56 Commits

Author	SHA1	Message	Date
Caprika	e654592ba6	fix(daemon): point users at the Settings section that actually exists (#6831) ... * fix(daemon): point users at the Settings section that actually exists When image generation failed for a missing credential, the reply told the user to configure it in "Settings → Media". No such nav item exists — the section is "Media providers" ("媒体生成提供商" in zh-CN) — so users following the instruction found nothing. The cause is that Settings destinations were spelled independently wherever a producer happened to need one: 29 provider errors in apps/daemon/src/media/index.ts said a bare unnamed "Settings" (one said "Settings -> Media Providers"), and the od-media-generation skill said "Settings → Media". None of them were tied to the Settings dialog, so a rename could not reach them. packages/contracts/src/settings-nav.ts is now the single place a Settings destination is spelled, and every producer reads it: the media provider errors, the ElevenLabs voice-options prompt (daemon + contracts), and the external-MCP auth guidance. e2e/tests/settings-nav-copy.test.ts holds the constants against the labels apps/web actually renders and fails the build if a producer re-inlines its own guess. Swept the same drift class while here: both hatch-pet SKILL.md copies pointed at "Settings → Pets", but #5517 folded the pet picker into General, so the real path is "Settings → General → Pets". Verified the gate red on the pre-fix tree (3 failing assertions) and green after. Adjacent, not fixed: these strings are English and the agent translates them ad hoc, so a localized client can still render a section name that does not match its own UI — see the report. Record: recvre8FrTE2Oa (V0.19.1 acceptance) * fix(contracts): gate destinations on rendered nav, not the i18n dictionary Review on #6831 caught that SETTINGS_EXTERNAL_MCP named a place users cannot navigate to. `mcpClient` kept its Settings render block but lost its sidebar nav item (SettingsDialog.tsx says so in its own comment), and reconnecting an external MCP server now lives in the top-level Integrations view. So the destination is not a Settings section at all. The stale string predates this branch — it was hardcoded in prompts/system.ts on main. But promoting it into a named constant made it worse twice over: the docblock asserted "The Settings nav item where external MCP servers are added/reconnected" in a canonical location, and the new gate whitelisted it by construction, so the check built to catch dead paths became the thing defending one. The deeper defect was the gate's invariant. Comparing a constant to its i18n key's value proves only that some dictionary entry matches — not that anything renders it. `settings.externalMcpTitle` still resolves to "External MCP" with no nav item behind it, which is exactly how the dead path passed. The same hole covered SETTINGS_MEDIA_PROVIDERS. Now the gate parses what the UI actually renders — `settings-nav-item` buttons and INTEGRATION_TABS — and resolves those keys through the dictionary, using it as a lookup rather than as the source of truth. Verified by reintroducing "Settings → External MCP": the old gate passed it, the new one fails with the rendered destinations listed. Replaces SETTINGS_EXTERNAL_MCP with INTEGRATIONS_MCP_PATH (`Integrations → MCP`) and adds a regression test pinning that a dictionary-only label is rejected.	2026-08-13 08:42:27 +00:00
lefarcen	356c8c364f	feat(workspace-team): team workspaces, shared resources, workspace-scoped billing, and the #5517 redesign (#6142) ... * fix(web): scope plugin URL imports to workspace * test(web): cover billing interest remount lifecycle * feat(packaged): enable the workspace-team transport for test-profile builds The vela test backend now serves the workspace-team API, so a packaged build baked with the test AMR profile should drive team projects / collab / resource sharing there instead of leaving them dormant. Replace the single feature-test equality check with a profile -> vela web origin map so adding a backend is one entry, and keep every unlisted profile (prod above all) off. * test(daemon): cover billing catch-up after SSE reconnect * fix(collab): surface and start first materialization when opening a shared project QA P0: a brand-new member on a fresh install joins someone's workspace, opens a project from it, and sees no loading state and no files — content only appears on a SECOND open, much later. Two defects, both on the first `/collab/status` request that opening a shared project makes. 1. No pull is started. The daemon's self-materialization block was gated on `callerIsOwner`, so a non-owner member got the placeholder record registered and nothing else. The web's auto-pull is gated on `publishedVersion` advancing past its cursor, and a fresh daemon's first status response cannot carry a published head: `collab.publishedVersion()` reads an in-process map that has never been written, and the real hub head is fetched fire-and-forget into `headEnrichmentCache` for a LATER poll to consume. Materialization therefore arrived only whenever a proactive lane (hub push / reconnect catch-up / the 30s recovery floor) next fired — the "second open" the report describes. 2. No download state is shown. `useProjectCollab.downloadPending` — which picks DesignFilesPanel's "Syncing files from the team…" over its empty state and create-a-file CTAs — reads only `publishedVersion > cursor`, `contentTransferState`, and an in-flight pull. All three are blank on that first response, so the member was shown an empty project inviting them to start creating over content that was still on its way. The fix makes the placeholder stamp the load-bearing signal on both sides: - `materializePlaceholderOnOpen` (routes/collab-sync.ts) replaces the owner-only block: any viewer opening a shared project whose only local record is an unmaterialized placeholder starts its pull on that same request, through the same coalesced flow. The retracted-share heal in its catch stays owner-only — a member who hits the hub tombstone has merely lost access and must not unshare anyone's project. - `/collab/status` reports `awaitingFirstMaterialization`, a purely local, synchronous fact that needs no hub round-trip and is therefore available on the very first response. `od collab status` prints it too. - `localFilesAreNotTheContentYet` (useProjectCollab.ts) makes it always download-pending, bypassing the member-only `shouldAutoPull` gate: whether the local files are the content is a fact about the record, not about who may pull it, so the owner of an unmaterialized placeholder (the reinstall case, recvqzaDvUU6B3) stops seeing the same empty state too. Red evidence: all six new specs fail on origin/feat/workspace-team @ 793d7b92c — the first status response reported `awaitingFirstMaterialization: undefined` with publishedVersion/materializedVersion/contentTransferState all null, `beginContentTransfer` was never called for a member's first open, and `downloadPending` was false for both the member and the owner. * chore(packaged): inject the vela web origin at build time, not source This repository is public. Commit 319cb42b3 added a profile -> vela web origin table to apps/packaged/src/sidecars.ts, which put an internal environment's hostname into product source and would have published it on merge. The same hostname had also reached apps/web/src/runtime/amr-guidance.ts as a new profile row. Internal AMR environments are not public (one of them fronts a Stripe sandbox), so their origins now travel the same build-time path POSTHOG_KEY already uses: release-beta.yml env (per-profile secret) -> tools-pack config (OD_VELA_WEB_URL) -> open-design-config.json (velaWebUrl) -> packaged config -> daemon spawn env (OD_VELA_WEB_URL) -> GET /api/integrations/vela/status (consoleOrigin) -> web runtime console links The workspace-team gate keeps its meaning and gets stricter: it now needs an allowlisted AMR profile AND an injected origin. `prod` can never satisfy the profile half, so a stable build stays dormant however it is configured, and a feature-test/test build whose secret is unset stays dormant too rather than pointing the transports at an unknown backend. A build with no secret configured therefore ships with workspace-team silently off — the same failure mode as a fork build without POSTHOG_KEY, and the safe direction for an unreleased feature. apps/packaged/tests/source-origins.test.ts is a standing guard: every absolute URL literal under apps/packaged/src must resolve to a publishable host, so the next backend origin cannot be hardcoded there either. Secrets required for a workspace-team dogfood build: VELA_WEB_URL_FEATURE_TEST, VELA_WEB_URL_TEST. * test(e2e): follow the #5517 plugin-details route in the visual capture `captures the home plugin use staged surface` has been failing on this branch since before the main merge. It was written against the pre-#5517 UI: clicking a marketplace card opened a role="dialog" details overlay with a per-slug `plugin-details-use-<id>` action. #5517 made plugin details a full-page route — `openCardDetail` calls navigate({ kind: 'marketplace-detail' }) for plugin records, rendering `PluginDetailView` at /marketplace/<id> whose Use control is a single `plugin-detail-use` button. Per the product rule that the accepted feature-branch UI is the source of truth, the test follows the route instead of the UI being changed back. Asserting the route alone was not enough: the detail surface refetches the record from /api/plugins/<id>, which the visual fixture never mocked (it mocks the list, */preview and */apply), so the route rendered its "Failed to load plugin: HTTP 404" branch. configureVisualPage now serves the single-plugin GET from the same VISUAL_PLUGINS fixture. The capture asserts the Use button rather than the `plugin-detail` shell because the shell also renders for the loading and load-failed states. * fix(packaged): restore masked CLI icons (#6154) * Sync local workspace-team batch: UI polish, popover simplification, update-reminder progress (#6156) * UI polish batch: import-dialog cleanup, settings toast placement, tab chrome fixes - Plugin/skill import dialog: drop per-card icons, left-align card content - Settings page: center the autosave pill under the top nav - Avatar model menu: soften the pinned footer divider - Workspace tabs: pinned entry tab always reads as Home; remove tab-search button and its popover - Model picker: wider row gap in the two-pane browse popover - Community header: unpin (scrolls with content) - New update-reminder dialog assets and strings - Keep entry-settings-button as the signed-out settings entry (e2e contract); align NextStepActions with the navPlugins key rename * Update reminder: simulate in-place download progress instead of linking out The strip's confirm now runs a staged progress state ('updating') with an eased fake download bar, then marks the version updated — replacing the jump to the GitHub releases page. * test(web): retire AvatarMenu account-row suites after the popover simplification The composer popover was reduced to a model picker (2026-07-24): the Open Design account row — plan badge, balance, wallet fallback, upgrade/console links — no longer renders there, so the nine suites asserting that surface (including the workspace-balance and billing-permission gates that landed upstream meanwhile) can no longer pass. Drop them and recast the remaining account-row test as the guard for the new invariant: a signed-in AMR status must render no account UI in the popover. Also drop the stale onClose prop from the new upstream sign-out-confirm test; the rail no longer takes one. * Design-systems toast: anchor to the pane's top edge, pill radius * Update reminder strip: progress ring on the button, percent face While updating, the collapsed strip no longer stacks a label + bar above the rocket button. Progress draws as a brand-green ring hugging the round button's edge (5px band reserved so the button never shifts), and the button face swaps the rocket for the bare percent — 'N%' while downloading, 完成 (updater.done) at 100. The full 正在下载更新 N% label stays reachable via the hover bubble and the ring's aria-label. Demo payload version bumps to 1.4.6 so the once-per-version card re-arms. * fix(web): restore design kit section spacing (#6155) * fix(web): carry the plugin back to Home when Use runs from the detail route Product call: using a plugin from the full-page detail route should land on Home with that plugin already selected and its brief pre-filled, exactly like the marketplace card's "Try it". It did not. `PluginDetailView.onUse` applied the plugin, kept the result in local state, and navigated home. `App` renders that route outside `EntryShell`, so the navigation unmounted the holder and dropped both the plugin and the brief — Home came up empty. The "redirected to Home with the brief pre-filled" note under the button could never be seen either, since the navigation fired immediately; it is removed rather than left lying. Reuses the existing channel instead of adding a parallel one: onUse now publishes the same `createPluginUseHandoff` payload "Try it" produces, and Home's existing pendingPluginUseHandoff path applies it unchanged. The handoff is parked in module scope — not on `window` — so it survives the unmount, and `EntryShell` claims it in a lazy state initializer so it arrives in the same commit as the mount. Reads are destructive, so a handoff applies once and does not re-fire on the next visit to Home. Red first: PluginDetailView.use-handoff.test.tsx fails on the unfixed code at the handoff assertion (navigation and the failure path already passed), and goes green with this change. The e2e visual capture that asserts home-hero-active-plugin should follow without weakening its assertion. test(e2e): match the settings surface in both #5517 presentations openSettingsDetailsFromHeader still waited on `.modal-settings[role="dialog"]`. #5517 routes the entry's settings to /settings, where SettingsDialog renders in presentation="page" mode with `role="region"`, so that selector never matched the page presentation: an already-open settings surface looked absent and the helper fell through to hunting for entry triggers that surface does not carry, failing 16 captures on one line. Reuses `settingsSurface` from amr.ts — the existing bare `.modal-settings` matcher both presentations share — rather than adding a third local variant. That helper also documents why the `role="dialog"` fallback was actively wrong: AvatarMenu is a dialog too, so it could resolve to the account menu. * test(e2e): open the nav rail before reaching for entry settings The bare-`.modal-settings` change alone did not move the settings-workspace lane: all 16 captures still died on `.settings-icon-btn`, because the failure happens before the surface selector matters. None of the four triggers was ever visible. amr.ts already documents why. #5517 moved the entry settings chip into the nav rail footer, and a collapsed rail is `inert` + `aria-hidden`: the chip is present but invisible to `getByRole`, and even a programmatic `element.click()` is a no-op. `openSettingsDialog` expands the rail first (`ensureEntryRailOpenIfPresent`), clears loading, dismisses the privacy dialog, matches the surface with the shared bare class, and ends its trigger chain on the settings aria-label instead of `.settings-icon-btn`, which the entry surface does not carry. It also clicks `entry-settings-open-details`, so it is a superset of the local copy. So `openSettingsDetailsFromHeader` now delegates to it and keeps only its name, leaving exactly one settings opener instead of a third variant. * test: realign the suites #6156 outpaced, and reach Settings from a project #6156 (4e3161751) landed a UI batch whose test fallout was only partly handled. Four Vitest files and four e2e call sites still describe the surface as it looked before it, and the Playwright settings opener never had a trigger that exists once a project is open. Vitest — the assertions now read the surface that shipped: - community-view: the type tabs traded their `<small>` count badges for type icons, so `readFacets().badge` was `NaN`. Counts move to a new `readFacetCardCounts()` that drives each tab and counts the grid — the same array the badges were derived from, so the catalogue-fidelity guard (including "never grids more than the whole catalogue") survives the badge's removal rather than being dropped. - home-logo-assets: the rail's signed-out brand header is gone (with no cloud identity the rail starts at the search box), so it can no longer carry `od-brand-glyph`. Keeps the guard that still means something: it must never fall back to the retired raster app icon. - acceptance-visual-fixes: recvq4iEq1Esno's fix is intact — page mode still hides only `.settings-chrome-btn`, leaving the autosave pill visible. #6156 re-added the bare `.settings-page-shell .settings-chrome` selector purely to centre that pill under the top nav, so assert the invariant the row is about (no page-mode `display: none`) instead of the selector's absence. - FileViewer: the new `artifact-preview-first-load` cover is a `role="status"` of its own, so `findByRole('status')` had become ambiguous. Scope the success assertion to the toast. e2e — `entry-nav-settings` no longer exists anywhere in `apps/web/src`; the rail item carries `entry-settings-button`. #6156 renamed it and updated entry-chrome-flows' two `toHaveCount(0)` assertions but not the four places that click or await it (critical-smoke, entry-topbar x2, entry-chrome-flows x2). `openSettingsDialog` also only ever knew entry-shell triggers, all of which live on Home. From a project every one of them is absent — and `EntrySettingsMenu` and `AppChromeHeader`'s `SettingsIconButton` are both unrendered — so the surface never opened and the failure surfaced as a missing `.modal-settings`. Add the project surface's real entry: the composer model popover's pinned `avatar-open-execution-settings`, with the topbar switcher's `inline-model-switcher-open-settings` as a second route. Not addressed here, deliberately: #6156 also deleted the `settings-general-field` block that rendered `AppearanceSection`, orphaning the component. That removes the product's only System/Light/Dark control (the rail's account menu dropped its theme row *because* Settings owned it), so the 11 `SettingsDialog.execution` appearance failures are reporting a capability loss, not a stale expectation. Restoring it is a product call, so those tests are left red rather than weakened. * test(e2e): finish the popover the settings chain opens on a project surface `openSettingsDialog`'s trigger chain ends on OPEN_SETTINGS_LABEL, which matches `Account & settings` — and that is `avatar.title`, the label on AvatarMenu's own trigger. So on a project surface the chain does find something and clicks it, but what opens is the composer's model popover, not Settings. The follow-through step then looked only for `entry-settings-open-details`, which #5517 left unrendered, so the run gave up with a missing `.modal-settings` after three identical attempts. Widen the follow-through to the two rows that actually route to Settings from a project — AvatarMenu's pinned `avatar-open-execution-settings` and the topbar switcher's `inline-model-switcher-open-settings` — so whichever popover the first click opened gets finished. * test(e2e): pin the AMR selection assertion to the agent card With Settings actually opening from a project surface again, the surface-wide `/Open Design/i` in amr-logout-requires-relogin resolves to the sidebar's "Open Design MCP" `settings-nav-item` — which carries no `aria-pressed` — not to the AMR agent card's select button. The looseness was invisible while the surface never opened. Read the toggle through `settings-agent-card-amr` instead, so the assertion names the thing the test is about: AMR stays the selected agent. * test(e2e): prove Settings opened via its section nav, not a heading probe `prepareVisualSettingsDialog` gated on a heading matching /Settings|General|Execution mode/. Now that the surface opens from a project it lands on the execution section, whose heading reads "Models & providers" — and the surface's own <h2> is consumed as its accessible name via aria-labelledby anyway, so the probe could not match in either presentation. Assert `settings-nav-execution` instead, which is what critical-smoke already uses for the same purpose and holds for both the modal and the routed page. * test(web): retire the theme/appearance cases the product cut Product decision (2026-07-28), verbatim: 「主题设置不要了,因为 workspace 功能不 支持暗色主题,要干掉,并且之前用户如果设置了暗色主体,需要强制改成明亮色主题」 So #6156 deleting the `AppearanceSection` render site was the right direction, and the NON-ALIGNMENT #9 note that argued for keeping the segmented control as the product's last "follow system" entry point is formally overturned. These cases are retired because the capability is gone by decision — NOT to turn CI green. The source-side removal (orphaned `AppearanceSection`, onboarding light/dark toggle, `settings.appearance*` keys, `trackSettingsAppearanceClick`, plus forcing stored dark/system back to light for existing users) lands separately on `fix/remove-theme-force-light`. Deleted (8) — their whole subject was theme or the accent it carried: - offers the theme segmented control, and System leaves the document theme unset - applies the stored default accent color even though the picker is gone - writes the picked theme to the document and autosaves it - live previews the configured theme on open, and System leaves no explicit document theme - reverts an unsaved appearance preview back to the saved appearance when the dialog closes - persists System mode explicitly and preserves accent variables without an explicit document theme - keeps a stored non-default accent applied and carries it through an autosave - localizes the theme controls in Chinese Nothing was left behind as a loose "still renders something" assertion, and no live coverage went with them: the close-button/`onClose` path the revert case also touched is already covered at five other call sites in this file. Kept (3) — theme was only the vehicle, the subject is still shipping. Each now rides the notifications completion-sound toggle, seeded on so the single click is a real state change (the pills no-op when clicked in their current state): - reconciles the open settings draft when the parent agent CLI env changes — the only integration proof that `reconcileAmrModelChoice` / `reconcileAmrProfileEnv` actually run through the real draft on autosave; its two siblings are pure unit tests and do not cover that path. - drops a pending autosave when explicit onboarding reset unmounts Settings — subject is the pending-autosave drop and the draft the reset carries. - still autosaves an unrelated edit that lands during a silent-update save — subject is autosave bookkeeping (success must only advance autosaveLastSavedRef for allowSilentUpdates). The enclosing block is renamed 'SettingsDialog draft reconciliation' since it no longer describes appearance, and its document theme/accent teardown is dropped — nothing in it writes those any more. 144/144 green. * test(e2e): realign the visual workspace captures with the narrowed surfaces Three deliberate narrowings shipped without this Playwright lane following, so eight captures were driving UI that no longer renders. All eight are stale fixtures; none was a regression. - `ef9c8cd8b` made the home top-bar `InlineModelSwitcher` `compact`, and `EntryShell` (its only call site) always passes the flag. In compact mode the popover is just the active agent's model radio list plus the route to 設定 → 執行; the mode segmented control, agent grid, account block, and both searchable dropdowns live in the non-compact branches. `68cecac1c` records that product confirmed this narrower shape, so acceptance #40 ("home 页不能 切换 cli 了") is working as designed. - `4e3161751` (#6156) removed the Open Design account row from `AvatarMenu` (plan badge, balance, wallet fallback, upgrade/console links) and retired the nine equivalent Vitest suites — but not these. - `56b538aa4` moved the design-system picker out of the staged-context bar, so `staged-contexts` is no longer unconditionally mounted. Where a surface still ships, the capture follows it and the assertion got sharper rather than looser: staged contexts now stages a real attachment and names the chip; the topbar/avatar captures assert the surviving model picker plus the *inverse* invariant (no account block, no upgrade button, no balance), gated on a counted `vela/status` request so a negative cannot pass by racing the fetch. `:57` additionally pins `inline-model-switcher-mode-daemon` at count 0, so re-mounting the CLI console on Home fails here again. `:167` (topbar BYOK model dropdown) is deleted: in compact mode it would re-capture the identical popover as `:141`, which is a duplicate screenshot rather than coverage. `:141` absorbed its guard. `:244` (avatar reasoning readout) turned out never to have passed — not a #6156 casualty. `VISUAL_CLI_AGENTS`' codex entry declares `models` only, while `AvatarMenu` draws the readout solely for agents reporting `reasoningOptions`, so it has been red since `68cecac1c` authored it. Fixed by declaring `reasoningOptions` on a test-local codex fixture, matching what the real daemon reports (`apps/daemon/src/runtimes/defs/codex.ts:164`). Nothing was dropped without a verified live home elsewhere in the same CI lane or in Vitest: the AMR plan/balance/upgrade card at `visual-settings.test.ts:30`, the searchable dropdowns at `visual-settings.test.ts:93`/`:156`, the upgrade attribution URLs in `InlineModelSwitcher.test.tsx:585` and `AvatarMenu.test.tsx:283`, the "no account row" invariant at `AvatarMenu.test.tsx:528`, and real staged-context chips in `project-management-flows.test.ts`. The one assertion with no surviving home is the Open-Design-first agent ordering, whose grid no longer renders anywhere; that is called out in the test comment rather than silently lost. * test(e2e): give the AMR upgrade capture a billing-capable workspace `settings-agent-card-amr-upgrade` stopped rendering for this capture because `amrCardCanUpgrade` (SettingsDialog.tsx:4651) now also requires `workspaceContext?.permissions?.canManageBilling` — this branch's workspace-scoped billing work, i.e. the feature #6142 exists to ship. The gate is correct; the fixture was not representing anyone entitled to pass it, since `mockSignedInVelaAccount` establishes a Vela session but no workspace context. Stub `/api/workspace/context` with a personal-owner context inline in this one test rather than widening `mockSignedInVelaAccount`, which visual-workspace shares. The assertion is unchanged — the upgrade entry is a real capability for billing-capable members, so the fixture represents one instead of the assertion being relaxed. Verified the stub does not quietly satisfy the three assertions that already passed: `planId: null` keeps `resolvePlanTier` falling through to `plus`, and billing still 404s so the balance stays `$247.51`. Expect one legitimate baseline diff on `visual-settings-open-design-account`: the rail now renders signed-in workspace chrome, which is the only state in which the upgrade entry exists at all. * test(e2e): leave projects through shipping chrome, and reach /projects reliably Two dead locators and one under-budgeted wait, all test-side. `openNewProjectModal` (rail.ts) probed `entry-nav-new-project` then `entry-nav-projects`, both deleted from EntryNavRail by the #5517 redesign (`b55f17169`, `f16075f7e`) — `onNewProject` is still destructured there but has zero call sites. Its body is byte-identical to main, where both testids exist, so main takes the rail path and never reaches the fallback this branch always hits. The live affordance is `designs-new-project` / `designs-empty-new-project` in DesignsTab, inside `entry-view-projects`; `/projects` has no UI entry at all (entry-chrome-flows:373-382 already documents that and routes directly). The fallback then failed for a second reason: `entry-view-projects` does ship (EntryShell.tsx:1579) and `/projects` does route to it, but it was asserted on the 10s default budget right after `waitUntil: 'domcontentloaded'`. `apps/web` mounts `src/App` via `dynamic(..., { ssr: false })`, so domcontentloaded fires while only the boot shell exists — every suite that does this correctly waits out `Loading Open Design…` with `T.long` first. Now routed via `history.pushState` + `popstate` (the client router listens) instead of a full reload, boot shell waited out, and both the view and the create button given `T.long`. `ensureRailOpen` was also called unconditionally, but it ends in a hard `expect(workspace-home-rail-toggle).toBeVisible()` and that testid only renders for `isPinned && active` (WorkspaceTabsBar.tsx:1474-1510) — from inside a project it does not exist, so the helper hard-failed on a control this flow never needed. Now best-effort and gated on `.entry`, kept only so the `visual-new-project-modal` baseline does not churn. `real-daemon-run.test.ts:547` hung on `/back to projects/i`, which matches nothing on a project surface: `AppChromeHeader` owns that aria-label but is no longer mounted anywhere, and ChatPane's top-left slot resolves `onCollapse ?? onBack` while ProjectView passes both, so it is always `chat-collapse-toggle` (deliberate, `884ed1085`). Replaced with a local `leaveProjectForEntry` that clicks the pinned entry tab — the shipping way out — so the isolation journey still leaves through real chrome instead of a URL jump. Dropped `getActionablePoint` with its only consumer. Removing the reload from ~25 call sites across 15 suites was audited against the stub-order-sensitive ones (settings-media-providers, new-project-ds-picker-*, api-empty-response, visual-entry); all install routes before their first navigation. Correcting my own earlier misattribution: `.ws-tab` / `.ws-tab-label` are FileWorkspace's in-project file strip and are fully intact, `role="tab"` and file-name labels included. #6156 rewrote WorkspaceTabsBar, which renders `.workspace-tab` / `.workspace-tab__label` — a different component. Upload→tab is also intact (`FileWorkspace.uploadFiles` still calls `openFile`). Five of those six failures merely routed through the broken helper above; the sixth was the dead back-button. No `.ws-tab` assertion was rewritten. * fix manual edit across workspace pages (#6160) * fix(collab): keep process-local presence alive when the collab transport is off (#6170) `createVelaCliCollabClientFromEnv` returns `null` unless the run opted into the vela-cli collab transport, but `server.ts` wired the presence routes with an object literal of arrow functions closing over that client. A literal is unconditionally truthy, so `registerCollabPresenceRoutes` always saw a `cloud` dependency: its `deps.cloud ?? null` could never resolve to `null`, the process-local `presence.present()` fallback became dead code, and every presence request that reached the cloud branch dereferenced `null` and was answered `502 collab_presence_unavailable`. `POST /api/projects/:id/presence/leave` carries no shared-project precondition, so it failed on any project id in any run without the transport — every stable/prod packaged build (the packaged workspace-team env is gated to the `feature-test`/`test` AMR profiles) and every plain `tools-dev` run. `server.ts` is `@ts-nocheck`, so the null dereference was invisible to `pnpm typecheck`. Route the dependency through `createCollabPresenceCloudClient`, which lives in the checked route module and states the invariant: a `cloud` dependency exists if and only if a transport exists. Removing its guard is now a typecheck error, so the bug class cannot come back at the construction site even while `server.ts` stays unchecked. * fix(web): scope desktop vibrancy to macOS (#6171) * fix(web): remove the theme setting and force every install back to light (#6168) Product removed theme selection: the workspace surfaces shipped for team workspaces have no dark tokens, so dark mode renders a broken app. Deleting the picker is not sufficient on its own. Every install that ever opened it still has `theme: 'dark'` — or `'system'`, which resolves dark on a dark OS — persisted in localStorage, and a stored value does not move when the default does. So the theme is now coerced on READ, at all three points a persisted value can reach the document: - `loadConfig()` funnels `parsed.theme` through `resolveAppTheme()` and marks the config migrated so the coerced value is written back once. - `applyAppearanceToDocument()` stamps `data-theme="light"` unconditionally. The attribute must be PRESENT, not merely non-dark: every dark CSS rule is gated on `html:not([data-theme])` / `html:not([data-theme="light"])`, and every JS theme reader (shiki, ConnectorLogo, SketchEditor, TerminalViewer, connectorBrandColor, MentionNode) falls back to `prefers-color-scheme` only when the attribute is absent. - The pre-hydration inline script in `app/layout.tsx` stamps light before React mounts, outside its try/catch so a throwing storage read still leaves the attribute set. Electron's `themeSource` defaults to `system`, which colours everything the web layer does not own (macOS vibrancy glass, native menus/dialogs) on a dark-mode Mac — including the splash, before the renderer's appearance IPC lands. It is now pinned to light before the first window exists. Removed surfaces: - `AppearanceSection` in SettingsDialog, orphaned by #6156 (zero call sites), together with its `settings-general-block--appearance` styles. Its docblock claimed the control was "deliberately kept … NON-ALIGNMENT #9"; that decision is superseded, so the comment goes with the code. - The onboarding welcome page's sun/moon toggle — the last reachable theme writer — and the `onThemeChange` prop chain behind it (App → EntryView/ProjectView → EntryShell → OnboardingView). - The orphaned theme row in EntrySettingsMenu and its styles. - i18n keys `settings.appearance`, `settings.appearanceHint`, `settings.themeSystem`, `settings.themeLight`, `settings.themeDark` across `types.ts` and all 19 locales. - Analytics `trackSettingsAppearanceClick`, `SettingsAppearanceClickProps`, and the `settings_popover` `appearance` element. `'appearance'` survives only as a legacy settings deep-link token that `normalizeSettingsSection` folds into General, so an old link is not a type error. Red-first: tests/state/force-light-theme.test.ts and tests/components/theme-settings-removed.test.tsx were written against the unmodified branch and went red (11 failing) before any source change. * fix(web): make the update surfaces read real data (#6163) * fix(web): make the update surfaces read real data #6156 (4e3161751) shipped two update surfaces whose every field was invented. `EntryShell` held a private `updateReminderStage` machine keyed on a literal `'1.4.6'` (the app ships 0.16.1), the rocket's confirm ran a 200ms `setInterval` easing a fake bar toward 100% and then wrote "updated" to localStorage, and the cover dialog listed three hardcoded English notes past i18n over a committed 432 KB JPEG. Nothing in that path made a single network, IPC or daemon call — a user who clicked "立即更新" watched a progress ring finish and got no update. Both surfaces now sit on the real machinery that already existed: The cover dialog becomes the post-update highlights surface and REPLACES the bottom-right `WhatsNewPopup` card rather than coexisting with it. Cover art, release headline, bullets and link all come from the hosted highlights document via `/api/whats-new`; the title states the running version from `useAppVersion()` (`/api/version`). It keeps that card's show gate verbatim — once per highlight `id`, only with content, only on the home surface after the app returns on a new version — and its existing analytics (`whats_new_popup` surface-view / click). Its footer is close + open-release; there is no "cancel / update now", because reporting what already shipped is all this surface does. Bullets come from a new `whatsNewNotesFromBody`, which splits the document's `body` per line and strips operator list markers. The rocket keeps its look and becomes the real updater's ready indicator in the bottom-left rail footer, replacing that indicator's arrow glyph. It is gated on the updater's own `shouldShowControl` (installer downloaded and never opened, desktop only) and still drives `openUpdaterInstaller` → `quitAfterUpdaterInstallerOpen` through the untouched panel, watchdog and restart-safety preflight. The progress ring and percent face are gone on purpose: the indicator only exists once the download has finished, so any percentage it drew would be invented. Deleted: `lib/update-reminder.ts`, `UpdateReminderDialog.tsx` and its module CSS, `public/update-reminder-cover.jpg`, the now-dead `entry-updater-menu__button/__glyph/__progress` rules, and the unused `accountNotice` rail slot. The three `updateReminder.