loading. - Enhanced the PickerCard component for better performance by memoizing individual asset cards. - Updated tests to ensure proper handling of brand kit assets and their visibility in the LibraryPicker. * feat(clipper): implement internationalization for toolbar and popup - Added i18n support to the clipper, enabling localization of UI elements and tooltips. - Introduced a new i18n.js file to manage translations for various languages. - Updated content.js and popup.js to utilize the i18n functions for dynamic text rendering. - Enhanced accessibility by ensuring aria-labels and tooltips are also localized. - Improved user experience by providing localized messages for actions and statuses. * feat(clipper): enhance brand kit extraction and localization support - Updated the brand kit extraction process to include improved handling of assets and localization for various UI elements. - Added internationalization support for the brand kit feature, allowing for dynamic text rendering based on user locale. - Enhanced the user experience by ensuring that all relevant messages and tooltips are localized. - Updated tests to cover new localization features and ensure proper functionality of the brand kit extraction process. * feat(clipper): enhance brand color derivation and update localization - Introduced new functions for color manipulation, including linear interpolation and clamping, to improve brand color derivation. - Updated the deriveBrandColors function to better map observed palettes to semantic roles, ensuring consistent brand representation. - Revised localization strings in i18n.js to reflect changes from 'brand kit' to 'design system', enhancing clarity and user experience. - Improved overall code organization and readability by refactoring existing functions and adding new utility methods. * refactor(clipper): update terminology from 'brand kit' to 'design system' - Replaced all instances of 'brand kit' with 'design system' across various components and localization files for consistency. - Updated UI elements, tooltips, and documentation to reflect the new terminology. - Enhanced user experience by ensuring clarity in the design system extraction process and related functionalities. - Adjusted localization strings in multiple languages to align with the updated terminology. * feat(clipper): enhance image fill handling and normalization - Introduced functions to normalize image fills by converting non-PNG/JPEG formats (SVG, WebP, GIF, AVIF) to PNG before import, ensuring all images are properly rendered in Figma. - Updated the UI to report the number of images converted and dropped during the import process, improving user feedback. - Enhanced the overall image processing workflow to prevent silent failures when unsupported formats are encountered. - Revised documentation to reflect the new image handling capabilities and supported formats. * feat(clipper): enhance UI kit and busy state feedback - Updated the UI kit to include new components such as inputs, selection, and overlays, improving the overall design system representation. - Enhanced the busy state feedback during capture processes with localized messages and a step-by-step progress indicator, providing users with clearer status updates. - Revised localization strings to support new UI elements and improve user experience across multiple languages. - Improved documentation to reflect changes in the UI kit and busy state handling. * fix(brands): restore design-systems nav entry + reconcile BrandsTab on re-activation Address review feedback on PR #4260: 1. EntryNavRail dropped the only control that reached view==='design-systems' when Brands replaced it in the rail, leaving the still-rendered/routed design-system manager deep-link only (the entry-nav-design-systems e2e specs assert this). Restore a reachable rail entry (blocks icon, existing navDesignSystems key) alongside Brands. 2. BrandsTab only fetched once on mount, but EntryShell keeps sub-views mounted and toggles visibility, so a brand finishing extraction in its backing project never reconciled until a full reload. Refresh whenever the Brands view becomes active again, and poll while any brand is extracting (torn down once settled / when hidden). Red spec: tests/components/BrandsTab.refresh.test.tsx (fails pre-fix: fetchBrands called once, not twice). * Update clipper/brand-capture.js * fix(clipper): improve busy state handling and UI feedback - Adjusted the spinner CSS to use flex properties for better layout control. - Enhanced the reclampIfMoved function to preserve user position during busy state transitions. - Added loading toast notifications for popup-launched captures to ensure progress visibility even when the on-page bar is hidden. * feat(daemon): add kiwi-schema dependency and enhance Figma API integration - Added kiwi-schema package to the daemon for improved schema handling. - Updated FigmaApiNode interface and related functions to support shared functionality with the offline decoder, ensuring consistency in node processing. - Refactored capture functions in clipper to maintain UI visibility during DOM/IR snapshots, enhancing user experience during capture operations. * fix(web): surface missing backing projects * fix(web): re-enable brand actions after use * fix(daemon): serve brand logos from data roots * fix(brands): reconcile failed extractions * feat(daemon): implement offline Figma import and decoding functionality - Added support for importing `.fig` files directly into the daemon, enabling offline processing without requiring a Figma account. - Introduced a new `fig-decode.ts` module for decoding `.fig` files, handling both ZIP-wrapped and raw formats. - Created `figma-import.ts` to orchestrate the import process, generating a canonical snapshot and associated metadata. - Enhanced the server to handle Figma file uploads and integrate with the new decoding logic. - Updated package dependencies to include `kiwi-schema`, `html2canvas`, and `jspdf` for improved functionality. - Added tests for the new Figma import features to ensure reliability and correctness. * feat(clipper): reload-proof capture progress badge on the extension icon The on-page progress strip dies if a page reloads itself mid-capture (aggressive paywall sites like economist.com do this), leaving no loading signal. Add a per-tab '•••' badge on the extension icon for the lifetime of any capture message — it lives on the action icon, so a page navigation can't take it down. Verified end-to-end via a real loaded extension. * feat(daemon): add export functionality for Figma and enhance PDF export process - Introduced `runFigma` command for importing Figma designs, supporting both local `.fig` files and Figma URLs. - Added detailed usage instructions for the `od figma import` command. - Implemented `runExport` command for programmatic export of HTML/deck artifacts to PDF, PPTX, or image formats. - Enhanced error handling and user feedback during export processes. - Removed obsolete `build-pptx-export-prompt` module and related tests to streamline the codebase. * feat(daemon): enhance library synchronization and export capabilities - Implemented `reconcileLibrary` to mirror design systems and agent-produced project deliverables into the Library as referenced assets. - Added support for programmatic export of artifacts via the `od export` command, including detailed usage instructions. - Introduced new functions for handling Figma imports and exports, improving integration with design workflows. - Enhanced error handling and user feedback during synchronization and export processes. - Added tests for new features to ensure reliability and correctness. * feat(web): PPTX export for any shareable artifact + Library toolbar tooltips * chore(nix): refresh pnpm deps hash * refactor(web): enhance onboarding view and file export progress indicators - Updated the onboarding view layout for improved accessibility and visual hierarchy, including adjustments to spacing, typography, and button styles. - Introduced a loading toast for file export progress, displaying elapsed time and estimated time remaining for slide exports. - Added new translation keys for export progress messages in multiple languages. - Refactored the export progress handling to provide real-time updates during the export process, improving user feedback and experience. * refactor(web): streamline export capture bridge and update connector styles - Removed unused loading logic for html2canvas in the export capture bridge, simplifying the code. - Updated CSS for the onboarding view connector to improve visual clarity and ensure it does not overlap with node numbers. * refactor(web): remove html2canvas dependency and enhance Figma URL handling - Removed the html2canvas package from the project, including its references in the lock file and related components. - Added functionality to manage Figma URLs within the Design System flow, allowing users to add, remove, and validate Figma file links. - Improved drag-and-drop handling to prevent unintended file navigation when dropping files outside designated areas. - Updated UI components to accommodate new Figma URL features, enhancing user experience and accessibility. * refactor(web): unify brand and design system flows - Merged the brand extraction process into the design system creation workflow, allowing users to start from a brand directly within the design system wizard. - Updated routing to redirect legacy brand links to the unified design systems tab. - Enhanced the onboarding experience by removing the separate Brand Kit tab and integrating brand selection into the design system creation process. - Improved UI components to reflect these changes, ensuring a seamless user experience across the application. * feat(web): introduce brand enrichment banner and picker modal - Added a new BrandEnrichmentBanner component to allow users to refine programmatically-extracted design systems with AI by selecting design-system skills. - Implemented a BrandPickerModal for selecting brands from a searchable gallery, enhancing the design system creation flow. - Updated ChatPane to conditionally display the enrichment banner for eligible brand projects, improving user engagement. - Enhanced the design system flow to support the new brand enrichment features, ensuring a seamless experience for users. * feat(web): enhance BrandPickerModal and DesignSystemAssetDropzone - Updated the BrandPickerModal to allow scrolling of the entire picker area, improving user experience by creating a unified scrolling surface. - Added new props to the BrandReferencePicker for action labels and scroll root reference, enhancing flexibility in brand selection. - Introduced a new DesignKitView component for rendering design kits consistently across different surfaces. - Enhanced the DesignSystemAssetDropzone to support a wider variety of file types with appropriate previews, improving asset management during design system creation. - Updated styles for better visual clarity and responsiveness across components. * feat(web): update Design Systems tab actions and enhance localization - Changed the button label in the DesignSystemsTab from "Edit" to "Open" for better clarity in user actions. - Added a new translation key for 'dsManager.openSystem' across multiple languages to support the updated button label. - Enhanced the FileWorkspace component to ensure the Design Files tab aligns correctly with the Design System tab, improving UI consistency. - Implemented a new design system editing feature that allows users to fetch and save design system content from DESIGN.md, enhancing the design workflow. * fix(merge): repair post-merge regressions after origin/main integration Follow-up fixes on top of the origin/main merge (886f925cd) addressing regressions the conflict resolution introduced. main's web suite is the oracle (100% green); resolution principle was main's engine/backend + HEAD's UI, unioned. daemon: - library-sync.ts: correct design-systems import to ./design-systems/index.js (design-systems became a directory module on main). - tests/server-bootstrap-regression: add LIBRARY_DIR to the PathDeps fixture (main-added test x HEAD-added LIBRARY_DIR field). web: - WorkspaceTabsBar: union — restore main's onboarding Search-popover close behaviour + guards, keep HEAD's library/brands nav entries. - HomeView: restore main's composer sending-state (await onSubmit, widen its return type to Promise<boolean>|boolean|void, pass submitting to HomeHero). - MemorySection.test: take main's version to match main's two-loop memory component. - i18n: restore dropped settings.onboardingRoleMarketing key across types.ts and all locales. - App/BrandsTab/EntryNavRail/router/home-intent: union fixes restoring main features dropped during conflict resolution (needs_input handling, etc.). Validation: pnpm guard + full pnpm typecheck (all 23 packages) green. Known-red: EntryShell onboarding step 3 intentionally retains HEAD's "build" step rather than main's brand-extract step; 8 EntryShell.onboarding / App.onboarding-amr-e2e tests stay red pending that onboarding decision. * fix(merge): keep HEAD's unified brand flow (revert main's separate Brands tab) Follow-up to 688544ff7. Per the chosen product direction (brand creation unified into the design-system create wizard, not a standalone Brands tab), revert the brand-flow routing/nav that the post-merge repair had restored from main: - router.ts: keep HEAD's brand routing (brands folded into design-systems), drop main's standalone /brands and /brands/:id view routing. - EntryNavRail.tsx: drop main's standalone "Brands" nav button. - runtime/home-intent.ts: drop main's brand "Use in new chat" confirmation notice plumbing (tied to the separate Brands flow). Kept from the repair commit (additive, non-conflicting): App.tsx loadedActiveProject correctness, composer Sending… state, WorkspaceTabsBar onboarding popover behaviour, two-loop memory test, restored i18n keys, brand needs_input STATUS handling, server.ts plugin-route infrastructure. * feat(library-ui): implement conditional rendering based on LIBRARY_UI_VISIBLE - Updated router.ts to conditionally render the library view based on the LIBRARY_UI_VISIBLE flag. - Modified ComposerPlusMenu.tsx, DesignFilesPanel.tsx, and DesignSystemAssetDropzone.tsx to show the "Select from library" button only when LIBRARY_UI_VISIBLE is true. - Adjusted EntryNavRail.tsx and EntryShell.tsx to include the library navigation button and section conditionally based on the LIBRARY_UI_VISIBLE state. - Enhanced HomeHero.tsx to allow starting a blank project directly, improving user experience by providing more options for project creation. This commit introduces a feature toggle for the library UI, allowing for better control over its visibility during development and testing. * feat(home-hero): implement edge auto-scroll for horizontal overflow - Introduced `useEdgeAutoScroll` hook to manage auto-scrolling behavior for horizontally overflowing components in HomeHero. - Updated `PluginPromptPresets` and `RailGroup` components to utilize the new auto-scroll functionality, enhancing accessibility for users without trackpads. - Added `EdgeScrollZones` component to provide interactive edge zones for scrolling. - Enhanced CSS styles to support the new scrolling layout and ensure proper positioning of elements. This commit improves user experience by making overflow content more accessible and easier to navigate. * feat(design-systems): add project creation from design system and enhance UI components - Implemented `handleCreateProjectFromDesignSystem` function in `AppInner` to facilitate project creation directly from a selected design system. - Updated `DesignKitView` to wrap the iframe in a span for better layout control. - Refactored CSS for `BrandPreviewCard` and `DesignSystemsTab` to improve styling and responsiveness. - Introduced a new `TemplatePicker` component in `HomeHero` for selecting project-type templates, enhancing user experience. - Updated various components to support asynchronous