*` i18n keys and the orphaned `whatsNew.dismissAria` are replaced by one `whatsNew.updatedTitle` across all 19 locales. A source-level guard (`tests/update-surface-real-data.test.ts`) pins the invariant that outlives the deletion: no quoted `x.y.z` and no `setInterval` in the update surfaces, and the placeholder module and cover art stay gone. * fix(web): name the release-notes destination on the what's-new CTA Product review of the five open calls closed all five; only the CTA copy changes. The button opens the release notes, so it now says so — 「查看更新说明」 in Chinese (product's wording, verbatim), with the other 18 locales aligned on "view the release notes" instead of inheriting the old "see what's new" tease. `whatsNew.cta` had exactly one consumer left (the dialog) once it replaced the bottom-right card, so the key is repurposed in place rather than forked. The other four calls were approved as implemented, and two of them overturn conventions the old comments still asserted, so those comments are synced: - `lib/whats-new.ts` documented the toast's deliberate Escape exemption (Escape hid the card WITHOUT spending the highlight). As a focus-trapping modal that exemption is retired — every close path marks seen — and the docblock now says which paths and why. - `contracts/api/whats-new.ts` described `title` as generic copy, `imageUrl` as an image "beside the copy", `body` as prose, and `linkUrl` as the "See what's new" link. The dialog reads them as headline / top-inset cover / one-bullet-per-line / release-notes link, so each field now documents the role it actually plays. Comment-only; no shape change. * fix(web): never state the placeholder version on the what's-new dialog Review catch (nettee, #6163): `useAppVersion()` reads /api/version at runtime, so it necessarily boots on `APP_VERSION_PLACEHOLDER` and resolves a round-trip later. This dialog rendered as soon as /api/whats-new resolved and printed the hook unconditionally — so a highlights fetch that won that race painted "Open Design 0.0.0 is here" on first frame. An invented version string, on the one surface this PR exists to make truthful. The new suite could not see it because it mocked the hook to an already-resolved value. Fixed by falling back rather than gating the whole render: gating would delay the dialog behind a second round-trip on slow networks, while the highlights document already carries the running version in its `version` field — the daemon stamps it for display (see contracts/api/whats-new.ts), which is what fed the old bottom-right card's eyebrow. So `statedAppVersion()` prefers the resolved hook, falls back to the document, and returns null when neither can name one; on null the dialog waits, because highlights are worth nothing under a headline that lies. The same derived value feeds the title AND every `app_version` prop, so analytics cannot ship the placeholder either. `APP_VERSION_PLACEHOLDER` moves out of ./provider into a new leaf analytics/app-version.ts alongside an `isResolvedAppVersion()` predicate, so a surface that must not PRINT a placeholder can test for it without importing the analytics client. The provider keeps its own use of the constant. Regression tests, red before this commit (`.red-evidence-version-race.txt` reproduces nettee's exact string, `expected 'Open Design 0.0.0 is here…' not to contain '0.0.0'`): the placeholder never paints while /api/version is in flight, it never reaches the surface-view analytics, the title switches to the running version once the hook resolves, and a document with no usable version waits instead of inventing one. The suite's provider mock is now a mutable holder so both sides of the race are reachable. Also caught by this PR's own source guard: quoting the literal in a docblock tripped it, so the comment names the constant instead. * test(e2e): unmask the AMR runtime lane and repair the visual settings/workspace captures (#6174) Three fixture defects, each verified by running the lane rather than reading it. - amr-run-failure-recovery.test.ts was still `mode: 'serial'`. A second `describe.configure({ timeout })` cannot clear it — configure only overwrites the keys it is given — so one failure skipped the eight cases behind it and the lane reported them as "did not run". e2e/AGENTS.md forbids serial groups outright. - configureVisualPage's `**/api/**` catch-all (added by #6126, which is on main) answered `/conversations` with 404. ProjectView mounts ChatPane only once a conversation resolves, and both listConversations and createConversation swallow a non-ok response, so the project opened with no conversation and no error, ChatPane never mounted, and every capture that enters the workspace died on `chat-composer` not existing. Supplies the conversation boundary the catch-all closed without replacing. - The BYOK tab is named "API providers" since #5971 renamed `settings.modeApiMeta`; `getByRole('tab', { name: 'BYOK' })` matched nothing and three captures hung until the test timed out. The topbar BYOK capture also left `[MOCK_AGENT]` installed, contradicting its own "a BYOK config has no local agent" premise: an installed agent wins the popover and renders its model radiogroup instead of the BYOK rows. Co-authored-by: lefarcen <ontf116@gmail.com> * Home shell productization batch: message center, What's-new on release data, update-reminder & updater popup restyle (#6162) * UI polish batch: import-dialog cleanup, settings toast placement, tab chrome fixes - Plugin/skill import dialog: drop per-card icons, left-align card content - Settings page: center the autosave pill under the top nav - Avatar model menu: soften the pinned footer divider - Workspace tabs: pinned entry tab always reads as Home; remove tab-search button and its popover - Model picker: wider row gap in the two-pane browse popover - Community header: unpin (scrolls with content) - New update-reminder dialog assets and strings - Keep entry-settings-button as the signed-out settings entry (e2e contract); align NextStepActions with the navPlugins key rename * Update reminder: simulate in-place download progress instead of linking out The strip's confirm now runs a staged progress state ('updating') with an eased fake download bar, then marks the version updated — replacing the jump to the GitHub releases page. * test(web): retire AvatarMenu account-row suites after the popover simplification The composer popover was reduced to a model picker (2026-07-24): the Open Design account row — plan badge, balance, wallet fallback, upgrade/console links — no longer renders there, so the nine suites asserting that surface (including the workspace-balance and billing-permission gates that landed upstream meanwhile) can no longer pass. Drop them and recast the remaining account-row test as the guard for the new invariant: a signed-in AMR status must render no account UI in the popover. Also drop the stale onClose prop from the new upstream sign-out-confirm test; the rail no longer takes one. * Design-systems toast: anchor to the pane's top edge, pill radius * Update reminder strip: progress ring on the button, percent face While updating, the collapsed strip no longer stacks a label + bar above the rocket button. Progress draws as a brand-green ring hugging the round button's edge (5px band reserved so the button never shifts), and the button face swaps the rocket for the bare percent — 'N%' while downloading, 完成 (updater.done) at 100. The full 正在下载更新 N% label stays reachable via the hover bubble and the ring's aria-label. Demo payload version bumps to 1.4.6 so the once-per-version card re-arms. * Home shell productization batch: message center in the account menu, What's-new on real release data - Message center: entry moves into the account menu under 设置 (bell row); MessageCenter becomes controllable (hideTrigger + open/onOpenChange + onUnreadCountChange) and mounts persistently in EntryNavRail so unread polling survives the hover menu; unread shows as a red dot on the account avatar (and on the menu row); avatars go from squircle clip to 8px rounded squares; panel filter segmented control and mark-all-read go pill-radius. - What's-new: the post-update highlights card now wears the shared release-dialog shell (cover / title / dotted notes / pill footer) while keeping its REAL /api/whats-new data source, show-once-per-id timing, soft-hide Escape/backdrop semantics, and analytics. The demo-payload update-reminder dialog and its simulated download no longer trigger; the stage machine and progress strip stay for the real updater-feed wiring. - Rail chrome: brand logo and the in-rail collapse control are gone — the rail starts at the search box and folding lives in the pinned Home tab's toggle; the signed-out cloud tip bottom inset now matches its sides. - Brand picker (modal variant): side-nav split — search + vertical category nav left, a roomy 2-up borderless gallery right, content flush to the column line with hover fill/ring bleeding past it; logo tiles lose their boxed edge; selected template chip and the composer mode pill share the same selected ring, with the mode glyph optically matched at 13px. - Tab launcher: rows are icon + label only (descriptions dropped) with a rotating four-hue icon palette; the 新建空白页面 entry is paused behind ENABLE_BLANK_PAGE_WORKSPACE_ENTRYPOINT and its PageCreator suites skipIf on the same switch. - Move-to-team confirmations: extracted MoveToTeamConfirmDialog, no backdrop blur (dim only), and the confirm keeps its brand-green label through the mention-home ink-pill restyle in every interaction state. - Publish CTA: hover inverts to ink fill with brand-green icon + label. - Plus assorted in-progress workspace polish (composer, viewer, settings, model icons) riding the same branch iteration. * Restyle the updater ready popup to the update-reminder dialog language Cover art on top (compressed 1296x555 jpg, natural aspect), the orange accent icon tile removed, secondary action as a soft white pill and the install CTA as a black pill with brand-green ink, and a stacked footer so the silent-update checkbox keeps a full-width single line instead of wrapping beside the widened pills. * Signed-out rail: message-center entry under 设置 The signed-out rail has no account menu (where the 消息中心 row lives when signed in), which left the message panel with no opener at all. The rail item carries the unread dot. * Composer row: pin chip glyphs against flex shrink The row-wide min-width: 0 that lets chip labels ellipsize also let SVG glyphs absorb the squeeze — a hard-narrowed pane rendered the design-system palette icon tiny. Chips still shrink; their icons keep natural size. * Bind Community Remix projects to the current workspace Addresses mrcfps' review thread on apps/web/src/App.tsx:3303. Product reproduction: 「通过 remix 后的方案, 不出现在我当前 workspace 里的 草稿了」 — stable repro in a team workspace. `duplicatePluginAsProject` only sends the workspace/member identity headers when its third `workspaceContext` argument is supplied, and the daemon's `authorizeCreatedProjectWorkspace` deliberately reads a COMPLETELY headerless create as a legal legacy/anonymous caller — `bindCreatedProjectToWorkspace` is a no-op for a null context. Both remix call sites this PR adds (App.tsx's standalone /community branch and EntryShell's community tab) omitted the argument, so a remix performed inside a team workspace produced a project bound to no workspace at all and therefore invisible to every workspace view. Same enforceWorkspaceProjectMutation / created-project bypass class as c0bce3b8f, fixed the same way: thread the already-resolved workspace context that both files already hold, through the repo's existing `resolvedWorkspaceContextForWrite` seam so an unresolved or unavailable authority fails closed instead of silently creating an unbound orphan. The second half of the review note — the follow-up `patchProject` whose `null` was ignored — was a consequence of the same root cause: with the project unbound, `enforceWorkspaceResourceMutation` finds no workspace row for the caller's workspace and 403s the pendingPrompt seed, so the template prompt was dropped too. Both requests now share one resolved authority, so they can never disagree about which workspace they are acting in, and a still-null result is reported instead of swallowed (without creating a second project, which is what routing it through the existing catch would do). Red spec first: apps/web/tests/components/community-remix-workspace-binding.test.tsx drives both call sites in a team workspace against a fetch stub that reproduces the daemon's create-then-bind contract. Red before this change (the create carried no workspace headers, the project stayed unbound, and the seed PATCH 403'd), green after. * Cover the refused-prompt-seed branch of the Community Remix fix Second half of mrcfps' review ask on the same thread: prove what the flow does when the follow-up `patchProject` still returns null after the binding fix. The remaining null shapes are genuine transient refusals (daemon down, membership revoked mid-flight, workspace locked between the two requests). By then the copied project is real and bound, so the flow deliberately does NOT fall into its own catch — that path creates a second, prompt-only project and would strand the copy. It keeps the user on the remix and reports the dropped seed. This case pins that: user lands on the remixed project, no second project is created, and the failure is surfaced rather than swallowed. * Re-anchor three style specs on the dogfooded UI `Web workspace tests` went red on this branch because three CSS specs still described the pre-dogfood layout the restyle replaced. Each one is re-pointed at what shipped, keeping the invariant it was written to protect: - `acceptance-visual-fixes` (recvpYDfW12NBu): the preset-thumbnail fix is the resting `scale(1.15)` framing transform, which is intact. Its hover partner went away with the family-wide cover-zoom removal (2026-07-27), so the spec now asserts the framing zoom on both media surfaces and separately locks the hover rules out — re-adding one would resample the covers soft again. - `mention-popover`: the filter strip scrolls on one line instead of wrapping to a second row. The "no clipped labels" half of the contract is unchanged and still asserted (pills hold natural width, labels stay `nowrap`). - `settings-polish`: the updater popup footer stacks the silent-update checkbox above a 50/50 action row. Long en labels must still wrap inside the checkbox column rather than overflow the panel, which the spec keeps checking. * Return message-center focus to the rail opener that owns it `hideTrigger` handed the message-center entry point to the rail but left the component's internal `triggerRef` unattached, so `closePanel()` restored focus to nothing. Opening focuses the portaled dialog, so every close — button, backdrop, Escape, notification-settings — unmounted the focused node and dropped keyboard focus to the document. Both external openers also failed to advertise the dialog they own. `MessageCenter` now takes a `returnFocusRef`: the host that hides the built-in bell owns the duty that button used to serve. `EntryNavRail` points it at a control that is still mounted after the close — the account trigger on the signed-in branch, because the hover menu unmounts the 消息中心 row before the panel opens, and the rail item itself when signed out. Both openers carry `aria-haspopup="dialog"` and the live `aria-expanded`. Red first: `EntryNavRail.message-center-entry.test.tsx` opens from each entry, closes with Escape and with the close button, and asserts focus lands back on the host control. All four cases failed before this change. * Carry the menu popup contract onto the composer quick pills The 插件 / 设计百宝箱 pills open the standalone `role="menu"` popovers in ChatComposer, but they arrived without the contract of the ComposerPlusMenu rows they replaced: no `aria-haspopup` / `aria-expanded`, no Escape handler, and no focus return. Keyboard and screen-reader users could not tell a popup was open, and Escape pressed while focus sat in the plugin search did nothing. The pills live in ChatPane while the popovers live in ChatComposer, so the state is plumbed both ways rather than duplicated: - `onStandalonePanelChange` reports which popover is open, and each pill carries `aria-haspopup="menu"` plus its own `aria-expanded` — the same pair `ComposerPlusMenu` already puts on its trigger. No `aria-controls`: that surface does not use one, and this is not the place to invent a second convention. - `openDesignToolbox` / `openPluginsPanel` take the opening pill as the return-focus target. Both popovers move focus inside themselves, so a dismissal has to hand it back, and the pill is the control the user came from. - Escape closes through a document-level handler, mirroring ComposerPlusMenu's. `dismissStandalonePanels` is deliberately only wired to the dismissal paths (Escape, backdrop). Picking a plugin or an action keeps the plain setters, because those hand focus to the composer input and pulling it back to the pill would fight that. No interaction changes: hover-open, the shared close timer, pill-to-popup pointer travel and every selection path behave exactly as before. Red first: `tests/components/ChatPane.quick-pill-popup-contract.test.tsx` runs both pills through advertise / expand / Escape-from-inside / backdrop-dismiss and asserts focus lands back on the pill. All six cases failed before this change. --------- Co-authored-by: lefarcen <935902669@qq.com> * Converge the visual Design Files prelude instead of clicking once (#6181) `Playwright visual (settings-workspace)` went red on `[P2] captures the settings BYOK surface` with a 10s `aria-selected` timeout: the Design Files tab sat at `false` for all 23 polls with nothing re-clicking it. Seven other captures run this identical prelude and passed, including the two neighbouring BYOK cases. The defect is in the oracle, not the product. `prepareVisualWorkspaceFileList` decided **once** whether to click — one instantaneous `isVisible()` probe of a file row — and then asserted a state nothing retries. Any interleaving where the workspace's own tab reconciliation lands around that single click leaves the assertion permanently unsatisfiable for that attempt, and the lane runs `OD_PLAYWRIGHT_FULLY_PARALLEL=1` with `retries: 0`, so it reports as a hard failure rather than a flake. `activateVisualDesignFilesTab` now converges on the goal state via `toPass`, driving off `aria-selected` directly rather than through the file-row proxy — the guard and the assertion were about different things even though FileWorkspace derives both from one `activeTab === DESIGN_FILES_TAB` expression. Repeat clicks are safe: the tab's handler is `setPersistedActive(DESIGN_FILES_TAB)`, which is idempotent. Why this is not a product regression from #6162: nothing in it touches tab selection, tab persistence, or row visibility. Its only `design-files.css` change deletes the hover cover-zoom, which cannot affect visibility, and a diff of `apps/web/src` for `localStorage|activeTab|openTabs|restoreTab` comes back empty. The lane's one green run before this failure (`4a6653186`, the #6174 repair of the unrelated #5971 BYOK rename) is the whole basis for calling the baseline clean. Scope is the visual lane only — every caller is in `visual.ts` or `visual-*.test.ts`, so the UI P0 lanes are untouched. * fix(web): explain the AMR workspace-scope block instead of a dead send button (#6178) An Open Design Cloud project run requires a resolved personal/team workspace authority (21f452ffe). Failing closed there is correct and stays. Failing closed SILENTLY was the bug: the send button went grey with no reason on screen and no way out, while Home's equivalent dead end (checkAmrBalanceGate -> AmrBalanceDialog reason `signed_out`) hands the user an in-app sign-in. e2e/ui/amr-logout-requires-relogin.test.ts exists to protect exactly that route, which a disabled composer can never reach. Adds a classifier (`amrWorkspaceScopeBlock`) that turns "gate closed" into the remedy that clears it, and a composer-adjacent notice that renders it: signed_out — the same AmrLoginPill action and `chat.amrBalanceGate.signInCta` copy Home's balance gate uses, so one identical action clears it from either surface. unresolved — a re-read of the project's workspace authority, exposed as `ProjectWorkspaceScopeState.revalidate`. An account action would be a guess. The gate itself is untouched: `projectRunWorkspaceScopeReady` never consults the classifier, and the `disabled: true` invariant stays asserted. * test(updater): join the installer-reinstall floor across release and client (#6167) * test(updater): join the installer-reinstall floor across release and client A payload update never replaces the Electron outer shell, so a release whose shell changed can only reach an old install through the installer. The `control.launcher.version.{min,url}` floor is the one mechanism that forces that, and it spans three owners: tools/release resolves the channel policy, the feed carries it, and the desktop updater enforces it against the physically installed outer version. Every side had unit coverage; nothing joined them, so the only place a break in the chain would surface was a release publish. Adds six specs to the already-allowlisted packaged-launcher cross-boundary suite, driving the real release-side resolver into a real feed and then into a real packaged update check: - an outer below the floor takes the installer, not the payload, and the launcher pointer proves nothing was adopted; - the floor is judged by the installed outer rather than the payload it is running (two installs on the same payload, only the stale shell diverted); - an unreadable installed outer fails closed as `outer-version-unreadable` with no installedVersion to render; - a launcher schema beyond this client diverts on the ABI axis alone; - with no floor configured a below-floor outer still swallows the payload, which is why a shell-changing release must set the repo vars deliberately; - a floor above the release version stays refused. Falsifying `remoteRequiresReinstall` to compare against `config.currentVersion` -- the semantics the released 0.15.1/0.16.1 shells actually ship -- turns two of these red, including the unreadable case being mislabelled as below-min. Also pins the floor's operational shape against real channel version formats: a bare stable floor sorts above every same-base `-beta.N`/`-preview.N`/ `-prerelease.N`, so inheriting it into those lanes hard-fails their publish. The specs name that trap and pin the one-explicit-pair-per-lane configuration that avoids it. * test(updater): drive the reinstall floor on Windows too, off the real outer Review (nettee) caught these specs running macOS only: the feed described `platforms.mac`, the payload writer built a `.app`, and the updater config was pinned to arm64/darwin. So `resolveInstalledOuterVersion`'s Windows branch — `dirname(launcherLaunchPath)/resources/open-design-config.json`, a different lookup from the mac bundle path — and the `installer` artifact shape never ran. Since the installs most exposed to a shell/payload mismatch are the oldest ones, leaving Windows uncovered left the half most likely to break unguarded. The specs now run through `describe.each` over a per-platform target table carrying the launch-path shape, outer-config location, installer artifact key, and payload extractor. They also stop using `OD_UPDATE_INSTALLED_VERSION`. That override returns before the platform branch it was supposed to exercise, so it was masking the code under test. Each scenario now materializes a real installed outer package at the real per-platform location and lets the updater read the version off disk — which also makes the unreadable-outer case genuinely unreadable rather than simulated. Falsifying the Windows lookup (collapsing it into the macOS path) fails exactly the two Windows specs that depend on reading a real installed version, while all twelve macOS and publication-policy specs stay green. * fix(web): partition the workspace plan nameplate like the wallet (#6182) A workspace Vela Web shows as 免费 rendered as 专业版 Plus in the client's account menu, while the 额度 row in the same card correctly read $0.00. Money and plan travelled different paths. `GET /api/workspace/billing` returns three independently scoped things, and only two of them are about the workspace: `workspaceBalance` / `workspaceSnapshot` are proven for the exact workspace + member, while `summary` is the caller's VELA ACCOUNT billing (`workspaceId: null` by contract; the daemon reads it with one unscoped `fetchBilling()` regardless of `?workspaceId=`). The rail's plan nameplate read `response.summary` raw, so an account holding a personal Plus reported `plus` in every workspace — a value that cannot change when the workspace changes, because it was never about the workspace. `workspaceBillingSummaryForContext` makes the partition key explicit, the same `workspaceId` + `workspaceMemberId` pair money already uses: - personal workspace — the account IS the scope, summary passes through; - team workspace — plan comes from the context-authorized snapshot, and the account tier may stand in only when it is itself team-namespaced, since a personal tier cannot name a team workspace's plan. That last clause keeps the 飞书 P0 fix intact: B omits planId/billingState for a non-owner and `workspaceSnapshot` is an additive capability, so a team-namespaced account tier is the only surviving evidence that a paying MEMBER's team is subscribed. `useWorkspaceBilling` is now this projection over the ambient context, and EntryShell / SettingsDialog consume it instead of the raw summary. No interaction, layout, or copy changes. * Revert "fix(web): explain the AMR workspace-scope block instead of a dead send button (#6178)" (#6184) This reverts commit ea259eb402. * fix(daemon): resolve an unbound project against the caller's current workspace (#6185) * fix(daemon): resolve an unbound project against the caller's current workspace Every project must resolve to a workspace; when the project itself has no binding, the workspace is the one the caller is currently acting in. There is no other candidate. `GET /api/projects/:id/workspace-scope` read only the persisted `workspace_projects` row and the membership directory — never the request's `x-od-workspace-*` identity — so a project with no row answered `unbound` for every caller forever. `unbound` makes `projectWorkspaceScopeAuthorizesAmr` false, which disabled the chat composer's send button for an Open Design Cloud run on that project permanently, with nothing the user could do to clear it. #6178 wrote user-facing copy for that state instead of fixing it (reverted in #6184). `resolveProjectWorkspaceScopeForCaller` wraps the existing resolver instead of branching inside it, so `resolveProjectWorkspaceScope` stays byte-identical and the bound path is provably untouched. The fallback re-enters that resolver with a synthetic binding naming the caller's own workspace, so the resulting `workspaceMemberId` comes from the membership directory and never from the request header: a caller can only select among workspaces their signed-in identity is genuinely an active member of, and anything the directory cannot confirm degrades back to `unbound` rather than to `unavailable` on a workspace the project was never bound to. Two cases keep today's behavior, both pinned by spec: unavailable — all three of its return sites. A project pinned to workspace X read by a member of Y answers X. The scope carries `workspaceMemberId`, the wallet that pays for the project's runs; resolving to Y would bill Y for X's project. Reachable because `GET /api/projects/:id` has no workspace gate, so a deep link or a workspace switch lands there. no caller identity — signed out, or a plain curl, has no current workspace to fall back to, and inventing one is worse than answering "none". The fallback deliberately does not persist a binding. `reconcileUnboundProjectBeforeMutation` was the preferred shape going in and is wrong here: its own docblock is explicit that a passive read must not hand out ownership just because it ran first, and this endpoint is a GET. Writing a row from it would let whichever workspace opened the project first claim authorship on no user intent, and would race two clients in different workspaces. * fix(web): stop pre-emptively blocking an AMR send that has a wallet An Open Design Cloud run is billed to the CALLER's own wallet, so the only defensible client-side veto is "there is no billing principal at all". The gate instead required THIS PROJECT's workspace scope to resolve, and blocked the send whenever it did not: an unbound project, a membership-directory read that transiently failed (offline / 504 / timeout all collapse into one `ok: false` upstream), a workspace that is billing_past_due or locked, or a team the caller has since left. In every one of those the user is spending their own quota. It is also not the enforcement point. Real enforcement is server-side — the daemon's `WORKSPACE_CONTEXT_REQUIRED` 401 plus vela's own billing check. The client gate could only convert a request the server would have answered into a dead, unexplained button, which is strictly worse than an honest server error. It arrived as 21f452ffe, whose entire message is "fail closed on unresolved workspace authority" with no body and no stated product requirement. `workspaceIdentityCanBillAmr` names the invariant on the identity read, and the gate now admits either witness of a billing principal: that identity, or a project scope that already resolves to an explicit personal/team principal. Strictly a widening — every state it newly admits was previously blocked, and nothing previously admitted becomes blocked. Deliberately NOT treated as "no wallet": loading — the identity read holds no answer yet. Reporting "signed out" on a frame that has not heard back is the bug shape this replaces. failure 'unavailable' — a transient outage taught us nothing about the user. failure 'unsupported' — an old daemon with no workspace endpoint keeps its legal pre-workspace behavior. A genuinely signed-out caller — a settled, authoritative read that came back with no workspace — stays blocked: there is no wallet, so the run cannot be billed and cannot succeed. No UI, no notice, no copy: #6178 wrote copy for this dead end instead of removing it, and #6184 reverts that. This removes the dead end. * fix(web): point every console entry at /dashboard, drop the wallet target (#6165) * fix(web): point every console entry at /dashboard, drop the wallet target Product ruling: there is no wallet page in the console's information architecture any more. Balance, manual top-up and the auto-recharge policy were all rehomed onto the console dashboard (vela #1055), so every entry that used to open `/wallet` now dropped users on a surface the product no longer navigates to. Retargets all of them: - `AMR_CONSOLE_URL` / `DEFAULT_AMR_RECHARGE_URL` and the per-profile console map (prod / test / local) now resolve `/dashboard`, keeping the `?source=open_design` attribution param. - `teamConsoleUrl`'s `billing` section — the team account menu's 「额度 $0.00」 row — is a plain dashboard visit. - `teamConsoleUrl`'s `plans` section, `amrPlansUrlForProfile` and `amrPlansUrlForWorkspace` — the free-tier 「升级」 button and every other Upgrade affordance — send `billing=plan` instead of the wallet page's `view=plans`. - `amrWalletUrlForWorkspace` is renamed `amrConsoleUrlForWorkspace` so the name matches where it now points. `billing=plan` is the console's one state-aware upgrade intent: its dashboard resolves it against the workspace's real subscription state, so a personal owner lands on the personal plan modal — the dialog the console's own 「升级订阅」 hero button opens, which is what product asked the free-tier 「升级」 button to reach — while a team owner still gets checkout or change-plan. The team `upgrade` section keeps sending its more specific `billing=checkout` hint, but that is now only a hint: powerformer/vela#1127 makes the console fall back to the dialog that actually matches, so a stale `hasActivePlan` can no longer strand the user on a bare Overview page (recvpSQKna0LwR). Comments carrying earlier live-verification findings are updated wherever this change invalidated them, rather than left contradicting the code. No new user-facing copy, so no locale changes: the affected labels are all action-named (「充值」/「升级套餐」), never destination-named. * fix(daemon): retire the wallet target in the AMR recharge link too The daemon builds its own recharge URL for AMR balance failures — it lands in the failure message and in `actionUrl`, which the client renders as the chat error card's clickable link — and it still pointed at the console's retired wallet page. Same product ruling as the client-side retarget: balance and manual top-up report on the console dashboard now (vela #1055), so this link has to go there. Every existing assertion in `vela-errors.test.ts` referenced the constant symbolically, so all of them would have kept passing while the link sent users to a surface the product no longer navigates to. Added one that pins the literal, which is the red spec for this change. Also retargets the two e2e assertions that pinned the old destination (`e2e/tests/amr/insufficient-balance.test.ts` on the daemon's emitted URL, `e2e/ui/visual-workspace.test.ts` on the avatar upgrade link's `view=plans`), and the web-side fixtures that mimic the daemon's emitted string so they stop documenting a URL it no longer produces. * chore(release): bump feat/workspace-team to 0.16.2 (#6188) The published beta feed is self-inconsistent: metadata.json carries baseVersion 0.16.1 alongside betaVersion 0.16.2-beta.144, because 0.16.2-beta.144 was published with an explicit release_version override while every manifest on this branch still said 0.16.1. Every subsequent beta build now fails its own consistency check: [release-beta] beta metadata.json baseVersion 0.16.1 does not match betaVersion 0.16.2-beta.144 `force` does not help — it only waives "base must exceed latest stable", not the baseVersion/betaVersion match. Raising the branch's base version to 0.16.2 makes the next beta (0.16.2-beta.145) consistent with its own metadata, and removes the need to pass force at all. Same 18 manifests the release bot touched in 23f9fcaac; test fixtures that mention 0.16.1 as data are left alone, as that commit also left them. Co-authored-by: lefarcen <ontf116@gmail.com> * fix(collab): keep a project's "last changed" time out of sync's hands (#6189) A member who opened the client hours later and pulled a shared project saw 「刚刚更新」 on a project nobody had touched, and the home 最近项目 strip kept rendering the previous workspace's cards for a beat after switching workspaces. Two independent defects, both reported by the product owner on a packaged client. 1. `projects.updated_at` (and the `workspace_projects.updated_at` the project list folds into it with `MAX`) is what the project card shows and what the list sorts by, so it must answer "when did a person last change this project's conversations, files, or name". Sync was answering it too: `materializePulledTeamMirror` carried the origin's timestamp into the project row but not into the binding it wrote in the same transaction, so `MAX` surfaced the pull's own clock on EVERY pull. Four more sync writers had the same shape. `SYNC_KEEPS_UPDATED_AT` names the invariant and the sync paths now either carry the origin's time or keep the row's existing answer. 2. A loaded project list describes exactly one workspace identity, so leaving that workspace invalidates it. The re-list on switch runs in an effect — after the commit — so the browser painted workspace A's cards under workspace B's identity first. The list is now dropped during the render that first observes the new scope, so no frame shows another workspace's projects. No extra request: the refetch already existed and was already keyed on the resolved workspace. Co-authored-by: lefarcen <ontf116@gmail.com> * fix(web): key every workspace read cache on who is asking (#6198) `coalesced-get` and `shared-cancellable-get` are CACHES (1s share window), not just in-flight dedupers, so a key that omits the caller's identity hands the previous workspace's answer to the next one — and an in-flight entry is joined with no window at all. Three reads were keyed on a constant: - `useTeamMembers` — `'workspace-members'`. `GET /api/workspace/members` answers for whichever workspace the DAEMON is active in and reads nothing off the request, so the roster is a per-workspace answer with no per-workspace URL. A leaked roster renders the previous workspace's teammate name on project cards (`RecentProjectsStrip.resolveCreator`). Now keyed on the workspace identity, which also makes the hook re-read on a switch instead of waiting out its 15-60s poll, and a late read for the identity the user left no longer overwrites the newer roster. - `useWorkspaceContext` — `'workspace-context'`. This is the read that ESTABLISHES the identity, so it cannot be keyed on the identity it fetches and has no workspace argument to borrow (the switch is a separate `PUT /api/workspace/active`). It is keyed on the identity GENERATION instead: one token per deliberate identity change, so a single broadcast heard by a dozen mounted consumers still collapses to one request, while two switches inside `forceCoalescedGet`'s 250ms burst window stop being mistaken for one. - `useProjectWorkspaceScope` — `project-workspace-scope:<id>`. The scope carries the `workspaceMemberId` that pays for the project's runs, so a shared key serves one member the wallet of another. The same read also fetched HEADERLESS, which made #6185's daemon fallback unreachable: `GET /api/projects/:id/workspace-scope` resolves an unbound project against the caller's current workspace, but only when the request carries the caller's `x-od-workspace-*` identity. It now sends `workspaceProjectHeaders`, the same set every other workspace-aware project read uses — and waits for the caller's own identity to settle first, so a project open still costs one request instead of a wrong headerless one followed by a corrected one. * fix(collab): carry B's workspace name for personal workspaces too (#6199) B names EVERY workspace, personal included: vela's CurrentWorkspaceContext requires `workspaceName`, derives "«owner»'s workspace" for an unnamed personal one (vela #964), and an owner may rename it outright. The daemon read that field and then threw it away unless the workspace was a team, because the only name on WorkspaceCollabContext was `teamName`. The switcher's collapsed label therefore had nothing real to show for a personal workspace and fell back to a hardcoded English "Personal workspace" until the user opened the dropdown and the separate workspace-directory read landed. Adds `workspaceName` to the context contract and carries it for both workspace types, in the vela mapping and in the directory-item synthesis. `teamName` stays team-only: it is the team switcher's field and doubles as an "is a team" signal, so nothing may start reading it for a personal workspace. The web side consumes the context the shell already holds at startup, so the label is correct on first paint and NO new request is added — the diff adds zero fetch call sites. The dev provider parses `workspaceName` too so the dev/demo lane can drive a personal workspace's label the way B does. Note this is not what the reported screenshot shows: there, B's real name for that workspace IS the literal "Personal workspace", because an in-place team upgrade flips the default workspace's stored type to 'team' and vela's owner-derived naming then no longer applies. That half is upstream. Co-authored-by: lefarcen <ontf116@gmail.com> * fix(web): stop offering 升级 at the top plan tier (team_max) (#6205) A 团队版 Max workspace is the top of the ladder — nothing is above it — but both upgrade entry points still showed 「升级」, and clicking it could only reopen the plan the user already holds. The two surfaces got there two different ways, and neither shared a rule: - The account menu's billing card gated on `billingUpgradeUrl && canManageBilling` — a destination check and a permission check, with no TIER check at all. Every tier saw the button. - The Settings AMR card asked a personal-ladder question (`canUpgradeVelaPlan`) about `amrCardStatus.account.plan` — vela's ACCOUNT-scoped login projection, which reports `free` for a user whose entitlement is held by a team workspace. So a team_max owner measured as "free" and got the button, while the PlanBadge beside it correctly read Max off the workspace-resolved tier. Both now ask one predicate, `canUpgradeFromPlanTier`, about the same resolved tier each surface already LABELS, so the button can never contradict the nameplate next to it. Team and personal tiers are two ladders, so the predicate reads the team-namespaced id whole instead of stripping the prefix and asking a personal question. Per the product ruling — 「个人档位都是要显示可升级的, 最顶的就是团队 max」 — personal `max` keeps the affordance: that user can still move onto a team plan, and vela #1146 deliberately routes their click to the Team upgrade dialog. Only `team_max` loses it. Destination logic (`workspaceUpgradeUrl` / `amrPlansUrl`) is untouched; this only decides whether the affordance renders. No copy, no new i18n keys. * fix(web): keep Send alive after using a community template (#6206) Clicking 「使用」 on a community template seeds the template's own brief into the composer and binds the template as the run's driver. For a template whose `od.inputs` are `required: true` with no `default` -- the real `example-html-ppt-pitch-deck` ships three such fields -- the bind left `active.inputsValid` false, and `submitDisabled` folded that into the send button. The user saw a full prompt next to a permanently dead Send whose tooltip still read "type something to run". Typing did not help: the gate was never about the prompt. Those fields have no input surface on that path. #3645 removed the Home composer's inline plugin-inputs form, and the template's query carries no `{{...}}` placeholders, so prompt -> inputs write-back cannot reach them either. A gate on values the user cannot supply anywhere is a dead end, not a guard. Narrow it to where it is actionable: `requiredInputsAreUserFillable` keeps the gate when the media composer renders the fields as controls, or when the tracked query template actually names the missing field as a `{{placeholder}}` that editing the prompt writes back. A tracked template alone is not enough -- re-applying a plugin without an explicit template derives one from the manifest, placeholders or not, which is the shape a reload lands in. The daemon stays the authority: `validateInputs` still throws MissingInputError. Since the seeded path no longer pre-empts the send, its rejection now reports the fields it rejected instead of a generic "Failed to apply", reusing the existing pre-submit wording. * fix(collab): give every created project a workspace home (#6201) * fix(collab): give every created project a workspace home A project created with no `x-od-workspace-*` headers got no `workspace_projects` row and still returned 200, so nothing surfaced the loss. `GET /api/projects/:id/workspace-scope` then answers `unbound`, which strips the workspace off the run request (`ProjectView`'s `projectRunWorkspaceContext` -> an Open Design Cloud run nothing can bill) and blanks the balance/plan area while that project is open (`AvatarMenu`). The same orphan is also denied its first run outright by `enforceWorkspaceResourceMutation`. Headerless creates are not anonymous callers asserting "no workspace" — they are callers that could not say which workspace they meant: `od project create` and the MCP `create_project` tool mint no headers at all, the web duplicate / design-system-copy / plugin-share paths read a ref that drops the context's `loading` flag, and Orbit + scheduled routines have no request to read headers from. So a create that names no workspace now binds to the one this daemon is signed in to, read through `workspaceContext.lastKnown()` — zero-network, synchronous, no failure mode. A daemon that has resolved no workspace still binds nothing, which keeps `unbound` correct for the signed-out single-player user. Six creation paths were writing no binding at all, not merely skipping it when headerless: the plugin share-project task, Orbit run projects, scheduled routine projects, the library capture-as-page exit, the project-location scan importer, and the `ds-*` project backing a design system's editing workspace. All six now bind. Deliberately unchanged: the collab pull's register-on-pull and shared-project placeholder. Those are a teammate's shared project, whose correct binding is written by `materializePulledTeamMirror` with `visibility: 'team'`; claiming them into the reader's ambient workspace as personal would misattribute someone else's resource. No creation path gains a new failure mode. `createdProjectWorkspaceHome` never refuses — a partial or denied header identity degrades to the ambient workspace rather than turning a working 200 into a 4xx. On the web side `createPluginShareProject` was the one create in `state/projects.ts` with no `workspaceContext` parameter at all, so it sent no workspace identity ever. It now forwards the context when known, best-effort — deliberately not `resolvedWorkspaceContextForWrite`, which throws while the identity read is in flight and would add a new block to a path that works today. * fix(collab): verify an asserted workspace before persisting it `createdProjectWorkspaceHome` resolved a created project's workspace with `resolveCreatedProjectWorkspace`, which only PARSES headers. It trusted the caller-provided member status and permissions and never checked that the workspace/member pair exists in the membership directory or agrees with the daemon's last-known state. `x-od-workspace-*` headers are an unauthenticated hint, so any local caller — the `od` CLI, a plain curl, a compromised page — could assert an arbitrary pair and get a project bound to a workspace it has no membership in, with a fabricated `createdByWorkspaceMemberId`. "Do not fail the create" and "trust unverified input" are not the same constraint. The helper now VERIFIES, then DEGRADES — never rejects, never trusts: 1. asserted identity that verifies -> bind to it 2. asserted identity that does NOT -> bind to the daemon's ambient verify, including an unreadable workspace instead, or leave authority ("cannot confirm") the project unbound 3. nothing asserted -> ambient, as before Creation still never answers 4xx, so the six previously-never-bound paths keep binding and a signed-out daemon still creates usable local projects. An unverifiable claim is simply never written as fact. Verification is not re-implemented. It is `authorizeCreatedProjectWorkspace` — the same directory lookup `POST /api/projects` gates on, which also returns the DIRECTORY's authoritative context rather than the caller's claimed one — plus `withLastKnownMembership`, the same cross-check the mutation gates apply (now exported rather than copied). Only the failure behavior differs: they refuse, this degrades. An absent directory fetcher remains `authorizeCreatedProjectWorkspace`'s own documented local/dev compatibility path, not a second weaker definition of verified. Route modules now take one `CreatedProjectWorkspaceResolver` dep instead of re-threading the three authorities, so there is a single notion of "verified" per daemon. * test(daemon): drive brand routes through the created-project workspace resolver The brand harness constructed `registerBrandRoutes` without the new `resolveCreatedProjectHome` seam, so the binding became a no-op and "binds a freshly extracted brand project into the caller's ACTIVE team workspace" went red. Inject the same production resolver `server.ts` builds, in its no-directory (local/dev) configuration, so the test keeps asserting the product behavior through the real seam instead of a header-trusting shortcut. --------- Co-authored-by: lefarcen <ontf116@gmail.com> * fix(web): move the update-ready rocket above the rail account row (#6208) * fix(web): move the update-ready rocket onto the rail account row #5517 removed the entry topbar and parked the updater host in the rail footer, which put the green rocket on its own line UNDERNEATH the account row — bottom-left, detached from the identity it belongs to. Product reported it from a real client: the rocket belongs at the right edge of the name + plan wordmark line. Move the mount instead of nudging it with CSS: the rail now owns the updater host through an `updaterSlot` prop and renders it inside the account row (`.entry-nav-rail__account-row`), as a SIBLING of the account trigger so it never steals the account-menu click target. The rail footer stays as the fallback home for the signed-out shell, which has no account row to ride, so the rocket's appearance conditions are unchanged. Same change also un-clips the 「更新已就绪」 prompt. The host is pinned to the bottom of the rail, so a `top: 0` panel grew downward off the bottom of the window and the copy was cut off mid-sentence. Anchor its BOTTOM edge to the host instead, the same way `.entry-help-popover` already does for the same reason. Side effect worth having: the rail no longer grows a 52px footer strip the moment an update lands, so the account row stops jumping. * fix(web): put the rocket ABOVE the account row, right-aligned Placement correction. 「放到名字啥的上面的右侧」 was read as "on the name row, right side"; product clarified 「应该是在名字那个横条的上方,靠右对齐」 — the rocket gets its own right-aligned strip ABOVE the identity row, not a slot inside it. The strip (`.entry-nav-rail__account-updater`) is mounted unconditionally so it stays the account trigger's immediately-preceding sibling, and carries `:empty { display: none }` so an idle rail reserves no height for it. That rule is load-bearing: without it every user without a pending update would get a blank 34px row plus the container's 6px gap pushing the account area up — a worse regression than the placement it fixes. Measured in a real browser at 1280x900: the account trigger sits at y 850-884 in BOTH states, so nothing shifts. Everything else from the first commit stands: the rail owning the host via `updaterSlot` instead of an opaque `footerExtra`, the sibling-not-child relationship to the trigger (now moot in the best way — a strip above the row cannot be button-in-button), the `bottom: 0` panel anchoring that un-clips 「更新已就绪」, and the footer fallback for the signed-out shell. * fix(web): stop the home model list offering picks the chip cannot honor (#6209) On the Home composer, clicking a model in the chip's compact list did nothing — the chip kept showing the previous model. The compact list rendered `currentAgent.models` raw, so a model above the caller's plan (`enabled: false`, straight from `vela model list --json`) appeared as an ordinary selectable row. Clicking it wrote the pick to config, `normalizeAgentModelChoice` reported the plan fallback instead, and the re-normalization effect in `InlineModelSwitcher` persisted that fallback — so the chip snapped back with no explanation, and the user's previous pick was overwritten by the default in the process. The sibling surface (`AvatarMenu`, the project composer's model list) had already hand-rolled `agent.id === 'amr' && model.enabled === false` for this. Copying the rule per surface is what let the newest list drop it, so this introduces one definition instead: `agentModelIsSelectable`, defined to be at least as strict as `normalizeAgentModelChoice` (pinned by a test) so a gated row can never be a pick the config would revert. Both surfaces now ask it, and every model write inside `InlineModelSwitcher` — the compact list and the execution-settings picker — goes through a single `applyAgentModel` sink that asks the same question, leaving no second path for a future list to bypass. Locked rows now read as locked: dimmed, `aria-disabled`, a lock glyph, the existing `settings.amrModelUpgradeHint` reason, sorted below the available models, and a click routes to the plans page instead of silently doing nothing. * fix(collab): verify the asserted workspace before claiming an orphan project (#6213) * fix(collab): verify the asserted workspace before claiming an orphan project `reconcileUnboundProjectBeforeMutation` claims a project this daemon has never bound to ANY workspace into the current mutating request's workspace, so a true orphan is not denied its first mutation by `enforceWorkspaceResourceMutation`'s `!row -> false` rule (recvqbhor3pai2). It resolved that workspace from `workspaceProjectContextFromRequest(req)` — header PARSING with no authority check — and stamped `createdByWorkspaceMemberId: ctx.workspaceMemberId` from the same headers. `x-od-workspace-*` is an unauthenticated hint any local caller can forge, so a plain curl could claim someone else's orphaned project into a workspace it has no membership in AND install itself as the author. Authorship is the dangerous half: `workspaceResourceAccess` derives `selfCreated` from it, and that bit is what grants a non-privileged member mutation rights over the row. Both the workspace and the authorship now come from `resolveCreatedProjectHome` — the same verify-then-degrade resolver #6201 introduced for created projects: - asserted identity VERIFIES against the membership directory -> claim it, attributed to the DIRECTORY's member id, not the header's; - it does NOT verify (foreign, inactive, permissions disagree, last-known says removed, or the authority is unreadable so it cannot be confirmed) -> claim the daemon's own ambient workspace instead, attributed to that verified session's member id; - neither available -> write nothing, and let the pre-existing gate answer. The `null`/`'missing'` early return is unchanged and load-bearing, which is why this does not reuse `createdProjectWorkspaceHome`'s own third branch: the mutation gate's HEADERLESS branch answers 401 as soon as any row exists for the resource, so claiming on a request that asserts nothing would convert a working headerless mutation into a 401. A verified caller is unaffected — `workspace-projects.test.ts`'s recvqbhor3pai2 regression case still passes unchanged. A caller that cannot prove membership over a never-claimed project is now refused by that pre-existing gate instead of being let through on a binding it had just invented for itself; #6201's e2e case is updated to assert the persisted binding rather than the mutation's status, since both outcomes satisfy the property it pins. * fix(collab): persist only an asserted-and-confirmed workspace on an orphan Review follow-up (mrcfps). `resolveCreatedProjectHome` is not a pure verifier: by contract a foreign, inactive, removed, or unconfirmable assertion degrades to `workspaceContext.lastKnown()`. Reconciliation then persisted that ambient context onto a PRE-EXISTING orphan before the mutation gate had rejected the asserted caller — and the `getWorkspaceProjectByProjectId` guard one line above makes that write sticky, so the rightful verified workspace could never reconcile it afterwards. A forged request, or a legitimate one during an authority outage after the active workspace changed, would permanently mis-file the project. Creation and reconciliation are not the same risk, which is the distinction the original patch missed. Putting a BRAND-NEW project in the ambient workspace takes nothing from anyone — that is #6201 and it stays. Putting an EXISTING orphan there may take it from the workspace it actually belongs to. So a degraded ambient authority is persisted only when it names the very pair that was asserted. Verified assertions resolve to the asserted pair by construction (the directory lookup is keyed on it), so they are unaffected; outage continuity still works for the ordinary legitimate caller, whose client took its headers from this same daemon and therefore agrees with it; a mismatch writes nothing at all. Not in tension with 「所有 project 都应该能找到 workspace」: the display-side fallback (#6185) already renders an unbound project inside the caller's current workspace, so nothing reads as "unknown". The binding row is a separate, durable fact and stays conservative. Adds the fixture-matrix case the review asked for — a populated but DIFFERENT ambient workspace, asserting the orphan stays unbound. The mock authority's `/current` is now flippable so the fixture can create a true orphan while ambient is absent and then populate ambient deterministically through `GET /api/workspace/context`, rather than depending on a poll tick. --------- Co-authored-by: lefarcen <ontf116@gmail.com> * fix(web): use neutral Windows app background (#6218) * fix(collab): let a headerless caller mutate its own daemon's project (#6216) * fix(collab): let a headerless caller mutate its own daemon's project `enforceWorkspaceResourceMutation`'s headerless branch answered 401 WORKSPACE_CONTEXT_REQUIRED as soon as ANY `workspace_projects` row existed for the resource. That was survivable while headerless creates left projects unbound. #6201 made every created project get a workspace home, so the two rules combined into a project its own creator cannot touch: od project create -> 200, and now writes a binding od project duplicate -> 401 The `od` CLI never sends `x-od-workspace-*` — only `od workspace …` builds those headers — so this is not an edge case for it. It is every CLI mutation of every project the CLI created, which breaks the embeddability contract `AGENTS.md` makes the CLI responsible for. Reproduced end to end through the real binary against a daemon-only process (`od daemon start --headless`, no web, no browser). INVARIANT, now named in `headerlessMutationAllowed`: every mutation resolves to a workspace identity. A request that ASSERTS one is judged on that assertion; a request that asserts NOTHING is the local daemon's own signed-in user and is judged as that identity. Being unable to name a workspace is not the same as having no standing in one — the same "nothing asserted -> ambient" fallback the create path already applies, so the gate and the creation paths finally agree about what a headerless caller is. Verified the ambient identity is available without any UI: a daemon-only process resolves it from the vela session on disk, and `GET /api/workspace/context` answers fully in that state. The `ambientWorkspaceId` in `collab/workspace-hub-subscriptions.ts` is unrelated — it is SSE subscription bookkeeping fed from the disk-persisted selection store, not an authorization input. Deliberately NOT weakened: `authorizeCreatedProjectWorkspace` still refuses to let ambient stand in for an explicitly CLAIMED pair, and `resolveProjectWorkspaceScope` still resolves a persisted binding without consulting ambient. Both govern cases where something WAS asserted; headerless is the third case. What stays refused, because the original branch protected something real (recvqbeDjAsejl / recvqbklNGDqYY, spec 04 §10): a resource bound to a workspace the daemon is not currently in; a resource the daemon's own identity may not mutate anyway (the same `workspaceResourceMutationAllowed` computation runs); and everything when the daemon has no signed-in identity to resolve. With no ambient wired the branch is byte-identical to before. The ambient snapshot type moves down into `collab/workspace-resource-mutation.ts` so the gate and the creation paths cannot drift into two notions of "the daemon's own workspace"; `created-project-workspace.ts` re-exports it and now reuses the shared context builder instead of its own copy. * test(e2e): pin that signed out, visible equals unbound equals mutable 「未登录也可以用自己 cli 修改未登录态下的那些 project, 这个一定要保证, 不然就是 P0 事故」 A signed-out client can only SEE unbound projects: the no-scope catalog (`routes/project/index.ts:2432-2443`) reads no `x-od-workspace-*` at all and joins through `listUnboundProjects`, so a project any workspace has claimed never leaks to a caller with no identity to check it against (spec 04 §10). This pins the other half of that set — everything visible while signed out stays WRITABLE. The case runs against a daemon with NO vela session at all, not merely a request without headers, creates its draft in that same signed-out state (the real user sequence), asserts the draft is listed by the no-scope catalog, then renames it, duplicates it, and duplicates it again through the real `od` binary. It holds only because `headerlessMutationAllowed` short-circuits on "no row anywhere" BEFORE it asks for an ambient identity, so it is mutation-tested against that ordering rather than written red-first: moving the short-circuit after the ambient check turns it red with `expected 401 to be 200`. * fix(collab): make the delete side effect use the gate's own context Review follow-up (mrcfps). Allowing a headerless caller to mutate a project the daemon's own identity owns made a latent inconsistency reachable: `DELETE /api/projects/:id` re-derived its context with `workspaceProjectContextFromRequest(req)`, which is null for a headerless caller, so `requestTeamVisibility(..., 'personal')` was skipped while `dbDeleteProject` still ran. The owner's local row and directory disappeared and the hub kept serving the resource, so teammates went on seeing a project that no longer existed — a cross-client data-consistency bug, worse than the 401 this branch set out to fix. Threading the context, not narrowing the capability: `effectiveWorkspaceProjectContext` names the identity a mutation actually acts under — asserted when the request carries one, ambient when it does not — and its docblock states the invariant that any SIDE EFFECT must read from it rather than re-deriving from headers, or the effect disagrees with the gate that permitted it. The delete now uses it. The no-context case becomes a refusal rather than a silent skip. It is unreachable while the gate is intact (a team-bound row is admitted only for an asserted identity or a matching ambient one), but falling through is what produced a local-only delete of a still-shared project, so a future gate change must not be able to reintroduce it quietly. Audited every other capability this branch newly admits for a headerless caller. Delete was the only one: `/move` and both share/unshare routes each guard with their own `if (!ctx) return sendMissingWorkspaceContext(res)` so headerless never reaches their hub work, and the upload route's `workspaceProjectContextFromRequest(req) !== null` only shapes a 404 for a missing project. Rename/duplicate/writeFiles/comment have no hub side effect. Adds the requested route regression to `tests/routes/project-delete-unshares-team-share.test.ts`: real route, real collab runtime, mutable fake hub, no request headers, `workspaceContext.lastKnown()` populated — asserting the unpublish and catalog removal happened and the project is gone locally only after. Plus the other half: with no ambient identity either, the delete is refused and nothing is destroyed. Mutation-tested — restoring the header re-derivation turns the first red with "expected 0 to be greater than 0". --------- Co-authored-by: lefarcen <ontf116@gmail.com> * fix(web): draw the team wordmark for every tier of a team plan (#6219) The account row of a team workspace showed the PERSONAL Plus wordmark. Product ruling: 「团队版的订阅，这里应该都显示 team 的标识」…「产品期望团队从 free 到 max，徽标都显示 team 的那个，个人的还是维持现状不要动」. The badge names the plan FAMILY, not the tier inside it, and it got that wrong from both ends. `planBadgeTierForLabel` asked `plus` / `pro` / `max` BEFORE `team`, and B namespaces team ids by EMBEDDING the personal tier word — so `team_plus` matched `plus` and the `team` branch was reachable only from a bare `team` id, the one team tier that happened to work. The free team tier missed from the other side: B reports an unsubscribed workspace with a null `planId` and an empty `membershipTier`, an id no different from a personal free account, so no id can name it. `planBadgeTierForWorkspace` states the whole rule once, and both surfaces read it — the rail's account row and the Settings CLI card, which the owner requires to move together (「设置中的这里应该一样的逻辑」). Team-namespaced ids go through the shared `isTeamPlanTier`, so the badge cannot drift from the other team gates; `workspaceType === 'team'` covers the free tier that no id can express. The plan LABEL is untouched, deliberately: it answers a subscription question, every user-created workspace in B is team-typed, and reading one as the other is #146. 免费 beside the `team` wordmark is now the intended pairing — the family is team, the subscription is not paid. No interaction, layout, sizing, artwork, or copy changes; no new i18n keys. * fix(collab): warm the workspace-scoped digest faces on switch and reconnect (#6222) Every workspace-scoped cache in the daemon keys on the active workspace, so the instant the user switches, `catalog` and `members` are both a miss and the FIRST consumer in the new workspace refills them inline on its own request path (`createPersistentSyncCache` fetches synchronously on a miss). The cost is the same either way; the only question is who waits for it. A switch is a user action followed by idle time, so paying it there is free — paying it inside the first project load or agent run is not. `PUT /api/workspace/active` now announces a CONFIRMED switch through a new fire-and-forget `onWorkspaceSwitched` seam, and the daemon warms the two faces from it. The announcement deliberately does not fire for a rejected or rolled-back switch: warming there would refill the caches against a workspace this daemon just refused to move to. Warming goes through the cache functions, never their underlying fetchers. `createSwrCache`'s read returns `entry.inflight ?? refresh(key)`, so a warm that races the very consumer it is protecting joins that consumer's request instead of issuing a second one. No request is added that would not otherwise be made. Second half, same root cause: on hub reconnect the gap-closing catch-up read the team-project and member lists THROUGH those same caches, so an entry that settled just before (or during) the disconnect still counted as fresh, the diff concluded "nothing changed", and the one cycle meant to close the gap emitted nothing — the client stayed stale until an unrelated read happened to miss. Reconnect now drops those two entries first, and `pollOnce` joins the in-flight refresh that starts, so the pair still costs one fetch per face. Co-authored-by: lefarcen <ontf116@gmail.com> * fix(daemon): split AMR workspace proof failure from proof refusal (#6221) An AMR run died in preflight with "its persisted workspace <id> is unavailable for the signed-in member". Two causally unrelated situations shared that one error and one outcome: a directory that answered and genuinely listed no active membership, and a directory that could not be read at all. The `.catch` swallowed a read failure into `{ ok: false, items: [] }`, so a transient vela blip made a user's own project unrunnable — and nothing downstream could tell the two apart. Refusal now fails closed under `ProjectWorkspaceScopeRefusedError` (`PROJECT_WORKSPACE_SCOPE_REFUSED`); an unreadable directory is retried with bounded backoff and, if it still cannot be reached, the run proceeds with no workspace, i.e. on the caller's own account wallet. That is a product decision recorded in the docblock: a hard failure is worse than a mis-attributed personal charge. The reverse direction, charging a personal run to a team wallet, stays impossible — no fallback selects another workspace, and a proven non-membership still refuses. The decision was also invisible: a full diagnostics export carried no directory-fetch line, no run-id in the daemon log, and only a generic AGENT_EXECUTION_FAILED plus prose. Every branch now reports a closed-union outcome to the daemon log, the run record (via `ApiError.details`, leaving the wire error code unchanged) and telemetry. * fix(comments): preserve rejected mutations * fix(comments): preserve partial send results * fix(web): keep workspace-scoped data fresh across account and workspace changes (#6225) * fix(web): keep workspace-scoped data fresh across account and workspace changes Three defects in one family — workspace-scoped data in the web client going stale or being read under the wrong identity. 1. The workspace switcher's module-level directory cache had no invalidation. `/api/workspace/directory` answers "which workspaces can the SIGNED-IN ACCOUNT see", but nothing cleared the cache on an account change and `resetWorkspaceDirectoryCache` had no production caller — so signing in as a different account kept the previous account's workspace names on screen, and kept them confidently, since a non-empty cache also suppresses the loading state. The cache is now served only to an identity that can claim it, by membership id, which keeps the flash-free reopen it exists for. The `coalescedGet` key is identity-scoped for the same reason. 2. App.tsx read `/api/skills` without the caller's workspace headers and never refetched on a workspace switch. The daemon is fail-closed on a missing `x-od-workspace-id`, so a headerless read is not the unfiltered list — it is the list with every workspace-claimed skill removed, including the ones claimed by the workspace the user is in. Skills now get the identity headers and the same workspace-keyed refresh design systems already had. Launch still spends exactly one `/api/skills` request: the read moved from the boot pass to the workspace-keyed effect rather than being added alongside it. 3. `PUT /api/workspace/active` already returns the post-switch context, from the same producer `GET /api/workspace/context` serves and only after the daemon agrees the switch happened. The client parsed that body, discarded it, and made every consumer re-read the same data. The shell is now seeded from the response; the refresh broadcast still fires, because `useProjectWorkspaceScope` listens to it and passive tabs cannot be seeded. Switch path: 2 requests -> 1. * fix(web): discard workspace-scoped reads that land after the identity moved Review follow-up on #6225 (PerishCode, two threads — both real). Keying a read by identity stops the wrong identity being SERVED a cached answer. It does nothing about the other direction: a read issued for identity A resolves later, and by then the caller may be identity B. Committing that late answer restores A's data under B — the same staleness this PR removes, arriving through the back door. A workspace switch is precisely when one read is in flight and another starts, so reverse-order completion is reachable, not exotic. Both sites now use one mechanism, `beginWorkspaceScopedRead`: capture the identity the read is issued FOR, request with that captured context, and compare against a ref before any commit. Its docblock states the invariant and the two rules that make it hold (request with the captured context so request and guard cannot disagree; compare against a ref, never a closed-over prop, which would always match and guard nothing). It is the cross-component form of the `requestEpochRef` ordering guard `useWorkspaceContext` already applies to its own read. - `refreshSkills` and `handleSkillsChanged` (App.tsx): a slow read for the workspace the user left no longer overwrites the current catalog. The registry-ready gate is intentionally skipped on a discarded response — it is not an answer about the current identity, and the newer read marks it. - `loadWorkspaceDirectory` (EntryNavRail.tsx): an in-flight account-A read that lands after the rail moved to account B no longer repopulates either the module cache or the visible list. This was the sharper of the two, because it wrote into module scope and so persisted past the render that caused it. Request counts are unchanged (startup 4, switch 1): the guard discards responses, it does not issue requests. * fix(web): make computing a workspace identity total, and key the skills trigger on it Fixes the `Web workspace tests` failure 886f11b24 introduced. CI reported all 555 files and 5583 tests PASSING and still exited 1: Unhandled Rejection TypeError: Cannot read properties of undefined (reading 'canShareProjects') ❯ workspaceIdentityCacheKey src/collab/useWorkspaceContext.ts:112:32 ❯ beginWorkspaceScopedRead src/collab/useWorkspaceContext.ts:159:20 ❯ src/App.tsx:1770 ❯ src/App.tsx:1799 ❯ commitHookEffectListMount originating in tests/components/App.amr-plan-tier.test.tsx `workspaceIdentityCacheKey` dereferenced `context.permissions` unguarded. That survived while it was only called during render (a throw there fails loudly, in the right place) and inside `fetchSkills`'s own try/catch. 886f11b24 put it behind `beginWorkspaceScopedRead` in an async function launched with `void refreshSkills()`, so a partial context turned a synchronous programming error into an unhandled rejection — invisible to every assertion, fatal to the process. `permissions` is required on the contract, but API JSON reaches these objects through an unchecked cast, so a partial context is reachable at runtime and not only in fixtures. Computing an identity must therefore be TOTAL: a partial context is its own cache partition, never an exception. Second, independent defect, found while fixing the first: the skills trigger was keyed on `workspaceId` while the commit guard compares the full identity digest. A guard that discards without guaranteeing a successor is worse than the staleness it replaced — two accounts in one shared team workspace differ only by membership, so account A's pending read would be discarded for B while the unchanged workspace id suppressed B's replacement read, leaving the functional registry loading forever. The trigger now uses the same digest the guard compares, so every transition that invalidates a response also starts its successor. Both are covered by tests that go red without the fix: - tests/collab/workspace-identity-key-is-total.test.ts (new) — identity is total for null, partial and complete contexts, including a late commit-time guard. - tests/components/App.skills-workspace-scope.test.tsx — a member-id-only change must start AND complete a successor read. --------- Co-authored-by: lefarcen <ontf116@gmail.com> * feat(landing): publish current pricing snapshot * fix: durably deliver enterprise leads * test(web): update ProjectView comment-status suites to the workspace-scoped signature (#6233) `feat/workspace-team`'s `Web workspace tests` lane is red at the branch tip: 3 files / 4 tests, all comment-status assertions. Not a flake and not attributable to any open PR — I had to prove twice while landing #6225 that a red lane was inherited rather than mine, which is the cost a red base imposes on every downstream PR. Cause: `1c15574c2 fix(comments): preserve rejected mutations` gave `patchPreviewCommentStatus` a fifth argument — the acting workspace context — so the daemon can authorize the mutation (`routes/project/comments.ts`, same commit). It updated `FileViewer.test.tsx` and added `registry.test.ts` coverage but left three `ProjectView.*` suites on the four-argument signature. The tests were stale, not the code. Checked before editing, because "update the tests" is the wrong move if the assertions were right: - Every asserted call still happens, unchanged. The failures are pure arity mismatches: `api-empty-response` expects `(…, 'failed')` and receives `(…, 'failed', null)`; likewise `needs_review` in run-cleanup and `applying` in run-isolation. No status transition changed. - `1c15574c2` shipped the new contract WITH tests — `describe('preview comment scoped mutations')` asserting `x-od-workspace-id` reaches the PATCH. The fifth argument is deliberate and covered. - The parameter is optional and additive; headers are spread only when a context is present. Also restores two assertions that had gone silently vacuous. A four-argument matcher cannot match a five-argument call, so `run-isolation`'s two `not.toHaveBeenCalledWith` assertions could never match once the signature grew and passed unconditionally — coverage actively lost, not merely failing. Both pass with the correct arity, which independently confirms the new code does not write `needs_review` after a canceled+done run and does not reset a queued send's own comment to `open`. The fifth argument is matched as an explicit `null` rather than `expect.anything()`, which rejects null/undefined and would have re-broken the positive assertions and re-vacuated the negative ones. Tests only — no source file is touched. Co-authored-by: lefarcen <ontf116@gmail.com> * fix(collab): make the local pin the only workspace-selection truth (#6230) * test(collab): pin the one-account-two-clients workspace scope behaviour Executable evidence for the account-level Active Workspace investigation. Models vela exactly as its source behaves at origin/main 2155a969f: - active_workspace_selections is keyed by app_user_id alone (db/schema/public.hcl:792), so an account has exactly ONE selection. - GET /api/v1/workspaces/current discards a ?workspaceId= hint (services/api/src/workspaces/routes.ts:166-176, and vela asserts it by name in services/api/test/workspaces-personal.test.ts:480). - GET /api/v1/workspaces is scoped by app_user_id, not by the selection. What it establishes: OD's local pin DOES hold against a competing client (resolvePinnedWorkspace), so the switch does not 404. The damage is that the losing client's context degrades to a directory synthesis - planId null and a 0/0 seat summary, which derives isSeatFull: true - and its context read gains a second, fallible round-trip the winning client never makes. No behaviour change. * fix(collab): make the local pin the only workspace-selection truth Picking a workspace is a local action, but `PUT /api/workspace/active` gated it on mutating ACCOUNT-scoped state in vela: it PUT the account-level active workspace first and failed the user's click with 502 `workspace_switch_rejected` when that write did not take, then rolled back both the local pin and the backend switch if the follow-up context read disagreed. That backend row is keyed by app user alone, so it can only ever name ONE workspace for an account. One account routinely runs several clients in different workspaces, so every switch yanked the other clients' server-side scope, and whichever client did not write the row last was answered for the wrong workspace — forcing OD to synthesize its context from the membership directory, which carries no billing plane. That client saw planId null and a 0/0 seat summary, and a 0/0 summary derives isSeatFull: true, so a workspace with free seats read as FULL and blocked inviting. It also turned that client's context read into two round-trips, the second of which could blip and leave it with no context at all. vela #1179 (1ba3eebcb, deployed to test 09:57Z) taught `GET /api/v1/workspaces/current` to honour `x-vela-workspace-id`, the per-request workspace scope vela already accepted on its resource plane, billing scope routes and the Link gateway. So: - `fetchCurrent` sends that header and drops the `?workspaceId=` query param, which vela ignores by design and asserts it ignores — it only ever made this call look scoped. - `PUT /api/workspace/active` no longer calls vela. The membership directory it already reads is the authorization; once that confirms an active membership the switch cannot fail, so the 502 gate and the rollback are gone along with `selectWorkspace` and `putCurrentWorkspace`. - An unconfirmed context read is no longer treated as a refusal: the route answers from the directory entry it already validated instead of reverting the user's choice, mirroring the invariant `resolvePinnedWorkspace` already follows in the same module. Verified against the deployed test backend, GETs only: an explicit workspace returns that workspace (not the account row), a workspace the caller is not a member of is refused 404 `workspace_member_required`, and both an absent and a blank header keep the previous account-level behaviour. The URL query hint is still ignored. vela's `active_workspace_selections` table and its write path are left alone; deprecating it is a separate decision and #1179 kept omitting the header backward compatible. Two comments that asserted the now-false invariant are corrected. * fix(collab): never answer a switch with a workspace the pin no longer holds Review catch (mrcfps): `workspaceContext.current()` is not a passive read. The vela provider's `resolvePinnedWorkspace` does its OWN fresh directory lookup and, when that confirms the pinned workspace is gone, clears the pin and re-pins a recovery workspace so a removed member is not locked out of everything. The route's directory read can meanwhile have been served from its 5s cache and still list that workspace. The previous branch state read `context.workspaceId !== workspaceId` and treated the provider's recovery as a merely-unconfirmed read, synthesized the stale cached entry, and returned 200 claiming the requested workspace while `activeWorkspace.get()` had already become the fallback. That shipped this PR's own thesis — the local pin is the only selection truth — as a violable invariant, and the user-visible symptom is the switch appearing to succeed and then snapping back on the next context poll. The pin is now re-read AFTER `current()` resolves. If the provider moved it, the route reports `404 workspace_no_longer_available` for the workspace the user asked for, never claims it, and does not warm its caches. The recovery pin is deliberately left in place: reverting it would restore the very "signed out of every workspace" state it exists to prevent. The directory entry that authorizes the switch is also now required to be a LIVE membership (`memberStatus === 'active'`, lifecycle not deleted) — the same predicate the provider uses. Matching on id alone let a listed-but- removed membership authorize a switch AND get synthesized into the response. Tests wire the real provider against the production cached directory fetcher over one shared pin store, exactly as server.ts does, so the cached and fresh reads genuinely disagree. Disabling the new pin re-read turns "never claims a workspace the pin no longer holds" red and nothing else. --------- Co-authored-by: lefarcen <ontf116@gmail.com> * fix landing pricing controls * fix(daemon): resolve the AMR scope-telemetry app version in its own scope (#6240) Every AMR run in 0.16.2-beta.148 died at spawn with `spawn failed: appVersionForCapture is not defined`. `appVersionForCapture` is a local of `createFinalizedMessageTelemetryReporter`. #6221's `amr_workspace_scope_resolved` capture called it from `startChatRun`, ~7,500 lines and one function away, so the name resolved to nothing. The callback runs while building the agent's launch env, inside the spawn `try`, so the ReferenceError surfaced as the generic AGENT_EXECUTION_FAILED spawn failure for 100% of AMR runs. `design.getAppVersion` is the accessor that scope actually has, and it is the same one the unreachable helper falls back to, so the reported value is unchanged. A scope guard covers the class rather than the instance: it runs the checker over `server.ts` with `@ts-nocheck` stripped and fails on any identifier that reaches runtime unbound. It flagged one sibling, fixed here too — the critique orchestrator's `skill` label read `effectiveSkillId`, a local of `composeDaemonSystemPrompt`. A `typeof` guard on an undeclared name does not throw, so instead of crashing that label has silently been `undefined` for every run since #1485. `@ts-nocheck` on `server.ts` is the enabling condition for both: an undefined identifier in this file reaches users without any tool objecting. Removing it is a separate project — 29 daemon files carry it. * fix(web): isolate workspace identity snapshots * test(e2e): move the server.ts identifier-scope guard into the merge gate (#6244) `apps/daemon/tests/server-identifier-scope.test.ts` landed with the 0.16.2-beta.148 AMR spawn fix (#6240) but protected nothing: `ci.yml`'s "Daemon workspace tests" step runs exactly one file (`tests/project-watchers.test.ts`), so no other daemon suite executes in any workflow. The guard sat outside every merge-gate lane. Widening the daemon lane is not available as a local fix — that exact command string is pinned by `workflowRunsOnlyAllowedDaemonTest` in `scripts/check-certain-exempt-consumption.ts`, which conditions the `trae-cli.test.ts` docs-consumption exception on the lane running nothing else. Touching it is a coupled scope-policy change. So host the guard where a lane already runs and the wiring is itself guarded: - Any change under `apps/daemon/src/` matches `certain-daemon-core` (`scripts/scopes.ts`), whose effects include `ui_p0_validation_required`; `run_e2e_vitest` is `isFull || web_tests_required || ui_p0_validation_required`. A `server.ts`-only change therefore arms `E2E Vitest` even at the merge queue's `certain` threshold, and an unresolved file list escalates fail-closed to full. - The `daemon core boundary` guard (`scripts/lib/guard/scope.ts`) asserts `ci.yml` still contains both `run_e2e_vitest == 'true'` and `pnpm --filter @open-design/e2e test`, and runs in the always-on policy floor — so the premise cannot rot silently. The check only ever reads `server.ts` as text (no daemon boot, no fixtures), and reading another app's tree as a repository resource is what root `AGENTS.md` sends to `e2e/tests/` — the same reason `e2e/tests/critique-coverage.test.ts` lives there. Behavior is unchanged, including both self-checks that keep the guard from going vacuous. Verified red on the pre-#6240 `server.ts`: exit 1 naming `appVersionForCapture (line 9261)` and `effectiveSkillId (lines 9657/9658)`; green (exit 0) on the fixed file. * fix(collab): align unbound project mutation identity (#6231) * fix(web): name the caller when a run starts before its project scope resolves Sending the 「水面焦散」 example prompt from Home failed instantly on a team workspace: daemon 401: {"error":{"code":"WORKSPACE_CONTEXT_REQUIRED","message":"workspace context is required"}} with `run_id: n/a`, because the refusal lands before the run is created. That string is produced in exactly one place in the repo — the `!createResp.ok` branch of the `POST /api/runs` create fetch in `providers/daemon.ts` — so the refused call is run creation, gated by `enforceWorkspaceResourceMutation ('project', …)`. The cause is client-side. Home creates the project WITH the caller's workspace headers, so #6201 binds it to the team workspace; the follow-on auto-send then went out with NO headers, because it took its identity from the PROJECT's workspace scope — an async read still in flight when the auto-send fires (its gate is `messagesInitialized` + `activeConversationId`, never the scope). Every other project write in `ProjectView` (`patchProject`, `uploadProjectFiles`, the comment mutations) already asserts the caller's own context; run creation was the one write that did not. INVARIANT, now named in `runWorkspaceIdentity`: a send names its caller while the project's binding is still UNREAD, and never overrides an answer the daemon actually gave. Deliberately not a blanket `?? caller` — every answered or failed state keeps asserting nothing, because for them a headerless request is judged on daemon-owned state while an asserted one is judged on client-controlled headers: - `unbound` — `headerlessMutationAllowed` short-circuits on "no row anywhere" BEFORE asking for an identity, so asserting would turn a working 200 into a 403 and break 「未登录也可以用自己 cli 修改未登录态下的那些 project」. - `unavailable` — the daemon's `resolveProjectWorkspaceScope` returns this both for an unreadable directory AND for a directory that answered with no active membership, i.e. a proven "you were removed". - a FAILED scope read — this identity also picks the wallet the AMR pre-run balance gate prices against, and guessing the caller's team wallet with the binding unknown blocks a send the daemon would have answered (the dead button 21f452ffe undid). Second consequence of the same null, fixed by the same one-liner: with no resolved scope, `checkAmrBalanceGate` was called with `undefined` and priced the run against the ACCOUNT wallet instead of the team's. The red spec observes that directly rather than arguing it. `ProjectView.run-isolation.test.tsx` mocks `useProjectWorkspaceScope` with a hand-written factory that enumerates every export, so the new export is added there too — without it, adding one export breaks all 64 tests in that file with "not a function" at render. * fix(web): narrow the run-identity fallback to a project's first unread binding Review catch (nettee): keying the fallback on `loading` served two opposite situations, because `useProjectWorkspaceScope`'s trailing transition guard re-enters `{ loading: true, scope: null }` whenever the resolved caller identity stops matching — and every workspace switch does that: - first read, nothing known -> the caller is the only identity available - revalidating a KNOWN binding -> the caller's current workspace is a guess that contradicts an answer we already have So a send issued during a workspace switch asserted the workspace the user had just moved TO for a project still bound to the one they moved FROM. Both consumers break, and differently: `POST /api/runs` can 403 because `enforceWorkspaceResourceMutation` still finds the project row under the old workspace, and `checkAmrBalanceGate` preflights the new workspace's wallet — worse than the `undefined` this fix was written to remove, because a wrong wallet looks like a real answer. `ProjectWorkspaceScopeState` now carries `initialLoadPending`, reported by the hook rather than inferred from `loading`: true from mount until the first settled answer (a scope OR a failure) for the current `projectId`, false for that project's whole lifetime afterwards, and reset when `projectId` changes because a different project genuinely has not been read. `runWorkspaceIdentity` keys the fallback on that bit alone, and its docblock names which of the two loading reasons it serves so the distinction cannot erode. The field is required, not optional, so every construction site has to state which case it is. Two pre-existing assertions in `useProjectWorkspaceScope.test.tsx` now document the distinction they always exercised: a project A->B rerender reports pending (B is unread), while a same-project identity change reports not-pending — the exact window this fixes. * fix(collab): align unbound project mutation identity Allow an identified caller to mutate a project that no workspace has claimed, matching the existing headerless and unbound-resource behavior without persisting a new binding. Name the caller on Home auto-send while keeping AMR preflight scope derivation unchanged. * fix(web): refresh the settled run billing scope Track the project billing context in both callbacks that read it so an auto-send after scope settlement cannot preflight through a stale unscoped closure. Add a regression whose run identity stays referentially stable while the billing scope changes. * fix(web): stop asserting disproved run scope * fix(web): guard workspace-scoped catalog reads (#6249) * fix(web): guard workspace-scoped catalog reads * fix(web): guard remaining plugin catalog races * fix(web): align design catalog guard scope * fix(landing): show introductory team totals * fix(daemon): label critique with project skill (#6251) * fix CI scopes across file renames (#6252) * fix(ci): preserve scopes across renames * fix merge queue rename ceiling detection * test raw merge compare responses * fix(landing): make contact sales KV canonical * fix(web): preserve Cloud sign-in during outages (#6274) * fix(collab): allow shared project viewer comments * fix(web): keep readonly comment creation available * feat(web): personal/team project labels + collapse chat for shared non-owners (#6294) * feat(web): rename sidebar project lists and collapse chat for shared non-owners Workspace home left rail now labels personal vs team project lists ("Personal projects" / "Team projects", 个人项目 / 团队项目) across all locales. Opening a confirmed shared team project that the viewer did not create defaults the chat pane to collapsed so the design is primary; owners and personal projects keep chat open, and expanding chat stays sticky for the visit. * fix(web): use effective ownership for shared non-owner chat default Default-collapsed chat was latching on raw isOwner, so a catalog-confirmed owner whose collab status was still missing ownerMemberId looked like a non-owner and permanently collapsed chat. Expose isEffectiveOwner and isSharedNonOwner