handlers for design system actions, improving overall functionality. This commit enhances the design system integration and user interface, making project creation more intuitive and accessible. * feat(brand-routes): enhance brand reservation API and add DESIGN.md support - Updated the POST /api/brands endpoint to accept optional fields: description and designMd, allowing for more flexible brand reservations. - Modified validation to require either a URL or designMd for brand extraction. - Introduced a new design-md-input module to handle parsing and validation of DESIGN.md content. - Enhanced startBrandExtraction function to support processing of DESIGN.md, improving integration with design systems. - Added utility functions for managing DESIGN.md input and output, streamlining the brand creation process. This commit improves the brand extraction workflow by integrating DESIGN.md support, making it easier for users to create and manage brands. * feat(chat-pane, design-kit-view): enhance chat functionality and design preview features - Added `handleNextStepPromptAction` to `ChatPane` for setting draft prompts, improving user interaction. - Introduced `nextStepVariant` to differentiate design system projects in `ChatPane`. - Updated `DesignKitView` to include a button for previewing design kit covers, enhancing user experience. - Implemented a modal for displaying design kit previews, allowing users to view content in a dedicated space. These changes improve the chat interface and design kit interactions, making the application more intuitive and user-friendly. * feat(brand-extraction): enhance DESIGN.md support and testing - Added a new test case to validate brand extraction from DESIGN.md input without requiring a website. - Implemented functionality to register brands directly from DESIGN.md, improving the brand creation workflow. - Updated the `ChatPane` and `NextStepActions` components to handle design system-specific actions for projects, enhancing user experience. - Enhanced localization files with new carousel hints and project brief options across multiple languages. These changes streamline the brand extraction process and improve the overall functionality of the design system integration. * feat(wireframe-examples): add annotated and greybox wireframe examples - Introduced new wireframe examples for annotated and greybox styles, enhancing design system capabilities. - Added HTML and JSON files for both wireframe types, providing templates for low-fidelity design mockups. - Implemented SKILL.md documentation for each wireframe example, detailing usage and design specifications. These additions improve the design toolkit, offering users more options for creating wireframes in various styles. * feat(brand-extraction): refine Chrome fallback and enhance error handling - Updated the Chrome fallback logic in the prefetch pipeline to clarify its purpose and usage as a diagnostic tool. - Introduced environment variable checks to enable or disable system Chrome usage, improving control over the extraction process. - Enhanced error messages in the DesignSystemCreationFlow component to provide clearer guidance on required inputs for creating a design system. - Added regression tests to ensure that prompts do not instruct the agent to invoke a non-existent `brand-extract` skill, preventing potential failures during brand extraction. These changes improve the robustness of the brand extraction process and enhance user experience by providing clearer instructions and error handling. * feat(brand-extraction): enhance DESIGN.md input handling and introduce brand ready prompt - Updated the BrandFromDesignMdInput interface to explicitly define the description property as optional with undefined. - Enhanced the brand extraction prompts to clarify the inline brand-extract workflow, preventing confusion during the extraction process. - Added a new BrandReadyPrompt component to notify users when a design system is ready for preview, improving user experience. - Introduced CSS styles for the BrandReadyPrompt to ensure a visually appealing and user-friendly interface. - Updated localization files to support new strings related to the brand ready prompt across multiple languages. These changes improve the clarity and usability of the brand extraction process, providing users with timely feedback and a more intuitive interface. * feat(brand-extraction): improve design system focus handling and localization updates - Refactored the handling of browser tabs in the brand extraction tests to ensure proper validation of tab states. - Enhanced the AppInner component to refresh design systems alongside templates, ensuring users see the latest updates without page reloads. - Introduced a pending focus state in the DesignSystemsTab to manage design system selection more effectively after brand extraction. - Added a BrandReadyPrompt in the ProjectView to notify users when a design system is ready for preview, improving user engagement. - Updated localization files for Chinese (Simplified and Traditional) to reflect changes in terminology related to design systems. These changes enhance the user experience by providing timely feedback and ensuring that the design system selection process is seamless and intuitive. * fix(styles): adjust letter-spacing and enhance plus-menu trigger styles - Set letter-spacing to 0 in design-system-flow.css for improved text clarity. - Added styles for plus-menu trigger in plus-menu.css, including background, border, and hover effects to enhance user interaction and visual consistency. These changes refine the design aesthetics and improve the usability of the plus-menu component. * feat(tests): add design-system focus handoff tests - Introduced a new test suite for validating the design-system focus handoff functionality. - Implemented tests to ensure that the focus ID is correctly set, read, and cleared from session storage, preventing user selection hijacking. - Added checks for scenarios where no focus ID is pending, enhancing test coverage for the design system's behavior. These tests ensure the reliability of the design-system focus handling, contributing to a more robust user experience. * feat(export): restrict image format options to PNG and JPEG - Updated the image format options in the export functionality to only allow PNG and JPEG, removing WebP to prevent silent downgrades. - Enhanced error handling to provide clear feedback when an unsupported image format is specified. - Adjusted related documentation and comments to reflect the changes in supported formats across the application. These changes ensure consistency in image export behavior and improve user experience by providing immediate validation errors for unsupported formats. * feat(origin-validation): implement zero-config OD Clipper bypass for library requests - Added a new function `isZeroConfigClipperLibraryRequest` to validate requests from locally-installed browser extensions targeting the `/library/` path. - Updated the origin validation middleware to utilize this function, allowing unpaired browser extensions to access the `/api/library/ingest` endpoint while blocking other cross-origin requests. - Enhanced tests to cover the new bypass functionality, ensuring correct behavior for both valid and invalid origins. These changes improve the integration of browser extensions with the local daemon, enhancing user experience while maintaining security. * feat(design-systems): add download functionality for design systems - Implemented a new command `od design-systems download <id>` to allow users to download design systems as a .zip file, including all system files and a generated SKILLS.md usage guide. - Updated the CLI help documentation to include usage instructions for the new download command. - Enhanced the design systems API to support the download feature, ensuring only user design systems are accessible while handling errors for non-existent presets. - Added localization strings for the new download functionality across multiple languages. These changes enhance the usability of design systems by providing a straightforward method for users to obtain and share their design assets. * feat(design-systems): enhance design system management and localization - Introduced new UI components and styles for managing design systems, including buttons for downloading, refreshing, and resetting edits. - Updated the DesignKitView to support direct actions for DESIGN.md editing, improving user interaction with design systems. - Enhanced the DesignSystemDetail component to include download functionality and improved state management for design system edits. - Added localization strings for new features, ensuring consistent user experience across multiple languages. - Improved error handling and user feedback for design system operations, including download failures. These changes streamline the design system management process, making it more intuitive and user-friendly while ensuring robust localization support. * feat(tests): add comprehensive tests for design system archive functionality - Introduced a new test suite for validating the `buildUserDesignSystemArchive` and `buildDesignSystemSkillsMarkdown` functions. - Implemented tests to ensure correct packing of design system files, including the generation of a `SKILLS.md` guide and exclusion of internal metadata. - Added checks for handling non-user IDs and scenarios where a design system already includes its own `SKILLS.md`. - Enhanced the overall test coverage for design system functionalities, ensuring reliability and correctness in the design system archive process. These changes improve the robustness of the design system features by ensuring thorough testing of critical functionalities. * feat(figma-import): enhance CLI output and add Figma import endpoint - Updated the CLI to conditionally log detailed import information based on the `--json` flag, improving usability for users who prefer JSON output. - Introduced a new API endpoint for importing Figma files, handling file uploads and validating project existence, with appropriate error responses for missing files or invalid URLs. - Added a dedicated route for the Figma import functionality, ensuring seamless integration with existing project workflows. These changes improve the Figma import experience by providing clearer output options and robust error handling, enhancing overall user interaction with the CLI and API. * feat(design-files): enhance DesignFilesPanel with new actions and styles - Added new action buttons for opening a browser and creating a design system in the DesignFilesPanel, improving user interaction in the empty state. - Updated styles for action buttons to enhance visual distinction and usability. - Enhanced tests to verify the functionality of new actions in the DesignFilesPanel, ensuring they trigger correctly. These changes improve the user experience by providing additional functionality and clearer visual cues in the design files interface. * fix(ci): restore new project modal flow * fix(ci): align design kit and onboarding checks * fix(ci): sync bake preview workflow action * fix(ci): include plugin preview helper scripts * fix(review): harden brand source and preview flows * fix(ci): stabilize web workspace tests * fix(review): address latest blocking feedback * chore(ci): retrigger validation after label update * chore: re-trigger CI on updated main — needs-validation gate moved to merge_group (#4714) * refactor(lightbox): implement portal for overlays to resolve z-index issues - Updated the lightbox component to use React's createPortal for rendering overlays directly to the <body>, ensuring proper z-index stacking. - Removed session mode toggle from HomeHero and adjusted related styles and tests accordingly. - Cleaned up CSS by removing unused styles related to session mode toggle. - Updated tests to reflect changes in the HomeHero component and its interaction with the design router. * style(home-hero): remove focus halo from template search input - Updated CSS to eliminate the global input focus outline and box-shadow for the template search field in the HomeHero component. - Added a test to verify that the template picker search field maintains a clean appearance when focused. * feat(design-system): add create design CTA and enhance design kit functionality - Introduced a new `DesignSystemCreateCta` component to facilitate creating new designs from an active design system, enhancing user experience in the chat interface. - Updated `ChatPane` to include the new CTA, allowing users to create designs directly from the chat. - Enhanced `DesignKitView` with sticky header functionality for better accessibility while scrolling. - Added new CSS styles for the `DesignSystemCreateCta` component to ensure a visually appealing and consistent design. - Updated internationalization files to include new strings for the design system creation feature. * feat(upload): enhance file upload handling and error recovery - Introduced `sanitizePath` to preserve directory structures during file uploads, preventing issues with subdirectory paths. - Updated `DesignKitView` and related components to utilize the new `sanitizePath` function for improved file name resolution. - Added `KitErrorBoundary` component to gracefully handle rendering errors in the design kit, providing a user-friendly fallback. - Implemented internationalization updates for new error messages and action confirmations related to uploads and error handling. - Enhanced CSS styles for better visual feedback during error states and improved user experience. * feat(design-kit): add keyboard shortcuts hint and enhance key handling - Introduced a new keyboard shortcuts hint in the DesignKitView, providing users with quick access to essential actions (E edit, C copy, U upload, R refresh, ⌫ delete logo). - Implemented a keydown event handler to manage keyboard shortcuts contextually within the design kit, improving user interaction and accessibility. - Updated CSS for the shortcuts hint to ensure it remains low-contrast until hovered, enhancing the UI experience. - Added internationalization support for new shortcut labels and hints across multiple languages. - Adjusted DesignSystemsTab to prefer user logos for their systems, improving visual consistency. * feat(design-system): introduce DesignSystemExtractionPanel and enhance design system interactions - Added the `DesignSystemExtractionPanel` component to facilitate user interactions during design system extraction, providing a synthesized conversation view and next steps. - Updated `ChatPane` to render the new extraction panel when a design system is active, enhancing user guidance. - Introduced a new utility function `designSystemExtractionSource` to derive human-readable labels for design system sources. - Enhanced internationalization support with new strings for extraction-related actions and prompts across multiple languages. - Updated various components and tests to reflect changes in terminology and functionality, improving overall user experience. * feat(project): add project deletion functionality and enhance design system interactions - Introduced `onDeleteProject` prop in `ProjectView` to handle project deletion, improving project management capabilities. - Updated `AppInner` to include the new delete project handler, enhancing user experience in project interactions. - Enhanced `DesignKitView` and `DesignSystemsTab` with loading states and improved visual feedback during design system resolution. - Removed deprecated `DesignSystemCreateCta` component and associated styles, streamlining the codebase. - Updated internationalization files to reflect changes in project management terminology and actions. * feat(design-kit): enhance internationalization and user feedback in DesignKitView - Updated various labels and error messages in the DesignKitView to utilize internationalization functions, improving accessibility and user experience. - Enhanced color input validation messages and added confirmation prompts