from useProjectCollab (catalog + session-created + status) and gate the sticky collapse path on the confirmed non-owner signal only. * fix(web): stop narrow chat error cards stacking titles vertically (#6295) Move the long Open Design Cloud switch CTA into UserActionCard footer actions (same shell as run-recovery), add a card-width container query so head actions reflow when ChatPane is narrow, and soften title wrapping so CJK copy no longer renders one character per line. * fix(workspace): make resource authority explicit (#6287) * fix: make workspace authority explicit across resources * fix(web): keep new team projects writable during scope load * fix: close workspace authority review gaps * fix(web): retry rejected project auto-send * fix: propagate workspace scope to project consumers * fix: cache project read workspace authority * fix(web): stabilize project scope revalidation * fix: cache project collaboration status authority * fix: cache collaboration status owner reads * fix: revalidate media wait tool authority * fix: rehome member comments on local threads * fix(web): stabilize project resource authorization * fix(web): prioritize settled project authority * fix(web): consume queued home auto-send handoffs * fix: revalidate dirty comment pulls * fix: isolate mutation authority reads by session * fix: cache project presence read hot path * fix(web): stop unauthorized project background writes * fix(web): require settled scope for project background work * fix(web): scope remaining project reads by workspace * fix(web): scope remaining project resource consumers * fix(web): partition project caches by full authority * fix(daemon): pin run workspace billing scope * fix(daemon): lease workspace read authority * fix(daemon): keep presence reads on the hot path * fix(web): refresh deck thumbnails across workspace scope * fix(daemon): revoke stale unshared team mirrors * perf(daemon): cache stale mirror read guards * fix(web): gate deep-link reads on project workspace * fix(web): keep deep-linked project tab scoped * fix(web): preserve project routes during onboarding * fix(web): keep project previews warm across file-list toggles * perf(daemon): refresh presence without cold reads * fix(web): keep retained preview iframes connected * fix(web): reuse exact HTML thumbnail sources * fix(web): settle read-only empty project chat * fix(daemon): scope CLI run transports by workspace * test(web): align preview cache refresh semantics * fix(web): require positive shared viewer ownership proof * fix preview auto-fit measurement feedback * preserve preview fit during annotation freezes * preserve preview measurement semantics on refresh * stabilize preview overflow measurement test * test design systems move exclusively to team * fix design systems move exclusively to team * test shared project title scope convergence * test(daemon): cover project command workspace scope * fix(daemon): scope project command transports * fix shared title test project state type * fix(daemon): preserve shared project catalog title * fix(daemon): keep foreign mirrors creator-unattributed * fix(web): recover first shared project conversations * fix(web): fence conversation recovery generations * test(web): verify conversation recovery cleanup fence * UI polish batch: cloud sign-in, onboarding, composer menu (#6281) * UI polish batch: cloud sign-in, onboarding, composer menu Sign-in surfaces (rail callout, balance-gate dialog, onboarding) had drifted from the visual system and lost some redundant chrome; this batch tightens them up alongside a couple of composer/design-files reorganizations that were sitting in the same working tree: - Rail's signed-out callout: reorder copy above the login pill, give the pill an icon + accent-green label, restore the Escape hatch the pill had before it lost its close affordance. - AmrBalanceDialog (insufficient-balance / signed-out gate): add a full-bleed art banner above the copy, drop the now-redundant icon badge, tighten spacing/shadows to match. - Onboarding cloud landing: switch from a single centered column to a two-column layout (form pane + full-bleed art panel), move the language switcher into the footer, swap the local-CLI/BYOK links for icon Buttons, and add a dismiss control to the activation-retry hint. - Composer "+" menu: fold 插件/设计百宝箱 back in as hover-expand submenu rows instead of standalone quick pills above the input. - Design files panel: move new-document/upload actions out of the always-visible toolbar into the empty-state actions only. - Message center: drop the redundant header close button (backdrop click and Escape still dismiss it) and restyle the list from bordered cards to a divider-separated list. - New `key` / `robot` / `translate` / `arrow-right` icons; language menu switches from the `languages` glyph to `translate`. - Tab launcher popover reverts to the glass material; language dropdown gets a max-height + scroll so long lists don't blow out the popover. Rebased the composer-quick-pill removal onto this branch's own accessibility work on those pills (opener-based focus return via `ComposerStandalonePanel`) rather than reverting it — the "next step" card still drives the same standalone-panel API, just without a pill to hand focus back to. Also updated/removed the tests that pinned the now-removed surfaces (quick-pill popup contract, message-center close button, onboarding top bar, design-files toolbar upload trigger) so none of this lands with a newly-red suite. * perf(web): optimize onboarding cloud artwork * fix(web): invalidate project file reads after mutations * fix(web): disable readonly project starter mutations * fix(web): preserve focus for standalone composer panels * test(e2e): require explicit workspace scope * fix(web): invalidate file reads on project events * test(e2e): seed explicit settings workspace * test(e2e): align manual edit with current inspector * fix(web): refresh deployments when share opens * test(e2e): follow composer design system entry * fix(web): keep local project creation workspace-independent * fix(web): preserve scoped auth recovery state * test(e2e): follow current entry settings flows * fix(web): preserve AMR retry across settings * test(e2e): model explicit personal workspace recovery * test(e2e): stabilize AMR logout settings recovery * fix(projects): return workspace scope on create --------- Co-authored-by: lefarcen <935902669@qq.com> * fix(workspace): preserve scoped projects after main sync (#6320) * fix(daemon): surface AMR OpenCode stall context (#6040) * fix(daemon): surface AMR OpenCode stall context * fix(daemon): accept runtime-omitted OpenCode diagnostics Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix(ci): make static gate runner-independent (#6039) --------- Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com> * test(e2e): parallelize restoration group (#6169) * test(e2e): parallelize restoration group * test(e2e): identify conversations from persisted prompts Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * test(e2e): wait for conversation persistence --------- Co-authored-by: Looper <looper@noreply.github.com> * feat(landing-page): sharpen the Codex agent page for "codex ui" intent (#6200) The /agents/codex-design/ page ranks #1 for "codex design" but only ~6th with a 1.3% CTR for "codex ui", a query that grew from 30 to ~90 daily impressions this month. A live SERP check shows the intent is mostly "build UI with Codex" (our intent), with a minority looking for the Codex app's own interface. - Retitle to "Codex Design: Build UI with OpenAI Codex" (title + H1). - Lead the frontend section with the query phrase and an answer-shaped opening paragraph, so the section is extractable for AI answers. - Add a disambiguation paragraph separating the Codex app's own UI from the UI you build with Codex, and route the former back to the main line. - Add two FAQ entries covering both readings; they also feed the FAQPage schema, which already earns a text snippet on this query. Applied across all 11 shipped locales (en, zh authored; the other nine translated with the page's terminology preserved). Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com> * Add Clone Audit plugin (#5687) * Add Clone Audit plugin * Update open-design.json * fix: make clone audit skill reusable * fix: sanitize clone audit provenance path * fix(e2e): bound tools-dev runtime lifecycle (#6204) * test(e2e): refresh full-pool UI fixtures (#6211) * fix(web): allow skipping required chat questions (#6177) * fix(web): allow skipping required chat questions * fix(web): auto-skip unanswered chat questions --------- Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com> * docs(tools-pack): add build cache contract (#6207) * docs(tools-pack): add build cache contract Document the tools-pack build-graph cache as a contract: the exact-match acceptance model, determinant rules, materialization-time parameters, the signing boundary, and fail-closed confidence grading. The rules come from an audit of all 11 cache nodes. Two are written down because nothing currently enforces them: a node key must carry the key of every upstream node it consumes, and a node key must not restate a list that already exists as a constant. Known low-confidence points are declared explicitly so fail-closed grading stays checkable rather than becoming a verbal convention. * docs(tools-pack): clarify cache materialization exceptions Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * docs(tools-pack): document NSIS base version scope Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com> * docs(landing-page): add 0.16.0 release post, localize and re-cover 0.15.1 (#6236) * docs(landing-page): localize 0.15.1 post, fix its cover, add 0.16.0 release post The 0.15.1 blog post shipped English-only and with an off-brand cover: a Fauvist oil painting overlaid with large display type, which reads nothing like the warm editorial illustrations every other release post uses. It also pointed `socialImage` at a 309KB JPEG while a WebP sat unused beside it. Regenerate the cover in the established house style (cream paper ground, sage/terracotta watercolour washes, pencil sketch resolving into a calm product surface), drop the stray JPEG, and add the full ten-locale i18n block so /zh/, /ja/, /ko/, /de/, /fr/, /ru/, /es/, /pt-br/, /it/ and /tr/ read in their own language instead of falling back to English. Also add the missing 0.16.0 "Reliable Delivery" post with a cover plus two inline figures in the same style, localized across the same ten locales. The 0.16.1 patch is a single preview fix, too thin to carry its own page, so it lands as a closing section of the 0.16.0 post and the download CTA points there. * docs(landing-page): fix doubled apostrophes and locale copy in release posts Three defects surfaced reviewing the localized bodies. The French, Italian and Turkish bodies rendered every apostrophe twice — "aujourd''hui", "all''interno", "0.16.1''i". The `''` escape belongs to single-quoted YAML scalars, but `bodyHtml` is a block scalar, where content is literal. 173 occurrences across the two posts. Korean used Japanese corner brackets and Brazilian Portuguese and Turkish used French guillemets. All three take curly double quotes. The Chinese copy read as translation rather than prose. "标签" opens the release line as a UI label, not a version tag; "抢画框", "编辑策展位" and "安静修复" are literal renderings that say nothing in Chinese; "画廊" is not the term the product itself uses for a gallery, which keeps the English word. The tag fix also lands on 0.10.0 through 0.15.0, which share the phrasing — leaving the series half-corrected would read worse than either state alone. * docs(landing-page): drop the leading tag word from release post openings Every release post opened with the word for a git tag before the version identifier — "Tag open-design-v0.16.0", "Etiqueta …", "タグ …", and in Chinese "标签", which reads as a UI label rather than a version. The word carries no information the identifier does not already carry, and in several languages it lands as a category noun the sentence never uses again. Drop it across all nine release posts and every locale, in both the summary and the opening line, leaving the version identifier to open the dateline. Spanish and Brazilian Portuguese lose the feminine agreement that referred back to the removed noun; Turkish loses the trailing "etiketi" apposition for the same reason. * docs(landing-page): correct the 0.16.1 interval in the 0.16.0 post 0.16.0 was published 2026-07-22 14:42 UTC and 0.16.1 on 2026-07-23 16:11 UTC — 25.5 hours apart. "Two days later" overstated it, and the same wording had been carried into all ten localized bodies, so every published route repeated it. --------- Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com> * feat(integrations): add the local Open Design Cloud flow for Codex (#6055) * feat(daemon): expose Vela login through CLI and MCP * feat(mcp): add interactive local brief card * feat(packaged): bootstrap local MCP headlessly * feat(daemon): secure local BYOK credential profiles * feat(cli): manage secure BYOK profiles * feat(web): store BYOK keys in secure profiles * fix(runs): deduplicate cloud generation requests * feat(daemon): add end-to-end plugin observability * fix(pack): include native PTY runtime in desktop packages Lazy-load node-pty in the daemon so missing native binaries only disable Terminal and interactive Keychain operations instead of crashing startup. Ship and validate target prebuilds in macOS and Windows packages. Repair the macOS spawn helper before signing, and invalidate stale Windows packaging caches. Cover the packaged PTY path in macOS and Windows smoke tests. Require Vela CLI for every beta desktop build target. * fix(mcp): localize and stabilize plugin briefs Keep collect and confirm on one MCP Apps card, report intrinsic size changes, and remove the fragile widget-state fallback. Localize brief forms, summaries, status, and public errors from the current request or Host locale while preserving stable protocol ids and selections. Keep internal runtime identifiers out of user-facing MCP guidance. * fix(packaged): register live Studio URLs with daemon Register the packaged web sidecar loopback origin over namespace-scoped daemon IPC after dynamic binding. Invalidate install-info by the live web port and remove the second MCP URL cache so run and project responses use the current Studio address. Validate loopback origins and cover registration, rebind, and cache refresh. * fix(mcp): stabilize brief confirmation lifecycle Keep confirmed briefs locked after Host publication failures and retry only the cached follow-up message instead of confirming twice. Replace blank initialization with a compact loading state, accept immediate and delayed tool results, and bump the MCP Apps resource to v3 so Codex does not reuse the stale card. Add an executable JSDOM Host bridge harness covering double-submit, publication retry, delayed results, and repeated draft notifications. Validated with the full daemon suite, workspace typecheck, and guard. * fix(mcp): prevent brief app resize feedback loops Replace the self-observed intrinsic-height loop with deduplicated body measurements so Codex MCP app iframes do not repeatedly resize themselves and fail sandbox startup. Bump the brief resource URI to v4 to avoid cached v3 cards and cover the regression with the focused brief-app spec. Validated with daemon tests/build, workspace guard/typecheck, a verified beta DMG, and a direct packaged MCP resource smoke. * fix(mcp): use the final Open Design plugin identity Make open-design the only accepted external plugin ID across MCP tools, run attribution, artifact version origins, and telemetry. Rename the Brief MCP App resource to v5 and reject the unpublished old ID instead of aliasing it. Validated with 171 daemon tests, 5 web tests, daemon/web typechecks, and guard. * chore(pack): bump Vela CLI to 0.0.27 * chore(nix): refresh pnpm dependency hashes * fix(mcp): honor host and plugin request contracts Respect independently advertised MCP Apps capabilities and prefer the Codex-native follow-up bridge so confirmed briefs render as readable user turns instead of context-only messages. Bump the brief resource to v6 to invalidate stale cards.\n\nMark Vela login and account probes as open-world interactions, and require stable request IDs for attributed generation so lost responses cannot create a second logical run. * fix(cli): support keyless BYOK profiles Add an explicit --no-api-key save mode for local and self-hosted providers while keeping credential-bearing profiles stdin-only. Reject missing or conflicting credential modes and cover both paths in the CLI tests. * fix(pack): replace headless owner when desktop opens Advertise headless packaged runtimes as having no visible window, then shut them down before a normal desktop launch continues instead of treating SHOW as a successful focus. Validated with the focused packaged headless and launcher lifecycle tests (20 passed). * fix(pack): clean up failed headless startup Acquire the headless identity, sidecars, and IPC server through one failure-atomic lifecycle so later bootstrap errors close every previously acquired owner in reverse order. Cover MCP-install and web-identity publication failures; validated with 22 focused tests and the packaged typecheck. * fix(byok): remove raw provider request contract Expose only daemon-owned BYOK profile references from shared run types and the web transport, while retaining the daemon's fail-closed rejection for legacy or untyped raw credential payloads. Validated with 76 web provider tests plus web and contracts typechecks. * fix(daemon): preserve interrupted run idempotency Hydrate queued or running durable requests as DAEMON_RESTARTED failures before idempotency reuse, preserving the original request and workflow mappings instead of creating a second cloud operation. Share the restart transition with boot reconciliation and expose synthetic terminal events to reattaching clients. Validated with 48 focused tests and the daemon typecheck. * fix(byok): roll back failed credential metadata writes Snapshot secure-store values before mutation and compensate create, update, and delete operations when profile metadata cannot be persisted, preventing orphaned or lost credentials. Validated with nine focused credential-service tests and the daemon typecheck. * fix(web): reconcile selected BYOK profile metadata Treat the daemon's selected secure profile as authoritative for protocol, endpoint, model, and API version so CLI profile edits cannot leave the browser showing stale execution settings. Validated with 66 config tests and the web typecheck. * fix(byok): migrate legacy credentials before cleanup Import each supported legacy browser credential into a stable daemon-owned secure profile before removing plaintext copies. Keep the original browser record on secure-store or unsupported-provider failures and surface a Settings recovery path. Cover successful migration, duplicate projections, and injected secure-backend failure while preserving existing Bedrock downgrade behavior in memory. * fix(byok): secure Windows profiles with DPAPI Dispatch native Windows BYOK profiles to a CurrentUser DPAPI backend rooted under the resolved daemon data directory. Secrets enter PowerShell only through stdin, encrypted blobs stay separate from non-secret profile metadata, and API responses remain secret-free. Add platform dispatch coverage, a Windows-only real DPAPI round-trip test, and the packaged Windows smoke path for create, resolve, response-redaction, and delete behavior. * fix(web): preserve config writes during hydration * fix(byok): persist secure credentials across entry flows * test(byok): cover secure onboarding persistence --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com> * test: strengthen E2E coverage and fixtures (#6150) * test: strengthen e2e coverage and fixtures * test: allow artifact route when starting conversation * test: keep e2e count assertions stable Use the shared stable-count helper for no-request and duplicate-event windows so delayed async events cannot escape the assertions. Generated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix: add e2e assertion import extension Use the explicit runtime extension required by the e2e NodeNext typecheck.\n\nGenerated-By: looper 0.11.0 (runner=fixer, agent=codex) * fix: preserve design system provenance and settle e2e assertions Keep disabled design systems available to project recovery and provenance while filtering only runtime injection. Make hover and cancellation checks observe their full settled windows. Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): preserve unique restoration run IDs Pass the restoration fixture's run ID prefix through routeSuccessfulRuns so each mocked request receives a distinct run identity. Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): stabilize agent and async count fixtures Route restoration agent requests through the shared JSON and SSE fixture, capture autosave baselines after a quiet period, and observe onboarding cancellation for a bounded stable window.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix: honor disabled design systems in daemon runs Filter disabled persisted project selections at prompt and analytics boundaries, and keep restoration run fixtures unique.\n\nGenerated-By: looper 0.11.2 (runner=fixer, agent=codex) * test(e2e): shorten cancellation duplicate check Generated-By: looper 0.11.2 (runner=fixer, agent=codex) * fix(daemon): continue stalled post-tool sessions (#6237) * fix(daemon): continue stalled post-tool sessions * fix(daemon): separate post-tool continuation budget Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(daemon): preserve retry telemetry budget Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(daemon): align retry failure telemetry Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(tools-pack): carry workspace build key into tarballs (#6235) * fix(amr): recover late login failures and trace auth stages (#5986) * fix(amr): recover late login failures and trace auth stages * fix(amr): preserve scoped cancel attempt IDs Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): defer unsupported Vela auth stages Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): narrow fallback telemetry to shipped Vela Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve live login after stale cancel Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve cancel during login startup Retain cancellation intent when a provisional cancel races the delayed canonical login response, then cancel the canonical attempt before polling can begin. Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): rejoin newer login after startup cancel Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): preserve cancel across web login starts Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): retain cancel when status refresh fails Generated-By: looper 0.11.1 (runner=fixer, agent=codex) * fix(amr): cancel onboarding status preflight Treat cancellation before an auth attempt exists as a local preflight cancel so a delayed status response cannot start login.\n\nGenerated-By: looper 0.11.1 (runner=fixer, agent=codex) * ci: constrain Actions cache writes (#6270) * fix(tools-pack): carry workspace build key into tarballs * ci: constrain Actions cache writes * fix(daemon): auto-mint assistantMessageId when clients omit pin (#6107) * fix(daemon): auto-mint assistantMessageId when API clients omit it Web always supplies assistantMessageId. Headless/MCP/eval clients that already send conversationId but omit the pin left lastMessageId null and skipped multi-turn native session resume (missing_cursor). Mint the id server-side whenever a conversation is bound and the client did not, and seed the user message the same way the old MCP-only path did. * fix(daemon): validate conversation ownership before omit-pin seed Reorder project-ownership checks before minting assistantMessageId and seeding the user prompt so cross-project omit-pin requests cannot corrupt foreign chats. Make ChatRunCreateRequest.assistantMessageId optional and expose conversationId/assistantMessageId on McpRunCreateRequest with contract tests for the omit-pin shape. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): reject missing conversation before omit-pin mint Return CONVERSATION_NOT_FOUND when a client supplies a stale or mistyped conversationId so omit-pin does not mint an unpersisted assistantMessageId and plugin snapshot resolve does not FK-crash with a 500. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed latest turn and fallback-bound user prompts Prefer currentPrompt over full message transcripts when seeding omit-pin user turns, and still seed after conversationId fallback when the client already supplied assistantMessageId. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): preserve attachments on omit-pin seeded user turns Copy request attachments and commentAttachments into the server-seeded user message so omit-pin/headless clients keep chips and annotation context after conversation reload. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): treat empty currentPrompt as authoritative omit-pin seed Attachments-only ChatRequest turns send currentPrompt as '' while message is the flattened transcript. Prefer any string currentPrompt, including empty, so seeded user rows keep empty content and do not duplicate history. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed turn metadata and bump project activity on omit-pin Persist sessionMode, runContext, and appliedPluginSnapshot on omit-pin seeded user turns so reload/retry keep applied context. Call updateProject after seed so listProjects reorders headless/API activity like PUT /messages. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): require projectId for bound conversation ownership Reject POST /api/runs when conversationId is present but projectId is missing or non-string, so omit-pin cannot seed messages without owning project context. Cover both early and post-fallback ownership checks. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): preserve slideIndex and BMP kind on omit-pin seeds Keep deck annotation slideIndex and classify .bmp as image when seeding user messages for clients that omit assistantMessageId. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed empty message when omit-pin has attachments When currentPrompt is unset and message is empty, still seed the user turn if attachment metadata is present so chips/annotations survive reload. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(daemon): seed omit-pin chat content from original request Plugin resolution may rewrite meta.message with a rendered scenario brief for the run; persist requestBody currentPrompt/message for the user turn so the internal brief is not shown as chat content. Generated-By: looper 0.11.1 (runner=fixer, agent=grok-build) * fix(web): persist browser preview viewport (#4899) * fix(daemon): honor Kiro ACP turn completion (#6268) * fix(daemon): isolate plugin-started Local Codex runs (#6273) Disable Codex plugins only for externally attributed Open Design Plugin runs so Local Codex cannot recursively enter collect_brief or Cloud login. Preserve normal Local Codex plugin loading and the existing operator-wide override. Validated with the focused runtime args suite, workspace typecheck, guard, and an isolated source smoke that produced a valid artifact without Cloud login. Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> * fix(landing): accept signed Vela team plan leads (#6283) * fix: durably deliver enterprise leads * fix(landing): make contact sales KV canonical * feat(prompts): introduce on-demand discovery in SP v2.0 (#6223) * feat(prompts): introduce on-demand discovery in SP v2.0 * fix(prompts): prevent nested deck label overlap * fix(plugins): stabilize od-default task routing * fix: address prompt and deck audit regressions * fix(prompts): restore plan mode precedence * fix(daemon): accept all form answer headers --------- Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com> * fix(web): surface BYOK migration validation errors (#6280) * fix(web): surface BYOK migration validation errors Preserve structured daemon errors during legacy credential migration and reserve offline guidance for fetch failures. Keep legacy browser credentials until migration succeeds, and cover HTTP validation, malformed responses, and network failures. Validated with focused web tests, web typecheck, workspace guard, and workspace typecheck. * fix(web): stabilize BYOK persistence error telemetry Map secure-profile HTTP and network failures to semantic error codes before emitting settings_byok_test_result, while preserving existing fallback behavior for unrelated connection-test errors. Validated with the complete web test suite, web typecheck, workspace typecheck, guard, and git diff --check. --------- Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> * fix(ui): improve dark-mode contrast for off-state toggles (#5825) * fix(ui): improve dark-mode contrast for off-state toggles The default off-state track uses --border-strong (#c9d0da light / #46433c dark). In dark mode #46433c is only ~5% lighter than the --bg-subtle (#252321) panel behind it, making the toggle nearly invisible when off and users unsure of the control state. Bump the off-state track to #6b6862 with a subtle inset border, and add a thin outline to the white thumb so it stays visible against the (now lighter) track. On-state already uses --text (#e8e4dc) and is left unchanged. Applies to both .toggle-row (used by speaker-notes toggle in the deck tab) and .compact-toggle (used by SurfaceOptions toggles). Hover lift gives an additional interactive affordance. Fixes #5298 * fix(ui): fix two dark-mode toggle blocking issues from review Two correctness issues called out by mrcfps: 1. System dark theme never gets the contrast fix — the default "system" theme mode removes [data-theme] and falls back to @media prefers-color-scheme. Added a parallel block scoped to html:not([data-theme]) inside @media (prefers-color-scheme: dark). 2. Hover override wins over on-state — .compact-toggle:hover and .toggle-row:hover have higher specificity than .on variants, so hovering an ON toggle dropped its track from bright var(--text) to #75726c. Changed to :not(.on):hover so the hover lift only applies when off, leaving the on-state always bright. Both applied to both selector paths (explicit data-theme and system dark). * fix(web): keep Azure deployment names editable (#6034) * chore(plugin-previews): refresh baked preview manifest (#6293) Co-authored-by: open-design-bot <bot@open-design.ai> * fix(byok): withdraw Windows DPAPI backend (#6308) * fix(byok): withdraw Windows DPAPI backend * fix(byok): clean up retired Windows secret blobs Generated-By: looper 0.11.2 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com> * fix(web): dismiss stale todo after continuation starts (#6307) * fix(web): preserve shared project update timestamps * fix(web): reconcile shared timestamps on home * fix(web): preserve workspace scope in preview assets * fix(collab): avoid unscoped shared cover requests * fix(web): avoid double-wrapping preview assets * fix(web): preserve first prompt across project refresh * test(web): target the active shared project card * test(web): keep empty BYOK profile type-safe * test(e2e): require explicit workspace scope * fix(web): finish scoped preview hydration * test(e2e): align manual edit with current inspector * fix(web): reconcile files after event stream readiness * fix(web): keep local project creation workspace-independent * fix(web): preserve scoped auth recovery state * test(e2e): assert explicit Personal workspace scope * test(e2e): preserve visual AMR account fixture * test(web): await scoped cover source * UI polish batch: cloud sign-in, onboarding, composer menu (#6281) * UI polish batch: cloud sign-in, onboarding, composer menu Sign-in surfaces (rail callout, balance-gate dialog, onboarding) had drifted from the visual system and lost some redundant chrome; this batch tightens them up alongside a couple of composer/design-files reorganizations that were sitting in the same working tree: - Rail's signed-out callout: reorder copy above the login pill, give the pill an icon + accent-green label, restore the Escape hatch the pill had before it lost its close affordance. - AmrBalanceDialog (insufficient-balance / signed-out gate): add a full-bleed art banner above the copy, drop the now-redundant icon badge, tighten spacing/shadows to match. - Onboarding cloud landing: switch from a single centered column to a two-column layout (form pane + full-bleed art panel), move the language switcher into the footer, swap the local-CLI/BYOK links for icon Buttons, and add a dismiss control to the activation-retry hint. - Composer "+" menu: fold 插件/设计百宝箱 back in as hover-expand submenu rows instead of standalone quick pills above the input. - Design files panel: move new-document/upload actions out of the always-visible toolbar into the empty-state actions only. - Message center: drop the redundant header close button (backdrop click and Escape still dismiss it) and restyle the list from bordered cards to a divider-separated list. - New `key` / `robot` / `translate` / `arrow-right` icons; language menu switches from the `languages` glyph to `translate`. - Tab launcher popover reverts to the glass material; language dropdown gets a max-height + scroll so long lists don't blow out the popover. Rebased the composer-quick-pill removal onto this branch's own accessibility work on those pills (opener-based focus return via `ComposerStandalonePanel`) rather than reverting it — the "next step" card still drives the same standalone-panel API, just without a pill to hand focus back to. Also updated/removed the tests that pinned the now-removed surfaces (quick-pill popup contract, message-center close button, onboarding top bar, design-files toolbar upload trigger) so none of this lands with a newly-red suite. * perf(web): optimize onboarding cloud artwork * fix(web): invalidate project file reads after mutations * fix(web): disable readonly project starter mutations * fix(web): preserve focus for standalone composer panels * test(e2e): require explicit workspace scope * fix(web): invalidate file reads on project events * test(e2e): seed explicit settings workspace * test(e2e): align manual edit with current inspector * fix(web): refresh deployments when share opens * test(e2e): follow composer design system entry * fix(web): keep local project creation workspace-independent * fix(web): preserve scoped auth recovery state * test(e2e): follow current entry settings flows * fix(web): preserve AMR retry across settings * test(e2e): model explicit personal workspace recovery * test(e2e): stabilize AMR logout settings recovery * fix(projects): return workspace scope on create --------- Co-authored-by: lefarcen <935902669@qq.com> * test(e2e): lock design system team partition * fix(workspace): stabilize scoped project lifecycle * test(e2e): stabilize retained workspace transitions * fix(workspace): retain exact scope through transient outages * test(workspace): lock outage identity boundaries --------- Co-authored-by: Ray Xi <2667192167@qq.com> Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com> Co-authored-by: Looper <looper@noreply.github.com> Co-authored-by: Joey-nexu <joeylee12629@gmail.com> Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com> Co-authored-by: bestthanapon <thanapon.suwannasuk@gmail.com> Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com> Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com> Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: Amy <58060647+AmyShang-alt@users.noreply.github.com> Co-authored-by: Marc Chan <mrc@powerformer.com> Co-authored-by: _HDCoder <2728073932@qq.com> Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com> Co-authored-by: Nicholas-Xiong <2482929840@qq.com> Co-authored-by: mehmet turac <mehmetturac@gmail.com> Co-authored-by: open-design-release-bot[bot] <295937643+open-design-release-bot[bot]@users.noreply.github.com> Co-authored-by: open-design-bot <bot@open-design.ai> Co-authored-by: CHENGLONG WANG <honam884844@gmail.com> * fix(workspace): seed dashboard workspace input * test(workspace): cover live dashboard workspace input * fix(workspace): backfill legacy workspace names * test(e2e): harden workspace collaboration coverage (#6312) Harden Workspace collaboration authority, lifecycle cleanup, and browser coverage.\n\nRetry an expired authorized Team-project pull exactly once with a fresh receipt while preserving fail-closed scope, version, cleanup, and final freshness checks. Align the fake Vela receipt lifetime with the real two-second contract and use scalable E2E timeouts. * fix(workspace): refresh dashboard input on switch * fix(viewer): avoid inert attribute warning * fix(chat): preserve user turn ordering * fix(workspace): stop retracted Team plugins immediately (#6335) Prevent stale Team-plugin listings, materializations, and delayed positive hub reads from reactivating a resource after retraction. Preserve independent Personal plugins with the same manifest ID and keep Team members able to share their own resources. Add deterministic regression coverage for cache invalidation, binding lifecycle, and the superseded-positive activation race. * fix(workspace): harden Vela billing proxy boundaries (#6348) Reject invalid wallet balances without overwriting valid cache state, validate normalized proxy paths and Workspace scope, strip hop-by-hop headers, and tear down upstream requests on disconnect. Keep team Workspace scope fail-closed when Connection nominates the protected header. * fix(web): tolerate unnamed workspace directory rows (#6349) Preserve a verified explicit Workspace context when legacy directory rows omit the display-only workspaceName field. Keep exact-row name backfill when a non-empty name is present, without inferring authority from active or default Workspace state. * fix(workspace): enforce exact project-list scope * fix(workspace): show team design systems in pickers * fix(web): reserve image cards while thumbnails load * fix(web): keep home creation types ready during refresh * test(e2e): align Windows beta smoke with installer * perf(web): start team catalog from exact directory identity * fix(web): refresh revoked workspace context * fix(web): order collaboration presence refreshes * fix(amr): prefer selected Vela OpenCode companion * fix(web): isolate collaboration presence sessions * fix(web): parallelize scoped project route bootstrap * perf(daemon): cache workspace project list authority * fix(web): preserve project-open connection budget * test(web): preserve memory toast exports in app mock * fix(web): preserve exact project opening scope * fix(daemon): coalesce scoped comment pulls * fix(daemon): retry team comment relay delivery * fix(daemon): atomically queue comment relay writes * fix(collab): show team comments across local conversations * fix(daemon): preserve catalog-only projects on unshare * fix(collab): close comment realtime catch-up gaps * docs: add workspace team rollout runbook * fix(collab): retry failed Team project shares * fix(workspace): isolate personal projects in recent lists * fix(daemon): isolate personal design systems * fix(workspace): authorize runs before plugin snapshots * test(daemon): align workspace retry contracts * fix: isolate plugins and skills by workspace member * fix(workspace): scope design systems in run prompts * fix(workspace): gate runs before plugin resolution * fix(daemon): namespace team design system bindings * fix: close plugin and skill scope leaks * test(collab): cover project-scoped comment actions * fix(workspace): scope project resource selection * fix(workspace): preserve personal design system reads * fix(workspace): authorize scoped run resources first * fix(workspace): keep project design systems scoped * fix(types): carry design system member scope * fix(billing): scope personal balances by workspace * fix(workspace): preserve unbound local design systems * fix: resolve team design systems by canonical binding * fix(workspace): invalidate nested project catalog cache * fix: keep team design system runs canonical * perf: batch durable comment relay delivery * fix: cancel stale local comment relays * fix(web): preserve scoped project display snapshots * fix(web): synchronize project rename projections * perf: reuse request-scoped workspace authority * test: enforce personal project creator ownership * fix(web): wait for project workspace authority * fix(daemon): invalidate team project caches before signaling * fix(web): order targeted project metadata refreshes * fix(workspace): preserve team catalog on outages * fix(web): isolate catalog display across accounts * fix(web): scope extension marketplace catalogs * fix(web): order broad team catalog refreshes * fix(web): scope home plugins to workspace identity * fix(web): isolate plugin views by workspace identity * fix(web): polish sign-in and composer focus * fix(web): preserve scoped project state after team moves * fix(workspace): enforce scoped design and billing identity * test(e2e): align workspace flows with scoped bootstrap * fix(collab): drain newer comment revisions promptly * test(e2e): keep owner actions after workspace lock * fix(web): converge project renames across scoped lists * fix(web): preserve pending projects across view changes * fix(web): restore preview runtime after activation * test(e2e): align workspace scope assertions * test(web): cover hidden stream recovery * fix(web): update deep-link project titles after rename * fix(collab): retry project metadata propagation * fix(web): preserve legacy design system logos * fix(web): wait for activated preview bridge * fix(design-systems): isolate team resource storage * fix(plugins): reject team mirror mutations * fix(web): partition extension catalogs by workspace * fix(skills): isolate team mirrors by workspace * fix(plugins): keep local share projects unscoped * fix(web): retry preview state capture during activation * test(e2e): scope project workspace fixtures explicitly * feat(collab): coordinate team resource invalidations * fix(collab): emit team resource changes after sync * fix(web): invalidate project lists after updates * fix(web): serialize project renames by scope * fix(collab): preserve team project comment anchors * fix(web): refresh shared resources after remote changes * fix(collab): materialize team projects before rename * fix(web): keep workspace catalogs current * fix(web): close catalog and credential races * test(workspace): harden team workflows and packaged deep links (#6358) * test(workspace): harden team workflows and deep links * fix(packaged): deliver hot invite deeplinks Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * fix(workspace): catch up team resources safely Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * fix(workspace): invalidate resource catch-up changes Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * fix(workspace): catch up shared resource changes Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * fix(packaged): preserve fallback invite deeplinks Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * fix(workspace): hide retracted team skills Generated-By: looper 0.11.7 (runner=fixer, agent=codex) * test(e2e): align workspace CI fixtures with route bootstrap * fix(collab): complete design system reconnect adoption * feat(analytics): track Workspace interactions (#6397) * feat(analytics): track Workspace interactions * fix(analytics): dedupe community page views --------- Co-authored-by: elifive555555 <296440099+elifive555555@users.noreply.github.com> * fix(daemon): preserve team comments across conversations * fix(collab): keep presence rosters converged * fix(comments): preserve routed comment anchors * fix(workspace): reconcile team project renames * fix(collab): preserve member directory last-good state * perf(collab): start scoped Team presence before status * fix(comments): keep relay anchors internal * perf(collab): warm presence from daemon cache * perf(collab): cancel obsolete cold status polls * fix: fence presence sessions against late heartbeats * perf(collab): share team member roster scheduling * fix(collab): preserve roster store through strict replay * perf(collab): retain workspace member directory stores * fix(collab): resolve presence identities from team directory * fix(collab): hide unresolved presence identities * fix(collab): prefer directory presence names * perf(web): preload workspace member directory * test(collab): preserve no-leave lifecycle contract * fix(web): preserve personal workspace presence after share * fix(web): refresh covers after team materialization * fix(web): refresh files after team materialization * fix(web): gate shared file reads on project authority * fix(web): preserve workspace folder action sizing * ci(e2e): split project-workspace UI P0 shard into project-workspace + project-collab project-workspace pins workers=1 by design (deliberate, not incidental — see e2e/AGENTS.md's UI test stability rules on cross-file worker carry-over), so its 7 files ran fully serially: ~26min wall time in recent merge-queue runs, the longest pole in the ui_p0 matrix by a wide margin over its 10-13min siblings. workspace-multi-client-collab.test.ts alone (spins up two isolated client/daemon runtimes per case) accounted for ~10 of those minutes. Carving it and workspace-keyboard-flows.test.ts into a new project-collab shard — still workers=1, still one file at a time — lets the two halves run as separate concurrent CI jobs instead of one long serial chain, without touching the single-worker-per-shard isolation the pin exists for. Updates the topology guards that pin the exact matrix shape so the split doesn't drift silently: DAEMON_RUNTIME_DEFINITION_MATRIX_NAMES (scopes.ts), the full/candidate matrix name guards (guard/scope.ts), and the fixed expectations in scopes.test.ts / packaged-smoke-workflow.test.ts. Validated: pnpm guard (UI P0 shadow contract + CI topology checks pass), pnpm typecheck (all workspaces), and the two topology test files (107/107 passing). * fix(collab): revoke unshared team project mirrors * fix(web): preserve unbound project authority across workspace changes * fix(web): pair scoped raw queries with headers * test(e2e): pin writable scope for project actions * test(web): cover Personal authority recovery after reload * test(web): await version preview readiness * fix(workspace): scope brand design system resources * fix(workspace): materialize owner team design systems * fix(web): fence design system reads by generation * fix(web): propagate brand read generations * fix(web): preserve workspace project visibility * fix(preview): retain scope for runtime relative assets * fix(web): explain design system delete denial * fix(daemon): bound team resource prewarm scopes * fix(daemon): recheck prewarm lease after queue * fix(web): stabilize transient presence roster gaps * chore(pack): pin Vela CLI 0.0.28 * fix(workspace): move design system project with team share * fix(workspace): gate linked unshare on live authority * fix(workspace): ensure backing project before design share * fix(web): scope srcdoc preview assets * perf(web): mint preview scope only for srcdoc * perf(web): reuse srcdoc preview scope * chore(nix): refresh pnpm deps hashes for vela-cli 0.0.28 pnpm-lock.yaml moved @powerformer/vela-cli from 0.0.27-test.7 to 0.0.28, but nix/pnpm-deps.nix was not regenerated, so `nix flake check` failed with a fixed-output hash mismatch for both the daemon and web derivations. Hashes taken from the Nix-reported expected values in CI run 30933223422 (nix is not available on this machine to run `pnpm nix:update-hash` locally); the merge of origin/main did not touch pnpm-lock.yaml, so those values still describe this tree. * chore(ci): retrigger workspace-team validation The previous ci run for this branch sat pending with zero dispatched jobs; cancelling it and pushing an empty commit re-enters the ci-6142 concurrency group from a clean slot. * perf(web): skip preview mint for authored base * fix(collab): preserve presence through lease gaps --------- Co-authored-by: Ray Xi <2667192167@qq.com> Co-authored-by: CHENGLONG WANG <honam884844@gmail.com> Co-authored-by: lefarcen <ontf116@gmail.com> Co-authored-by: PerishFire <39043006+PerishCode@users.noreply.github.com> Co-authored-by: Looper <looper@noreply.github.com> Co-authored-by: Joey-nexu <joeylee12629@gmail.com> Co-authored-by: Joey <236967869+joeylee12629-star@users.noreply.github.com> Co-authored-by: bestthanapon <thanapon.suwannasuk@gmail.com> Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com> Co-authored-by: xiaoche-hub <298951296+xiaoche-hub@users.noreply.github.com> Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com> Co-authored-by: Amy <58060647+AmyShang-alt@users.noreply.github.com> Co-authored-by: Marc Chan <mrc@powerformer.com> Co-authored-by: _HDCoder <2728073932@qq.com> Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com> Co-authored-by: Nicholas-Xiong <2482929840@qq.com> Co-authored-by: mehmet turac <mehmetturac@gmail.com> Co-authored-by: open-design-release-bot[bot] <295937643+open-design-release-bot[bot]@users.noreply.github.com> Co-authored-by: open-design-bot <bot@open-design.ai> Co-authored-by: shangxinyu1 <shangxinyu@refly.ai> Co-authored-by: elifive555555 <296440099+elifive555555@users.noreply.github.com>	2026-08-05 08:31:54 +08:00
open-design-crew[bot]	ebcba704ef	feat(prompts): introduce on-demand discovery in SP v2.0 (#6223) ... * feat(prompts): introduce on-demand discovery in SP v2.0 * fix(prompts): prevent nested deck label overlap * fix(plugins): stabilize od-default task routing * fix: address prompt and deck audit regressions * fix(prompts): restore plan mode precedence * fix(daemon): accept all form answer headers --------- Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>	2026-07-31 02:35:18 +00:00
nettee	6b90486c97	docs: reconcile stale documentation with current code (#5829) ... * fix(docs): align question guidance with form flow * docs: reconcile stale documentation with current code * fix(docs): remove retired template metadata from guides Generated-By: looper 0.10.6 (runner=fixer, agent=codex) * fix(e2e): stabilize visual workspace helper Generated-By: looper 0.10.6 (runner=fixer, agent=codex) * fix(docs): align localized template guide metadata Generated-By: looper 0.10.6 (runner=fixer, agent=codex)	2026-07-18 03:41:08 +00:00
lefarcen	da7c4ae051	fix(web): rank Community "Newest" by shipped publishedAt, not local install timestamps (#5597) ... * fix(web): rank Community "Newest" by shipped publishedAt, not local install timestamps The Community gallery Newest toggle sorted by the installed-record updatedAt/installedAt. Those are stamped when a machine seeds its own database, so a fresh install (or an upgrade that re-stamps the catalog) writes the whole bundled catalog milliseconds apart in folder-walk order — Newest showed reverse walk order (roughly reverse-alphabetical), unrelated to publication recency. Root-cause fix: bundled templates now ship a real publication date. - packages/contracts: add optional manifest field publishedAt (ISO 8601). - apps/web sortByNewest: freshness = publishedAt when parseable, else updatedAt (right signal for user-installed plugins); tie-breaks and stability unchanged. - plugins/_official: backfill publishedAt into all 460 bundled manifests from each folder's first-appearance commit date in upstream git history. - e2e: repository-resource guard requiring every bundled manifest to declare a parseable publishedAt, so the signal cannot silently erode. - docs: field reference entries in plugins-spec (en + zh-CN). Issue: https://plane.powerformer.net/open-design/projects/49832a02-3158-4faf-bf2f-d0e39c40c7e6/issues/ca0778af-97f5-4fc0-bc63-739280904979 Generated-By: looper 0.0.0-dev (runner=worker, agent=claude-code) * worker: 模板用最新筛选，筛选出来的不是最新的 Generated-By: looper 0.0.0-dev (runner=worker, agent=claude-code) * fix(web): keep shipped appeal order inside same-publishedAt batches Review follow-up (#5597, nettee): after the freshness tie on an equal publishedAt, the comparator still consulted local updatedAt/installedAt, which a fresh install stamps in folder-walk order — so every same-publication batch (largest: 322 manifests on one catalog date) re-sorted per machine instead of keeping the shipped visual-appeal ranking. Same-publishedAt records now preserve their incoming position; local timestamps break ties only when at least one side has no usable publishedAt. Adds the requested regression spec pinning same-publishedAt / different-updatedAt records. Generated-By: looper 0.0.0-dev (runner=worker, agent=claude-code) * fix(web): gate publishedAt freshness to bundled records; untrack oversized looper attachment Review follow-up (#5597, nettee round 2): publishedAt was overriding updatedAt for every visible plugin, so a user-installed github/local/ marketplace plugin carrying an old manifest publishedAt would be buried behind bundled templates despite a newer local install. publishedAtMs now returns null for non-bundled records — "Newest" means install recency for user installs, catalog publication for bundled ones. Adds the requested regression (non-bundled, old publishedAt, newer updatedAt) and clarifies the field docs (en + zh-CN). CI repair: commit 578f7a9 tracked .looper-attachments/bug13_1.png (3.8MB bug screenshot), tripping the Static gate 1MiB blob guard and the Validate workspace aggregate. Untrack it and gitignore .looper-attachments/ so harness attachments stay out of the repo. Generated-By: looper 0.0.0-dev (runner=worker, agent=claude-code)	2026-07-14 08:43:57 +00:00
Tom Huang	bc6a246c65	feat(slides): enhance deck project experience (#5083) ... * feat(deck): enhance slide deck functionality with speaker notes and navigation improvements - Added a switch for including speaker notes in slide decks, defaulting to true. - Updated keyboard navigation to include 'R' for resetting to the first slide. - Implemented click navigation for half-slide transitions. - Enhanced the deck framework to support hidden programmatic prev/next controls. - Improved handling of file inputs in question forms to support file submissions. This update aims to improve user experience in creating and presenting slide decks, ensuring better accessibility and functionality. * feat(artifacts): enforce semantic naming for user-facing deliverables - Updated guidelines to require semantic filenames derived from user briefs for new artifacts, moving away from defaulting to `index.html`. - Enhanced documentation to clarify naming conventions for HTML files, emphasizing the use of descriptive names like `investor-pitch-deck.html`. - Adjusted prompts and hints across the system to reflect these changes, ensuring consistency in user-facing outputs. - Improved test coverage to validate the new naming conventions and ensure proper implementation in various contexts. This update aims to enhance clarity and usability in project file management, promoting better organization and user experience. * feat(file-viewer): enhance speaker notes display and improve file workspace functionality - Updated the speaker notes section to include a styled placeholder for empty notes, improving user experience. - Changed the icon in the file workspace from "slides" to "panel-left" for better clarity. - Introduced new sub-category filtering options in the file workspace, enhancing organization and navigation. - Improved styling for the page creator search input and added visual feedback for loading states. These changes aim to enhance usability and visual consistency across the file viewer and workspace components. * test(web): align workspace tests with pages switcher * test(e2e): open design files through pages menu * fix(deck): keep source mode reachable * fix(workspace): restore uploaded file tabs * feat(deck-thumbnail): implement virtualized thumbnail rail for improved performance - Introduced a new `DeckThumbnailRail` component to optimize the rendering of deck thumbnails, reducing memory usage and improving load times. - Enhanced the `FileViewer` to integrate the new thumbnail rail, allowing for lazy loading of thumbnails based on viewport visibility. - Added tests for the `DeckThumbnailRail` to ensure correct functionality and caching behavior. - Updated styles for better visual consistency and performance during thumbnail rendering. These changes aim to enhance user experience by providing a smoother and more efficient way to navigate through deck slides. * feat(deck): enhance deck rendering with thumbnail support and keyboard shortcuts - Integrated `DeckSlideThumbnail` for rendering individual slides in a shadow root, improving performance and reducing main-thread load. - Updated `DeckThumbnailRail` to utilize the new thumbnail component, allowing for efficient slide navigation. - Implemented keyboard shortcuts for deck navigation, enhancing user experience during presentations. - Added tests for `buildDeckRenderInput` to ensure proper functionality of the deck stage fallback. - Improved styling for loading states in the viewer, providing a smoother visual experience. These changes aim to optimize the deck viewing experience by reducing resource consumption and enhancing interactivity. * feat(deck): improve thumbnail loading and speaker notes editing experience - Refactored `DeckSlideThumbnail` to enhance loading states with a new shimmer effect, improving visual feedback during thumbnail rendering. - Updated `DeckThumbnailRail` to manage loading states for thumbnails, ensuring a smoother user experience. - Simplified the speaker notes editing interface by removing the toggle switch, allowing direct editing from the notes body. - Enhanced accessibility by adding roles and focus states to speaker notes elements. - Added tests to verify the new loading states and speaker notes functionality. These changes aim to optimize the user experience in deck navigation and speaker notes management, providing a more intuitive and responsive interface. * feat(file-viewer): enhance version export functionality and speaker notes interaction - Introduced new export options for file versions, including PDF and image formats, improving the ability to download and share content. - Implemented a streamlined process for exporting version content, with progress indicators and error handling for a better user experience. - Enhanced speaker notes editing by refining event handling to prevent unintended focus shifts, ensuring a smoother editing experience. - Updated styles for improved visual consistency in the file version download interface. - Added tests to verify the functionality of version exports and speaker notes interactions. These changes aim to optimize the file viewer's usability and enhance the overall experience when managing and exporting project files. * fix(web): polish export menus and creator filters * fix(file-viewer): fall back to preview exports * test(file-viewer): cover version export fallbacks * test(file-viewer): assert loading skeleton by role * fix(file-viewer): restore html source mode affordance * fix(file-viewer): capture full version fallback snapshots * docs: trim slides handoff eof * test(exports): cover full preview snapshot requests * test(file-viewer): account for snapshot options arg * refactor(file-viewer, file-workspace): streamline export functions and enhance page creator dialog visibility * test(file-workspace): enhance slide template creation and mock plugin responses * feat(export): add support for versioned exports and enhance HTML export functionality * feat(export): implement versioned export support across multiple formats and enhance related tests * feat(file-viewer): enhance manual edit functionality with commit sequence tracking and add test for inline text session saving * style(speaker-notes): update filmstrip and thumb-frame styles for improved responsiveness and add corresponding tests * feat(file-viewer): enhance comment composer functionality with portal metrics and improve draw toolbar layout for mobile views * feat(analytics): track slide deck viewing experience Add analytics for the new deck/slides experience introduced in this PR: the deck viewer surface, in-deck slide navigation, thumbnail rail, and speaker-notes authoring. Presentation entry stays on the existing present_popover click to avoid double-counting. - contracts: DeckViewerSurfaceViewProps (surface_view), DeckViewerClickProps (ui_click), SpeakerNotesSaveResultProps (new speaker_notes_save_result event), wired into the event unions. - web: track* wrappers + fire helpers in FileViewer — deck_viewer surface_view on deck mount, slide_prev/next/reset, thumbnail_select, thumbnail_rail_toggle (expand/collapse), speaker_notes_edit, and speaker_notes_save_result (preview + presenter surfaces). - tests: deck analytics suite asserting the emitted (event, props) pairs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(file-viewer, file-workspace): enhance export toast functionality and improve localization for page creation * feat(home-view, plugins-home-section, agent-skill): update default facet preference, enhance category selection handling, and improve localization support - Set `preferDefaultFacet` to true in HomeView component for better user experience. - Introduced `handlePickCategory` function in PluginsHomeSection to manage category selection based on card layout visibility. - Updated PRIMARY_CATEGORIES to reflect the new order and added localization for titles and descriptions in adaptAgentSkill. - Enhanced tests to verify the correct handling of display copy and tags from SKILL frontmatter. * feat(plugins-home, file-workspace): introduce commercial category labels and enhance deck handling - Added a new module for resolving and localizing commercial category labels for plugins. - Updated the FileWorkspace and PluginCard components to display the commercial category label on deck cards. - Enhanced the PageCreatorPresetFrame to adjust frame classes based on deck presets. - Refactored subcategory handling in facets to align with the new commercial category taxonomy. - Improved localization support for new category labels across multiple languages. * feat(deck-preview): implement deck preview scaling and enhance home hero layout - Introduced `useDeckPreviewScale` hook to manage scaling of deck previews within a fixed 1280×720 logical viewport, ensuring proportional rendering across various templates. - Updated `FileWorkspace`, `HomeHero`, and `PluginCard` components to utilize the new scaling functionality for improved visual consistency. - Enhanced the layout of the home hero section to accommodate new subtype chips and descriptions, including a "More" dropdown for overflow handling. - Improved localization support for new UI elements across multiple languages. * fix(PreviewModal): clarify sidebar prop documentation and update test description - Updated the documentation for the `PreviewSidebar` interface to specify that the sidebar's stage-edge handles are not shown when the sidebar prop is absent. - Modified the test suite description for `PreviewModal` to be more concise and relevant. * test(e2e): select prototype visual card --------- Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 09:41:47 +00:00
open-design-crew[bot]	323246a64c	Website Clone: first-party Home entry, fidelity, real-clone example cards + tracking (#5178) ... * Add Website Clone home entry with bundled web-clone skill and root-relative asset preview fix * Retrigger CI * Open the site entry after website-clone turns * Harden web-clone skill asset and color fidelity Recon now scrolls the full page and captures @font-face rules, real font/image resource URLs, computed section palette, and resolved root variables. Asset harvest is rebuilt on the browser network stack so cross-origin CDN images, fonts, and media (hotlink-protected included) all land locally, with a self-hosted fonts.css and an originalUrl→localPath manifest. Clone audit gains --recon --strict fidelity gates (fonts self-hosted, images downloaded, key section colors exact) that exit 2 on violations, and SKILL.md makes all three a mandatory delivery gate. * Default web-clone mode to faithful reproduction when unconfirmed A real nike.com run showed the agent silently downgrading to visual-homage mode (placeholder brand, typography blocks instead of photography, approximated palette) because the user skipped the turn-1 confirmations and the site was a copyright-heavy commercial SPA. Fidelity is the point of this scenario: default to faithful reproduction, land real assets first, record trademark/copyright replacements as a pre-deploy checklist for the user to decide in Step 6, and never skip script recon just because the target looks bot-sensitive. * Streamline web-clone runs: skip discovery with URL, exempt brand constraints, actionable playwright setup Three run-path optimizations for the Website Clone scenario: 1. POST /api/projects derives metadata.skipDiscoveryBrief for web-clone projects whose pending prompt already carries the target URL — the URL is the brief, so the turn-1 question form no longer stalls the run (an explicit client flag still wins). Covered by project-create-web-clone-discovery.test.ts. 2. Prompt composition skips the design-system authoritative block and craft rules for intent=web-clone runs: the fidelity target is the original site, not the project brand; brand application belongs to the skill's Step 6 replacement phase. 3. The plugin's playwright-loader now also resolves from the process cwd (so 'npm i -D playwright' in the project root works for scripts staged under .od-skills/) and fails with exact fix commands; SKILL.md documents the staged-path resolution and forbids downgrading to eyeballing because of missing deps. * Swap the copyright guardrail for faithful reproduction on web-clone runs The official designer prompt's 'don't recreate copyrighted designs — help the user build something original instead' bullet made web-clone agents silently rebrand clones (Nike → placeholder brand, original SVGs instead of real photography) even after the skill mandated faithful defaults: a system prompt guardrail outranks skill blocks. For intent=web-clone runs the bullet is swapped for a faithful-reproduction rule that routes trademark/copyright caution through a pre-deploy replacement checklist (NOTES.md) the user owns. Prompt tests guard both directions of the substitution. Also: recon now captures scroll-feel signals (scroll-behavior, scroll-snap rule count, sticky/fixed census) and SKILL.md makes matching the original's scroll behavior (smooth-scroll libs, snap, sticky) a fidelity requirement. * Extract web-clone into a shared global skill referenced by ref The Website Clone workflow (SKILL.md + 14 recon/harvest/audit scripts + references) moves from the example-web-clone plugin into the global skill registry at skills/web-clone/. example-web-clone now references it via od.context.skills:[{ref:'web-clone'}] instead of shipping its own copy, so the upcoming per-site clone example plugins can all share one skill rather than each duplicating a 16KB SKILL.md and its scripts. Pinned-plugin skill resolution (server.ts) previously only loaded a plugin's LOCAL ./SKILL.md; a {ref} skill loaded nothing, so the body never entered the prompt and the scripts never staged. It now falls back to resolving the ref against the global registry, loading the body and registering the skill dir for cwd staging. Verified end-to-end in a live run: skills/web-clone stages to .od-skills/web-clone-<hash>/ with SKILL.md + all scripts. guard.ts residual-JS allowlist follows the scripts to their new home; a structural test locks the manifest<->skill contract. * Add 7 Website Clone example-prompt cards for the Home clone rail nexu.io, open-design.ai, anthropic.com, vercel.com, resend.com, linear.app, raycast.com — each a thin example plugin that references the shared web-clone global skill (od.context.skills:[{ref:'web-clone'}]) so none duplicate the workflow. Each seeds the composer with a faithful-clone prompt for its URL and ships a self-contained example.html preview built from a real recon capture of the target homepage, so the gallery card shows what the card clones. They surface under the Website clone chip's example-prompt rail (verified in a live desktop run) and inherit the chip's intent:'web-clone' metadata, so clicking one runs through the full fidelity path (skip discovery, brand exemption, faithful reproduction, script recon/harvest/audit). * Polish clone example-card previews with a framed hero capture The first pass inlined a downscaled full-page screenshot cropped mid-content — it read as a raw screenshot dump. Each preview is now a crisp above-the-fold hero capture (1440x900 DPR2, 16:10) presented inside a browser-window chrome (traffic lights + host URL pill) on a brand-tinted gradient, so the gallery card reads as an intentional site preview. Verified by rendering the previews headless. * Cache the plugin list so Home remounts don't grey the create rail HomeView re-fetched + parsed the large /api/plugins payload on every remount, leaving the create-rail chips disabled for 1-2s each time. A module-level cache (listPluginsFresh, 10s TTL) serves warm mounts without the network round trip so pluginsLoading clears within a frame; the first render stays cheap (empty list) to keep the click off the critical path. Also hide the base example-web-clone plugin from the example rail (the per-site clone-* cards are the real examples). * Ship real self-contained clones as example-card previews + align seed prompt Each clone-* example.html is now a real, self-contained reproduction of its target site (inlined CSS/fonts/images via document.styleSheets serialization so CSS-in-JS/Next.js SPAs like Vercel/Raycast capture correctly, oversized icon sprites dropped, rasters downscaled to stay under the 5MB preview cap, plus a scroll-reveal motion layer). Preview renders the real HTML; Remix copies it into a project as index.html. Manifests reuse the base web-clone useCase.query with a {{targetUrl}} default per site, so picking a card seeds the same preset prompt with the URL filled in instead of the marketing description. * Shrink clone example previews ~33% (dedup + drop EOT + WebP) Three lossless-to-near-lossless passes on the self-contained clones: - Dedup repeated data-URIs (same image used in <img> + css url() N times): store each once as a :root CSS var, point url() at var(), hydrate img[src] from the var via a tiny script. Resend alone shed 1.8MB. - Drop leftover EOT/fontobject font data-URIs (IE-only, redundant with woff2). - Re-encode inlined raster images to WebP (~50% smaller than JPEG at equivalent quality) via cwebp q72. Total across the 7 cards: ~23MB → ~15.5MB, every card now under 3MB (was up to 5MB). Image hydration + fidelity verified by headless render. * Lead create rail with Website clone; seed example cards with just the URL - Move 'web-clone' to the front of CREATE_RAIL_ORDER so Website clone is the first create-rail card, ahead of Slides (deck). - Website-clone example cards (Clone Nexu, Clone Vercel, …) now seed the composer with the same short 'clone this site: <url>' scaffold the chip uses (localized webClonePromptSeed prefix + the card's targetUrl), e.g. 'Website URL to clone: https://nexu.io', instead of the multi-paragraph build spec. Picking the chip with an empty composer already seeds the bare prefix for the user to paste a URL after. - Fix a test-only regression from the Home plugin-list cache: the module-level visible-plugins cache leaked a case's mocked /api/plugins payload into later cases via listPluginsFresh, greying the rail / stranding scenarios on 'Template None'. Add resetPluginsCache() and clear it in a global afterEach. * Track web-clone example-card picks (example_prompt / example_open_project) The Website-clone example cards (Clone Nexu / Vercel / …) had no analytics on pick or remix, so the site-clone funnel could not be broken down per example. Wire the two clicks the contracts already type (埋点文档 row 116): - useExamplePlugin → ui_click area=chat_composer element=example_prompt - duplicateExamplePlugin (Remix) → element=example_open_project Both carry chip_id (web-clone) + plugin_id (example-clone-<site>) + plugin_type for per-site breakdown. The created project's own project_kind=web_clone (already derived from metadata.intent via projectKindToTracking) still rides project_create_result / run_created, so 'how many projects are website clones' is answerable without extra work. No contracts change — the element enum and the web_clone project_kind already existed. Adds a behavioral test asserting both events fire with the right triplet + attribution. * Mirror web-clone copyright-guardrail swap into contracts/BYOK prompt PR #5178 blocking review (nettee/looper): the daemon prompt special-cases intent='web-clone' (faithful-reproduction rule) but the contracts prompt stack — which apps/web uses for API/BYOK runs — imported OFFICIAL_DESIGNER_PROMPT directly and never routed web-clone, so BYOK website-clone runs kept the original 'build something original' guardrail. Daemon and BYOK now behave identically: - contracts/prompts/official-system.ts: add COPYRIGHT_GUARDRAIL_BULLET, WEB_CLONE_COPYRIGHT_GUARDRAIL_BULLET, renderOfficialDesignerPrompt (mirrors the daemon renderer; contracts base has no execution placeholders so it only swaps the bullet). - contracts/prompts/system.ts: composeSystemPrompt routes the charter through renderOfficialDesignerPrompt({ webCloneFidelity: metadata.intent==='web-clone' }). - Add system-prompt-web-clone.test.ts covering both modes + the byte-identical bullet guard. * Complete web-clone BYOK prompt parity + rebase relative JS asset refs Two remaining blocking issues from PR #5178 looper re-review: 1. contracts composeSystemPrompt still appended the active-design-system 'authoritative' block + visual-direction override unconditionally, while the daemon suppresses both for intent==='web-clone'. A BYOK web-clone run with an active design system was still told the design system wins, fighting faithful reproduction. Gate both sections behind !isWebCloneRun; add contracts tests asserting web-clone BYOK prompts drop the design-system guidance. 2. rewriteInlinedScriptAssetRefs only handled root-relative literals. When js/app.js is inlined into the HTML entry, a sibling lookup like fetch('./data.json') / new Worker('./worker.js') / import('./chunk.js') resolved against the HTML root instead of js/. Take the source script path and rebase confirmed relative refs against it (mirrors the CSS pass), membership- confirmed; add unit cases for ./sibling, ../parent, and escaping/missing. * Website-clone examples: plain text prompt cards, drop embedded HTML + Remix The 7 site example cards embedded a full self-contained clone of each target site (anthropic.com, vercel.com, …) as example.html and offered a one-click Remix that copied that markup into a project. Shipping verbatim copies of other companies' sites is an IP risk, so replace them with plain text prompt cards: - Delete plugins/_official/examples/clone-* (7 dirs, incl. the example.html reproductions and the Remix-enabling preview.entry). - Add a 'web-clone' entry to HOME_PROMPT_EXAMPLES (en + zh-CN, others fall back to en): 7 text cards that fill the composer with 'Website URL to clone: <url>'. With the site plugins gone, the web-clone chip's preset rail is empty so these static text cards render instead. Clicking one fills the URL prompt and (via the existing usePromptExample) still fires ui_click element=example_prompt chip_id=web-clone — no plugin_id / no Remix / no example_open_project. - Remove the now-dead webCloneCardTargetUrl seed override; refresh stale comments. - Rewrite HomeView.web-clone-tracking test for the text-card path (asserts text cards render, no plugin-preset / no remix affordance, and the pick still tracks). The base example-web-clone skill + web-clone run behavior (intent, fidelity prompt, discovery skip) are unchanged. * Give web-clone example cards a site logo + domain, not raw prompt text The 7 Website-clone examples rendered as near-identical white boxes each showing 'Website URL to clone: https://<site>' — visually flat and hard to scan. Render them as a logo gallery instead: each card shows the site's own favicon (resolved at render time via a public favicon service — no third-party brand assets are bundled) in a rounded tile above the bare domain (nexu.io, vercel.com, …). A blocked/failed icon fetch falls back to a lettered monogram tile. Click behavior is unchanged: the full 'Website URL to clone: <url>' prompt is still what fills the composer and fires ui_click element=example_prompt. Non-URL prompt examples (other chips) keep the plain text card. * Web-clone examples: keep only open-design, add kimi Legal review flagged brand-copy risk in the example rail. Drop the nexu / anthropic / vercel / resend / linear / raycast site prompts and keep just open-design.ai plus kimi.com (official Kimi partnership). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 03:28:06 +00:00
XingliGe	e02a36f51c	feat(examples): add Open Design homepage — interactive 3D showcase (#5355) ... * feat(examples): add Open Design homepage — interactive 3D showcase Adds the live open-design.ai homepage as a first-party, self-contained example: an interactive React Three Fiber / Next.js hero with a real-time 3D "Open Design" wordmark, sticker collage, variable fonts, cursor parallax, and scroll-driven motion. Renders in the sandboxed powered preview. Made repo- and preview-safe without touching the app's runtime: - 3D geometry Draco-compressed (KHR_draco_mesh_compression): hero wordmark 4.4MB -> 300KB, cnt 2.2MB -> 548KB, decoded by the bundled DRACOLoader. Visually identical (verified). - Work/sticker imagery converted to LOSSLESS WebP: pixel-identical to the source PNGs (alpha + visible-pixel diff = 0), 12.2MB -> 7.1MB. - Every file now < 1MB, so the template is fully self-contained in-repo with no external asset host. - Path-portable so it renders from the nested preview subpath, not just the site root: absolute asset paths made relative; font/bgm URLs derived from document.baseURI instead of window.location.origin; App-Router createHrefFromUrl pinned to "/" and history push/replaceState URL neutralized so hydration matches and baseURI stays put (fixes the React #418 + broken relative-asset resolution seen when serving a Next RSC bundle from a subpath). Verified end-to-end from a deep subpath: 3 Draco models + 41 WebP + 3 fonts load, zero 404s, zero console errors, no hydration error, interactive (scroll/cursor). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(examples): list the full asset set in open-design homepage manifest Addresses review: od.context.assets previously listed only the design assets (models, fonts, imagery, bgm) and omitted the Next runtime chunks under assets/_next/. Applying the plugin would stage an incomplete copy of the static export, missing the runtime files example.html needs to render. Now lists every file the entry requires (example.html + all 54 files under assets/, including the _next chunks + css). Also cleaned up the truncated od.useCase.query text into a complete sentence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(examples): complete the open-design homepage asset closure Addresses the review's local-asset-closure blocker (three dangling references the mirror never captured): - Restore the Next polyfills chunk assets/_next/.../a6dad97d9634a72d.js (referenced by the noModule fallback script; modern browsers skip it, so it never 404'd at runtime but left the closure incomplete). - The work grid's passcode-protected /2026 tile pointed at work/tt01|tt02 images that were never in any mirror source (they 404 on the live site too). Add lockscreen placeholder images in the site palette so the reference resolves and — importantly — the client work data still matches the server-rendered HTML (removing the tile instead reintroduced a React #418 text hydration mismatch). - od.context.assets now lists the full closure (58 entries). Also corrected the manifest/SKILL 'zero external dependencies' wording: the Draco decoder is fetched from Google's gstatic CDN on demand (same pattern as the other WebGL examples); everything else is bundled locally. Re-verified from a preview subpath: 3 Draco models + fonts + imagery load, zero local 404s, zero console errors, no #418. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(examples): remove third-party network calls + committed key from homepage bundle Addresses review: the bundled preview shipped two undisclosed external requests, contradicting the manifest/SKILL 'only Draco loads externally'. - useWeather() made a live QWeather request with a hardcoded API key (devapi.qweather.com/...&key=...) to append a live temperature to the clock HUD. Replaced the fetch with static data ({now:{temp:"19"}}) — no network call, key removed from the bundle. The HUD still shows a temperature (static, as befits a mirror showcase). - Removed the Vercel toolbar injection IIFE (vercel.live/_next-live/ feedback/feedback.js + a data-deployment-id). It was cookie-gated to Vercel team members so it never fired in preview, but it left a committed external endpoint in a first-party plugin. Re-verified from a preview subpath: the ONLY external request is now the gstatic Draco decoder (as the manifest states); 3 models + fonts + imagery load, zero local 404s, zero console errors, no #418. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Tuola Ge <gexingli@refly.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 12:42:32 +00:00
XingliGe	49d64f0e8c	fix(examples): resize WebGL canvases lazily in the render loop (#5327) ... The powered-preview iframe can finish loading while its viewport is still 0x0 (hidden/animating dialog). Every WebGL example sized its canvas once at init plus on window resize, so when no resize event is delivered after the dialog settles, the drawing buffer stays 0x0 and the preview renders black until something (e.g. opening the plugin-info panel) changes the iframe width. Guard each resize handler to no-op when dimensions are unchanged and call it from the render loop, so the canvas self-heals within one frame of the iframe getting its real size — no reliance on resize events. Applies to all 15 webgl-* examples. Reported by QA: preview stays black until fullscreen/plugin-info is toggled. Co-authored-by: Tuola Ge <gexingli@refly.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 06:52:57 +00:00
XingliGe	7d005a17c3	feat(examples): add 10 WebGL example templates (#5312) ... * feat(examples): add 10 WebGL example templates Adds 10 first-party powered-preview WebGL examples under plugins/_official/examples, each a self-contained dir (SKILL.md + example.html + open-design.json, self-contained i18n): C-tier — faithful Codrops ports (MIT + credit + LICENSE; original imagery): webgl-depth-gallery, webgl-pixel-reveal-gallery, webgl-horizontal-parallax, webgl-distortion-grain D-tier — original self-contained WebGL2 shader heroes (no third-party assets): webgl-caustic-pool, webgl-halftone-drift, webgl-holographic-foil, webgl-voronoi-cells, webgl-aurora-veil, webgl-liquid-iridescence All changed files are <1MB (pass the blob-size gate). The two large mirror showcases (oryzo, opendesign) are deferred: they exceed the 1MB blob guard and need their heavy assets moved to repository-assets R2 (per the gate's guidance). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(examples): stop shader setup after WebGL2 fallback message Wrap each pure-shader example script in an IIFE and return early when getContext('webgl2') is unavailable, so unsupported environments settle on the fallback message instead of throwing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Tuola Ge <gexingli@refly.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 17:29:38 +00:00
Tom Huang	956b6607f5	feat(preview): add powered WebGL previews and examples (#5266) ... * feat(powered-preview): implement cross-origin isolation for WebGL and Worker artifacts - Introduced a new powered preview feature that allows rendering HTML artifacts in a cross-origin-isolated iframe, enabling the use of Web Workers, WASM, and SharedArrayBuffer. - Added API endpoint `/api/preview/isolation` to report the daemon's directly-reachable HTTP origin for rendering. - Implemented logic in the file viewer to determine if an artifact requires powered preview based on its content. - Updated the file serving routes to support powered preview, ensuring proper headers are set for cross-origin isolation. - Enhanced the user interface to include new scenarios for WebGL and Worker visualizations in the home hero section, with corresponding translations and descriptions. This feature addresses the limitations of the opaque-origin preview sandbox, allowing for more complex GPU and compute applications to function correctly. * feat(preview): add WebGL templates and lazy HTML previews * test(web): stabilize project back routing assertion * fix(preview): address powered preview review blockers * fix(preview): isolate powered preview origin	2026-07-08 08:58:51 +00:00