for design system deletions in DesignSystemsTab and FileWorkspace. - Introduced new props for handling design system project deletions, streamlining project management. - Updated internationalization files to reflect new strings and translations for improved user guidance across multiple languages. * refactor(design-kit): remove keyboard shortcuts hint and streamline header menu - Eliminated the keyboard shortcuts hint from the DesignKitView, simplifying the header menu. - Updated the sticky-header overflow menu to exclude upload, full-system preview, and shortcut help actions, focusing on essential project operations. - Adjusted related tests to reflect the removal of the shortcuts hint and ensure accurate menu item visibility. * feat(brand-routes): add extract-from-html endpoint for brand extraction - Introduced a new POST endpoint `/api/brands/:id/extract-from-html` to re-run brand extraction using HTML rendered from the in-app browser after clearing anti-bot walls. - Implemented error handling for missing HTML and brand not found scenarios. - Enhanced the `extractBrandFromHtml` function to process the provided HTML and optional CSS, integrating it into the existing brand extraction workflow. - Updated `prefetch` functionality to support extraction from pre-rendered HTML, improving the overall brand data retrieval process. * chore(nix): refresh pnpm deps hash * feat(brand-cli): add extract-from-html command for brand extraction - Introduced a new CLI command `od brand extract-from-html` to facilitate brand extraction from pre-captured rendered HTML, allowing users to bypass anti-bot walls. - Enhanced the command to accept optional CSS and base URL parameters, improving flexibility in extraction scenarios. - Implemented error handling for missing HTML input and invalid brand IDs, ensuring robust user feedback. - Updated the `BRAND_USAGE` documentation to reflect the new command and its usage details. - Adjusted server configuration to accommodate larger payloads for the new extraction endpoint. * feat(design-system): enhance design system extraction and browser tools - Added a new script to collect CSS styles from rendered pages, improving brand extraction capabilities by capturing computed styles from cross-origin stylesheets. - Removed the `DesignSystemExtractionPanel` component and its associated styles, streamlining the codebase. - Updated `ProjectView` and `FileWorkspace` components to enhance design system interactions and improve user experience. - Introduced new internationalization strings for design system phases and actions, ensuring better user guidance across multiple languages. * feat(brand-assist): implement browser assist for brand extraction - Added support for a client-side confirmation mechanism for the brand-browser-assist od-card, allowing users to extract brand information from the unblocked browser DOM. - Enhanced the `ProjectView`, `ChatPane`, and `AssistantMessage` components to handle the new assist functionality, improving user interaction during brand extraction. - Introduced new internationalization strings for browser assist prompts and messages, ensuring clarity and guidance across multiple languages. - Updated the `useBrandReadyPrompt` hook to manage the state of the browser assist, providing a seamless user experience when dealing with anti-bot walls. * feat(brand-prompt): enhance BrandReadyPrompt with refinement options - Updated the BrandReadyPrompt component to include options for AI optimization and manual editing, allowing users to refine extracted brand systems. - Added a new refinement nudge to inform users that automatic extraction may miss details, improving user guidance. - Adjusted styles for the prompt and dismiss button for better alignment and visual consistency. - Introduced new internationalization strings for the refinement features, ensuring clarity across multiple languages. - Removed deprecated PPTX export functionality from the FileViewer component, streamlining the export options. * refactor(export): remove PPTX export functionality and streamline export options - Eliminated PPTX export support across various components, including CLI, desktop, and web, to simplify export formats. - Updated documentation and help messages to reflect the removal of PPTX, ensuring clarity for users. - Adjusted export-related types and constants to focus on PDF and image formats only, enhancing code maintainability. - Improved user experience by refining export options and related UI elements. * refactor(export): remove PPTX references and update export functionality - Removed all instances of PPTX export functionality from the codebase, including related dependencies and comments. - Updated export options to focus solely on PDF and image formats, enhancing clarity and maintainability. - Adjusted UI components and tests to reflect the removal of PPTX, ensuring a streamlined user experience. - Improved internationalization strings and documentation to align with the new export capabilities. * chore(nix): refresh pnpm deps hash * fix(onboarding): preserve selected runtime * fix(brand): localize generated kit copy * fix(onboarding): align first-run flow with main * fix(nav): use palette icon for design systems * fix(analytics): use design system onboarding step * fix(ui): remove design system guide toggle * fix(ui): position design system ready prompt * fix(ui): space plugin task notice * fix(web): restore home ask mode and design kit preview * test(e2e): align onboarding visual capture * test(e2e): align amr onboarding checks * fix(brand): remove blocked reference brands * feat(onboarding): show profile choices as chips * fix(home): prefer design system cover art in recents * test(e2e): select onboarding profile chips * feat(brand-extraction): implement programmatic extraction transcript and UI enhancements for design systems * feat(brand-extraction): enhance programmatic extraction with transcript agent support and UI improvements * feat(brand-extraction): add transcript agent resolution and improve message handling in brand extraction * fix(design-systems): stabilize loading state coverage * test(e2e): align design system detail visual * fix(brand-extraction): backfill programmatic transcripts * fix(web): refresh ready brand design systems * fix(brands): stabilize extraction handoff and seed colors * fix(brands): return extraction transcript immediately * fix(web): open new project modal from entry rail * fix(editing): expose content edits for plain targets * feat(file-viewer): implement manual edit draft dirty state tracking and reset logic * feat(design-system): enhance project creation flow with conversation ID handling * feat(brands): implement light theme handling for color extraction and seed generation * feat(brands): add finalizeBrandProject function for brand project completion * feat(file-workspace): add designSystemBrandId prop and update DesignSystemProjectPanel to use it * Fix manual editing for brand kits * fix(design-system): wait for project refreshes * fix(web): open new project modal from rail * fix(web): restore home ask mode toggle * fix(web): sync brand color edits with seeds * fix(web): stabilize design system workspace tests * test(tools-pack): relax Windows resource cache timeout * chore(pr): retrigger review after validation * fix(web): surface design kit action progress * fix(web): clarify brand next-step actions * fix(web): cancel programmatic brand extraction * fix(web): add design systems tab action feedback --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: xne998808-ai <xne998808@gmail.com> Co-authored-by: PerishCode <perishcode@gmail.com> Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com> Co-authored-by: Siri-Ray <2667192167@qq.com>	2026-06-25 03:56:14 +00:00
lefarcen	f4fe5ad757	feat(ci): implement the plugin-preview bake pipeline (spec 4548) (#4700) ... * feat(ci): bake pipeline slice 1 — previews-diff guard + single rolling PR Per specs/change/20260618-plugin-preview-bake-pipeline/spec.md rollout step 1 (the smallest change that stops the bleeding on the stacked bake-PR backlog). - scripts/plugin-previews-diff.mjs: decide whether a manifest's `previews` subtree changed, ignoring the per-run `generatedAt` timestamp. node:test coverage in plugin-previews-diff.test.mjs (the #4261 timestamp-only noise case, entry change, add/remove, key-order stability). - bake-plugin-previews.yml: open a review PR only when `previews` actually changed (was: whole-file `git diff` that fired every run because of generatedAt), and reuse ONE rolling branch (chore/plugin-previews) / force-update the open PR in place instead of stacking chore/plugin-previews-<run_id> per run. - guard.ts: allowlist the two new CI-only .mjs scripts. Deferred to later slices (same spec): pre-merge same-repo coupling job, release-cut full bake, tag-union GC, directory-layered artifact keys. * feat(ci): bake pipeline slices 2-4 — pre-merge coupling, release full bake, GC, directory keys Completes the spec (specs/change/20260618-plugin-preview-bake-pipeline) on top of slice 1, all in one PR (GC ships dry-run so staged ENABLEMENT still holds): - .github/actions/bake-previews: composite action for the shared render + R2 upload core, so the three bake workflows stop duplicating it. - bake-plugin-previews.yml (post-merge): refactored onto the composite; role is now uploader + fork path + nightly backstop (rolling PR unchanged). - bake-plugin-previews-pr.yml (slice 2): pre-merge bake for SAME-REPO PRs — renders, uploads, and commits the manifest INTO the author's branch so it rides with the code change. Loop guard checks the head COMMIT author (git log -1 %ae of head.sha, fetched via full checkout), not head.user.login, plus a no-op previews-diff guard. Forks fall through to post-merge. - bake-plugin-previews-release.yml (slice 3): release-cut full bake committing the authoritative manifest onto release/**, with paths-ignore + bot-author loop guards. - scripts/bake-plugin-previews.mjs (slice 4a): directory-layered, content- addressed keys <id>/<fingerprint>/preview.mp4 (+ poster.jpg), prefix-relative in the manifest. Daemon consumer already resolves base+key / path.join(dir,key) so no consumer change; reused flat entries are left untouched (additive). - scripts/plugin-previews-gc.mjs (slice 4b) + .github/workflows/ bake-plugin-previews-gc.yml: weekly R2 GC. Protected set = keys referenced by every tag + live release/** HEAD + main; deletes orphans older than a 90d grace window. DRY-RUN by default (needs --delete AND GC_ENABLE_DELETE=1). Pure protected-set/orphan logic covered by node:test. - guard.ts: allowlist the new CI-only .mjs files. * fix(ci): capture diff-guard result on its own line so a helper error fails the step Per review: `if [ "$(node plugin-previews-diff.mjs ...)" != changed ]` swallows the helper's exit 2 (bad args / unreadable manifest) inside command substitution, so an error reads as empty string → 'unchanged' branch → the manifest PR/commit is silently skipped despite a successful bake. Capture into diff_result on its own line (so `set -e` aborts on a helper error) and `case` on the value, treating unexpected output as a workflow failure. Applied to all three bake workflows. * fix(ci): satisfy actionlint — quote gc description colon + route PR/dispatch context through env - bake-plugin-previews-gc.yml: quote the `delete` input description (the '(default: ...)' colon broke YAML parsing) and pass dispatch inputs via env (GC_DELETE/GC_GRACE_DAYS) instead of interpolating into the run body. - bake-plugin-previews-pr.yml: route head.sha/head.ref through HEAD_SHA/HEAD_REF env vars to avoid the script-injection lint on untrusted PR context. * fix(ci): hard-gate the release bake job to release/** branches workflow_dispatch can fire from any ref; the commit step pushes the authoritative manifest to the triggering ref with contents:write, so a dispatch on main would write straight to main and bypass the release back-merge. Add a job-level `if: startsWith(github.ref, 'refs/heads/release/')` guard. * fix(ci): GC fails closed on partial protected-ref data Per review (non-blocking but real once deletion is armed): the GC workflow's protected-ref fetches ended with '|| true', so a transient fetch failure could leave the tag/release/main protected set incomplete and, with GC_ENABLE_DELETE=1, prune clips a live release/main still references. Drop the '|| true' (fail the job if the protected refs can't be fetched), and add a script-side guard that refuses to delete when the protected set is empty or origin/main's manifest is unreadable.	2026-06-23 15:39:16 +00:00
PerishFire	0bf1b6d6b8	[codex] converge release workflows and stable dry-runs (#4390) ... * fix(tools-pack): use junctions for Windows standalone peer deps * fix(desktop): expose IPC during startup * fix(tools-pack): preserve Windows inspect diagnostics * fix(tools-pack): report Windows inspect status errors * fix(packaged): use Electron net fetch for app protocol * fix(packaged): load Windows renderer from web sidecar * fix(desktop): show Windows packaged window during startup * fix(packaged): disable Windows GPU startup * fix(tools-pack): keep Windows core smoke observable * fix(packaged): remove Windows startup probes * fix(tools-pack): trace Windows desktop IPC status * fix(tools-pack): add Windows IPC diagnose loop * fix(release): default beta-s Windows updater feed * chore: clean merged test eof * refactor(release): unify prerelease channel model * chore(release): close prerelease doc escape hatches * refactor(release): converge release channel workflows * fix(release): install toolchain in metadata jobs * fix(release): build release package before contracts * chore(release): bump development version to 0.10.1 * fix(e2e): seed windows packaged smoke runtime config * fix(release): install toolchain for metadata publish * fix(release): materialize betas metadata checkout * chore(release): bump development version to 0.10.2 * fix(release): allow betas metadata cold start from s3 * fix(e2e): support betas packaged update scenarios * fix(release): pass betas channel into packaged smoke * fix(release): set betas channel during self-hosted builds * fix(release): verify counted channel reservations * fix(release): use pnpm cmd for betas windows publish * fix(release): add betas manifest artifact fallback * fix(release): skip beta-s public metadata fetch * fix(release): read beta-s manifests from storage * fix(release): cache beta windows tools-pack builds * fix(release): inline beta mac tools-pack builds * fix(pack): deep sign unsigned mac bundles * docs(pack): document payload-first beta updater validation * fix(release): align preview tools-pack cache flow * fix(release): align prerelease tools-pack cache flow * fix(release): pass github token to prerelease metadata * fix(release): setup pnpm before feishu notify * fix(release): add stable dry-run prepublish flow * fix(release): accept completed prerelease metadata gate * fix(release): require stable release branches * fix(release): converge r2 access checks * fix(updater): use release channel parser for defaults * fix(updater): harden windows payload relaunch * fix(release): converge updater smoke fixture contract * test(e2e): require silent updater fixture output * fix(release): align stable windows smoke build path * fix(ci): include release workspace in validation * fix(ci): repair release validation lanes Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) * fix(ci): restore zero-install Feishu notification Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-23 06:13:21 +00:00
PerishFire	b49c9b7932	Refine CI hot and full validation modes (#4466)	2026-06-17 09:32:29 +00:00
PerishFire	15d3759834	[codex] Optimize CI topology and Playwright suites (#4460) ... * Consolidate PR validation into ci * Tune absorbed CI runner tiers * Fold visual validation into CI Playwright shards * Run PR shards during manual CI dispatch * Optimize CI topology and scopes * Increase UI P0 Playwright workers * Relax visual Playwright timeout	2026-06-17 08:24:52 +00:00
Jeshua:D	a0beba92f9	[codex] lint craft references in guard (#4239) ... * chore: lint craft references * fix: validate bundled plugin craft references --------- Co-authored-by: Jeshua09090 <jeshuaelpro@outlok.com>	2026-06-14 08:53:54 +00:00
Denis Redozubov	34053d95bf	Pin sandbox contract shapes and ownership guards (#3429) ... * Pin sandbox contract shapes and ownership guards * fix(web): guard alias import escapes	2026-06-13 13:07:57 +00:00
CHENGLONG WANG	8359fb6d2c	landing: skill-spec restyle, upstream parity, newsletter + nav updates (#4158) ... * landing: skill-spec restyle, upstream parity, newsletter + nav copy updates Landing-page-only rebuild of the home-refresh branch on top of current main (the previous branch carried unrelated apps/web changes and conflicted with main): - Homepage: newsletter band between CTA and FAQ (localized in all 18 locales, client-side stub until a provider lands), AMR logo in the nav, hero subtitle now reads 'best open-source alternative' in every non-English locale, hero/nav download labels swapped. - /plugins/: upstream hub structure (3 tiles); /plugins/templates/ + kind pages: breadcrumb and counter chip removed, scene chip active-state contrast fix, tpl-card styles with token colors. - /agents/: design-spec pass (token spacing incl. 68px max module gap, font scale, 8px radius), 3-up card grid, list-indent fix; /solutions/, /agents/, /plugins/ unified on one 1180px centered safe area. - /blog/: cream/terracotta leftovers replaced with token colors, 8px card radius. - Header dropdowns: full 21-agent list, upstream caret/gap parity; neutralized the homepage section padding leak inside info pages. - package.json stays on main's shape; cobe / matter-js / @types/ matter-js added as exact pins (homepage globe + FallingText) with matching pnpm-lock entries. nix/pnpm-deps.nix hash NOT refreshed (no nix locally) — needs the Validate workspace gate or a follow-up. * landing: fix CI gates while keeping the homepage refresh intact Rebased onto current main and resolved the blocking review + red checks on this branch without dropping the design refresh: - Zero-client-JS gate: the cobe globe and matter-js FallingText enhancers used ES `import`, so Astro emitted external `/_astro/*.js` module bundles and tripped `Verify zero external JavaScript`. Both effects are preserved: index.astro now reads each library's prebuilt runtime from node_modules at build time and inlines it verbatim as a classic `<script is:inline>` (cobe's single ESM default export is rebound to `window.__cobe`; matter-js ships UMD), mirroring locale-switcher-script.astro. No bundled/module JS. - Staging/preview noindex: restored the `staging-noindex-headers` Astro integration that appends `X-Robots-Tag: noindex, nofollow` to `_headers` for OD_LANDING_NOINDEX builds, so PR previews stay out of search indexes. - Blob guard: removed 14 stray .bak/.prev/.leftpad backup files and 9 unreferenced PNG originals, converted 12 referenced >1MB PNGs to WebP (each <1MB) with their refs updated, and recompressed lab-video.mp4 / lab-hyperframes.mp4 under 1MB. No changed tracked file now exceeds 1MB. - Residual-JS guard: allowlisted public/community/_site-nav.js, a verbatim browser script for the static /community/ pages (same precedent as the web notifications service worker). - Homepage-art gate: the refresh serves its hero/gallery/method art as optimized origin-hosted WebP instead of Cloudflare Image Resizing variants, so the homepage no longer emits cdn-cgi URLs. The gate now requires the same floor of 16 optimized WebP references (ci/staging/production) so a regression to raw, unoptimized art is still caught. * landing: stop 18x-localizing the skills/systems/templates catalog The PR preview deploy hit Cloudflare Pages' 20,000-file-per-deployment cap: the branch added `[locale]/{skills,systems,templates}` detail/listing generators plus per-locale plugin previews, all fanned out across the 18 LANDING_LOCALES, producing ~29,300 output files. This is exactly the locale-explosion the branch's own `public/_redirects` already anticipated — its "Catalog migration" section says the standalone skills/systems/templates generators "were removed" and are 301'd to `/plugins/*`, but the generator routes were left in the tree, and the localized 301 rules only covered 4 of the 18 locales. Fix, matching that stated intent and Astro's guidance for bounded static multilingual builds (prune the prerender matrix; signal i18n via hreflang/sitemap, which this site already does — non-default locales are sitemap-excluded): - Remove the localized `[locale]/{skills,systems,templates}` detail, index and facet generators, and the localized `[locale]/plugins/previews` duplicate (previews are language-agnostic visual assets). - Extend the localized catalog 301s in `public/_redirects` from {zh,zh-tw, ja,ko} to every prefixed locale, and add `/<loc>/plugins/previews/*` → the canonical English previews. Kept-localized plugin hub/detail pages whose links degrade to these paths now resolve via a single 301 hop. English catalog pages, all localized marketing pages, the localized plugins hub, and the homepage design are unchanged. Output drops to ~19.2k files, back under the deploy cap. * landing: canonicalize legacy locale aliases in the header language switcher The shared sub-page header language switcher builds its targets with `localePath(target, Astro.url.pathname)`, and `stripLocaleFromPath` only recognized canonical `LANDING_LOCALES`. The catch-all route still emits legacy / alias locale pages (`app/_lib/i18n.ts` LOCALES: `/zh-CN/`, `/es-ES/`, `/fa/`, `/hu/`, `/th/`, plus upper-cased `zh-TW`/`pt-BR`), so on those pages the switcher produced doubled, non-existent targets like `/zh/zh-CN/blog/`. Strip those alias prefixes too (case-insensitive, canonicalizing to the default locale) so switching language from `/zh-CN/blog/` now lands on an existing URL (`/blog/`, `/zh/blog/`, …). Verified against the static build: the doubled `/<loc>/{zh-CN,es-ES,fa,hu,th}/…` targets are gone (0 matches), and canonical `LANDING_LOCALES` pages are unchanged. * landing: optimize homepage first-screen — fonts → subset woff2, hero → responsive webp Resource-weight pass on the homepage, focused on the first screen. Fonts (≈861 KB → ≈106 KB, and no longer render-blocking): - Albert Sans regular/italic shipped as TTF (125 KB + 138 KB). Added woff2 builds (50 KB + 55 KB) as the primary `src`, TTF kept only as a fallback. - `remixicon.ttf` was a 598 KB icon font loaded `font-display: block` (it hid the icons — and text in the same paint — until the whole font downloaded). The site only renders 11 of its glyphs, so it's now subset to a 1.3 KB woff2. - All faces are `font-display: swap` now, and the above-the-fold Albert Sans woff2 is `<link rel=preload>`ed at high priority, so text paints immediately in the fallback and swaps without a blocking round-trip. Hero imagery (responsive WebP instead of one oversized file for all devices): - The hero backdrop was a single 326 KB / 2880px PNG served to every viewport. Now responsive q90 WebP variants (960→33 KB, 1440→47 KB, 1920→89 KB, 2880→110 KB); `og:image`/`twitter:image` keep the PNG since social crawlers don't reliably accept WebP. The LCP preload points at the WebP set with `imagesizes="100vw"` to match the full-bleed `<img>`. - The hero product shot now has a responsive srcset (800/1280/1920/2508); the 2508px master is the pristine original (no re-encode), phones pull the 800px (66 KB) variant. Quality is kept high (q90) — the savings come from format + right-sizing per viewport, not heavier compression. Build output is unchanged structurally (zero external/module JS still verified; ~19.2k files, under the deploy cap). * landing: include all 25 used Remix Icon glyphs in the subset The first subset only covered the 11 codepoints declared via CSS `content:` and missed the 15 declared as JS \u escapes in page.tsx's `RI` glyph map (download \uec5a, github \uedcb, star \uf18b, the arrow/chevron set, …), so the hero download / Star CTA icons and several nav arrows rendered blank. Re-subset to the full union of 25 glyphs (still ~2KB woff2). * landing: add the locale-switcher caret glyph to the Remix Icon subset A full scan of the built site (18,912 HTML files, every rendered Private-Use codepoint) surfaced one more glyph the 25-glyph subset was missing: U+EA4E (arrow-down-s-line), the language-switcher dropdown caret in header.tsx — it's inserted as a literal char (not via the RI map), so the source grep missed it. Re-subset to 26 glyphs (≈2.1KB); the same scan now reports zero missing glyphs site-wide. * landing: convert remaining raster art to WebP site-wide After a site-wide image audit, converted the last referenced PNG/JPG raster art to WebP (q88, no visible quality loss — the source files are lossless so there's no generation loss): - `lab-stage-bg` (homepage lab section): 710KB JPG → 323KB WebP. - Blog study plates 09–12 and 16–22 (the hero/inline art in the Figma- and Claude-alternative posts, referenced across every localized section): ~4.9MB of 1024² PNGs → ~2.6MB WebP. All `<img src>` references in the two blog markdown files and the blog index were repointed; the originals are removed. Combined with the earlier hero/font pass, the homepage and blog now ship only WebP raster art (PNG kept solely for the social `og:image`). Verified: build clean, no dangling references to the removed files, zero external/module JS, ~19.2k output files (under the deploy cap). * landing: make homepage og:image / twitter:image absolute URLs `heroImage` is a same-origin path (`/hero-home.png?v=2`); social crawlers (Facebook, Twitter, LinkedIn) need an absolute URL for rich link previews. Resolve it against `Astro.site` at the metadata call site so the share card renders as `https://open-design.ai/hero-home.png?v=2`. Per @PerishCode's review note; non-blocking but correct. * landing: absolute share image on sub-pages + canonical-locale plugin search.json Two non-blocking output regressions from @PerishCode's review: - sub-page-layout.astro wrote `og:image`/`twitter:image` from the raw `ogImage ?? heroImage` (origin-relative), so every sub-page's share card (plugins, agents, download, …) emitted `content="/hero-home.png?v=2"`. Resolve against `Astro.site` like the homepage already does; `new URL()` leaves an already-absolute `ogImage` untouched. - [locale]/plugins/search.json.ts keyed off `_lib/i18n` PREFIXED_LOCALES (the legacy alias table: zh-CN, es-ES, pt-BR …), so it emitted `/zh-CN/plugins/search.json` whose entries linked to `/zh-CN/plugins/<slug>/` detail pages that don't exist, while the canonical `/zh/plugins/search.json` was missing. Drive it from `app/i18n` LANDING_LOCALES + localePath so each endpoint matches the localized plugin detail routes and its hrefs resolve. Verified: sub-page og:image is now absolute, /<canonical-locale>/plugins/ search.json exists with resolvable hrefs (legacy /zh-CN/ variants gone), zero external/module JS, ~19.2k files. * landing: preserve query + hash when switching language The locale switcher's click handler only persisted the choice and let the anchor's bare server-rendered href ('/<locale>/<path>/') drive navigation, so a plain left-click dropped the current query string and hash — switching language on '/plugins/templates/?kind=deck#gallery' landed on '/<locale>/plugins/templates/'. Intercept the plain left-click and route through the existing selectLocale(), which carries window.location.search + hash across the switch via targetFor(); modified-click / non-left-button / right-click still fall through to the real <a> (open-in-new-tab, etc.). Per @PerishCode's review note. Verified: build clean, homepage still ships no external/module JS, typecheck 0 errors. * landing: handle legacy locale aliases in the switcher's path recompute The previous commit routed plain locale-switch clicks through selectLocale(), which recomputes the target via basePathFromCurrent(). That helper only treated canonical LANDING_LOCALES as a strippable first segment, so on a legacy alias page (/zh-CN/, /es-ES/, /fa/, /hu/, /th/ — still emitted by the catch-all) clicking a language built a nested, non-existent URL like /zh/zh-CN/blog/. Teach the switcher the same legacy-alias set as stripLocaleFromPath in app/i18n.ts (zh-cn, es-es, fa, hu, th) via an isLocaleSegment() helper, so the alias prefix is stripped before the target is rebuilt: /zh-CN/blog/ → ja now yields /ja/blog/ (+ preserved query/hash), not /ja/zh-CN/blog/. Per @PerishCode. Verified: build clean, switcher script carries the alias handling, homepage still ships no external/module JS, typecheck 0 errors. * landing: make plugin detail canonical-only + guard the deploy file count The localized plugin detail wrappers (`[locale]/plugins/[...slug].astro` and `[locale]/plugins/[slug]/index.astro`) regenerated the full ~450-plugin detail set across all 17 non-default LANDING_LOCALES, so `build:static` emitted 19,234 files with `public/previews` empty — only ~766 below Cloudflare Pages' 20k-file deploy cap, which the CI-generated preview thumbnails would erode further. This is the same locale-explosion the PR set out to fix, left in the plugin subtree. - Remove both localized plugin detail generators; plugin detail stays canonical (English). Output drops 19,234 → 4,287 files (huge headroom). - Add `/<loc>/plugins/* -> /plugins/:splat` 301s for every prefixed locale so localized plugin links (still emitted by the kept localized hub pages) resolve to the canonical detail page. Kept hub pages (/<loc>/plugins/, /<loc>/plugins/{skills,systems,templates}/) have static files and win over the redirect (static assets take precedence over _redirects on CF Pages). - Add a post-build "deploy file count under Cloudflare Pages cap" step to the ci / staging / production landing workflows (fail at >=19,000) so this limit can never regress silently again. Per @PerishCode. Verified: 4,287 files, localized hubs + canonical detail intact, homepage zero external/module JS, typecheck 0 errors. * landing: one canonical plugin detail route (drop namespace catch-all) `plugins/[...slug].astro` keyed getStaticPaths off `plugin.slug`, which keeps the registry namespace (`open-design/<name>`), so it emitted nested pages like /plugins/open-design/<name>/ and self-canonicalized them via Astro.url.pathname. But catalog cards and the search JSON link to `plugin.detailHref` (/plugins/<last-segment>/), which the sibling `plugins/[slug]/index.astro` already generates from `detailSlug`. The catch-all therefore produced ~440 orphan, indexable duplicate URLs that no surface links to — extra sitemap entries and extra files against the Cloudflare Pages cap. Delete the catch-all; `[slug]/index.astro` remains the single canonical detail route at the exact `detailHref` URL the catalog/search already target. These namespace URLs are net-new to this branch (never shipped/indexed), so no redirect is needed. Output drops 4,287 → 3,848 files; canonical detail pages (445) and the templates/[kind] hubs are intact. Per @PerishCode. Verified: /plugins/open-design/* gone, canonical detail renders, file-count guard passes, homepage zero external/module JS, typecheck 0 errors. * landing: fix dead locale-prefixed links to canonical detail pages and migrated catalogs Plugin/skill/template detail pages are canonical-only since the catalog migration, but the card components still ran detailHref through localizedHref, 404ing every card click on all 17 non-default locales (430+ links per locale). The homepage lab dock, the design-systems stat card, and the html-video CTA also still pointed at the legacy /skills and /systems paths. Cards now link detail pages canonically; homepage and html-video links target the /plugins/* catalogs and kind facets. * landing: anchor the community dropdown into the hub sections again Contributors / Ambassadors / Moderators in the header dropdown linked straight to the standalone static pages, surfacing them on a plain menu click. Restore upstream main's destinations — /community/#... hub anchors — so the dropdown scrolls the hub; the standalone pages stay reachable from the hub cards only. --------- Co-authored-by: wangchenglong <879618852@qq.com> Co-authored-by: lefarcen <ontf116@gmail.com>	2026-06-12 12:11:56 +00:00