XingliGe	390fcf88f3	fix(plugin-previews): keep Community gallery previews in sync with shipped plugins (#5262) ... * fix(plugin-previews): validate baked preview metadata against shipped plugins The Home Community gallery renders whatever data/plugin-previews/manifest.json names, and nothing kept that metadata in sync with reality: #4815 deleted 19 example plugins but left all 19 manifest entries behind, #4040 shipped a card showing another plugin's imagery, a failed re-bake silently leaves the old clip serving outdated content, and durationMs recorded the intended walk time rather than the encoded file (23 entries carried holdMs > real duration, so the card's idle loop pointed past the end of the clip). - add scripts/check-plugin-preview-manifest.ts to pnpm guard: every manifest entry must name a shipped plugin, own its clip keys (<id>/<hash>/... or the legacy <id>.<hash>....), carry a coherent fingerprint, and never share a clip with another entry; prune the 19 orphaned entries it caught - bake validation (BAKE_VERSION 5): reject blank clips (whole-clip luma range via ffprobe signalstats), record durationMs from the encoded file, clamp holdMs to it, and write a bake-report.json naming skipped/stale/blank plugins instead of swallowing the failure - strict mode (--strict / PREVIEW_STRICT=1) fails the run when a bake left broken metadata behind; the pre-merge validation workflow now runs strict while the post-merge/nightly publishers stay lenient * fix(plugins): make the hyperframes example self-contained The example loaded cdn.tailwindcss.com (a render-blocking head script the page never used — every style is inline) plus Google Fonts. Inside the sandboxed gallery iframe or on a slow network the stalled script showed a long blank instead of the composition, and the CI bake raced the webfonts. Drop both: the page now renders from local system font stacks with zero external requests, so the live preview, the detail iframe, and the baked clip all show the same content. * fix(plugin-previews): address review — fail fast on probe errors, widen strict trigger paths - probeClipMs/clipLumaRange now throw instead of returning null: ffprobe is required validation infrastructure, and a swallowed probe error silently disabled exactly the checks this PR adds. A thrown error becomes an 'error …' skip, is recorded in bake-report.json under 'errors', and fails strict mode — while the routine skips every sweep has (non-html plugins 404ing the preview route) still never trip strict. - bake-plugin-previews-pr.yml now also triggers on plugins/community/**, .github/actions/bake-previews/**, and itself, so community-plugin preview changes and bake-recipe changes cannot merge without the strict pre-merge validation. * fix(plugin-previews): bake static pages as a held still instead of skipping forever The strict pre-merge bake on this PR caught five manifest entries that could NEVER refresh: example-dating-web, example-html-ppt-zhangzara-8-bit-orbit, example-frame-logo-outro, od-new-generation, example-orbit-notion. All five are (near-)static pages — the CDP screencast only delivers frames when something repaints, so they produce 1-4 frames and the old 'frames < 5' guard skipped them on every bake, nightly included, leaving their committed entries permanently stale (their old clips are the 103-210ms degenerate files in the manifest today). Encode <5-frame captures as a still instead: hold the last frame for the idle-loop span (half before the trailing repeated concat entry, half inherited by it, summing to ~HOLD_MS). Only a zero-frame capture is a real failure now. The blank-luma check still rejects stills of nothing. * fix(plugin-previews): never persist a manifest entry without a fingerprint When the preview fingerprint fetch failed, the loop still rendered and — on an otherwise successful bake — persisted an entry with hash: null and un-fingerprinted keys: metadata the content-hash reuse skip can never match again and the new manifest guard rejects. Treat a missing fingerprint as an infrastructure error instead: skip the plugin, record it under errors in bake-report.json (strict mode exits non-zero), and leave any committed entry untouched for the next sweep. --------- Co-authored-by: Tuola Ge <gexingli@refly.ai>	2026-07-08 03:44:05 +00:00
kokisanai	54de349c47	fix: replace expired Discord invite (#4849) ... Co-authored-by: koki yanlai xu <koki@kokideMacBook-Air.local>	2026-06-29 15:00:45 +00:00
elifive555555	1319bcef2e	chore: prune curated official example plugins (#4815) ... Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com>	2026-06-26 10:01:44 +00:00
Tom Huang	29b138f7a3	feat(brands): turn any brand into a reusable design system (#4691) ... * Implement brand management routes and CLI support - Added `brand-routes.ts` to handle HTTP endpoints for brand operations: listing, extracting, retrieving details, deleting, and serving logos. - Introduced `brands-cli-help.ts` for CLI commands related to brand management, including usage instructions for listing, creating, retrieving, and deleting brands. - Updated `cli.ts` to integrate brand commands into the existing CLI structure, allowing headless management of brands via the command line. - Created supporting files for brand metadata handling, including `design-md.ts` for rendering brand information in markdown format and `index.ts` for the brand engine API. - Implemented `prefetch.ts` to fetch and process brand material from specified URLs, ensuring a streamlined extraction process. - Enhanced server setup in `server.ts` to register brand routes and manage brand-related data effectively. This commit establishes a comprehensive framework for managing brands within the application, facilitating both HTTP and CLI interactions. * Enhance memory management and onboarding experience - Introduced canonical profile labels to ensure consistent handling of user input in profile forms, preventing duplicate entries. - Updated the `parseProfileBody` and `captureProfileFromForm` functions to utilize the new canonical label matching. - Added a memory callout section in the onboarding view to highlight the benefits of memory usage, including personalized responses and reduced setup questions. - Implemented new UI elements in the onboarding view to improve user engagement with memory features. - Expanded i18n support for new onboarding messages related to memory benefits across multiple languages. * Refactor onboarding flow and enhance design system integration - Updated the onboarding process to include a new brand extraction step, replacing the previous newsletter step. - Adjusted the tracking logic to reflect the new onboarding steps, ensuring accurate analytics for user progress. - Improved the UI for the onboarding view, including new input fields for email collection during the brand extraction phase. - Refined the EntryShell component to remove outdated comments and clarify the onboarding renderer's purpose. - Enhanced CSS styles for the onboarding steps to improve layout and user experience. - Updated internationalization strings across multiple languages to reflect changes in the onboarding flow and brand extraction messaging. * Add brand management features and enhance font handling - Introduced new modules for managing brand assets, including `chrome.ts` for headless Chrome operations and `fonts.ts` for self-hosting web fonts. - Implemented `prefetch.ts` to streamline the brand material extraction process, allowing for efficient harvesting of colors, fonts, and logos. - Enhanced the brand system with new schema definitions in `schema.ts` to support brand color and font management. - Developed the `engine` module to integrate brand building and rendering processes, including token derivation and artifact generation. - Improved the overall structure and organization of brand-related files for better maintainability and scalability. * Enhance brand extraction and project management features - Updated `brand-routes.ts` to include new dependencies for project management, allowing for the registration of brand-related projects. - Modified the `extractBrand` function to support project ID and system files, improving the brand extraction process. - Enhanced the CLI commands in `cli.ts` to handle project IDs during brand creation, enabling better tracking of brand projects. - Updated the server setup in `server.ts` to register new project-related routes. - Improved the UI components to display project information associated with brands, including buttons for opening projects in the `BrandDetailView` and `BrandsTab`. - Added new metadata fields in the contracts to support project tracking and management for brands. This commit establishes a more robust framework for managing brand projects, enhancing both backend and frontend functionalities. * Enhance onboarding profile management and memory persistence - Added new canonical profile labels for 'Organization size', 'Use cases', and 'Discovery source' to improve user input consistency. - Introduced `OnboardingProfileState` type to manage onboarding profile data more effectively. - Implemented functions to build and persist the onboarding profile body to memory, ensuring user selections are saved accurately. - Updated the `OnboardingView` component to handle profile persistence during navigation and submission steps. - Enhanced tests to verify that user selections are correctly persisted to the memory profile. This commit improves the onboarding experience by ensuring that user inputs are consistently captured and stored, enhancing overall user engagement with the application. * Reflow brand extraction into an agent-driven, live flow Replace the deterministic SSE prefetch/preview/system pipeline with an agent-driven extraction: POST /api/brands now reserves the brand and stands up a backing project with the target site open in an in-app browser tab plus a seeded prompt, so the agent measures, synthesizes brand.json incrementally, and the user can clear anti-bot walls by hand. New /preview and /finalize routes let the agent render the kit page live and register the resulting user:<id> design system, so extracted brand facts persist as a structured, reusable brand kit instead of a one-shot deterministic guess. Adds the brand-extract skill (SKILL.md + brand-kit.html template), kit-render engine, brand-extraction-engine tests, brand project covers in the Designs tab, onboarding extract handoff, and the matching od brand extract/preview/ finalize CLI subcommands and contract updates. Co-authored-by: Cursor <cursoragent@cursor.com> * Sediment finalized brands into structured memory Reflow a finalized brand into the memory store (brandToMemoryEntries + reflowBrandToMemory) so future chats can ground vague requests in the brand's palette, type, voice and rules. finalizeBrand now wires through the runtime dataDir and best-effort persists the brand, MemoryChangeEvent gains a 'brand' source, and the brand kit render hardens its inline JSON escaping. Adds brand.previewEmpty / brand.viewDetails across all locales. Co-authored-by: Cursor <cursoragent@cursor.com> * Implement logo fallback and imagery support in brand extraction - Introduced a deterministic logo fallback mechanism to ensure that brand extraction processes can retrieve and save site logos, even when the agent fails to do so. - Enhanced the `startBrandExtraction` and `finalizeBrand` functions to utilize the new logo fallback, allowing for better handling of logo assets. - Added support for imagery samples in brand validation, enabling the inclusion of representative images in the brand kit. - Updated the brand kit rendering to include self-hosted fonts and imagery, improving the overall presentation of brand assets. This commit strengthens the brand extraction workflow by ensuring that logos and imagery are reliably captured and displayed, enhancing the user experience in brand management. * Enhance memory management with rule proposal and verification features - Introduced new functionality for distilling annotations into rule proposals, allowing users to suggest rules based on in-canvas annotations through the `od memory rule suggest` command. - Implemented a verification system that programmatically enforces compliance with active rules during artifact generation, ensuring that all active rules are covered in the self-verify scorecard. - Added endpoints for managing verification outcomes, including listing, removing, and clearing verification records, enhancing the transparency of the verification process. - Updated the memory management system to support the retrieval of active rule entries, ensuring that only linked rules are considered during verification. - Enhanced tests for both rule proposal generation and verification processes to ensure reliability and correctness. This commit strengthens the memory management capabilities by integrating rule proposals and verification, improving the overall user experience in managing design rules and ensuring compliance. * Distill review annotations into memory and enforce self-verify scorecard Add distillAnnotationsToMemory to mine inline preview comments/highlights/ marks into durable feedback + rule memory via a dedicated distiller prompt, threaded through the existing extract pipeline with an 'annotation' change source. Tighten the self-verify prompt (daemon + contracts) to state the daemon programmatically checks the scorecard, so a missing or uncovered scorecard on an artifact turn is an enforcement failure. Cover the rule suggest and verification-history routes with tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Apply brand design system through web config on "Use in new chat" Thread onApplyDesignSystem from the entry shell into BrandsTab so the brand's registered design system is applied via the web config channel instead of a bare daemon PATCH that left the Home composer stale. Add a transient home-intent latch + event so the Brands tab can request the Prototype chip on the already-mounted HomeView, which consumes it once the plugin catalog loads. Co-authored-by: Cursor <cursoragent@cursor.com> * Wire annotation distillation into background memory extraction Add a background distill pass that mines inline review annotations (comments / highlights / drawn marks) from a turn into durable memory alongside the general LLM extraction, surface an `annotation` memory toast source in the web UI, and cover the flow with a unit test. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix brand design system not applying to composer on "Use in new chat" Selecting a brand's "Use in new chat" applies the brand's design system as the default and fires the Prototype chip intent in the same synchronous click handler. HomeView consumed that intent inside the event listener, so `pickChip` ran before React committed the config change and seeded the composer's design-system field from the stale (empty) default — the composer showed "No design system" instead of the brand until a reload. Split the intent handling: the listener now only bumps a tick, and a separate effect consumes the chip after the re-render lands, so the seeded design system reflects the freshly-applied brand. Add the previously-untracked home-intent latch test coverage. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): rework Brands into Brand Kit and add Home create entry Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): harvest real cover/hero images for the Images module The brand kit's Images gallery only populated when the extraction agent remembered to save imagery — so a forgetful or bot-blocked agent (and the pre-imagery "Open Design" brand) left it empty. Add a deterministic, server-side imagery fallback (imagery-fallback.ts), mirroring the logo fallback: it parses og:image/twitter:image, large <img> (highest-res srcset/<picture>), <link rel=preload as=image>, and CSS background-image hero blocks, fetches candidates with browser-shaped headers, decodes PNG/GIF/JPEG/WebP dimensions to keep only big representative images (dropping icons/sprites/logos/tracking pixels), dedupes by content hash, and saves up to 8 of the largest into imagery/ with labeled samples. finalizeBrand runs it as a timeout-bounded, failure-tolerant safety net (injectable so tests stay offline) when the agent captured too few samples, first adopting any on-disk images. The extraction prompt and brand-extract SKILL now explicitly direct the agent to harvest the site's large/cover/hero images, filtered by rendered size. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(qa): implement deck layout validation and safety checks Add a new QA module for validating the layout of generated brand decks to ensure robustness against clipping and truncation issues. The `analyseDeckLayout` function checks for critical layout invariants, including the presence of `.slide` sections, correct container types, and necessary runtime layers. Introduce `assertDeckLayoutSafe` to enforce these checks during brand system rebuilds, preventing the deployment of decks that fail validation. Additionally, create comprehensive tests to verify the functionality of the new layout validation features. * fix(brands): apply deck shrink-to-fit synchronously so slides never clip The no-clip runtime scheduled its fit pass through requestAnimationFrame, whose callbacks are throttled while the deck is offscreen or occluded. A slide could therefore stay unscaled — and clip its content — until first paint. Fit synchronously on resize/load/fonts-ready with a trailing setTimeout settle pass for late reflow, removing the rAF dependency. Verified at the previously-broken 1024x620 viewport: container-type:size, zero truncations, runtime auto-applies scale (Problem 0.71, ASK 0.87, Product 0.97, Competition 0.97) and frame clip count drops to 0. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(web): let New Brand modal embed scrollable brand reference picker Add a fillHeight mode to BrandReferencePicker so the heading, quick-pick row and controls stay pinned while only the gallery scrolls inside a bounded-height parent. Wire it into NewBrandModal with a stable, spacious dialog and refresh the related newBrand/brandPicker copy across all 18 locales. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): enhance brand extraction with deterministic seed harvesting Introduce a new `seed-fallback` module to provide a server-side deterministic palette and typography seed during brand extraction. This ensures that the brand kit's initial display includes a harvested logo, an approximate color palette, and font families, improving the user experience by reducing the all-skeleton appearance during the first paint. Update the `startBrandExtraction` function to utilize this new module, allowing for a more seamless and visually appealing brand extraction process. Additionally, enhance the `BrandReferencePicker` component to reflect loading states and errors during brand extraction, ensuring users receive immediate feedback on their actions. Update related tests to verify the idempotency of the `finalizeBrand` function, ensuring that re-finalizing a brand correctly reuses the existing design system without duplication. * feat(brand-extract): enhance BrandReferencePicker and localization updates Updated the BrandReferencePicker component to reflect loading states and errors during brand extraction, improving user feedback. Added a new localization key for the brand extraction process and updated existing translations in English, Simplified Chinese, and Traditional Chinese to enhance clarity and user experience. Additionally, introduced new styles for better interaction with brand assets in the brand kit template. * feat(brands): wire in-page lightbox/masonry/asset preview + refine seed Brand-kit preview improvements for the live extraction kit: - brand-kit.html: add in-page overlay system (sandboxed iframe has no top-nav) — clickable image lightbox with prev/next, a "view all" masonry modal, and a full-page asset preview modal that loads system/artifacts/<kind>.html in an iframe. Defer auto-reload while an overlay is open so it never yanks the modal out mid-interaction. - seed-fallback.ts: prefer vivid mid-luminance hues for the seeded accent/accent-secondary, and drop icon/symbol faces (Remix Icon etc.) from the typography seed so specimens never render glyph soup. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(brands): wire in-page lightbox/masonry/asset preview + refine seed Brand-kit preview improvements for the live extraction kit: - brand-kit.html: add in-page overlay system (sandboxed iframe has no top-nav) — clickable image lightbox with prev/next, a "view all" masonry modal, and a full-page asset preview modal that loads system/artifacts/<kind>.html in an iframe. Defer auto-reload while an overlay is open so it never yanks the modal out mid-interaction. - seed-fallback.ts: prefer vivid mid-luminance hues for the seeded accent/accent-secondary, and drop icon/symbol faces (Remix Icon etc.) from the typography seed so specimens never render glyph soup. Co-authored-by: Cursor <cursoragent@cursor.com> * i18n(web): add brandPicker.opening across remaining locales + picker test Completes the brand-reference picker i18n key that was committed only for en/zh-CN/zh-TW, so every locale satisfies the typed Dict, and lands the BrandReferencePicker extraction-feedback test left untracked by the concurrent worker. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(EntryShell): enhance AMR cloud card visibility post-detection Updated the EntryShell component to ensure the AMR cloud card remains visible after detection settles, even when the AMR runtime is unavailable. This change prevents the card from disappearing and allows it to degrade gracefully to fallback content and sign-in flow. Additionally, added tests to verify the new behavior, ensuring a better user experience during onboarding. * feat(library): OD Library asset registry + OD Clipper extension Add a global, cross-project asset registry (OD Library) and a Chrome MV3 capture extension (OD Clipper), wiring the full HTTP + CLI + Web UI three-track loop per specs/od-clipper.md. - contracts: LibraryAsset/Source/Kind, ingest, search, pairing, task DTOs - daemon: 6 additive SQLite tables, content-addressed owned storage, the idempotent registerLibraryAsset hook (hash dedup + append-source), programmatic enrichment (mime/size/image dims/domain/tags), pairing tokens with a persisted extension-origin allowlist, /api/library/* routes, and /api/tools/library/{search,apply} for in-task agent reuse - cli: `od library list|get|rm|search|import|pair` - web: Library tab (grid, source badges, filters, search, live SSE updates, extension pairing affordance) - clipper/: standalone MV3 extension (background SW, content toolbar, popup) - skills/library-curator: utility skill for agent-driven asset reuse Origin middleware now honors paired chrome-extension:// origins (seeded from SQLite on boot) and exempts the pairing-confirm handshake. Enrichment AI stages (caption/OCR/embedding) are recorded as skipped pending a configured model. * feat(brands): programmatic-first design system extraction + rename Make brand extraction two-phase so a usable design system is ready the moment the user enters a URL — the instant "aha" — instead of waiting on the AI agent: 1. PROGRAMMATIC-FIRST (synchronous): startBrandExtraction now harvests the site deterministically (logo, palette, typography, one-line description, cover imagery, source URL) via prefetchBrand, synthesizes a valid design system with brandFromMaterial (no LLM), and finalizes + registers it before returning. finalizeBrand is refactored into a reusable finalizeBrandCore shared by both the programmatic path and the agent path. 2. ASYNC AI ENRICHMENT: the seeded agent prompt is reframed to enrich the already-usable design system and re-finalize in place (same user:<id>), updating every artifact/template. Bounded + best-effort: a blocked/unreachable origin skips phase 1 and stays `extracting` for the agent to drive. Gated on userDesignSystemsRoot so the legacy agent-only path stays intact for tests. Also rename the user-facing "Brand Kit" surface to "Design System" across en + zh-CN strings, project names, and the enrichment prompt. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(library): enhance asset import and management features - Updated the `import` command to allow multiple local files and remote URLs, with restrictions on supported formats. - Added new commands: `apply` for copying assets into project design files, `edit-as-page` for converting HTML assets into editable projects, and `figma` for exporting Figma captures. - Introduced sidecar functionality for storing derived data alongside owned assets, including Figma capture IR and element HTML. - Enhanced server configuration to support larger ingest payloads for asset captures. - Improved error handling and user feedback during asset import and application processes. * feat(asset-management): enhance asset dropzone and introduce chat-to-design feature - Updated the DesignSystemAssetDropzone component to improve file preview handling with new functions for creating and revoking object URLs. - Adjusted CSS for better layout and spacing in the asset dropzone. - Added a new "Chat to design" button in the LibrarySection component, allowing users to send selected assets to the Home chat composer for project creation. - Updated localization strings across multiple languages to reflect changes in asset import terminology. - Enhanced the HomeView component to handle asset staging from the chat composer. * feat(library): enhance asset application with element markup support - Updated the `applyLibraryAsset` function to include an `includeElement` option, allowing the capture of element markup alongside assets. - Modified related components (e.g., `ChatComposer`, `LibrarySection`, `FileWorkspace`) to handle the new element markup feature, ensuring both asset paths and optional element paths are returned and processed. - Introduced a new function, `fetchLibraryAssetElementHtml`, to retrieve the captured HTML for element-pick assets. - Enhanced the UI to display element markup inline within the chat composer, improving user interaction with captured elements. - Updated API contracts to reflect changes in asset application responses, including optional element markup paths. * feat(library): enhance asset filtering and preview handling - Updated the LibraryPicker and LibrarySection components to implement a badge-aware kind filter, allowing for more precise asset filtering based on badge kind. - Introduced a new `matchesKindFilter` function to streamline the filtering logic across components. - Enhanced the DesignSystemAssetDropzone to ensure proper handling of image previews, addressing issues with broken thumbnails under React StrictMode. - Added CSS styles for kind badges to improve asset representation in the UI. - Implemented tests for the DesignSystemAssetDropzone to ensure correct preview lifecycle management. * feat(library): hydrate single asset on SSE ingest Add fetchLibraryAsset(id) so the Library grid can merge just the one asset an `ingest` SSE event references instead of refetching the whole list on every capture. Returns null on miss/error. * feat(clipper): richer in-page image picker Collect CSS background-image url()s in addition to <img> (so hero/section art painted as backgrounds is no longer silently missed), defer thumbnail decode to visible cells via IntersectionObserver, draw downscaled canvas thumbnails instead of second full-res decodes, and add locate-on-page highlighting so a picked image can be traced back to its DOM source. * feat(library): implement lazy loading for thumbnails and enhance asset filtering - Introduced a `LibraryThumb` component to lazily load heavy content (images, videos, iframes) only when they are near the viewport, improving performance. - Added a debounced search feature to optimize asset filtering, reducing unnecessary network requests during rapid input. - Enhanced the asset filtering logic to track active filters using a ref, ensuring efficient updates during live events. - Updated the `snapshotCardRects` and `cardIdsInBand` functions to support improved hit-testing for drag-and-drop interactions. * feat(library): lazy picker thumbnails + debounced search Extend the Library grid's lazy-thumbnail + 250ms debounced-search pattern to the composer LibraryPicker so opening it no longer fires one full-bytes request per asset, and tidy the clipper content-script image collection. * feat(clipper): compress and budget capture inlining Re-encode large raster images to downscaled WebP and inline smallest-first within a fixed budget, dropping only the secondary Figma IR past a safe body size, so an image-heavy page (e.g. a news front page) always saves as an editable HTML capture instead of 413-failing the ingest. * test(library): LibraryPicker debounce + lazy-thumbnail coverage Cover the composer picker's 250ms debounced search and its lazy <img> mount (deferred until the card is in view), matching the grid's perf test. * feat(design-system): enhance asset handling and UI for design systems - Updated the CLI to support additional asset kinds, including 'design-system'. - Enhanced the DesignSystemProvenance type to include source URLs, improving provenance tracking. - Modified the design system generation jobs to correctly summarize source links and GitHub repositories. - Updated UI components to reflect changes in asset handling, including new source link management in the DesignSystemFlow. - Improved tests to cover new functionality for adding source links and ensuring proper handling of design system assets. * refactor(library): rename 'design-system' to 'brand kit' and enhance thumbnail loading - Updated labels and filters in Library components to replace 'design-system' with 'brand kit'. - Introduced a shimmer skeleton for lazy-loaded thumbnails in the LibraryPicker to improve user experience during asset loading. - Enhanced the PickerCard component for better performance by memoizing individual asset cards. - Updated tests to ensure proper handling of brand kit assets and their visibility in the LibraryPicker. * feat(clipper): implement internationalization for toolbar and popup - Added i18n support to the clipper, enabling localization of UI elements and tooltips. - Introduced a new i18n.js file to manage translations for various languages. - Updated content.js and popup.js to utilize the i18n functions for dynamic text rendering. - Enhanced accessibility by ensuring aria-labels and tooltips are also localized. - Improved user experience by providing localized messages for actions and statuses. * feat(clipper): enhance brand kit extraction and localization support - Updated the brand kit extraction process to include improved handling of assets and localization for various UI elements. - Added internationalization support for the brand kit feature, allowing for dynamic text rendering based on user locale. - Enhanced the user experience by ensuring that all relevant messages and tooltips are localized. - Updated tests to cover new localization features and ensure proper functionality of the brand kit extraction process. * feat(clipper): enhance brand color derivation and update localization - Introduced new functions for color manipulation, including linear interpolation and clamping, to improve brand color derivation. - Updated the deriveBrandColors function to better map observed palettes to semantic roles, ensuring consistent brand representation. - Revised localization strings in i18n.js to reflect changes from 'brand kit' to 'design system', enhancing clarity and user experience. - Improved overall code organization and readability by refactoring existing functions and adding new utility methods. * refactor(clipper): update terminology from 'brand kit' to 'design system' - Replaced all instances of 'brand kit' with 'design system' across various components and localization files for consistency. - Updated UI elements, tooltips, and documentation to reflect the new terminology. - Enhanced user experience by ensuring clarity in the design system extraction process and related functionalities. - Adjusted localization strings in multiple languages to align with the updated terminology. * feat(clipper): enhance image fill handling and normalization - Introduced functions to normalize image fills by converting non-PNG/JPEG formats (SVG, WebP, GIF, AVIF) to PNG before import, ensuring all images are properly rendered in Figma. - Updated the UI to report the number of images converted and dropped during the import process, improving user feedback. - Enhanced the overall image processing workflow to prevent silent failures when unsupported formats are encountered. - Revised documentation to reflect the new image handling capabilities and supported formats. * feat(clipper): enhance UI kit and busy state feedback - Updated the UI kit to include new components such as inputs, selection, and overlays, improving the overall design system representation. - Enhanced the busy state feedback during capture processes with localized messages and a step-by-step progress indicator, providing users with clearer status updates. - Revised localization strings to support new UI elements and improve user experience across multiple languages. - Improved documentation to reflect changes in the UI kit and busy state handling. * fix(brands): restore design-systems nav entry + reconcile BrandsTab on re-activation Address review feedback on PR #4260: 1. EntryNavRail dropped the only control that reached view==='design-systems' when Brands replaced it in the rail, leaving the still-rendered/routed design-system manager deep-link only (the entry-nav-design-systems e2e specs assert this). Restore a reachable rail entry (blocks icon, existing navDesignSystems key) alongside Brands. 2. BrandsTab only fetched once on mount, but EntryShell keeps sub-views mounted and toggles visibility, so a brand finishing extraction in its backing project never reconciled until a full reload. Refresh whenever the Brands view becomes active again, and poll while any brand is extracting (torn down once settled / when hidden). Red spec: tests/components/BrandsTab.refresh.test.tsx (fails pre-fix: fetchBrands called once, not twice). * Update clipper/brand-capture.js * fix(clipper): improve busy state handling and UI feedback - Adjusted the spinner CSS to use flex properties for better layout control. - Enhanced the reclampIfMoved function to preserve user position during busy state transitions. - Added loading toast notifications for popup-launched captures to ensure progress visibility even when the on-page bar is hidden. * feat(daemon): add kiwi-schema dependency and enhance Figma API integration - Added kiwi-schema package to the daemon for improved schema handling. - Updated FigmaApiNode interface and related functions to support shared functionality with the offline decoder, ensuring consistency in node processing. - Refactored capture functions in clipper to maintain UI visibility during DOM/IR snapshots, enhancing user experience during capture operations. * fix(web): surface missing backing projects * fix(web): re-enable brand actions after use * fix(daemon): serve brand logos from data roots * fix(brands): reconcile failed extractions * feat(daemon): implement offline Figma import and decoding functionality - Added support for importing `.fig` files directly into the daemon, enabling offline processing without requiring a Figma account. - Introduced a new `fig-decode.ts` module for decoding `.fig` files, handling both ZIP-wrapped and raw formats. - Created `figma-import.ts` to orchestrate the import process, generating a canonical snapshot and associated metadata. - Enhanced the server to handle Figma file uploads and integrate with the new decoding logic. - Updated package dependencies to include `kiwi-schema`, `html2canvas`, and `jspdf` for improved functionality. - Added tests for the new Figma import features to ensure reliability and correctness. * feat(clipper): reload-proof capture progress badge on the extension icon The on-page progress strip dies if a page reloads itself mid-capture (aggressive paywall sites like economist.com do this), leaving no loading signal. Add a per-tab '•••' badge on the extension icon for the lifetime of any capture message — it lives on the action icon, so a page navigation can't take it down. Verified end-to-end via a real loaded extension. * feat(daemon): add export functionality for Figma and enhance PDF export process - Introduced `runFigma` command for importing Figma designs, supporting both local `.fig` files and Figma URLs. - Added detailed usage instructions for the `od figma import` command. - Implemented `runExport` command for programmatic export of HTML/deck artifacts to PDF, PPTX, or image formats. - Enhanced error handling and user feedback during export processes. - Removed obsolete `build-pptx-export-prompt` module and related tests to streamline the codebase. * feat(daemon): enhance library synchronization and export capabilities - Implemented `reconcileLibrary` to mirror design systems and agent-produced project deliverables into the Library as referenced assets. - Added support for programmatic export of artifacts via the `od export` command, including detailed usage instructions. - Introduced new functions for handling Figma imports and exports, improving integration with design workflows. - Enhanced error handling and user feedback during synchronization and export processes. - Added tests for new features to ensure reliability and correctness. * feat(web): PPTX export for any shareable artifact + Library toolbar tooltips * chore(nix): refresh pnpm deps hash * refactor(web): enhance onboarding view and file export progress indicators - Updated the onboarding view layout for improved accessibility and visual hierarchy, including adjustments to spacing, typography, and button styles. - Introduced a loading toast for file export progress, displaying elapsed time and estimated time remaining for slide exports. - Added new translation keys for export progress messages in multiple languages. - Refactored the export progress handling to provide real-time updates during the export process, improving user feedback and experience. * refactor(web): streamline export capture bridge and update connector styles - Removed unused loading logic for html2canvas in the export capture bridge, simplifying the code. - Updated CSS for the onboarding view connector to improve visual clarity and ensure it does not overlap with node numbers. * refactor(web): remove html2canvas dependency and enhance Figma URL handling - Removed the html2canvas package from the project, including its references in the lock file and related components. - Added functionality to manage Figma URLs within the Design System flow, allowing users to add, remove, and validate Figma file links. - Improved drag-and-drop handling to prevent unintended file navigation when dropping files outside designated areas. - Updated UI components to accommodate new Figma URL features, enhancing user experience and accessibility. * refactor(web): unify brand and design system flows - Merged the brand extraction process into the design system creation workflow, allowing users to start from a brand directly within the design system wizard. - Updated routing to redirect legacy brand links to the unified design systems tab. - Enhanced the onboarding experience by removing the separate Brand Kit tab and integrating brand selection into the design system creation process. - Improved UI components to reflect these changes, ensuring a seamless user experience across the application. * feat(web): introduce brand enrichment banner and picker modal - Added a new BrandEnrichmentBanner component to allow users to refine programmatically-extracted design systems with AI by selecting design-system skills. - Implemented a BrandPickerModal for selecting brands from a searchable gallery, enhancing the design system creation flow. - Updated ChatPane to conditionally display the enrichment banner for eligible brand projects, improving user engagement. - Enhanced the design system flow to support the new brand enrichment features, ensuring a seamless experience for users. * feat(web): enhance BrandPickerModal and DesignSystemAssetDropzone - Updated the BrandPickerModal to allow scrolling of the entire picker area, improving user experience by creating a unified scrolling surface. - Added new props to the BrandReferencePicker for action labels and scroll root reference, enhancing flexibility in brand selection. - Introduced a new DesignKitView component for rendering design kits consistently across different surfaces. - Enhanced the DesignSystemAssetDropzone to support a wider variety of file types with appropriate previews, improving asset management during design system creation. - Updated styles for better visual clarity and responsiveness across components. * feat(web): update Design Systems tab actions and enhance localization - Changed the button label in the DesignSystemsTab from "Edit" to "Open" for better clarity in user actions. - Added a new translation key for 'dsManager.openSystem' across multiple languages to support the updated button label. - Enhanced the FileWorkspace component to ensure the Design Files tab aligns correctly with the Design System tab, improving UI consistency. - Implemented a new design system editing feature that allows users to fetch and save design system content from DESIGN.md, enhancing the design workflow. * fix(merge): repair post-merge regressions after origin/main integration Follow-up fixes on top of the origin/main merge (886f925cd) addressing regressions the conflict resolution introduced. main's web suite is the oracle (100% green); resolution principle was main's engine/backend + HEAD's UI, unioned. daemon: - library-sync.ts: correct design-systems import to ./design-systems/index.js (design-systems became a directory module on main). - tests/server-bootstrap-regression: add LIBRARY_DIR to the PathDeps fixture (main-added test x HEAD-added LIBRARY_DIR field). web: - WorkspaceTabsBar: union — restore main's onboarding Search-popover close behaviour + guards, keep HEAD's library/brands nav entries. - HomeView: restore main's composer sending-state (await onSubmit, widen its return type to Promise<boolean>|boolean|void, pass submitting to HomeHero). - MemorySection.test: take main's version to match main's two-loop memory component. - i18n: restore dropped settings.onboardingRoleMarketing key across types.ts and all locales. - App/BrandsTab/EntryNavRail/router/home-intent: union fixes restoring main features dropped during conflict resolution (needs_input handling, etc.). Validation: pnpm guard + full pnpm typecheck (all 23 packages) green. Known-red: EntryShell onboarding step 3 intentionally retains HEAD's "build" step rather than main's brand-extract step; 8 EntryShell.onboarding / App.onboarding-amr-e2e tests stay red pending that onboarding decision. * fix(merge): keep HEAD's unified brand flow (revert main's separate Brands tab) Follow-up to 688544ff7. Per the chosen product direction (brand creation unified into the design-system create wizard, not a standalone Brands tab), revert the brand-flow routing/nav that the post-merge repair had restored from main: - router.ts: keep HEAD's brand routing (brands folded into design-systems), drop main's standalone /brands and /brands/:id view routing. - EntryNavRail.tsx: drop main's standalone "Brands" nav button. - runtime/home-intent.ts: drop main's brand "Use in new chat" confirmation notice plumbing (tied to the separate Brands flow). Kept from the repair commit (additive, non-conflicting): App.tsx loadedActiveProject correctness, composer Sending… state, WorkspaceTabsBar onboarding popover behaviour, two-loop memory test, restored i18n keys, brand needs_input STATUS handling, server.ts plugin-route infrastructure. * feat(library-ui): implement conditional rendering based on LIBRARY_UI_VISIBLE - Updated router.ts to conditionally render the library view based on the LIBRARY_UI_VISIBLE flag. - Modified ComposerPlusMenu.tsx, DesignFilesPanel.tsx, and DesignSystemAssetDropzone.tsx to show the "Select from library" button only when LIBRARY_UI_VISIBLE is true. - Adjusted EntryNavRail.tsx and EntryShell.tsx to include the library navigation button and section conditionally based on the LIBRARY_UI_VISIBLE state. - Enhanced HomeHero.tsx to allow starting a blank project directly, improving user experience by providing more options for project creation. This commit introduces a feature toggle for the library UI, allowing for better control over its visibility during development and testing. * feat(home-hero): implement edge auto-scroll for horizontal overflow - Introduced `useEdgeAutoScroll` hook to manage auto-scrolling behavior for horizontally overflowing components in HomeHero. - Updated `PluginPromptPresets` and `RailGroup` components to utilize the new auto-scroll functionality, enhancing accessibility for users without trackpads. - Added `EdgeScrollZones` component to provide interactive edge zones for scrolling. - Enhanced CSS styles to support the new scrolling layout and ensure proper positioning of elements. This commit improves user experience by making overflow content more accessible and easier to navigate. * feat(design-systems): add project creation from design system and enhance UI components - Implemented `handleCreateProjectFromDesignSystem` function in `AppInner` to facilitate project creation directly from a selected design system. - Updated `DesignKitView` to wrap the iframe in a span for better layout control. - Refactored CSS for `BrandPreviewCard` and `DesignSystemsTab` to improve styling and responsiveness. - Introduced a new `TemplatePicker` component in `HomeHero` for selecting project-type templates, enhancing user experience. - Updated various components to support asynchronous handlers for design system actions, improving overall functionality. This commit enhances the design system integration and user interface, making project creation more intuitive and accessible. * feat(brand-routes): enhance brand reservation API and add DESIGN.md support - Updated the POST /api/brands endpoint to accept optional fields: description and designMd, allowing for more flexible brand reservations. - Modified validation to require either a URL or designMd for brand extraction. - Introduced a new design-md-input module to handle parsing and validation of DESIGN.md content. - Enhanced startBrandExtraction function to support processing of DESIGN.md, improving integration with design systems. - Added utility functions for managing DESIGN.md input and output, streamlining the brand creation process. This commit improves the brand extraction workflow by integrating DESIGN.md support, making it easier for users to create and manage brands. * feat(chat-pane, design-kit-view): enhance chat functionality and design preview features - Added `handleNextStepPromptAction` to `ChatPane` for setting draft prompts, improving user interaction. - Introduced `nextStepVariant` to differentiate design system projects in `ChatPane`. - Updated `DesignKitView` to include a button for previewing design kit covers, enhancing user experience. - Implemented a modal for displaying design kit previews, allowing users to view content in a dedicated space. These changes improve the chat interface and design kit interactions, making the application more intuitive and user-friendly. * feat(brand-extraction): enhance DESIGN.md support and testing - Added a new test case to validate brand extraction from DESIGN.md input without requiring a website. - Implemented functionality to register brands directly from DESIGN.md, improving the brand creation workflow. - Updated the `ChatPane` and `NextStepActions` components to handle design system-specific actions for projects, enhancing user experience. - Enhanced localization files with new carousel hints and project brief options across multiple languages. These changes streamline the brand extraction process and improve the overall functionality of the design system integration. * feat(wireframe-examples): add annotated and greybox wireframe examples - Introduced new wireframe examples for annotated and greybox styles, enhancing design system capabilities. - Added HTML and JSON files for both wireframe types, providing templates for low-fidelity design mockups. - Implemented SKILL.md documentation for each wireframe example, detailing usage and design specifications. These additions improve the design toolkit, offering users more options for creating wireframes in various styles. * feat(brand-extraction): refine Chrome fallback and enhance error handling - Updated the Chrome fallback logic in the prefetch pipeline to clarify its purpose and usage as a diagnostic tool. - Introduced environment variable checks to enable or disable system Chrome usage, improving control over the extraction process. - Enhanced error messages in the DesignSystemCreationFlow component to provide clearer guidance on required inputs for creating a design system. - Added regression tests to ensure that prompts do not instruct the agent to invoke a non-existent `brand-extract` skill, preventing potential failures during brand extraction. These changes improve the robustness of the brand extraction process and enhance user experience by providing clearer instructions and error handling. * feat(brand-extraction): enhance DESIGN.md input handling and introduce brand ready prompt - Updated the BrandFromDesignMdInput interface to explicitly define the description property as optional with undefined. - Enhanced the brand extraction prompts to clarify the inline brand-extract workflow, preventing confusion during the extraction process. - Added a new BrandReadyPrompt component to notify users when a design system is ready for preview, improving user experience. - Introduced CSS styles for the BrandReadyPrompt to ensure a visually appealing and user-friendly interface. - Updated localization files to support new strings related to the brand ready prompt across multiple languages. These changes improve the clarity and usability of the brand extraction process, providing users with timely feedback and a more intuitive interface. * feat(brand-extraction): improve design system focus handling and localization updates - Refactored the handling of browser tabs in the brand extraction tests to ensure proper validation of tab states. - Enhanced the AppInner component to refresh design systems alongside templates, ensuring users see the latest updates without page reloads. - Introduced a pending focus state in the DesignSystemsTab to manage design system selection more effectively after brand extraction. - Added a BrandReadyPrompt in the ProjectView to notify users when a design system is ready for preview, improving user engagement. - Updated localization files for Chinese (Simplified and Traditional) to reflect changes in terminology related to design systems. These changes enhance the user experience by providing timely feedback and ensuring that the design system selection process is seamless and intuitive. * fix(styles): adjust letter-spacing and enhance plus-menu trigger styles - Set letter-spacing to 0 in design-system-flow.css for improved text clarity. - Added styles for plus-menu trigger in plus-menu.css, including background, border, and hover effects to enhance user interaction and visual consistency. These changes refine the design aesthetics and improve the usability of the plus-menu component. * feat(tests): add design-system focus handoff tests - Introduced a new test suite for validating the design-system focus handoff functionality. - Implemented tests to ensure that the focus ID is correctly set, read, and cleared from session storage, preventing user selection hijacking. - Added checks for scenarios where no focus ID is pending, enhancing test coverage for the design system's behavior. These tests ensure the reliability of the design-system focus handling, contributing to a more robust user experience. * feat(export): restrict image format options to PNG and JPEG - Updated the image format options in the export functionality to only allow PNG and JPEG, removing WebP to prevent silent downgrades. - Enhanced error handling to provide clear feedback when an unsupported image format is specified. - Adjusted related documentation and comments to reflect the changes in supported formats across the application. These changes ensure consistency in image export behavior and improve user experience by providing immediate validation errors for unsupported formats. * feat(origin-validation): implement zero-config OD Clipper bypass for library requests - Added a new function `isZeroConfigClipperLibraryRequest` to validate requests from locally-installed browser extensions targeting the `/library/` path. - Updated the origin validation middleware to utilize this function, allowing unpaired browser extensions to access the `/api/library/ingest` endpoint while blocking other cross-origin requests. - Enhanced tests to cover the new bypass functionality, ensuring correct behavior for both valid and invalid origins. These changes improve the integration of browser extensions with the local daemon, enhancing user experience while maintaining security. * feat(design-systems): add download functionality for design systems - Implemented a new command `od design-systems download <id>` to allow users to download design systems as a .zip file, including all system files and a generated SKILLS.md usage guide. - Updated the CLI help documentation to include usage instructions for the new download command. - Enhanced the design systems API to support the download feature, ensuring only user design systems are accessible while handling errors for non-existent presets. - Added localization strings for the new download functionality across multiple languages. These changes enhance the usability of design systems by providing a straightforward method for users to obtain and share their design assets. * feat(design-systems): enhance design system management and localization - Introduced new UI components and styles for managing design systems, including buttons for downloading, refreshing, and resetting edits. - Updated the DesignKitView to support direct actions for DESIGN.md editing, improving user interaction with design systems. - Enhanced the DesignSystemDetail component to include download functionality and improved state management for design system edits. - Added localization strings for new features, ensuring consistent user experience across multiple languages. - Improved error handling and user feedback for design system operations, including download failures. These changes streamline the design system management process, making it more intuitive and user-friendly while ensuring robust localization support. * feat(tests): add comprehensive tests for design system archive functionality - Introduced a new test suite for validating the `buildUserDesignSystemArchive` and `buildDesignSystemSkillsMarkdown` functions. - Implemented tests to ensure correct packing of design system files, including the generation of a `SKILLS.md` guide and exclusion of internal metadata. - Added checks for handling non-user IDs and scenarios where a design system already includes its own `SKILLS.md`. - Enhanced the overall test coverage for design system functionalities, ensuring reliability and correctness in the design system archive process. These changes improve the robustness of the design system features by ensuring thorough testing of critical functionalities. * feat(figma-import): enhance CLI output and add Figma import endpoint - Updated the CLI to conditionally log detailed import information based on the `--json` flag, improving usability for users who prefer JSON output. - Introduced a new API endpoint for importing Figma files, handling file uploads and validating project existence, with appropriate error responses for missing files or invalid URLs. - Added a dedicated route for the Figma import functionality, ensuring seamless integration with existing project workflows. These changes improve the Figma import experience by providing clearer output options and robust error handling, enhancing overall user interaction with the CLI and API. * feat(design-files): enhance DesignFilesPanel with new actions and styles - Added new action buttons for opening a browser and creating a design system in the DesignFilesPanel, improving user interaction in the empty state. - Updated styles for action buttons to enhance visual distinction and usability. - Enhanced tests to verify the functionality of new actions in the DesignFilesPanel, ensuring they trigger correctly. These changes improve the user experience by providing additional functionality and clearer visual cues in the design files interface. * fix(ci): restore new project modal flow * fix(ci): align design kit and onboarding checks * fix(ci): sync bake preview workflow action * fix(ci): include plugin preview helper scripts * fix(review): harden brand source and preview flows * fix(ci): stabilize web workspace tests * fix(review): address latest blocking feedback * chore(ci): retrigger validation after label update * chore: re-trigger CI on updated main — needs-validation gate moved to merge_group (#4714) * refactor(lightbox): implement portal for overlays to resolve z-index issues - Updated the lightbox component to use React's createPortal for rendering overlays directly to the <body>, ensuring proper z-index stacking. - Removed session mode toggle from HomeHero and adjusted related styles and tests accordingly. - Cleaned up CSS by removing unused styles related to session mode toggle. - Updated tests to reflect changes in the HomeHero component and its interaction with the design router. * style(home-hero): remove focus halo from template search input - Updated CSS to eliminate the global input focus outline and box-shadow for the template search field in the HomeHero component. - Added a test to verify that the template picker search field maintains a clean appearance when focused. * feat(design-system): add create design CTA and enhance design kit functionality - Introduced a new `DesignSystemCreateCta` component to facilitate creating new designs from an active design system, enhancing user experience in the chat interface. - Updated `ChatPane` to include the new CTA, allowing users to create designs directly from the chat. - Enhanced `DesignKitView` with sticky header functionality for better accessibility while scrolling. - Added new CSS styles for the `DesignSystemCreateCta` component to ensure a visually appealing and consistent design. - Updated internationalization files to include new strings for the design system creation feature. * feat(upload): enhance file upload handling and error recovery - Introduced `sanitizePath` to preserve directory structures during file uploads, preventing issues with subdirectory paths. - Updated `DesignKitView` and related components to utilize the new `sanitizePath` function for improved file name resolution. - Added `KitErrorBoundary` component to gracefully handle rendering errors in the design kit, providing a user-friendly fallback. - Implemented internationalization updates for new error messages and action confirmations related to uploads and error handling. - Enhanced CSS styles for better visual feedback during error states and improved user experience. * feat(design-kit): add keyboard shortcuts hint and enhance key handling - Introduced a new keyboard shortcuts hint in the DesignKitView, providing users with quick access to essential actions (E edit, C copy, U upload, R refresh, ⌫ delete logo). - Implemented a keydown event handler to manage keyboard shortcuts contextually within the design kit, improving user interaction and accessibility. - Updated CSS for the shortcuts hint to ensure it remains low-contrast until hovered, enhancing the UI experience. - Added internationalization support for new shortcut labels and hints across multiple languages. - Adjusted DesignSystemsTab to prefer user logos for their systems, improving visual consistency. * feat(design-system): introduce DesignSystemExtractionPanel and enhance design system interactions - Added the `DesignSystemExtractionPanel` component to facilitate user interactions during design system extraction, providing a synthesized conversation view and next steps. - Updated `ChatPane` to render the new extraction panel when a design system is active, enhancing user guidance. - Introduced a new utility function `designSystemExtractionSource` to derive human-readable labels for design system sources. - Enhanced internationalization support with new strings for extraction-related actions and prompts across multiple languages. - Updated various components and tests to reflect changes in terminology and functionality, improving overall user experience. * feat(project): add project deletion functionality and enhance design system interactions - Introduced `onDeleteProject` prop in `ProjectView` to handle project deletion, improving project management capabilities. - Updated `AppInner` to include the new delete project handler, enhancing user experience in project interactions. - Enhanced `DesignKitView` and `DesignSystemsTab` with loading states and improved visual feedback during design system resolution. - Removed deprecated `DesignSystemCreateCta` component and associated styles, streamlining the codebase. - Updated internationalization files to reflect changes in project management terminology and actions. * feat(design-kit): enhance internationalization and user feedback in DesignKitView - Updated various labels and error messages in the DesignKitView to utilize internationalization functions, improving accessibility and user experience. - Enhanced color input validation messages and added confirmation prompts for design system deletions in DesignSystemsTab and FileWorkspace. - Introduced new props for handling design system project deletions, streamlining project management. - Updated internationalization files to reflect new strings and translations for improved user guidance across multiple languages. * refactor(design-kit): remove keyboard shortcuts hint and streamline header menu - Eliminated the keyboard shortcuts hint from the DesignKitView, simplifying the header menu. - Updated the sticky-header overflow menu to exclude upload, full-system preview, and shortcut help actions, focusing on essential project operations. - Adjusted related tests to reflect the removal of the shortcuts hint and ensure accurate menu item visibility. * feat(brand-routes): add extract-from-html endpoint for brand extraction - Introduced a new POST endpoint `/api/brands/:id/extract-from-html` to re-run brand extraction using HTML rendered from the in-app browser after clearing anti-bot walls. - Implemented error handling for missing HTML and brand not found scenarios. - Enhanced the `extractBrandFromHtml` function to process the provided HTML and optional CSS, integrating it into the existing brand extraction workflow. - Updated `prefetch` functionality to support extraction from pre-rendered HTML, improving the overall brand data retrieval process. * chore(nix): refresh pnpm deps hash * feat(brand-cli): add extract-from-html command for brand extraction - Introduced a new CLI command `od brand extract-from-html` to facilitate brand extraction from pre-captured rendered HTML, allowing users to bypass anti-bot walls. - Enhanced the command to accept optional CSS and base URL parameters, improving flexibility in extraction scenarios. - Implemented error handling for missing HTML input and invalid brand IDs, ensuring robust user feedback. - Updated the `BRAND_USAGE` documentation to reflect the new command and its usage details. - Adjusted server configuration to accommodate larger payloads for the new extraction endpoint. * feat(design-system): enhance design system extraction and browser tools - Added a new script to collect CSS styles from rendered pages, improving brand extraction capabilities by capturing computed styles from cross-origin stylesheets. - Removed the `DesignSystemExtractionPanel` component and its associated styles, streamlining the codebase. - Updated `ProjectView` and `FileWorkspace` components to enhance design system interactions and improve user experience. - Introduced new internationalization strings for design system phases and actions, ensuring better user guidance across multiple languages. * feat(brand-assist): implement browser assist for brand extraction - Added support for a client-side confirmation mechanism for the brand-browser-assist od-card, allowing users to extract brand information from the unblocked browser DOM. - Enhanced the `ProjectView`, `ChatPane`, and `AssistantMessage` components to handle the new assist functionality, improving user interaction during brand extraction. - Introduced new internationalization strings for browser assist prompts and messages, ensuring clarity and guidance across multiple languages. - Updated the `useBrandReadyPrompt` hook to manage the state of the browser assist, providing a seamless user experience when dealing with anti-bot walls. * feat(brand-prompt): enhance BrandReadyPrompt with refinement options - Updated the BrandReadyPrompt component to include options for AI optimization and manual editing, allowing users to refine extracted brand systems. - Added a new refinement nudge to inform users that automatic extraction may miss details, improving user guidance. - Adjusted styles for the prompt and dismiss button for better alignment and visual consistency. - Introduced new internationalization strings for the refinement features, ensuring clarity across multiple languages. - Removed deprecated PPTX export functionality from the FileViewer component, streamlining the export options. * refactor(export): remove PPTX export functionality and streamline export options - Eliminated PPTX export support across various components, including CLI, desktop, and web, to simplify export formats. - Updated documentation and help messages to reflect the removal of PPTX, ensuring clarity for users. - Adjusted export-related types and constants to focus on PDF and image formats only, enhancing code maintainability. - Improved user experience by refining export options and related UI elements. * refactor(export): remove PPTX references and update export functionality - Removed all instances of PPTX export functionality from the codebase, including related dependencies and comments. - Updated export options to focus solely on PDF and image formats, enhancing clarity and maintainability. - Adjusted UI components and tests to reflect the removal of PPTX, ensuring a streamlined user experience. - Improved internationalization strings and documentation to align with the new export capabilities. * chore(nix): refresh pnpm deps hash * fix(onboarding): preserve selected runtime * fix(brand): localize generated kit copy * fix(onboarding): align first-run flow with main * fix(nav): use palette icon for design systems * fix(analytics): use design system onboarding step * fix(ui): remove design system guide toggle * fix(ui): position design system ready prompt * fix(ui): space plugin task notice * fix(web): restore home ask mode and design kit preview * test(e2e): align onboarding visual capture * test(e2e): align amr onboarding checks * fix(brand): remove blocked reference brands * feat(onboarding): show profile choices as chips * fix(home): prefer design system cover art in recents * test(e2e): select onboarding profile chips * feat(brand-extraction): implement programmatic extraction transcript and UI enhancements for design systems * feat(brand-extraction): enhance programmatic extraction with transcript agent support and UI improvements * feat(brand-extraction): add transcript agent resolution and improve message handling in brand extraction * fix(design-systems): stabilize loading state coverage * test(e2e): align design system detail visual * fix(brand-extraction): backfill programmatic transcripts * fix(web): refresh ready brand design systems * fix(brands): stabilize extraction handoff and seed colors * fix(brands): return extraction transcript immediately * fix(web): open new project modal from entry rail * fix(editing): expose content edits for plain targets * feat(file-viewer): implement manual edit draft dirty state tracking and reset logic * feat(design-system): enhance project creation flow with conversation ID handling * feat(brands): implement light theme handling for color extraction and seed generation * feat(brands): add finalizeBrandProject function for brand project completion * feat(file-workspace): add designSystemBrandId prop and update DesignSystemProjectPanel to use it * Fix manual editing for brand kits * fix(design-system): wait for project refreshes * fix(web): open new project modal from rail * fix(web): restore home ask mode toggle * fix(web): sync brand color edits with seeds * fix(web): stabilize design system workspace tests * test(tools-pack): relax Windows resource cache timeout * chore(pr): retrigger review after validation * fix(web): surface design kit action progress * fix(web): clarify brand next-step actions * fix(web): cancel programmatic brand extraction * fix(web): add design systems tab action feedback --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: xne998808-ai <xne998808@gmail.com> Co-authored-by: PerishCode <perishcode@gmail.com> Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com> Co-authored-by: lefarcen <935902669@qq.com> Co-authored-by: Siri-Ray <2667192167@qq.com>	2026-06-25 03:56:14 +00:00
PerishFire	0bf1b6d6b8	[codex] converge release workflows and stable dry-runs (#4390) ... * fix(tools-pack): use junctions for Windows standalone peer deps * fix(desktop): expose IPC during startup * fix(tools-pack): preserve Windows inspect diagnostics * fix(tools-pack): report Windows inspect status errors * fix(packaged): use Electron net fetch for app protocol * fix(packaged): load Windows renderer from web sidecar * fix(desktop): show Windows packaged window during startup * fix(packaged): disable Windows GPU startup * fix(tools-pack): keep Windows core smoke observable * fix(packaged): remove Windows startup probes * fix(tools-pack): trace Windows desktop IPC status * fix(tools-pack): add Windows IPC diagnose loop * fix(release): default beta-s Windows updater feed * chore: clean merged test eof * refactor(release): unify prerelease channel model * chore(release): close prerelease doc escape hatches * refactor(release): converge release channel workflows * fix(release): install toolchain in metadata jobs * fix(release): build release package before contracts * chore(release): bump development version to 0.10.1 * fix(e2e): seed windows packaged smoke runtime config * fix(release): install toolchain for metadata publish * fix(release): materialize betas metadata checkout * chore(release): bump development version to 0.10.2 * fix(release): allow betas metadata cold start from s3 * fix(e2e): support betas packaged update scenarios * fix(release): pass betas channel into packaged smoke * fix(release): set betas channel during self-hosted builds * fix(release): verify counted channel reservations * fix(release): use pnpm cmd for betas windows publish * fix(release): add betas manifest artifact fallback * fix(release): skip beta-s public metadata fetch * fix(release): read beta-s manifests from storage * fix(release): cache beta windows tools-pack builds * fix(release): inline beta mac tools-pack builds * fix(pack): deep sign unsigned mac bundles * docs(pack): document payload-first beta updater validation * fix(release): align preview tools-pack cache flow * fix(release): align prerelease tools-pack cache flow * fix(release): pass github token to prerelease metadata * fix(release): setup pnpm before feishu notify * fix(release): add stable dry-run prepublish flow * fix(release): accept completed prerelease metadata gate * fix(release): require stable release branches * fix(release): converge r2 access checks * fix(updater): use release channel parser for defaults * fix(updater): harden windows payload relaunch * fix(release): converge updater smoke fixture contract * test(e2e): require silent updater fixture output * fix(release): align stable windows smoke build path * fix(ci): include release workspace in validation * fix(ci): repair release validation lanes Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) * fix(ci): restore zero-install Feishu notification Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-23 06:13:21 +00:00
kokisanai	b02d20e6b9	fix: unify Discord invite links (#4452) ... Co-authored-by: koki yanlai xu <koki@kokideMacBook-Air.local>	2026-06-17 08:25:16 +00:00
PerishFire	915548b4bd	[codex] Fix social template English metadata (#4427) ... * Fix social media template English metadata * Remove social template description hard wraps Generated-By: looper 0.9.10+codex.autoclean (runner=fixer, agent=codex) --------- Co-authored-by: Siri-Ray <2667192167@qq.com> Co-authored-by: Looper <looper@noreply.github.com>	2026-06-17 11:00:06 +08:00
lefarcen	f6cceb303d	fix(plugins): unwrap cosmetic hard wraps in bundled manifest descriptions (#4406) ... Picking a Home example-prompt card (or "Replicate this content" in the plugin detail modal) seeds the composer with the plugin manifest's `description`. Many descriptions were authored with cosmetic hard wraps (a single newline mid-paragraph, ~75 cols, as if formatted for a terminal/markdown source). The composer renders the seed with `white-space: pre-wrap`, so those newlines survived as short ragged lines that never filled the editor width — leaving a large blank gutter on the right of the input box (e.g. the Trading Analysis Dashboard template: 4 hard breaks, ~200px / 29% of the editor blank). Reflow the offending `description` / `description_i18n` strings in the 56 affected bundled manifests into flowing text (wrapped lines joined, real blank-line paragraph breaks preserved; CJK joins carry no space). Surgical string edits only — manifest formatting/key order untouched (146 lines changed across 56 files). The full build spec still reaches the agent as plugin context (SKILL.md + example.html); only the human-facing seed copy changed. Add an e2e guard (plugin-description-hardwrap.test.ts) that fails if any bundled manifest description carries an intra-paragraph hard wrap, so the cleanup can't silently regress when new examples are added.	2026-06-16 22:39:55 +08:00
free666799	eb749841b4	fix(home): surface community slide decks on Home with letterbox-free 16:9 previews (#4350) ... * fix(plugins): surface slides decks on Home instead of marketplace sources The 23 community slides/deck plugins from #4127 were registered as a restricted community marketplace source, so they showed up as installable "available sources" cards (受限 + Install) instead of on Home. Relocate them to plugins/_official/examples so they ship bundled — appearing in the Home Community gallery and the deck example-prompt rail, exactly like the existing zhangzara / swiss / guizang decks — and drop their community-registry entries. - Move 23 plugins/community/<slug> → plugins/_official/examples/<slug> (upstream LICENSE / author / homepage / "Based on" attribution preserved) - Rename manifest name community-<slug> → example-<slug> (bundled convention) - Remove the 23 entries from plugins/registry/community/open-design-marketplace.json (the 3 pre-existing community entries stay) - HomeHero: uncap the deck example-prompt rail (other chips keep the curated 18) so every bundled slide template is reachable straight from "All" - curatedPriority: pin the 23 slides to the front of both the deck example rail and the Community Slides shelf Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(home): drop provenance tail from deck seeds & fix deck preview letterbox Two polish fixes for the slide/deck plugins now surfaced on Home: 1. Example-prompt seed: strip a trailing source-attribution sentence ("…。移植自 foo/bar 的 baz 模板。" / "Based on …") from the composer seed so the prompt doesn't end on provenance boilerplate. Conservative — only fires when the final sentence opens with an attribution marker and real text precedes it; attribution woven mid-description (followed by a use-case sentence) and the gallery/detail descriptions are left intact. Latin '.' only ends a sentence at whitespace/EOL so "STYLE_PRESETS.md" / "github.com/…" don't mis-split. 2. Deck gallery preview: decks ship a fixed 16:9 stage that scales to its viewport, so the tall scroll-preview frame letterboxed it and showed a dark --stage-bg band above/below the slide. Tag deck cards with data-od-mode and give them a 16:9 frame the iframe fills natively (no transform, no pan), so the stage sits edge-to-edge with no band. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(home): deck preview frame to 16:9 so no white strip below the slide The deck preview override targeted the inner html-frame while the gallery frame kept its fixed 300px height, leaving a white strip under the 16:9 slide. Make the gallery frame itself 16:9 for deck cards so the stage fills it exactly — title bar + slide, nothing left over. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(decks): hide the page-counter chrome on all 23 community slide decks The five upstream deck families each render a different page-counter ("1 / 10") — a center pill (.deck-controls), an id="counter" badge, a fixed .deck-counter, or a .count span inside a Shadow-DOM rail — so the home gallery thumbnails showed it inconsistently. Per maintainer request, drop it everywhere rather than unify: inject a display:none rule for the light-DOM counters and inline- hide the Shadow-DOM .count span. Keyboard/touch navigation is untouched; only the visual counter is removed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(home): fix deck letterbox band in the example-prompt rail tiles too The earlier 16:9 deck-preview fix only covered the Community gallery cards; the hero example-prompt rail tiles render the deck in a 4:3 (1440×1080) preview and still showed a dark --stage-bg band on top. Tag deck preset tiles with data-od-mode and give them a 16:9 preview the iframe fills natively, matching the gallery treatment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(home): remove the ↗ open-external button from community gallery cards The ↗ only rendered when a tile's preview was an HTML source, so it appeared on some cards (most decks, a few prototypes) and not others (images, srcless tiles) — inconsistent chrome across the shelf. Drop it and the whole onOpenExternal pass-through (PluginCard → PluginsHomeSection → HomeView) plus the now-dead .plugins-home__gallery-open styles. * fix(home): make the community search clear (×) button visible The clear button uses the shared <Button> component, whose CSS-module class set padding 6/12 and crushed the 12px × glyph to zero width inside the 26px button (a blank grey square). The .plugins-home__search-clear reset only out-specified the global `button {}` element rule, not the component class — scope it under .plugins-home__search so the padding:0 / 20x20 sizing actually wins. * fix(home): align deck example-prompt tile title row with other tiles Deck preset tiles used a 16:9 `auto` preview row, so their card was shorter than the fixed-150px sibling tiles; the flex rail stretched them back up and the slack leaked into the title row, making deck titles ~6px taller. Keep deck tiles on the standard 150px preview cell and center the native 16:9 stage inside it (neutral margin, no dark band), so card and title-row heights match prototype/HyperFrames/image tiles. * fix(deck-bridge): mirror the visible class so reveal animations fire on navigation Reveal-animation decks (the frontend-slides family) gate staggered entrances on a separate `.slide.visible` class that the deck's own show() adds alongside `.active`. The host bridge's setActive() flipped only the active class, so bridge-driven page turns showed slide chrome but left every .reveal child at opacity:0 — the body rendered blank. Mirror `.visible` in lock-step with the active slide (only for decks that use it, a no-op elsewhere). Adds a red→green regression test. * fix(home): unpin the bare Frontend Slides template from the slides shelf example-frontend-slides is the family-root template with a generic cover; pinned first it read as filler leading the Slides shelf and deck chip. Drop it from PINNED_SLIDE_PLUGIN_IDS so it falls to the uncurated tail while the styled variants (Creative Voltage, Electric Studio, …) keep the lead. --------- Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 09:32:15 +00:00
free666799	c7e422d7a2	feat(plugins): unify all 56 official deck seeds with the Open Design product narrative (#4357) ... * feat(plugins): unify all 56 official deck seeds with the Open Design product narrative Apply the same canonical 10-section story used for the community slides batch (sourced from the homepage structure doc + README) to every official deck plugin seed that ships an example.html: cover, why, three claims, numbers board (60K+ stars / 300+ contributors / 217+ plugins / 129 design systems / 21 agents), 5-step workflow, multimodal outputs, capabilities, agent ecosystem, testimonial, and CTA with GitHub/Discord/X links. Scenario decks keep their framing with Open Design as the subject: weekly-report/weekly-update become OD growth reports, course-module a getting-started tutorial, testing-safety-alert the local-data-security story, xhs-* decks OD-themed xiaohongshu notes, ib-pitch-book an investor narrative, presenter-mode-reveal keeps its presenter-mode demo. open-design-landing-deck only gets its numbers aligned to the canonical figures. Skipped (no example.html seed): guizang-ppt, html-ppt, replit-deck. Content-only edits: CSS tokens, layouts, decorations, animations, keyboard nav, hash routing and functional JS untouched. zh 13 decks / en 43 decks per existing typography. All 56 verified: script syntax, cover screenshot, no fictional brand residue. * fix(decks): wire dead Download/closing CTAs to real destinations Review follow-up for #4145: primary Download CTAs now point to https://open-design.ai/ (the canonical download landing), and the remaining href="#" closing links (Star on GitHub / Discord / X / See All Agents) point to the repo, Discord invite, and X profile. Also split the landing-deck primary CTA off the repo-root URL so the primary and secondary actions no longer share a destination. * style(official-decks): anti-slop visual pass across the official deck seeds Restyle/polish sweep over all 55 official example decks (taste-skill + impeccable + gsap-skills guidelines): - A-class seeds (AI-slop look: default Inter, purple-blue gradients, uniform rounded shadow cards) fully restyled with distinct typographic systems, locked single accents, and off-white/off-black grounds. - B-class seeds (clear style family, e.g. the zhangzara-* craft set) kept their family signature and received polish only: spacing rhythm, contrast to WCAG AA, hairline discipline, reduced-motion guards. - Motion limited to transform/opacity with prefers-reduced-motion guards; signature ease cubic-bezier(.16,1,.3,1). - Content is unchanged: all copy, numbers (60K+ stars, 217+ plugins, 129 design systems, 21 agents, -80% cost), links, slide counts and the deck engine scripts are byte-identical to the previous seeds. - html-ppt-zhangzara-pin-and-paper already met every rule (craft fonts, single ink accent, static content) and is intentionally untouched. * i18n(official-decks): translate all Chinese deck seeds to English All official slide seeds are now English-only per template policy. 15 decks translated (~12,000 CJK chars): presenter-mode-reveal, testing-safety-alert, xhs-pastel-card, tech-sharing, obsidian-claude-gradient, knowledge-arch-blueprint, xhs-white-editorial, hermes-cyber-terminal, xhs-post, dir-key-nav-minimal, graphify-dark-graph, ppt-keynote, guizang-editorial, swiss-international, open-slide-canvas. - Layout, engine scripts, slide counts, stats (60K+/300+/217+/129/21/ -80%) and links unchanged; only content language changed. - CJK-specific Google Fonts (Noto Sans/Serif SC, ZCOOL KuaiLe, Songti) replaced with Latin families matching each deck's voice (Inter, IBM Plex Sans, Nunito, Patrick Hand, Georgia, Noto Serif). - The xhs-* social decks keep their Xiaohongshu aesthetic with native English social copy. - Overflow from longer English copy fixed with minor per-element type sizing; every deck screenshot-verified; zero CJK characters remain across all 56 official deck seeds. * fix(xhs-pastel-card): restore absolute positioning of topbar/footer chrome The content-layer rule '.slide > *:not(.xp-blob){position:relative}' (specificity 0,3,0) overrode the absolutely-positioned .xp-topbar and .xp-footer (0,2,0), dropping both into the flex flow: the chip overlapped the headline, left:90px turned into a 90px rightward shift that pushed the page number off-canvas, and bottom:40px lifted the footer into the body copy on every slide. Excluding the two chrome elements from the content-layer rule restores the intended layout; verified per-slide screenshots across all 8 slides. * feat(deck-seeds): expand the three sampler decks to full 10-page examples deck-guizang-editorial, deck-swiss-international, and deck-open-slide-canvas shipped as 1-2 page style samplers while every other official seed carries a full 8-11 page example. Each is now a 10-page deck built from its own SKILL.md layout vocabulary: - guizang-editorial: one page per L01-L10 layout, single Ink/Monocle palette per the 5-pick-1 rule, ink/paper reversal for rhythm. - swiss-international: 10 of the 22 locked layouts (statement, cards, six-cell grid, timeline, duo compare, loop diagram, why-now, closing manifesto), Klein Blue as the single accent; SKILL.md example_desc updated from the stale two-page wording. - open-slide-canvas: ten free-composition 1920x1080 canvases (asymmetric split, oversized numerals, positioned-block flow, editorial quote, comparison spread) with keyboard + hash navigation per its own convention. Content follows the English-only OD narrative with canonical stats and links; every page screenshot-verified; zero CJK; single-file with Google Fonts as the only external resource. * fix(decks): wire the two remaining dead closing-slide CTAs Review follow-up for #4145 (nettee, looper reviewer): - 8-bit-orbit: the closing 'Download Open Design' / 'Star on GitHub' pixel buttons were plain <button> elements with no click handling; converted to anchors targeting https://open-design.ai/ and the GitHub repo, keeping the .pixel-btn skin. - retro-windows: the closing copy promised download/star actions but the action row was the old unwired Restart / Contact / End Session set; replaced with Download Open Design / Star on GitHub / Join Discord anchors in the same .btn-retro skin. * fix(decks): wire remaining button-skinned dead CTAs across deck seeds Review follow-up for #4145 (looper reviewer round 3). Converts every remaining action-copy control that carried button/chip skin but no href into a real anchor with the canonical targets, keeping each deck's skin: - zhangzara-long-table: closing .pill chips (GitHub / Download) and the cover 'Star on GitHub' pill - zhangzara-raw-grid: closing .label arrow Download + the two .s10-rb-block tiles (macOS-Windows / Star on GitHub) - zhangzara-peoples-platform: GET STARTED slide DOWNLOAD block - obsidian-claude-gradient: all four .oc-pill chips on the CTA slide - zhangzara-biennale-yellow / sakura-chroma / cobalt-grid colophon ftag labels, zhangzara-pink-script 'Star on GitHub' tile, and ib-pitch-book 'Download Open Design' stamp (same pattern, found by a repo-wide sweep for the regression class) * fix(decks): wire zhangzara-coral closing-slide social icons to anchors * feat(plugins): unify guizang-ppt (magazine-web-ppt) deck default with the Open Design product narrative in English The deck-mode default seed (magazine-web-ppt, dir guizang-ppt) was the one official deck the narrative+i18n pass missed, because its content lives in assets/example-slides.html + assets/template.html rather than example.html. - Rewrite the 9-slide example deck to the English Open Design product narrative (60K+ stars / 300+ contributors / 217+ plugins / 129 design systems / 21 agents / -80% cost), preserving the magazine editorial layout vocabulary and hitting all 8 layout categories. English titles use the Playfair .h-hero-en family; copy follows anti-slop craft (no decorative em-dashes, real labelled metrics, tight hierarchy). - Translate template.html (title, hint, all CSS/JS comments), SKILL.md, references/*.md, open-design.json, and the design-templates README to English. - Keep magazine-web-ppt name, mode=deck, default_for=deck intact. - Both synced copies (plugins/_official + design-templates) updated identically. --------- Co-authored-by: free666799 <293857035+free666799@users.noreply.github.com>	2026-06-16 08:41:04 +00:00