Amy	d055737de7	[codex] Add PR UI P0 gate (#4142) ... * add PR UI P0 gate * fix(ci): keep critical UI check in required workflow Generated-By: looper 0.9.7 (runner=fixer, agent=codex)	2026-06-11 09:09:00 +00:00
yinjialu	e94acc2702	add cross-app import boundary check to pnpm guard (#4069) ... * feat(guard): enforce the cross-app import boundary in pnpm guard Adds a cross-app import check that scans apps/* sources for imports reaching into another app (relative paths, @open-design/<app> package specifiers, or apps/-rooted paths) and fails pnpm guard with the offending file:line. The web/daemon integration boundary (HTTP APIs + packages/contracts) was previously enforced only by human review. The deliberate packaged -> desktop ./main export is allowlisted with a documented reason; further exceptions must be added the same way. * fix(guard): harden cross-app import scanning Generated-By: looper 0.9.6 (runner=fixer, agent=codex) * fix(guard): fail on unreadable app manifests Generated-By: looper 0.9.6 (runner=fixer, agent=codex) * fix(guard): reject unnamed app manifests Generated-By: looper 0.9.6 (runner=fixer, agent=codex) * fix(guard): catch require.resolve app imports Generated-By: looper 0.9.6 (runner=fixer, agent=codex) * fix(guard): detect createRequire app imports Generated-By: looper 0.9.6 (runner=fixer, agent=codex) * fix(guard): catch CommonJS node module createRequire Generated-By: looper 0.9.6 (runner=fixer, agent=codex)	2026-06-10 11:40:31 +00:00
lefarcen	d0f350e825	feat(plugins-home): pre-baked hover-pan preview clips for the gallery (#3994) ... * feat(plugins-home): pre-baked hover-pan preview clips for the gallery The Community gallery renders every html plugin as a live, scaled example.html iframe that animates + auto-pans on hover. That is GPU-expensive at scale (each tile is its own out-of-process document re-compositing a tall page) and renders inconsistently for tricky pages (WebGL noise, video backgrounds, lazy content). Pre-render each preview to a tiny H.264 clip + first-frame poster: - scripts/bake-plugin-previews.mjs: headless-Chrome screencast of a [hold@top in-place animation][linear pan top->bottom] capture, waiting on fonts + <img> + CSS background-images + <video> backgrounds first, then ffmpeg -> CFR H.264 mp4 + poster.jpg + manifest.json. Velocity is pre-computed from page height so the pan always finishes within ~10s. Runtime deps (puppeteer-core / Chrome / ffmpeg) stay out of package.json and are provided by the CI environment. - daemon: serves <out> at /api/plugin-previews and attaches the clip to a plugin record under od.bakedPreview (a SEPARATE field — the detail modal still reads od.preview and opens the live, interactive page). - web: inferPluginPreview(record, { preferBaked: true }) lets gallery tiles opt into the clip; MediaSurface loops the in-place [0, holdMs] span while idle and plays the pan on hover, one always-mounted <video> (no black flash), looped frame-accurately via requestVideoFrameCallback, with no native controls. Plugins without a bake keep the live-iframe fallback. CI upload to R2 + the post-merge/nightly bake workflow (with content-hash skip) and the daemon on-demand path land in follow-ups. * feat(plugins-home): content-hash skip so unchanged plugins reuse their baked clip The bake now hashes each plugin's preview HTML + a BAKE_VERSION and stores it in the manifest. Re-running skips any plugin whose hash is unchanged (no render, no re-encode, and the CI step re-uploads nothing) — editing the page or bumping BAKE_VERSION invalidates it. Verified: a second pass over already-baked plugins reuses all of them in ~1s instead of re-rendering. * feat(plugins-home): point baked-preview URLs at R2 in production bakedPreviewBlock now builds its poster/video URLs from OD_PLUGIN_PREVIEWS_BASE_URL (the R2 public origin) when set, falling back to the daemon's own /api/plugin-previews static route for local dev. The CI bake uploads the clips to R2 and the deployed daemon points at them there. * feat(plugins-home): CI workflow to bake + publish plugin previews Adds .github/workflows/bake-plugin-previews.yml: post-merge (paths: plugins/_official) + nightly + manual. Each run starts the daemon, bakes ALL plugins (the content-hash skip makes that cheap — only changed pages re-render, PREVIEW_REMOTE trusts the manifest hash since CI clips live on R2 not on disk), `aws s3 cp`s the new clips to R2 (no --delete, so untouched clips stay), and commits the refreshed manifest back to main. - The daemon now reads the checked-in manifest from data/plugin-previews/ by default (binaries stay on R2; OD_PLUGIN_PREVIEWS_DIR still overrides locally), seeded here with an empty manifest so every plugin starts on the live-iframe fallback until the first bake lands. Verification needs a real CI run (R2 secrets + a daemon in CI); the bake script, hash skip, daemon injection, and web display are all already verified locally. * ci(plugin-previews): open a reviewed PR for the manifest instead of pushing to main Protected main can't take a direct push, and the manifest is version-pinned (ships with the build), so the bake now opens a PR with the refreshed data/plugin-previews/manifest.json and requests review from @lefarcen rather than committing straight to main. Only fires when a plugin actually changed. * ci(plugin-previews): fix invalid YAML — single-line PR body (@ in body broke the literal block) * ci(plugin-previews): TEMP branch trigger + debug guards (limit 3, skip publish off-main) * ci(plugin-previews): install puppeteer-core via pnpm (npm chokes on workspace:*) * ci(plugin-previews): correct R2 secrets (repository-assets bucket) + TEMP branch publish test * ci(plugin-previews): revert temp branch-debug toggles (workflow verified in CI) * fix(plugins-home): gate bakedPreview on a fetchable source + fix workflow shellcheck Review feedback (nettee): - bakedPreviewBlock now only attaches a baked preview when a remote origin (OD_PLUGIN_PREVIEWS_BASE_URL) is set OR the clip files exist on disk. A deployment reading the checked-in manifest without the base URL set would otherwise emit /api/plugin-previews URLs that 404 (binaries live on R2), breaking tiles instead of falling back to the live iframe. - workflow: `for _` instead of unused `for i` (SC2034) and split the CHROME declare/export (SC2155) so the actionlint gate passes. * fix(plugins-home): log manifest load failures instead of swallowing them Review feedback (nettee, non-blocking): loadManifest() caught every read/parse error and returned {}, so a malformed manifest would silently disable all baked previews with no trace. Warn so it's diagnosable. * feat(plugins-home): use baked previews on the example-prompt preset tiles too The HomeHero '示例提示词' preset tiles render the same plugin previews via PreviewSurface; pass preferBaked so they get the cheap poster + hover-pan clip instead of a live iframe, matching the gallery. * ci(plugin-previews): grant pull-requests: write so the manifest PR step can open its PR Review feedback (nettee): the permissions block only set contents: write, so pull-requests defaulted to none and gh pr create would 403 on the first run that changes the manifest. --------- Co-authored-by: audit <a@b.c>	2026-06-09 13:14:54 +00:00
PerishFire	7a1ad1a438	feat(packaged): add launcher payload updates (#3812) ... * feat(packaged): add launcher payload runtime * ci: focus launcher payload windows smoke * ci: publish beta mac x64 launcher payload * test(e2e): harden payload updater smoke * fix(pack): inject launch config for installed windows smoke * fix(daemon): allow packaged payload resource roots * fix(updater): relaunch after payload update * test(e2e): refresh windows updater UI status * test(e2e): ensure windows smoke reaches main shell * test(e2e): skip onboarding before windows updater smoke * fix(updater): detach windows payload relaunch helper * test(e2e): run payload smoke without updater dry run * fix(desktop): relaunch windows payload updates on quit * fix(updater): preserve installed payload relaunch target * fix(updater): require launcher target for payload updates Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * test(e2e): align mac x64 artifact mode assertion * test(e2e): canonicalize launcher relaunch root * fix(updater): validate launcher payload config before activation Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix(updater): require live launcher target for payload updates Generated-By: looper 0.9.5 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-07 07:38:57 +00:00
PerishFire	8f6cdaaba1	Harden release-beta-s self-hosted beta lane (#3641) ... * Fix Windows smoke launcher payload layout * Harden release-beta-s runner probe * Use cmd shell for release-beta-s probe * Add win beta build script for self-hosted lane * Keep release-beta-s checkout lightweight * Use explicit local beta version for release-beta-s * Install dependencies in beta build script * Repair Electron dist before Windows beta build * Add release-beta-s timings and diagnostics * Polish release-beta-s observability guardrails * Trace tools-pack cache materialization * Reuse materialized workspace build cache * Trace Windows packaging segments * Trace Windows archive process details * Reuse installer unpacked materialization * Preserve reusable Windows unpacked projection * Add fast smoke telemetry for self-hosted beta * Cache Windows archive outputs for beta lane * Tighten fast Windows smoke lane * Scope Windows beta artifact reporting by target * Clean stale Windows target artifacts * Wire Windows Authenticode signing * Expose self-hosted beta validation modes * Add core Windows smoke profile * Decouple core smoke from updater fixture version * Trace Windows smoke lifecycle steps * Skip unpacked materialization on NSIS cache hit * Add Nexu S3 beta publisher * Harden self-hosted Windows beta lane * Use Windows PowerShell for publish probe * Run publish probe via repo script * Require explicit self-hosted S3 public origin * Run real installer acceptance for external feeds * Skip ready-prompt checks for external feeds * Relax optional self-hosted update inputs * Tolerate BOM in self-hosted publish probe * Converge self-hosted beta metadata and signing flow * Run self-hosted beta metadata prep on the runner lane * Use Windows PowerShell for self-hosted beta metadata checks * Bypass execution policy in self-hosted beta metadata checks * Split self-hosted beta metadata publish * Suppress mc output in beta publish helpers * Split Windows NSIS payload cache layers * Require fresh tool dist metadata * Preserve Windows overlay payload paths * Default beta-s gate to core * Optimize win beta packaging reuse * simplify windows full smoke lifecycle * preserve onboarding state after windows upgrade smoke * fix windows tools-pack test portability * recover stale tools-pack locks * Allow auto signing fallback for beta builds * Add self-hosted beta mac arm64 lane * Quote self-hosted signing choices * Run self-hosted beta metadata on mac lane * Use shallow metadata checkout on self-hosted beta * Use sparse beta metadata checkout * Make mac release profile bash-compatible * Allow file sparse metadata checkout * Isolate self-hosted metadata checkout * Clear sparse skip-worktree before mac build * Isolate self-hosted mac build checkout * Run self-hosted beta publish without aws cli * Use unsigned beta prefix for mixed platform publish * Sparse checkout self-hosted beta publish * Publish mac beta platform before metadata * Pass mac publish release profile * Probe mac signing keychain import * Expand mac signing preflight variants * Use sudo keychain helper for self-hosted mac signing * Route self-hosted mac codesign through sudo wrapper * Normalize mac signing identity name * Harden self-hosted mac notarization * Optimize self-hosted mac release cache * Fix mac signing helper cleanup * Retry transient mac notarization uploads * Keep mac notarization fail-fast * Reduce mac symlink diagnostics noise * Normalize self-hosted beta platform inputs * chore: bump beta base version to 0.9.1 * chore: tune release tools-pack cache retention * test: add temporary cache validation marker * chore: key windows nsis base payload by content * Revert "test: add temporary cache validation marker" This reverts commit e8487bfd3e. * chore: probe windows nsis payload cache before materializing * chore: align self-hosted beta smoke modes * chore: skip mac smoke report upload when disabled * chore: default self-hosted beta to publish both platforms * chore: make beta signing modes explicit * Add release report artifacts and metatool metadata * Fix Windows release report zip publishing * Remove artifact handoff from release beta self-hosted lane * Fix release beta merge follow-ups * Fix release beta install regressions * Restore web build dependencies * Route Windows beta downloads through mirrors * Use PowerShell 7 for Windows beta lane * Fix release beta preflight gates Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Fix Windows beta smoke update reuse Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Fix release beta review follow-ups * Refresh Nix pnpm dependency hashes Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Fix Windows signtool fallback resolution * Reject stale beta platform manifests * Validate beta platform manifest run identity Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Validate beta manifest commit identity Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Allow beta metadata publish reruns Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Build tools-pack fully in beta Windows bootstrap Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Emit r2 metadata for Windows beta publish Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Stabilize beta publish browser test Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Stabilize Windows beta metadata smoke test Generated-By: looper 0.9.4 (runner=fixer, agent=codex) * Restore multi-platform Vela CLI package * Refresh Nix pnpm dependency hashes Generated-By: looper 0.9.5 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-05 03:00:55 +00:00
Amy	8fefebbbaf	test(e2e): add priority tiers and main UI alerts (#3574) ... * test(e2e): add priority tiers and stabilize p0 coverage * test(e2e): align restoration artifact reopen path * test(e2e): stabilize p1 workspace flows * ci(e2e): run extended UI on main and notify failures * fix(e2e): repair priority preflight checks Generated-By: looper 0.9.2 (runner=fixer, agent=codex) * fix(e2e): restore AMR login pill coverage Generated-By: looper 0.9.2 (runner=fixer, agent=codex) * fix(e2e): add full UI test script Generated-By: looper 0.9.2 (runner=fixer, agent=codex) * fix(e2e): remove disallowed ui script Generated-By: looper 0.9.2 (runner=fixer, agent=codex) * fix(e2e): allow full UI script in guard Generated-By: looper 0.9.2 (runner=fixer, agent=codex)	2026-06-03 12:08:06 +00:00
Denis Redozubov	3da33f92a1	Harden sandbox orchestration daemon chokepoints (#3420) ... * Harden sandbox orchestration chokepoints * Cover web app public copy in neutrality guard	2026-06-02 07:33:12 +00:00
kami	333a62cda6	fix: link od bin after fresh install (#2069) ... * fix: link od bin after fresh install * test: lock root od bin shim path * test: cover root workspace deps in postinstall scan * chore(nix): refresh pnpm deps hash	2026-05-31 04:36:49 +00:00
lefarcen	da19ff3ca0	feat(mocks): replay-based mock CLIs for 14 of OD's supported agents (opencode/codex/claude/gemini/cursor-agent/deepseek/qwen/grok + ACP family devin/hermes/kilo/kimi/kiro/vibe) (#3241) ... * feat(mocks): replay-based mock CLIs for opencode/claude/codex/deepseek/qwen/grok Drops in a `mocks/` top-level dir that pretends to be the real agent CLIs by streaming pre-recorded sessions in each CLI's native stdout protocol. Zero LLM tokens. ## Use cases - **E2E tests** in `apps/daemon/tests/` — exercise the full chat-server pipeline against a known trace, assert UI events / artifacts. - **Self-validation during dev** — iterate on `claude-stream.ts` / `json-event-stream.ts` parser changes without burning provider budget. - **Regression harness** — replay the same trace before and after a charter / parser change; diff the daemon events the UI surfaces. - **Demo / onboarding** — show what a 17-tool claude editing session looks like end-to-end, offline. ## How - 6 bash wrappers (`mocks/bin/`) shadow the real CLIs when PATH-overlaid. - `mocks/mock-agent.mjs` reads `mocks/recordings/<trace>.jsonl`, picks one via env var (`SYNCLO_EXPLORE_MOCK_TRACE` / `_POOL` / `_BY_PROMPT_HASH`), streams the trace in the requested format. - Each format renderer matches the EXACT JSON shape the OD daemon parser expects, verified line-by-line against `apps/daemon/src/{json-event-stream,claude-stream}.ts`: | CLI | streamFormat | parser source | | ------------------------- | ------------------------- | ------------------------------------------ | | `opencode` | `json-event-stream` | `handleOpenCodeEvent` | | `codex` | `json-event-stream` | `handleCodexEvent` | | `claude` | `claude-stream-json` | `createClaudeStreamHandler` | | `deepseek` `qwen` `grok` | `plain` | `server.ts` (raw stdout) | ## Quick start ```bash export PATH="$PWD/mocks/bin:$PATH" export SYNCLO_EXPLORE_MOCK_TRACE=04097377 # 8-char prefix OK export SYNCLO_EXPLORE_MOCK_NO_DELAY=1 echo "any prompt" | opencode run echo "any prompt" | claude -p --output-format=stream-json echo "any prompt" | codex exec ``` The mock binary announces the picked trace id on stderr: `[mock-opencode] picked 04097377… via fixed`. Recording selection (env, in priority order): - `SYNCLO_EXPLORE_MOCK_TRACE=<id>` — fixed (prefix OK) - `SYNCLO_EXPLORE_MOCK_BY_PROMPT_HASH=1` + stdin prompt — `sha256(prompt) % N` - `SYNCLO_EXPLORE_MOCK_POOL=<tag>` — random within `agent:claude` / `skill:agent-browser` / `outcome:failed` / etc. - (default) uniform random - `SYNCLO_EXPLORE_MOCK_SEED=<str>` — reproducible "random" - `SYNCLO_EXPLORE_MOCK_NO_DELAY=1` — skip inter-event waits ## Dataset 179 anonymized Langfuse traces from this project's own production telemetry: - 9 agents: claude 57 · opencode 41 · codex 38 · gemini 25 · cursor-agent 11 · qwen 2 · copilot 2 · deepseek 2 · antigravity 1 - outcomes: succeeded 144 · failed 35 - skills: default 71 · ad-creative 50 · algorithmic-art 30 · agent-browser 22 · video-hyperframes 2 · plus magazine-web-ppt / brainstorming / data-report / penpot-flutter-design-source 1 each - 124 multi-turn (sessions with ≥2 turns) - 18 produce `<artifact>` output - ~4.5 MB on disk total Anonymization: `/Users/<name>/` → `${HOME}/`, `C:\Users\<name>\` → `%USERPROFILE%\`, project UUIDs → stable `proj-001`, `proj-002`, …. Tool input/output payloads preserved verbatim (templated UI, no cell-level PII). ## Smoke test `bash mocks/scripts/smoke-test.sh` — 6 checks across all 6 agents. All pass on this branch (verified locally): ``` ✓ opencode first event = step_start ✓ codex first event = thread.started ✓ claude first event = system ✓ deepseek emitted plain text (144 chars on first line) ✓ qwen emitted plain text (144 chars on first line) ✓ grok emitted plain text (144 chars on first line) All mock CLIs working. ✅ ``` ## Adding more recordings The exporter that produced this set lives in [nexu-io/agent-pr-explore](https://github.com/nexu-io/agent-pr-explore) (see `cli/src/local/orchestrator/langfuse-import.ts` + the `local langfuse-import` CLI command). Operators with the Langfuse keys can pull more by tag / outcome / artifact / multi-turn filter, then run `local recordings anonymize --out-dir ~/Documents/open-design/mocks/recordings`. `mocks/README.md` has the full instructions. ## Out of scope (follow-ups) - **ACP agents** (`devin`, `hermes`, `kilo`, `kimi`, `kiro`, `vibe`) need a JSON-RPC server on stdio rather than a one-shot stream — separate `format-acp.mjs` module not yet written. - **Per-agent json-event-stream variants** (`cursor-agent`, `gemini`, `qoder`, `copilot`, `pi`) currently fall back to the `plain` renderer; their parsers are in `apps/daemon/src/json-event-stream.ts` and follow the same template as `format-codex.mjs`. ## AGENTS.md updates - Added `mocks/` to the top-level content directories listing - Added a Validation strategy bullet pointing here for agent-stream / parser changes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mocks): add opencode-cli/kiro-cli/vibe-acp bin aliases and unref ACP timeout - Add mocks/bin/opencode-cli, kiro-cli, vibe-acp wrappers for the primary RuntimeAgentDef bin names OD resolves before any fallback. Without these, a PATH-overlaid OD daemon run bypasses the mock entirely (opencode-cli, kiro-cli) or cannot find the mock at all (vibe-acp, which has no fallback). - Include opencode-cli, kiro-cli, vibe-acp in the smoke-test ACP/JSON loop so coverage is verified end-to-end. - Call .unref() on the 30s safety timeout in format-acp.mjs so a completed ACP session exits promptly instead of waiting the full 30 seconds. Generated-By: looper 0.9.2 (runner=fixer, agent=claude-code) * feat(mocks): add vela (AMR) — login / models / ACP with strict set_model gate Extends mocks/ to cover OD's own AMR runtime. `vela` is the bin name `apps/daemon/src/runtimes/defs/amr.ts` specifies (`bin: 'vela'`, `streamFormat: 'acp-json-rpc'`). It's richer than the generic ACP agents — covers full login + models + chat-session lifecycle. ### What vela does (mirrored from apps/daemon/tests/fixtures/fake-vela.mjs) 1. `vela login` — writes ~/.amr/config.json with a fake profile (controlKey, runtimeKey, user{email,name,plan}, profile-specific apiUrl/linkUrl). The on-disk projection is what OD's daemon login route + AmrLoginPill poller read; production goes through device-auth, the mock skips straight to the file write. 2. `vela models` — prints the production-shaped public model catalog as newline-separated `public_model_* vela` lines. Override via FAKE_VELA_MODELS env. 3. `vela agent run --runtime opencode` — ACP JSON-RPC server with three vela-specific protocol extensions: a. `initialize` response carries `agentCapabilities` (`promptCapabilities.embeddedContext`) + `models` (`currentModelId` + `availableModels`). b. `session/new` response carries the same `models` block. c. **Strict set_model gate**: `session/prompt` is rejected with JSON-RPC -32602 ("session/set_model must be called before session/prompt") UNLESS `session/set_model` (or `session/set_config_option`) has been called for the current sessionId. Mirrors real vela 0.0.1 contract; catches regressions in `attachAcpSession` that silently skip set_model. ### Error injection envs (in sync with fake-vela.mjs) FAKE_VELA_SESSION_ID - sessionId returned by session/new FAKE_VELA_TEXT - override assistant text FAKE_VELA_THOUGHT - optional thought_chunk before text FAKE_VELA_SESSION_NEW_ERROR - fail session/new FAKE_VELA_SET_MODEL_ERROR - fail session/set_model FAKE_VELA_PROMPT_ERROR - fail session/prompt FAKE_VELA_REQUIRE_SET_MODEL='0' - disable the strict gate (legacy) FAKE_VELA_LOGIN_USER_EMAIL - email written into config profile FAKE_VELA_LOGIN_USER_PLAN - plan written into config profile FAKE_VELA_LOGIN_DELAY_MS - sleep before write (test in-flight) FAKE_VELA_LOGIN_FAIL - print + exit 1 FAKE_VELA_MODELS - override models stdout VELA_PROFILE - profile slot (prod | test | local) ### Components `mocks/lib/format-vela.mjs` (~205 LOC) - Full ACP server with vela protocol extensions - Strict set_model gate - Error injection plumbing `mocks/lib/vela-subcommands.mjs` (~90 LOC) - runVelaLogin() — writes ~/.amr/config.json - runVelaModels() — prints catalog `mocks/bin/vela` — dispatcher wrapper. Forwards `vela <subcmd>` to mock-agent.mjs which routes to login/models or falls through to ACP. `mocks/mock-agent.mjs` — parseArgs now collects positionals so the vela dispatcher can read subcommand from there; switch case added for vela. `mocks/scripts/smoke-test.sh` — +4 assertions: vela models prints ≥10 catalog lines vela login writes ~/.amr/config.json with the requested email vela agent run ACP roundtrip (initialize+models+set_model+stream+result) vela strict set_model gate rejects prompt without prior set_model ### Verified locally ✓ vela models printed 15 catalog lines ✓ vela login wrote ~/.amr/config.json with profile.prod.user.email ✓ vela agent run ACP roundtrip (initialize+models, set_model accepted, prompt streamed) ✓ vela strict set_model gate rejects session/prompt without prior set_model All 21 smoke checks pass (up from 17 with previous P3 ACP commit). ### AGENTS.md + README updates AGENTS.md — mention `vela (AMR — vela CLI)` alongside ACP agents in the directory listing entry. mocks/README.md — protocol table row + dedicated vela section with subcommand contract, strict gate explanation, env-injection cheat sheet. Mock-tree listing updated. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mocks): honor REPORT_FILE env when --report-file flag not given Harnesses that spawn the mock without translating their report-path contract to the mock's CLI flag (notably nexu-io/agent-pr-explore's orchestrator, which passes REPORT_FILE as env per the existing opencode/claude/codex agent launchers) wouldn't get a report file written, so the harness's "agent exit 0 but produced no report" check would always fire and mark mock runs as failure even though the stdout stream was complete. Fix: in mock-agent.mjs parseArgs, fall through to process.env.REPORT_FILE when --report-file wasn't provided on argv. Each format renderer already accepts opts.reportFile and writes the recording's final assistant text to it (`format-*.mjs` already had this — only the wiring was missing). Verified: synclo-explore run with `mock=true, mock_trace=04097377` against the opencode wrapper now produces a plan.md with the recording's 17-tool claude editing session report. ~1.5s per run vs ~70s real opencode. * mocks: move recordings to Cloudflare R2; PR→main→Action upload path The 179-recording corpus (~4.5 MB raw, ~280 KB after compression) has been moved off git into Cloudflare R2 at the bucket open-design-mocks under recordings/v1/. The repo now ships: - mocks/manifest.json — the canonical catalog (renamed from recordings/index.json) with sha256 + storage hints; consumers fetch this to discover what exists, then pull individual jsonl files on demand - mocks/scripts/fetch-recordings.sh — parallel, sha256-verified, idempotent puller for the public r2.dev URL - mocks/scripts/add-recording.sh — local maintainer helper that validates a new .jsonl and copies it into recordings-staging/ (no R2 calls; no credentials needed) - mocks/scripts/upload-to-r2.mjs — called only by the CI workflow - mocks/scripts/lib/manifest-utils.mjs — shared sha256/meta/ rebuild-histograms logic, used by both add-recording (preview) and upload-to-r2 (actual write) so the entry shape never drifts - .github/workflows/sync-mocks-to-r2.yml — fires on push to main when mocks/recordings-staging/ changes; uploads to R2, updates manifest, commits cleanup back; serialized via concurrency group Trust model: R2 write credentials (CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID) are repo secrets; nobody can push from a laptop. Read stays public via the r2.dev URL. Why not pnpm install integration: contributors who do not touch agent code do not pay the fetch cost. Fetch happens on first smoke-test run (auto-fallback) or when a mock spawn needs data. Repo size: -4.55 MB net (delete 179 jsonl, +280 KB manifest + scripts). Smoke test (21 checks) still green against the fetched corpus. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: scope R2 write token to a dedicated secret name Use CLOUDFLARE_R2_MOCKS_TOKEN (instead of reusing the shared CLOUDFLARE_API_TOKEN that landing-page-*.yml uses for Pages deploys) so the R2 write capability can be scoped to just the open-design-mocks bucket without bleeding extra capability into the Pages workflows. Also hardcode the powerformer CF account_id directly in the workflow (account IDs are not secret and the shared CLOUDFLARE_ACCOUNT_ID secret may point at a different account). Workflow now fails fast with an actionable error message + dashboard link if the secret is unset. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: switch R2 sync to S3-compat API (wrangler getMemberships gate) wrangler 4.x calls /memberships before any r2 action, requiring user:read scope. R2 "Object Read & Write" tokens deliberately lack that scope (defense in depth — a leaked token should not enumerate account-level resources). The workflow now uses the aws CLI talking straight to the R2 S3-compatible endpoint with SigV4, no membership lookup. Secret rotation: CLOUDFLARE_R2_MOCKS_TOKEN (Bearer) is replaced by CLOUDFLARE_R2_MOCKS_AK / CLOUDFLARE_R2_MOCKS_SK (matching the existing CLOUDFLARE_R2_RELEASES_AK/SK naming convention). End-to-end tested locally: PUT recording → manifest rebuild → manifest PUT → staging cleanup all green. aws CLI is pre-installed on ubuntu-latest, so no install step. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: scrub synclo namespace; use OD_MOCKS_* env prefix throughout These mocks were copy-pasted from synclo-explore, where they originated, and inherited the SYNCLO_EXPLORE_MOCK_* env-var convention. That brand-bleed is not appropriate in OD: rename the public env surface to OD_MOCKS_* (matching OD-native prefixes like OD_MOCKS_CACHE_DIR, OD_TRACE_R2_UPLOAD, OD_EXPECT_TIMEOUT_SECONDS). Renames: SYNCLO_EXPLORE_MOCK_TRACE → OD_MOCKS_TRACE SYNCLO_EXPLORE_MOCK_BY_PROMPT_HASH → OD_MOCKS_BY_PROMPT_HASH SYNCLO_EXPLORE_MOCK_POOL → OD_MOCKS_POOL SYNCLO_EXPLORE_MOCK_SEED → OD_MOCKS_SEED SYNCLO_EXPLORE_MOCK_NO_DELAY → OD_MOCKS_NO_DELAY SYNCLO_EXPLORE_MOCK_RECORDINGS_DIR → OD_MOCKS_RECORDINGS_DIR SYNCLO_EXPLORE_MOCK_SMOKE_TRACE → OD_MOCKS_SMOKE_TRACE SYNCLO_OD_MOCKS_I_KNOW_WHAT_IM_DOING → OD_MOCKS_ALLOW_LOCAL_UPLOAD Also drop the inline harvester usage from README. The harvester is an external CLI in nexu-io/agent-pr-explore — its README is the right place for langfuse-import flags, anonymization options, etc. OD only documents its own staging→PR→Action workflow. Smoke test (21 checks) still green; OD_MOCKS_TRACE end-to-end verified to route correctly. Consumers of the OLD env names (notably the orchestrator in nexu-io/agent-pr-explore) need a matching rename. No back-compat shim here — the explore side has zero external users today and a one-line follow-up is cleaner than a permanent deprecation layer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * AGENTS.md: align mock env names with mocks/ rename (SYNCLO_* → OD_MOCKS_*) Missed in the prior commit (a30b868a) — only grepped mocks/ subdir. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: drop staging dir + GH Action; back to local-script upload The staging-dir + Action design (added earlier in this PR) had a flaw the user caught: new recordings briefly entered the repo on their way through staging, leaving them in git history forever even after the Action cleanup commit removed them from HEAD. That defeats the whole point of moving recordings to R2. Replace with the simpler local-maintainer flow: bash mocks/scripts/upload-recording.sh /path/to/<trace>.jsonl # → validates, wrangler r2 put, updates manifest.json, wrangler r2 put manifest git add mocks/manifest.json && git commit && git push # → only the ~200B manifest delta enters git The wrangler-OAuth gate replaces the CI secret + Action duo. For a solo / small maintainer team this collapses the trust chain down to "do you have wrangler login to the powerformer account?" — no GH secrets to rotate, no concurrency window to worry about, no inevitable repo-history bloat. Deletes: - .github/workflows/sync-mocks-to-r2.yml - mocks/scripts/upload-to-r2.mjs (CI-only) - mocks/scripts/add-recording.sh (staging helper, now obsolete) - mocks/recordings-staging/ (empty dir, never to be repopulated) Adds: - mocks/scripts/upload-recording.sh Kept: - mocks/scripts/fetch-recordings.sh - mocks/scripts/lib/manifest-utils.mjs (still used by upload-recording.sh) - mocks/manifest.json (committed; the only mocks artifact in git) End-to-end tested locally: re-upload an existing recording is idempotent, manifest math is stable, fetch + smoke test still green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: address review — guard allowlist + safe ~/.amr + loud OD_MOCKS_TRACE typo Three concrete issues raised across recent Siri-Ray (Looper) review threads on #3241: 1. scripts/guard.ts only allowlisted mocks/lib/ + mocks/mock-agent.mjs, leaving mocks/scripts/lib/manifest-utils.mjs outside the residual- JS guard. Result: Preflight fail on every push. Extend the allowlist to mocks/scripts/ — same precedent as the lib/ entry directly above. 2. mocks/scripts/smoke-test.sh moved the caller real ~/.amr to ~/.amr-smoke-backup, ran vela login (which writes a fake config), then rm -rf the .amr and restored the backup. Two failure modes: crash mid-run loses the user real config, and re-running before restore overwrites the backup with the fake login. Fix: sandbox vela login into a mktemp -d HOME via env (HOME=$amr_sandbox vela login). Never touches the real ~/.amr at all. trap cleans up. 3. mocks/lib/recording-picker.mjs silently fell through to prompt-hash → pool → random when OD_MOCKS_TRACE was set but did not match any recording (typo, prefix too short, corpus not fetched). Tests using a pinned trace would silently get a different trace, hiding regressions. Fix: throw an explicit error with the failing value + a pointer at fetch-recordings.sh. Verified locally: pnpm guard prints "Residual JavaScript check passed", smoke-test still 21/21, ~/.amr mtime unchanged after run, typo on OD_MOCKS_TRACE now produces "mock-agent: OD_MOCKS_TRACE=... set but no matching recording in <dir>" on stderr. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fetch-recordings: detect empty filter result before line-counting printf '%s\n' on an empty string emits a single empty line, so the previous TOTAL=$(printf ... | grep -c "") math returned 1 on an empty $ENTRIES_TSV — a typo like `--agent no-such-agent` printed "Fetching up to 1 recordings", downloaded zero, and exited 0 ("ready"). Check `-z $ENTRIES_TSV` first. Reproduced + fix verified per the reviewer thread. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * mocks: address mrcfps review — goldens + provenance + contract check Three durability improvements suggested in the PR #3241 top-level review: ## 1. Golden daemon-event snapshots (mocks/golden/*.events.json + apps/daemon/tests/mocks-golden.test.ts) Smoke-test verified that mocks RUN; that catches crashes but not a parser change that semantically reshapes the events the daemon emits. Commit the daemon-event sequence for 3 representative traces: - claude 314d6833 — median-complexity agent-browser session - codex dcdff3b3 — 14-tool refactor - opencode 9a9522ec — 7-tool data-report apps/daemon/tests/mocks-golden.test.ts spawns the mock, feeds stdout through the real createClaudeStreamHandler / createJsonEventStreamHandler, normalizes per-spawn volatile fields (only sessionId today, only on claude), and deep-equals against the committed snapshot. A parser regression fails the test loudly. After an intentional parser change, regenerate: MOCKS_GOLDEN_UPDATE=1 pnpm --filter @open-design/daemon test mocks-golden git diff mocks/golden/ # eyeball; commit if shapes match intent ## 2. Provenance fields on every manifest entry (mocks/scripts/lib/manifest-utils.mjs + mocks/manifest.json) Augment inspectRecording() to write: captured_at — ISO 8601 from existing meta.timestamp cli_version — null until harvester writes it protocol_version — null until harvester writes it anonymization_version — null until harvester writes it captured_at is now populated for all 179 existing entries from the meta event the harvester already emits. The harvester in nexu-io/agent-pr-explore is the next step for cli_version / protocol_version / anonymization_version — once those are populated, consumers can detect when a recording is older than ~1 minor version behind the live CLI and flag for re-harvest. No matrix of (cli_version × agent) recordings — that explodes maintenance. Just metadata per recording so trust decay is visible. ## 3. Real-CLI contract check (mocks/scripts/contract-check.sh + docs/MOCKS-CONTRACT-CHECK.md) Mocks catch parser regressions against recordings; they do NOT catch recordings drifting away from the live agent CLI as that CLI evolves. The contract check spawns the real CLI alongside the mock with a fixed deterministic prompt + diffs top-level event-type distributions. Deliberately human-driven, not cron-scheduled: - costs real LLM tokens per invocation - requires real CLI auth - maintainer reads the output, not a regex Suggested triggers per doc: real-CLI release notes mentioning "output format" / "stream" / "JSON" / "events"; before a parser refactor; ad-hoc when something looks off. ## Coverage note README updated to position mocks as "deterministic protocol/parser coverage" (not "e2e replacement") per mrcfps framing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mocks-golden test): drop import of non-exported ParserKind Use plain string (the type alias is `string` anyway) — Preflight typecheck on a31fa71a failed: tests/mocks-golden.test.ts(29,8): error TS2459: Module "../src/json-event-stream.js" declares "ParserKind" locally, but it is not exported. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * recording-picker: structured OD_MOCKS_POOL + hard-fail no-match Siri-Ray review: \`OD_MOCKS_POOL=outcome:failed\` was documented as a supported selection knob, but the matcher only checked tags and \`meta.agent\` — so the negative-path pool found 0 candidates and silently fell through to global random, validating against any recording instead of a failed trace. Fix: - Parse \`<dim>:<value>\` shape and route each dim to the right meta field: \`outcome\` → \`meta.outcome\`, \`agent\` → \`meta.agent\`, \`skill\` → \`tags[]\`. Bare values still fall back to tag substring. - If the env was set and matched nothing, throw with the failing value and a jq one-liner for inspection. Same loud-fail policy as OD_MOCKS_TRACE — silent fallback was the original bug. Verified locally: outcome:failed, agent:codex, skill:agent-browser all route correctly; outcome:nonsense throws the explicit error. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * contract-check.sh: fix lost $PROMPT in mock invocation Siri-Ray review on e576074a: the mock side wrapped its pipeline in `bash -c "printf %s \"\$PROMPT\" | ..."` — but $PROMPT was a parent shell variable, not exported, so the child bash expanded it to an empty string. Result: the contract check sent the real prompt to the real CLI and an empty string to the mock, defeating the same-input invariant the whole script rests on. Also let the mock randomly select a different trace whenever a maintainer happens to have OD_MOCKS_BY_PROMPT_HASH=1 in their env. Fix: drop the inner bash -c entirely; use a subshell that scopes the PATH overlay and pipes printf into the PATH-resolved mock binary directly. The subshell limits the PATH change without var-passing. Verified locally: with prompt-A the mock picks trace 54ec02ee via hash; prompt-B → 2667e851 via hash; empty prompt (old broken behavior) → random — confirms the prompt is now actually reaching the mock under PATH overlay. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-29 07:17:20 +00:00
lefarcen	df8a0faff6	feat(runtimes): register AMR (vela) as an ACP stdio agent (#2355) ... * feat(runtimes): register AMR (vela) as an ACP stdio agent AMR is the vela CLI's ACP runtime mode. `vela agent run --runtime opencode` speaks ACP JSON-RPC over stdio (see vela's `specs/current/runtime/manual-agent-run-openrouter.md`); per `docs/new-agent-runtime-acp.md` we expose it through the same `streamFormat: 'acp-json-rpc'` transport that already powers Hermes, Devin, Kimi, etc. The new `defs/amr.ts` is the entire wiring — `buildArgs` returns `['agent', 'run', '--runtime', 'opencode']`, `fetchModels` reuses `detectAcpModels`, and the fallback list seeds the OpenRouter ids vela's e2e baseline uses. `executables.ts`/`app-config.ts`/`metadata.ts` get the matching `VELA_BIN`/`VELA_LINK_URL`/`VELA_RUNTIME_KEY`/`VELA_OPENCODE_BIN` allowlist + install/docs URLs, so users can configure the per-agent env in Settings without leaking into other adapters. Coverage: `tests/fixtures/fake-vela.mjs` is a minimal ACP stub that returns the documented `initialize` / `session/new` / `session/set_model` / `session/prompt` shapes; `tests/amr-acp-integration.test.ts` spawns it via `child_process.spawn` and drives a full turn through `attachAcpSession` and `detectAcpModels`, so the ACP transport contract for AMR is end-to-end verified locally even before a real `vela` binary is installed. Validated: - pnpm guard - pnpm typecheck (all workspace projects) - pnpm --filter @open-design/daemon test (2881/2881) Deferred: real OpenRouter-backed turn through a built `vela` binary — the runtime def needs no changes for that path, only `VELA_RUNTIME_KEY` and `VELA_LINK_URL` in env (or Settings). * fix(runtimes/amr): pin a concrete default model and bare openai ids End-to-end validation against a freshly-built `vela` (nexu-io/vela@main) + OpenRouter surfaced two contract details the first AMR runtime def got wrong: 1. vela rejects `session/prompt` with `session/set_model must be called before session/prompt`. attachAcpSession in apps/daemon/src/acp.ts skips set_model whenever the picked model is the synthetic 'default' id, so AMR's fallback list must NOT include DEFAULT_MODEL_OPTION. The def now ships a concrete `gpt-5.4-mini` as both `fetchModels`' default option and `fallbackModels[0]`, which makes attachAcpSession always send a real `session/set_model` for AMR turns. 2. `vela --runtime opencode` auto-prepends `openai/` to whatever modelId it forwards to opencode's openai provider. With OpenRouter-style ids like `openai/gpt-5.4-mini`, opencode receives the double-prefixed `openai/openai/gpt-5.4-mini` and replies `ProviderModelNotFoundError`. The new fallback list ships the bare ids opencode's openai registry actually knows about (gpt-5.4, gpt-5.4-mini, gpt-5.4-fast, etc.). Stub + tests: - tests/fixtures/fake-vela.mjs now enforces the set_model gate the same way real vela does, so a regression that silently goes back to model: 'default' would surface as a fatal error in tests instead of a hidden production failure. - tests/amr-acp-integration.test.ts pins both contracts: no 'default' / no 'openai/' prefix in fallbackModels, and a negative case that asserts session/prompt fails when no model is set. Adds `apps/daemon/scripts/verify-amr-real-vela.mjs` — a small dev-time runner that drives `attachAcpSession` against a real `vela` binary and prints the daemon's chat events, so future protocol drift can be checked against an actual OpenRouter call. Verified locally: `vela agent run --runtime opencode` + OpenRouter returns the prompted string ("AMR-E2E-PASS") through the full daemon pipeline; daemon test suite stays 2883/2883. * fix(runtimes/amr): substitute concrete model when chat run sends 'default' A plugin-driven AMR run from the UI surfaced a real-world hole in the prior commit: json-rpc id 3: session/set_model must be called before session/prompt The Default-design-router plugin (and any caller that doesn't pin a real model) sends `model: 'default'` straight through, which the AMR runtime def cannot accept — vela rejects `session/prompt` without `session/set_model` and attachAcpSession skips set_model whenever model === 'default'. Just leaving DEFAULT_MODEL_OPTION out of the adapter's `fallbackModels` is not enough: the chat-run handler in server.ts still forwarded 'default' verbatim. This adds `resolveModelForAgent(def, resolved, env?)` as the single source of truth for the substitution: 1. If the caller picked a real id, pass it through. 2. Else, if `def.defaultModelEnvVar` is set and the daemon process env has a non-empty value for it, return that (operator escape hatch — see below). 3. Else, if the def's `fallbackModels` does NOT contain a 'default' id, return `fallbackModels[0].id`. 4. Else, return the original value (the historic shape — defs that list 'default' themselves are untouched). AMR sets `defaultModelEnvVar: 'VELA_DEFAULT_MODEL'`, so when opencode's openai-provider registry deprecates `gpt-5.4-mini` upstream, an operator can swap the fallback id without a code change by exporting `VELA_DEFAULT_MODEL=gpt-5.5` before launching tools-dev / od. Worth noting the env var must live in the daemon's `process.env` (Settings-UI per-agent env values only reach the spawned child, not the daemon's resolver) — the new field's docblock spells this out. Coverage: - `tests/runtimes/resolve-model.test.ts` — 8 unit tests covering all four resolver branches plus the env-override happy path / fallback / ignore-when-user-picked-a-real-id case. - `pnpm --filter @open-design/daemon typecheck` clean. * chore(runtimes/amr): move AMR to the top of the base agent list So `AMR (vela)` shows up first in the agent picker / status views, ahead of claude / codex. Pure ordering change; no behavior delta. * feat(amr): Sign-in / Sign-out button on the AMR Settings card The first half of the AMR work assumed the operator would set VELA_RUNTIME_KEY / VELA_LINK_URL on the daemon process and never surfaced login state to users. This adds the missing UX so a fresh install can drive the full path from Settings: - GET /api/integrations/vela/status reads ~/.vela/config.json for the active profile and returns { loggedIn, profile, user } (without leaking the runtime/control keys themselves). - POST /api/integrations/vela/login spawns `vela login` once (409 if one is already in flight). The vela CLI opens the user's browser to the device-authorization page itself — Open Design only needs to kick the subprocess off. - POST /api/integrations/vela/logout removes ~/.vela/config.json so the next status read returns logged-out. `AmrAgentCard` is a dedicated agent-card component for AMR because the existing `<button>` row can't host an interactive sub-control (nested interactive elements). It polls /status after a login click until the daemon reports loggedIn=true (or 5 minutes elapse), and exposes a Sign-out action on hover. Other adapters (claude, codex, hermes, …) keep their existing `<button>` card. i18n: 8 new keys (settings.amrLogin / Logout / LoggingIn / etc.) added to en + zh-CN. Other locales spread `en` and inherit the English copy until translations land. Coverage: - `tests/integrations/vela.test.ts` pins the config.json reader against a tmp HOME — including the negative case where a profile has user info but no runtimeKey (still logged-out), and the secret-leak guard ("rt-secret-*" must not appear in the projection payload). - `tests/components/AmrAgentCard.test.tsx` covers all four UI states (logged-out, logging-in, logged-in, logging-out) plus the click-propagation invariant the divergent card was built to keep. `pnpm --filter @open-design/daemon test` 2901 / 2901 passing. `pnpm --filter @open-design/web test` 1719 / 1719 passing. `pnpm typecheck` + `pnpm guard` clean. Dev script side-effects: `apps/daemon/scripts/verify-amr-real-vela.mjs` no longer requires both VELA_RUNTIME_KEY and VELA_LINK_URL — if VELA_PROFILE is set, the vela CLI is allowed to resolve credentials from `~/.vela/config.json`. Added the two AMR `.mjs` fixtures to `scripts/guard.ts` allowlist with the executable-fixture / dev-runner rationale. * fix(connection-test): substitute model for AMR before attachAcpSession The chat-run path in server.ts already routes the requested model through `resolveModelForAgent` so AMR / vela (whose CLI demands an explicit `session/set_model` before `session/prompt`) gets the def's first concrete fallback id when the chat run ships `model: 'default'`. `connectionTest.ts` was wiring `attachAcpSession({ ..., model: model ?? null })` directly, which made the Test Connection button on the AMR Settings card deadlock with the same `session/set_model must be called before session/prompt` error the chat-run path already handles — surfaced as a permanent "Testing connection…" spinner in the UI. Reuse the same helper here so Test Connection mirrors chat-run behavior. * test(amr): three-layer end-to-end coverage for the AMR login + turn flow The PR up to this point shipped runtime + UI code with unit-level Vitest coverage. This commit adds the cross-layer regression net the live demo relied on: 1. apps/daemon/tests/integrations/vela.routes.test.ts (HTTP, Vitest) Spins up the real daemon Express app via `startServer({port:0,...})`, persists `agentCliEnv.amr.VELA_BIN = <fake>` into app-config.json, and exercises every /api/integrations/vela/* endpoint against the extended fake-vela stub: - status reads ~/.vela/config.json under various states - login spawns the fake, waits for config.json to appear, returns pid + startedAt + profile - 409 already-running guard with the stub's delay knob - logout removes the file (idempotent) - secrets (runtimeKey / controlKey) never leak in the projection - login → status round-trip flips loggedIn=false → true 2. e2e/tests/amr/turn.test.ts (tools-dev orchestrated, Vitest) Boots a namespaced daemon + web pair through `createSmokeSuite`, inlines a self-contained fake `vela` binary that handles BOTH `vela login` (writes ~/.vela/config.json) and `vela agent run --runtime opencode` (ACP stdio with the `session/set_model must precede session/prompt` gate the real binary enforces), then drives a complete /api/runs lifecycle for `agentId: 'amr', model: 'default'` and asserts the assistant message captures the fake's streamed text. This is the test that would have surfaced today's plugin-default-model regression (the `set_model before prompt` error) at PR time instead of demo time. 3. e2e/ui/amr-login-pill.test.ts (Playwright) Mocks /api/agents + /api/integrations/vela/{status,login,logout} to drive the Settings AMR card through the full Sign in → Signed in → Sign out cycle. Pins the AmrLoginPill polling contract and the aria-label semantics (the pill's accessible name is "Sign out" once logged in, regardless of which label the hover-state text shows). fake-vela.mjs extensions: - Handles `vela login` argv by writing ~/.vela/config.json for the active VELA_PROFILE and exiting 0 — mirrors real vela's on-disk side-effect without the device-auth loop. - FAKE_VELA_LOGIN_DELAY_MS knob so route tests can observe the in-flight state of the spawn lifecycle. - FAKE_VELA_LOGIN_USER_EMAIL / _USER_PLAN to assert the surfaced user fields end-to-end. Validated: - `pnpm guard` + `pnpm typecheck` (all workspace projects) - `pnpm --filter @open-design/daemon test`: 2998 / 2998 passing, including the new 8-test integration suite. - `cd e2e && pnpm test tests/amr`: 1 / 1 passing. - `cd e2e && pnpm exec playwright test ui/amr-login-pill.test.ts`: 1 / 1 passing (6.7s). * feat(amr): package native cli and refine login ui * feat(amr): wire vela cli beta packaging * docs(amr): document vela ci packaging review * docs(amr): refine vela ci integration review * fix(ci): refresh nix pnpm dependency hashes * fix(pack): clean up Vela CLI packaging * fix(pack): bundle Vela CLI support files * fix(amr): recover login attempts from stale auth state * test: expand AMR and automations coverage * fix(amr): address review follow-ups * test(web): align tasks fixtures with contracts * fix(daemon): type wildcard route params * fix(ci): refresh PR merge validation * fix(amr): clear env credentials on logout * feat(settings): inline local CLI model configuration * fix(amr): recognize daemon env credentials * [codex] Fix Vela companion packaging (#2979) * Fix Vela companion packaging * Update Nix pnpm dependency hashes * [codex] Surface AMR account failures (#2980) * fix: surface AMR account failures * fix: cover AMR recovery error guidance * chore: bump beta base version to 0.8.1 (#2990) * Fix AMR profile and packaged runtime review issues * Detect packaged AMR OpenCode companion tree * feat(web): polish AMR frontend flows * Polish AMR onboarding card * fix: read AMR login state from dot-amr config (#3048) * test: tighten AMR credential and packaging coverage * test: restore AMR executable test env helper * [codex] Fix packaged mac Dock identity and AMR label (#3076) * Fix packaged mac sidecar Dock identity * Rename AMR assistant label * Fix AMR live models and dot-amr login state (#3073) * fix: read AMR login state from dot-amr config * fix: load live AMR models before runs * fix: point AMR onboarding link to production wallet * fix: address AMR model review feedback * fix: persist live AMR model fallback * [codex] Fix AMR link catalog model ids (#3088) * Fix packaged mac sidecar Dock identity * Rename AMR assistant label * Fix AMR link catalog model ids * Fix AMR model normalization typecheck * Use live AMR model for default runs * fix: polish AMR runtime settings UI * Accelerate AMR startup defaults (#3092) * Surface AMR insufficient balance wallet URL (#3099) * fix(web): polish onboarding controls (#3112) * fix(web): show CLI scan loading state * Avoid duplicate AMR wallet recharge links (#3117) * Avoid duplicate AMR wallet recharge links * Use Vela CLI 0.0.3 test package * chore(nix): refresh pnpm deps hash * Fix AMR wallet guidance display --------- Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com> * chore(pack): pin Vela CLI 0.0.3-test.1 (#3127) * chore(nix): refresh pnpm deps hash * chore(pack): pin Vela CLI 0.0.3 * chore(nix): refresh pnpm deps hash * fix(web): suppress AMR exit 130 fallback (#3136) * feat(web): nudge users to hosted AMR on model/auth/quota failures (#3083) * feat(web): nudge users to hosted AMR on model/auth/quota failures When a non-AMR agent run fails with an auth / quota / upstream model error, surface an inline nudge under the error pill linking to Open Design's hosted AMR gateway (https://open-design.ai/amr). The nudge fires `surface_view` (element=run_failed_toast) on impression and `ui_click` (element=go_amr) on the link. Also teach the daemon to classify CLI-agent auth/quota/upstream failures (Claude Code, codex, ...) into specific API error codes (AGENT_AUTH_REQUIRED / RATE_LIMITED / UPSTREAM_UNAVAILABLE) instead of the generic AGENT_EXECUTION_FAILED, so both the error message and the nudge key off accurate codes. AMR's own runs are excluded from the nudge — they keep the dedicated sign-in / recharge affordances. * feat(web): rework failed-run AMR guidance into per-case error UI Replace the single inline nudge with a per-case failed-run experience driven by the run's error code + agent: - The error card is now neutral gray (was red) and always carries a retry button; it is driven by the persisted per-message error event so it survives a reload. - Non-AMR agent hitting a model/auth/quota wall: a theme-color promotion card under the error card offers "switch to AMR & retry" — switches the run to AMR, opens Settings on the AMR card, and auto-retries once the account signs in (ProjectView polls vela login status, independent of the Settings pill lifecycle, with success / 5-min-timeout / unmount exits). - AMR agent unauthorized: clearer copy + an "authorize & retry" button. - AMR agent out of balance: clearer copy + a "top up" button to the AMR wallet, with manual retry. - Settings AMR card: when opened from the nudge, it scrolls into view and pulses, and an authorize-button coachmark (a fake hand cursor that rises in and dismisses on hover) points at the sign-in control when not yet authorized. analytics: surface_view (run_failed_toast) on the promotion card and ui_click (go_amr) on its action are retained. i18n adds chat.amrCard.* and chat.amrError.* (en / zh-CN / zh-TW translated; other locales fall back to en) and drops the old chat.amrErrorGuidance keys. * fix(daemon): require status context for numeric service-failure codes Per review on #3083: the model-service classifier matched bare HTTP status numbers (`500`, `502`, `429`, `401`), so ordinary CLI output like `line 500`, `read 502 bytes`, or `exit code 401` could be misclassified as a provider outage / auth wall and wrongly surface the AMR nudge. Now a status number only counts when it carries explicit context (`HTTP 500`, `status 503`, `code: 401`, `502 Bad Gateway`); textual provider phrases (overloaded, bad gateway, service unavailable, rate limit, …) are unchanged. Adds fixtures proving unrelated numeric output stays null. * fix(web): keep error pill for failed runs ChatPane's card doesn't cover Per review on #3083: the per-message gray error pill was suppressed for every persisted error status event, but ChatPane only renders the replacement top-level error card for `retryableAssistantMessage` (the last failed assistant). So a failed turn that is no longer last (after a follow-up) or an older failed run in history showed neither the pill nor the card — its error detail vanished, undercutting reload/history survival. ChatPane now passes `errorCardOwnerId` (the assistant id whose error the card represents); AssistantMessage suppresses only that one pill and keeps rendering StatusPill for all other error events. * fix(daemon): don't treat a process exit code as an HTTP status Follow-up to review on #3083: the status-context helper accepted a bare `code` prefix, so `exit code 401` / `process exited with code 429` still matched and got classified as AGENT_AUTH_REQUIRED / RATE_LIMITED (the very `exit code 401` case the comment calls out as noise). `code` now only counts when qualified (`status code` / `error code` / `response code`) or punctuation-bound (`code: 401`); bare `exit code N` no longer matches. Adds fixtures for exit-code lines returning null. * chore(web): translate AMR card / error keys for 16 remaining locales PR #3083 added 10 new `chat.amrCard.*` / `chat.amrError.*` keys but only provided en/zh-CN/zh-TW translations; the other 16 locales fell back to English. Translate the card title/body, three chips, primary CTA, and the AMR self-error (auth / balance) messages and buttons for ar, de, es-ES, fa, fr, hu, id, it, ja, ko, pl, pt-BR, ru, th, tr, uk. * fix(amr): address review feedback on #2355 Targeted fixes for the unresolved review threads on #2355. Each fix includes / updates a focused test. - runtimes/executables.ts: `packagedVelaOpenCodeCompanionTree` now verifies the inner `opencode` executable exists + is runnable, not just the directory. This closes the false-positive availability path that let `detectAgents()` surface AMR as available even when the packaged companion was empty / partially copied (mrcfps, 4 threads). - runtimes/executables.ts: `resolveAmrOpenCodeExecutable` now prefers the bundled `<OD_RESOURCE_ROOT>/bin/libexec/opencode/opencode` over a stale `opencode` on the user's PATH, so packaged AMR builds can't be hijacked by a global installation. - web/EntryShell.tsx: when the Local CLI scan returns an available agent and the previously-selected agent is AMR, switch the selection to the first available local agent so the runtime and persisted agent agree before Continue. - server.ts (model-probe branch): for AMR, check `readVelaLoginStatus` BEFORE rejecting on an empty live-model catalog — a signed-out user was getting `AMR_MODEL_UNAVAILABLE` ("choose a model") instead of the correct `AMR_AUTH_REQUIRED` (sign-in affordance). - server.ts (default model fallback): if the user asked for the AMR agent default and the cached id is no longer in the FRESH catalog, fall back to `liveModels[0]` from the probe instead of rejecting the run as `AMR_MODEL_UNAVAILABLE`. - integrations/vela.ts: route `vela login` through `createCommandInvocation` so an npm/Node-style `vela.cmd` / `.bat` shim on Windows gets the correct `cmd.exe /d /s /c …` wrapping with verbatim args (matches `execAgentFile` / chat-run spawning). - tools/pack/src/linux.ts: in containerized Linux builds, bind-mount the host directory of `OPEN_DESIGN_VELA_CLI_BIN` and rewrite the env to the container-side path. The host path was being passed in as-is even though the default container only mounts /project, /tools-pack and cache/home — `copyOptionalVelaCliBinary` saw a missing path. Deferred (out of scope for this PR): - `od amr status/login/logout/cancel` CLI subcommands (AGENTS.md UI/CLI dual-track rule, server.ts:5763) — sizable surface; tracked for a separate focused PR. - Strict `--require-vela-cli` for Windows + mac-x64 beta builds: prematurely blocked — `@powerformer/vela-cli` only publishes the `darwin-arm64` platform binary today; adding the flag elsewhere would fail the builds. Revisit once win/x64/linux binaries ship. * fix(amr): hoist sendAmrAccountFailure above the AMR catalog preflight (TDZ) The new signed-out AMR branch in the catalog preflight at server.ts:10875 calls `sendAmrAccountFailure(...)` to emit AMR_AUTH_REQUIRED, but the const declaration sat ~100 lines below at the outer function scope. Because `const` is TDZ-aware, that branch would have thrown `ReferenceError: Cannot access 'sendAmrAccountFailure' before initialization` for the exact users it tries to help — defeating the original intent. Hoist the helper to just above the AMR preflight block so it's available to every AMR code path in this function. Behavior elsewhere is unchanged. Also rerun the daemon test suite: `launch.test.ts > resolveAgentLaunch uses packaged built-in Vela for AMR` was creating the `<resourceRoot>/bin/libexec/opencode/` companion *directory* only, but this PR's earlier tightening of `packagedVelaOpenCodeCompanionTree` also requires the inner `opencode` executable. Add it to that fixture to match the new contract; the test was a sibling of the executables / env-and-detection fixtures already updated in 13fc4f4. Addresses #2355 review (mrcfps, 2026-05-28). * feat(web): add hover cancel for AMR login (#3158) * feat(web): add hover cancel for AMR login * fix(web): don't bounce AmrLoginPill back to 'Signing in…' after local cancel Both codex-connector (P2) and looper (CHANGES_REQUESTED) on this PR flagged the same race in the new local-cancel path: `handleCancelLogin` dispatches `notifyAmrLoginStatusChanged('login-canceled')` immediately after `/login/cancel` returns, but the `AMR_LOGIN_STATUS_EVENT` listener unconditionally re-enters `refresh()` and then restarts polling whenever `/api/integrations/vela/status` still reports `loginInFlight: true`. That is a real race because the daemon's `cancelVelaLogin()` only sends SIGTERM (escalating to SIGKILL after `LOGIN_CANCEL_KILL_GRACE_MS` = 2000 ms) and keeps the child in `activeLoginProcs` until it actually exits — so the first `/status` read after a successful cancel can legally still come back as in-flight. Under that window the pill flips back to 'Signing in…' and can later surface the timeout/error path even though the user already canceled, defeating the behavior promised in the PR description. Fix the listener instead of every dispatch site: in the `login-canceled` branch, after the local reset (stopPolling + setPending(null) + clear refs), optimistically mark every subscribed pill instance as not-in-flight (`setStatus((c) => c ? { ...c, loginInFlight: false } : c)`) and `return` — skip the refresh-and-reconcile branch below entirely. The next explicit refresh (component mount, user interaction, or a `status-changed` event) will pick up the daemon's confirmed state once the child has actually exited. Add a focused regression test that holds `/api/integrations/vela/status` at `loginInFlight: true` even after a successful `/login/cancel`, asserting that the pill stays at the Canceled → Authorize sequence and never bounces back to 'Signing in…'. This test fails on the pre-fix listener and passes on the new behavior; existing 'cancels an in-flight AMR sign-in…' and 'reconciles late AMR browser completion to Signed in after local cancel' tests continue to pass. Addresses review feedback on #3158 (chatgpt-codex-connector, nettee). --------- Co-authored-by: lefarcen <935902669@qq.com> --------- Co-authored-by: a1chzt <chizblank@gmail.com> Co-authored-by: Amy <1184569493@qq.com> Co-authored-by: Mason <jinmeihong0201@gmail.com> Co-authored-by: Caprika <56862773+alchemistklk@users.noreply.github.com> Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com>	2026-05-28 05:09:55 +00:00