PerishFire	a0afc584bb	[codex] centralize daemon data directory docs (#4222) ... * docs: centralize daemon data directory contract * fix(e2e): allow slower artifact consistency navigation Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * docs: localize daemon data directory pointers Generated-By: looper 0.9.5 (runner=fixer, agent=codex) --------- Co-authored-by: Looper <looper@noreply.github.com>	2026-06-15 02:52:05 +00:00
elihahah666	ec524986b5	chore(plugins): remove html-ppt-dir-key-nav-minimal and html-ppt-xhs-post (#4212) ... * chore(plugins): remove html-ppt-dir-key-nav-minimal and html-ppt-xhs-post Final cut list from the maintainer review of the slide-template gallery (narrowed from the originally proposed nine html-ppt studio seeds to these two; the other seven stay). Removed across every surface: - plugins/_official/examples/<slug>/ (2 plugin dirs) - design-templates/<slug>/ (2 catalogue entries) - plugins/registry/official/open-design-marketplace.json entries - apps/web/src/i18n/content{,.ru,.fr}.ts slug keys Landing-page solution showcases never referenced these two, so no landing changes are needed. pnpm guard and pnpm typecheck pass; repo-wide grep for both slugs returns zero hits. * fix(registry): sync bundledPreinstallCount after removing two plugins plugins-marketplaces.test.ts asserts metadata.bundledPreinstallCount equals the registry plugins array length; update 414 -> 412 to match the two removed entries. --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-13 13:15:04 +00:00
elihahah666	b034609cde	chore(plugins): remove the shamoni example plugin (duplicate preview imagery) (#4040) ... * chore(plugins): remove the shamoni example plugin The Shamoni scroll-driven gallery example ships a baked preview that duplicates luxury-botanical's hero imagery, so the Community shelf shows the same perfume tile twice. Curator call: drop the example entirely — plugin folder, baked-preview manifest entry, and its slot in the pinned curated ordering. * fix(daemon): prune persisted bundled rows when their folder leaves the image The bundled boot walker only upserted folders that still exist, so a plugin removed from the daemon image (like the Shamoni example this PR deletes) survived in upgraded installs' installed_plugins table — and /api/plugins kept serving a record whose backing files were gone. Make bundled rows mirror the bundled tree: after a successful walk, delete source_kind='bundled' rows whose folder was not seen this boot. Folders that still ship but fail to parse stay registered (warned, not pruned), the ENOENT early-return never prunes (a missing bundledRoot is a packaging bug, not a removal), and user-installed rows are untouched. --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-10 08:07:12 +00:00
elihahah666	ec47346e94	feat(web): composer 插件菜单 & 设计百宝箱 hover 预览 (#4000) ... * feat(web): hover-preview column in the composer plugins menu Hovering (or arrow-defaulting to) a plugin in the composer "+" → Plugins flyout now opens a second-level preview column: a live preview hero (reusing the plugins-home PreviewSurface — media poster or sandboxed example iframe) plus the localized title, trust badge, description, and tags. The previewed row stays highlighted so the panel's subject is clear before the cursor lands. The Plugins flyout widens to fit the side column and reserves that width in the placement math; on narrow (contained) surfaces the preview drops below the list instead. Other submenus are unchanged. * feat(web): design-toolbox hover preview + styled detail panel Extends the plugin hover-preview to the project composer's design toolbox. Hovering a plugin entry now renders the same rich preview (ComposerPluginPreview — poster / sandboxed example iframe + title, trust badge, description, tags); every other kind (skill, MCP, connector, file, follow-up action) keeps a compact text card. The shared hover-detail panel (.plus-menu__detail) previously shipped with no CSS at all — it had no position/background/border, so the inline left/top never applied. This adds the panel styling (fixed, panelled, shadowed, viewport-clamped) plus the section-label and detail text styles, and clamps the panel's top so the taller plugin preview stays on screen. ComposerPluginPreview's column divider was de-scoped to the plugins-flyout context so it renders cleanly inside the toolbox panel too. * fix(web): drop redundant divider above design-toolbox search The toolbox head carried a border-bottom while the search box below it has its own full border, so with the flyout gap the two hairlines read as a doubled line. Drop the head border; the search box already bounds the section. * fix(web): localize plugin titles in the composer plugins list The list rendered the raw `plugin.title` (often English) while the hover preview used the localized `title_i18n`, so the same plugin showed two different-language names side by side. Render the localized title in the list too, and fold it into the search haystack so a localized-name query still matches. * feat(web): show plugin kind tag in the hover preview Adds a localized kind pill (Prototype / Slides / Image / Video / Audio / HyperFrames / Live artifact) to the plugin preview title row, reusing extractCategories — the same taxonomy that powers the home Community filter chips — so the preview names the plugin's type at a glance. Shows in both the composer plugins menu and the design-toolbox preview. * fix(web): localize the applied-plugin chip title The composer's applied-plugin chip showed the raw `record.title` (English, e.g. "Audio Jingle") while the same plugin's preset card / hover preview used the localized `title_i18n` (e.g. "音频铃声"), so the two read in different languages. Localize the chip in both surfaces: - HomeView: activeBadgeTitle now uses localizePluginTitle(locale, record). - PluginsSection: the ContextItem label (project ChatComposer chip) too. Mirrors the already-correct PluginPromptPresetCard pattern. * fix(web): localize trust badge, drop raw tag chips from preview - TrustBadge now resolves its label via i18n (pluginsView.trust.*) so Official / Trusted / Restricted follow the active locale everywhere it renders; an explicit `label` prop still overrides. - Drop the raw manifest tag chips from the plugin hover preview. Tags are author-defined English slugs with no controlled vocabulary, so they can't be reliably localized; the localized kind pill already conveys the category, so the card stays single-language. * feat(web): tag design-system plugins in the hover preview Design-system plugins aren't one of the home Community facets, so extractCategories returns nothing and they had no kind pill. Detect them by mode/tag (same heuristic as the preview classifier) and show the localized 'Design systems' label (entry.navDesignSystems). * i18n(plugins): backfill title/description translations for 22 example plugins These 22 official example manifests shipped title_i18n / description_i18n with only zh-CN + en, so in every other UI language (Korean, Japanese, …) the plugin name and description fell back to English — visible now that the composer surfaces them in the hover preview. Fill all to the full 18-locale set (zh-CN, zh-TW, ja, ko, de, fr, ru, es, pt-BR, it, vi, pl, id, nl, ar, tr, uk, en), matching the locale set used by the already-complete manifests. Brand/product/proper names and technical terms are kept verbatim; useCase.query stays English-authoritative. * fix(web): clamp design-toolbox detail panel into the viewport The left-side fallback (when the right side overflows) used rect.left - gap - detailWidth without clamping, so a row near the left edge or a pane narrower than detailWidth + gap*2 produced a negative left and pushed the position:fixed panel off-screen. Clamp the chosen left into [8, innerWidth - 8 - detailWidth] so it always degrades gracefully. (review: nettee/looper) * test(web): extract + unit-test toolbox detail panel positioning Pull the detail-panel placement out of showToolboxDetail into a pure computeToolboxDetailPosition helper and pin the narrow-pane clamp with a focused vitest regression (row near left edge / viewport narrower than the panel never yields a negative left; top clamps too). Addresses the nettee/looper review ask for a regression check. * fix(web): match plugins-flyout placement reserve to rendered width PLUS_MENU_PLUGIN_FLYOUT_WIDTH was 560 while .plus-menu__flyout--plugins renders at 466px, so getFlyoutPlacement over-reserved and medium-width panes (~664-757px side room) wrongly fell back to the contained layout, silently dropping the side-by-side preview column. Set it to 466 (with a cross-reference comment to the CSS), extract the boundary arithmetic into a pure resolveFlyoutSide helper, and pin the 466-vs-560 boundary with a vitest regression. (review: nettee/looper) * fix(web): localize trust badge tooltip + aria text title and aria-label still came from the hard-coded English meta.description, so on non-English locales the badge read as mixed-language to tooltips and screen readers. Resolve all of label, title, and aria-label from the localized tier key. (review: nettee/looper) * fix(web): update TrustBadge test for localized a11y text The existing TrustBadge spec asserted the old hard-coded English descriptions ("Open Design official", aria "…: Action plugin"), which the localization change replaced — that's why Web workspace tests went red. Keep a localized tier prefix in the accessible text when a contextual label is passed ("Official: Action plugin") and update the spec to pin the localized behavior. --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-09 17:04:11 +00:00
lefarcen	b8489c9874	fix(plugins): pin the Motion React UMD loader in motionsites plugins (follow-up to #3973) (#3992) ... * fix(plugins): pin Motion React UMD loader in plugins, generalize the system-prompt rule PR #3973 patched the blank-screen crash (Motion React hooks loaded from the vanilla motion.js DOM bundle) at the runtime/write boundary and added a Framer Motion note to the official system prompt. This closes the remaining gaps: - Root cause was in the plugins, not just the runtime: the 25-plugin motionsites batch (#3873) prescribes Framer Motion hooks in the React port but never locks how to load them, exactly as it locks fonts/colors/asset URLs. Add a "Motion loading (locked)" note to the 8 plugins that genuinely prescribe Framer Motion (3d-creator-portfolio, acreage-farming, evergreen-finance, liquid-glass-agency, luxury-botanical, mindloop-landing, portfolio-cosmic, shamoni). Plugins that map useScroll *down* to a passive listener, or use GSAP only (cinematic-landing-page), are intentionally left untouched. - Generalize the system-prompt note to lead with the principle (two UMD builds: vanilla DOM vs React, hooks live only on the React build's window.Motion) while keeping one pinned example version. - Add port-path regression coverage for the reported luxury-botanical plugin: full Motion hook set (useScroll/useTransform/useAnimationFrame/useMotionValue), the minified vanilla bundle, and the wrong-bundle + FramerMotion-global combo. Validation: pnpm guard, contracts + daemon typecheck, daemon artifact-runtime-compat.test.ts (8/8). * fix(daemon): widen Motion UMD normalizer to jsdelivr + wrong-file shape The runtime normalizer only matched the exact unpkg `motion@VER/dist/motion.js` script shape, so two real agent outputs still slipped through to a blank screen: a vanilla bundle served from jsdelivr, and the right package name pointing at the wrong file (`framer-motion@VER/dist/motion.js`). Widen the matcher to both hosts and both package spellings, preserve the original CDN host on rewrite, and document the `<script src>`-only boundary (ESM imports / importmaps / esm.sh are steered by the prompt + plugin notes, not rewritten). The React-hook usage gate still keeps animate-only vanilla DOM artifacts untouched, and a new test pins that the correct framer-motion.js bundle is never falsely rewritten. --------- Co-authored-by: audit <a@b.c>	2026-06-09 10:26:06 +00:00
elihahah666	75f1472d53	feat(web): align Home composer facet rails with Community + drop 6 low-quality example templates (#3939) ... * feat(web): align Home composer facet rails with Community + drop 6 low-quality example templates Home composer sub-category rails now mirror the Community plugin grid exactly — same sub-category set, order, and per-facet plugin slice: - Prototype order: Landing/marketing, Brand/design, Dashboards, Apps, Developer tools, Docs/reports - Slides order: Creative decks, Engineering talks, then Pitch/business, Course/training, Reports/briefings, Product/sales - Sub-chips are derived from the full install set (not the curated example subset), so the rail shows every type Community shows - Selecting a sub-category now lists the same plugins Community lists for it via applyFacetSelection (primary-category + sub-category match), so the example-prompt count matches the Community count badge Also removes six example templates with broken/poor visuals (Art Landing, Prisma Creative Studio, Urban Jungle, Modern Agency, AI Automation, FlowMate) and their pinned-order entries in curatedPriority. * fix(web): separate facet display order from matching precedence Addresses review: reordering SUBCATEGORIES re-bucketed overlapping-tag plugins because extractSubcategories() resolves via SUBCATEGORIES.find() (first match wins). Dashboards/app/launch-deck plugins with secondary design/marketing tags wrongly moved into Brand / design or Creative decks in both Home and Community. - Restore SUBCATEGORIES to its original matching precedence (stable buckets) - Add SUBCATEGORY_DISPLAY_ORDER, applied in buildSubcategoryCatalog, so the rails/catalog render Landing/Brand/... and Creative/Engineering/... first without changing which bucket a plugin lands in - Add regression coverage in plugins-home-facets.test.ts for overlapping-tag fixtures (dashboard+design, mobile+design, landing+brand, launch+marketing, pitch+marketing) and update the display-order expectations --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-08 17:56:31 +00:00
lefarcen	bad35b45c9	fix(daemon): stabilize HyperFrames render handoff (#3882) ... * fix(daemon): stabilize hyperframes render handoff * fix: align hyperframes skill handoff guidance --------- Co-authored-by: audit <a@b.c>	2026-06-08 08:15:58 +00:00
elihahah666	a93869ee09	feat(plugins): 25 motionsites example plugins + daemon asset cache (#3873) ... * feat(plugins): add 25 motionsites example plugins + daemon asset cache Add 25 first-party example scenario plugins under plugins/_official/examples/ (packaged from motionsites.ai templates via the motionsites-to-open-design-plugin skill): each ships open-design.json, SKILL.md, and a self-contained rendered example.html fidelity seed. All 25 pass PluginManifestSchema. Their cross-border CDN images/videos (cloudinary, higgs.ai, motionsites, cloudfront) are mirrored to Cloudflare R2 (plugin-assets.open-design.ai) and high-fidelity compressed (732MB -> 302MB), so example.html / query / SKILL.md reference the fast public origin instead of slow cross-border hosts. Daemon asset cache (plugin-asset-cache.ts + /api/asset-cache): a same-origin disk-cached proxy for any external preview media that remains. The preview URL rewriter now routes external media (src/poster attrs, CSS url(), and JS string constants) through it, so cross-border assets satisfy the sandbox CSP (img-src 'self') and load from local cache. SSRF-guarded: http(s) only, no credentials, and every resolved address must be public. * fix(asset-cache): tie SSRF validation to the actual outbound connection The previous guard resolved DNS in assertSafePublicUrl and then let fetch() resolve again independently, so a DNS-rebinding host could pass the validation lookup with a public address and steer the real connection to a private one (e.g. 169.254.169.254). Move the authoritative check to a connection-time undici Agent lookup (createValidatingLookup): the address that is validated is the exact address the socket connects to, closing the TOCTOU gap. assertSafePublicUrl is now a cheap up-front reject (scheme / credentials / localhost / literal private IP) only. Adds createValidatingLookup unit tests (public pass, rebinding-to-private reject, all:true any-private reject). * fix(asset-cache): reject IPv4-mapped IPv6 literals in the private-IP guard Node's URL parser normalizes a bracketed mapped literal like `http://[::ffff:127.0.0.1]/` to the hex form `::ffff:7f00:1`, which the old dotted-decimal regex missed — so a literal mapped host slipped past assertSafePublicUrl (and literal IPs skip the DNS lookup hook), letting `/api/asset-cache` target loopback/private IPv4 via its mapped representation. Canonicalize IPv6 now: expandIpv6() folds `::` compression and any embedded dotted IPv4 into eight 16-bit groups, and isPrivateAddress() detects the full `::ffff:0:0/96` mapped range (hex or dotted), feeding the embedded IPv4 back through the v4 private-range checks. Group-based classification also replaces the prefix string-matching for ::, ::1, fe80::/10, fc00::/7, ff00::/8. Regression coverage added for ::ffff:7f00:1 / ::ffff:127.0.0.1 and http://[::ffff:127.0.0.1]/x.png. * fix(asset-cache): full link-local range + stream-cap the upstream body Two SSRF/DoS hardening fixes on the cache path: - Link-local was matched as the single fe80:: prefix, leaking the rest of fe80::/10 (fe90::, febf::, …) through as "public". Classify with a mask ((groups[0] & 0xffc0) === 0xfe80); ULA/multicast use masks too now. - maxBytes was not a hard ceiling for responses without a trustworthy Content-Length: arrayBuffer() buffered the whole body before the size check, a memory-exhaustion path for a caller-supplied proxy. Stream the body and abort the moment the accumulated size exceeds maxBytes, before concatenating. Tests: fe80::1 / fe90::1 / febf::1 rejected; a no-Content-Length 800-byte stream against a 16-byte cap rejects with 413 after <10 pulls (proves it stops reading instead of buffering the full body). --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-08 07:31:41 +00:00
PerishFire	10dfd32a3e	Revert "feat: add screenshot-based visual validation to critique loop (#3660)" (#3865) ... This reverts commit 931780c914.	2026-06-08 06:24:44 +00:00
nettee	931780c914	feat: add screenshot-based visual validation to critique loop (#3660) ... * feat(daemon): add visual validation atom Generated-By: looper 0.9.3 (runner=worker, agent=codex) * fix(daemon): fail closed in visual validation Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): narrow visual validation defaults Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): add visual validation to default critique stages Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): harden visual validation review fixes Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): fail closed in visual validation discovery Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * test(daemon): tighten visual validation discovery regression Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): match visual validation reference viewport Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): tighten visual validation capture flow Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): fail closed across visual validation refs Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): honor metadata entry file in visual validation Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): capture visual validation through preview route Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): fail closed without preview context Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): disable pre-start visual validation worker Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): narrow visual validation spec discovery Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): stop advertising visual validation as runnable Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): restore visual validation critique worker Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): delay visual validation until run success Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * test(daemon): cover post-run visual validation scheduling Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): gate post-run visual validation before finish Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * chore(nix): refresh pnpm deps hash * fix(daemon): preserve deferred pipeline ordering Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(packaging): bundle Chromium for visual validation Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(scenarios): keep visual validation out of default critique loop Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(packaging): bundle Playwright headless shell Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(packaging): invalidate Playwright resource cache Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * fix(daemon): include visual-validation in bundled atom roster Generated-By: looper 0.9.3 (runner=fixer, agent=codex) * chore(nix): refresh pnpm deps hash * fix: restore pre-run plugin surfaces and nix hashes Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix: preserve pre-run surfaces and tolerate headed-only chromium bundles Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix: launch visual validation with bundled chromium Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix: avoid Playwright fixture teardown races Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix: fail packaged visual validation on shell-only chromium Generated-By: looper 0.9.5 (runner=fixer, agent=codex) * fix: isolate synthetic Playwright test bundles Generated-By: looper 0.9.5 (runner=fixer, agent=codex) --------- Co-authored-by: open-design-bot[bot] <282769551+open-design-bot[bot]@users.noreply.github.com>	2026-06-08 04:03:43 +00:00
elihahah666	df9ec8f40d	examples: add 3D creator portfolio and Velar luxury real-estate templates (#3817) ... * examples: add 3D creator portfolio and Velar luxury real-estate templates Two first-party motionsites.ai template seeds under plugins/_official/examples/, each shipping the manifest + locked SKILL.md spec + a self-contained rendered example.html fidelity anchor. - example-3d-creator-portfolio: dark gradient-text hero with a magnetic 3D portrait, scroll marquee, char-reveal About, and sticky-stacking project cards. - example-velar-luxury-real-estate: typewriter preloader, scroll-driven building that scales up while pinning to a dark stats band, count-up stats, and a hover-expand video gallery. Fixed decoration/portrait images are inlined as compressed WebP data URIs so the card and detail previews never break in the sandbox; large GIFs/videos and stable -CDN backgrounds stay as remote URLs. Both manifests validate against PluginManifestSchema (od.kind=scenario). * examples: use first-party metadata for motionsites templates Align the 3D creator portfolio and Velar manifests with the first-party metadata contract used by the rest of plugins/_official/examples/** (MIT, author Open Design, repo homepage) instead of CC-BY-4.0 / third-party motionsites provenance. Generated-By: looper 0.8.1 (runner=fixer, agent=claude-code) * examples: point all inlined-asset references in the locked query at example.html The per-section spec in od.useCase.query.en still named the original remote hosts (figma.site portrait/decorations, cloudinary HOUSE_IMG) as the asset source, while only the trailing note said to reuse the inlined data URIs. Since the query is the authoritative generation brief injected on Use, a port could copy the deprecated remote URLs and regress to sandbox-403 / broken images. Rewrote those references to instruct reusing the inlined data:image/webp URIs from example.html. Genuinely-remote assets on stable CDNs (the 21 motionsites marquee GIFs, 9 higgs project images, 5 cloudfront gallery videos, the higgs hero background) are unchanged. * examples: align Velar nav dark-section refs in the locked query with the seed The Fixed Navigation bullet in od.useCase.query.en said the nav-color logic watches "Section 4 and Section 5", but the seed and SKILL.md define the dark sections as Section 5 (dark statement band) and Section 6 (gallery). Since the query is injected as the generation brief, the stale ref could make a port watch the wrong sections and leave the nav dark over the gallery. Updated the string to match the seed/skill wording. * examples: give the 3D portfolio nav links real anchor targets The hero nav shipped #price and #contact links with no matching ids in the seed, so half the navbar did nothing in the preview (and ports would inherit the dead links). Added id="price" to the Services section and a minimal contact footer (id="contact") so all four nav anchors resolve to real targets. The four-link names stay as the prompt specifies; only the seed gains anchors. * examples: document the 3D portfolio contact footer in the locked query and skill The previous fix added a #contact footer to example.html but left the injected query and SKILL.md describing only five sections (no contact target), so a port could still recreate a dead #contact anchor. Added the Contact footer section to the SECTION ORDER, a nav→anchor mapping (every link must resolve), and a Contact Section spec in both od.useCase.query.en and SKILL.md so the prompt, skill, and seed all agree. --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-07 15:08:47 +00:00
elihahah666	0d84245b98	feat(plugins): add Dashboard UI — Liquid Glass first-party prototype preset (#3779) ... * feat(plugins): add Dashboard UI — Liquid Glass first-party prototype preset Bundle a premium liquid-glassmorphism conference dashboard as an official example prototype plugin. Picking it routes the plugin as the active driver and reproduces the template: dual theme-swapped fullscreen background videos, a 4x2 glass/solid card grid, animated voice-wave participant indicators, and a floating control bar. - od.kind: scenario with its own generate pipeline (file-write + live-artifact) and the full build spec in od.useCase.query so the agent reproduces the design. - Ships a rendered, self-contained example.html seed as the fidelity anchor and the HTML preview entry; the marketplace card uses the motionsites animated webp poster. - All 30 avatars are inlined as base64 SVG data URIs so the preview never breaks on external avatar-host rate limits inside the sandbox; background videos and screen-share thumbnails stay on stable CDNs. * fix(plugins): make dashboard-ui-glass avatar instructions consistent with the inlined seed The top-of-file "Avatars (critical)" rule says to keep the bundled data: URI avatars, but the Profile button and Meeting alert bullets still named api.dicebear.com remote URLs — conflicting guidance that could lead a React/Vite export to ship broken sandbox avatars. Both bullets now say to reuse the corresponding inlined avatar from example.html. * fix(plugins): drop dashboard-ui-glass zh-CN query override so it falls back to the full English brief resolvePluginQueryFallback picks od.useCase.query['zh-CN'] ahead of the English fallback, so the shortened Chinese string became the entire generation brief for zh-CN users — dropping the locked avatar/network rules, the card-by-card layout, and the interaction details the English brief carries, and producing a materially different dashboard under a Chinese locale. Remove the zh-CN query override so Chinese users fall back to the authoritative, complete English brief. title_i18n / description_i18n (marketplace display strings) are unaffected. --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-06-06 08:36:14 +00:00
ziyan2006	071db7ca1b	[codex] Stabilize HTML deck navigation state (#3142) ... * fix: stabilize html deck navigation state * fix: avoid misclassifying transform decks as scroll decks * fix: detect default root-scroller decks --------- Co-authored-by: Nongzi <3051966228@qq.com>	2026-05-29 07:41:10 +00:00
Yuhao Chen	d0921ed335	fix(skills): avoid orphan web prototype files (#3253)	2026-05-29 03:18:19 +00:00
Jane	f8c860a505	feat(landing-page): localize plugins library across 18 locales (#3010) ... * feat(landing-page): localize plugins library across 18 locales PR #2926 shipped the new `/plugins/` library hub + four kind sub-routes + detail pages, but the chrome was English-only — visitors landing on `/zh/plugins/` saw the old marketplace registry placeholder rendered by the catch-all instead, and detail pages rendered identical English copy regardless of locale prefix. This PR brings the plugin surface to feature parity with `/zh/skills/`, `/zh/templates/`, `/zh/systems/`, `/zh/craft/`. ## What changes - New `app/_lib/plugins-i18n.ts` — single source for all plugin chrome copy (hub, list pages, chip rails, share dialog, detail-page meta labels). English baseline + 17 locale overrides keyed on `LandingLocaleCode` (the same short-code shape `localeFromPath()` returns). Missing keys per locale fall back to English so a partially-translated locale still renders sensibly. Translations cover hub copy, four tile titles + blurbs, seven artifact-kind labels + descriptions, 23 scene-subcategory labels, 18 detail-page chrome strings, and a six-key share-dialog table with a per-locale `shareTemplate({title, url})` function (translated for every locale where `_lib/i18n.ts` already had one — same voice). - `app/pages/plugins/{,templates/,templates/[kind]/,skills/,systems/, craft/,[slug]/}/index.astro` — every hardcoded English string now reads `getPluginsCopy(locale)` keys. Page logic and routing unchanged. - New short-code wrappers under `app/pages/[locale]/plugins/` — six files (hub + three sub-routes + `[kind]/` and `[slug]/`) following the same pattern `[locale]/skills/index.astro` already uses: each re-exports the canonical page component and adds a per-locale `getStaticPaths()` so the build emits 17 locale prefixes per plugin route. Total plugin-route prerender count goes from ~390 to ~7 000, matching the existing skill/template scaling. - Catch-all (`[locale]/[...path].astro`) — old `getPublicPlugins` / `getRegistryCounts` registry rendering removed (placeholder UI that was never wired to a real marketplace data source). Plugin routes now live exclusively under `[locale]/plugins/...` short-code wrappers, so the catch-all stops claiming `'plugins'` as a route root. The dead-code path also drops a `pluginCounts.all` reference the title row was reading. - `.plugins-tile-grid` styles promoted from a scoped `<style>` in the default-locale hub to global `app/sub-pages.css` so the short-code wrapper renders the same hub markup without re-mounting per-page CSS — `display: contents`-style scoping pitfalls in Astro's per-component CSS scoping made this the cleanest fix. ## Surface area - [ ] **UI** — new page / dialog / panel / menu item / setting / empty state in `apps/web` or `apps/desktop` - [ ] **Keyboard shortcut** — new or changed - [ ] **CLI / env var** — new `od` subcommand or flag, new `tools-dev` flag, or new `OD_*` env var - [ ] **API / contract** — new `/api/*` endpoint, new SSE event, or changed shape in `packages/contracts` - [ ] **Extension point** — new entry under `skills/`, `design-systems/`, `design-templates/`, or `craft/`, or change to the skills protocol - [ ] **i18n keys** — new translation keys (full plugin chrome added across all 18 locales) - [ ] **New top-level dependency** — adding any new entry to the **root** `package.json` - [ ] **Default behavior change** — changes what existing users experience without opting in - [x] **None** — landing-page-only restoration of i18n parity for the plugin surface ## Validation - `pnpm --filter @open-design/landing-page typecheck` → 0 errors - `pnpm --filter @open-design/landing-page build:static` → 16 127 pages built (+6 584 over current main: ~388 plugin detail pages × 17 locale prefixes plus the hub + four sub-routes × 17 locales). - `copy-example-html.ts` reports `266 entry files + 65 referenced files`, identical to before — no regression in the asset-mirroring pipeline. - Local Playwright smoke (`/zh/plugins/...`): - `/zh/plugins/` renders `<title>插件库 · Open Design</title>`, label `插件库`, h1 `407 个可组合的构件。`, four tiles labelled `模板 / 技能 / 设计系统 / 工艺`. - `/zh/plugins/templates/video/` renders h1 `48 视频`, scene chips `全部 / 动效 / 短视频 / 营销 / 产品 / 数据讲解`. - `/zh/plugins/example-article-magazine/` share dialog renders `复制下面的文案、然后跳到你想分享的平台粘贴即可` etc., share template auto-interpolates plugin title + URL into Chinese voice. - All 18 locale prefixes (`/zh`, `/zh-tw`, `/ja`, `/ko`, `/de`, `/fr`, `/ru`, `/es`, `/pt-br`, `/it`, `/vi`, `/pl`, `/id`, `/nl`, `/ar`, `/tr`, `/uk`) → 200 across hub + four sub-routes + sample detail page. - English `/plugins/` unchanged (default-locale path bypasses the `[locale]/...` wrapper). * feat(landing-page): finish plugins i18n chrome across 18 locales The first localization pass shipped a partial fix: hub headings, lead copy, two-level page chrome, detail-page metadata labels, the share dialog, and the chip rail were still falling back to English on every non-English locale because plugins-i18n.ts only filled a chrome slice for `zh` and the file header even claimed "7 artifact-kind labels and 25 scene-subcategory labels are translated" for every locale that did not yet have those blocks. Three changes close the visible gap: 1. plugins-i18n.ts: fills the 27 still-missing chrome fields per locale for zh-tw / ja / ko / de / fr / ru / es / pt-br / it / vi / pl / id / nl / ar / tr / uk. Includes the 7-key category map, the 23-key subcategory map, hubHeading / hubLead, the 4 *Label / *Heading / *Lead triples for the templates / skills / systems / craft hub pages, the 4 tile blurbs, the 4 browse buttons, sceneLabel, allChip, the 12 detail-page metadata labels (mode / scenario / platform / surface / author / manifest id / tags / preview caption / find on GitHub / homepage / open in new tab) and bucket label map, the detail share dialog (title / copy link / jump-to), and the header-side nav.plugins entry. zh receives the same 11 detail-page and share-dialog labels it was also missing. 2. header.tsx + site-footer.astro: routes the hardcoded "Plugins / Templates / Skills / Systems / Craft" labels through `nav.*` from HeaderCopy, so every locale gets its own dropdown trigger and footer column. Adds `nav.plugins` to HeaderCopy and fills it in 18 locales with the local form ("插件" / "プラグイン" / "Plugins" / "Plug-ins" / "Plaginy" / "الإضافات" / etc). 3. plugin-row.astro + content-i18n.ts: chip rail. The bundled-plugin branch now runs raw `mode` / `scenario` slugs through the shared localizeTaxonomyValue, and that helper now also consults the plugins-i18n subcategory map before giving up. localizeTaxonomyValue now returns undefined on a true miss instead of the unknownTag placeholder, so chips drop quietly instead of showing "Category" / "分類" / "Categoría" for taxonomy slugs we have not localized yet. Callers that genuinely want the placeholder (`localizeContentTag`, blog `category`, system noun) still keep the explicit fallback. Out of scope and tracked separately: per-plugin title and description in plugins/_official/* (author-supplied English metadata, ~401 plugins without an i18n schema in the manifest yet — needs RFC + tooling before the manifests can be expanded), and adding the long tail of mode / scenario / category slugs (`code-migration`, `plugin-sharing`, `tune-collab`, `live-artifacts`, `engineering`, ...) to TAXONOMY_TERMS so chips render localized labels for every taxonomy value rather than dropping silently. * feat(landing-page): cover plugins chip rail long-tail taxonomy slugs PR #3010's first round localized the high-frequency mode/scenario chips (prototype, video, image, marketing, design, ...) but left the ~37 mode/scenario and 14 category slugs that show up in real `od.*` metadata — code-migration, plugin-sharing, design-system, planning, scenario, refine, discovery, handoff, token-map, tune-collab, orbit, live-artifacts, engineering, healthcare, hr, sales, support, default-router, downstream-export, figma-migration, media-generation, plugin-authoring, validation, 3d-shaders, animation-motion, audio-music, creative-direction, design-systems, diagrams, documents, image-generation, marketing-creative, screenshots, slides, video-generation, web-artifacts, ... — falling through to undefined and dropping their chip silently on every non-English locale. The data layer is the source of truth here, so this expansion lands in `content-i18n.ts:TAXONOMY_TERMS` / `CATEGORY_LABELS` rather than the plugins-i18n catalog: a single dictionary entry per slug fans out to every chip-rail consumer (catalog rows, detail metadata, the templates/[kind] facets) without each consumer touching its own copy. Translations cover all 17 non-`en` locales. Brand and product nouns (Figma, Open Design, BYOK, plugin) stay literal; technical taxonomy slugs get short equivalents that read as chips rather than full prose. The result on `/ja/plugins/skills/` matches `/plugins/skills/` chip-for-chip (30 chips both sides) instead of dropping 27 of them the way the previous iteration did. * feat(landing-page): read manifest title_i18n / description_i18n on bundled plugins PR #3010's prior rounds localized chrome and chip rails but the catalog's most prominent text — each row's plugin name and blurb — stayed English on every non-English locale. The plugin manifest schema (`packages/contracts/src/plugins/manifest.ts`) has supported `title_i18n` and `description_i18n` (Record<locale, string>) on every manifest from spec v1; ~24 of the 401 first-party manifests already carry one for `zh-CN`. The reader was just never wired to use them. This change does the reader half: bundled-plugins.ts captures the two i18n maps off each `open-design.json`, plugin-row.astro and the detail page resolve them at render time via two new helpers (`resolveBundledTitle`, `resolveBundledDescription`) that mirror the short→long fallback chain documented in the manifest spec (`htmlLang` like `zh-CN` → short `LandingLocaleCode` like `zh` → primary tag → `en` → English baseline). The static-paths pass still runs once for all locales — it has to, since each manifest produces one URL — but the title/description shown on the rendered page now reads the locale off `Astro.url.pathname` and picks the right entry out of the maps. Verified locally: `/zh/plugins/example-card-twitter/` now reads "Twitter 分享卡 / 推特金句 / 数据卡, 适合配推文" from the manifest's existing `zh-CN` block instead of the English baseline. Plugin-data half follows in a separate commit. The 17 non-English locales × 401 manifests need backfilling so the reader has something to resolve to; that's data, not schema, and lands as a sequence of manifest patches rather than tangled with this code change. * feat(plugins): translate scenarios bucket title/description across 17 locales Closes the first chunk of #3028. Eleven scenarios plugins (the default-scenario bundle for each taskKind: code-migration, figma-migration, media-generation, new-generation, tune-collab, plugin-authoring; the default design router; the React / Vue / Next.js downstream-export starters; and the Refine baseline) get title_i18n + description_i18n filled for all 17 non-English locales the landing page serves (zh-CN, zh-TW, ja, ko, de, fr, ru, es, pt-BR, it, vi, pl, id, nl, ar, tr, uk). The reader landed in 7ddfe36; this commit is data-only. taskKind slugs that other docs reference by name (`code-migration`, `figma-migration`, `tune-collab`, etc.) stay literal in the descriptions so cross-references still resolve. Brand nouns — Open Design, Next.js, React, Vue, Figma — also stay literal. `/ja/plugins/od-code-migration/` now reads "コードマイグレーション（デフォルトシナリオ）" instead of the English baseline; `/zh/plugins/skills/` shows "代码迁移（默认场景）" in the catalog row. Remaining buckets (image-templates 45, video-templates 50, examples 140, design-systems 142 = 377 plugins) follow in subsequent commits in this PR. * fix(landing-page): drop CJK template wrap when source name is still English The Chinese / Japanese / Korean fallback templates for craft, skill, template, system, plugin, and blog text splice the source `name` / `title` into a CJK sentence frame: ``${name}工艺规则``, ``Open Design 指南：${topic}``, ``${name} は…のスキルです``. When the underlying SKILL.md / craft markdown / blog frontmatter still ships an English name (true for ~95% of the catalog today), that produces mid-sentence script straddling on `/zh/...`, `/zh-tw/...`, `/ja/...`, `/ko/...` like: H1 : "Editorial typography hierarchy工艺规则" Lead : "这条 Open Design 工艺规则定义 Editorial typography hierarchy 的执行标准…" Plug : "video 插件 · 3D Animated Boy Building Lego" That reads worse than the all-English fallback, because the visitor parses the page in two scripts at once. Adds a `nameNeedsEnglishFallback` guard that fires for the four CJK locales whenever the spliced-in name has no CJK characters of its own, and threads it through every `localizeXxxText` helper: craft, template, system, plugin, skill, blog. When it fires the helper returns the raw English content untouched, so the section renders end-to-end in one language. Chrome (header, footer, breadcrumb, buttons, share dialog) keeps its CJK rendering — only the title-and-lead block falls back. Side benefit: the same guard kicks in on the long tail of plugin manifests still pending `title_i18n` / `description_i18n` backfill (tracked in #3028), so `/zh/plugins/<bundled>/` no longer pairs a "video 插件 · 3D Animated Boy Building Lego" title with a Chinese breadcrumb. The page reads "3D Animated Boy Building Lego" + the English manifest description, while header / footer / breadcrumbs stay localized. Once a manifest ships its i18n maps, the chrome and body re-converge automatically. Non-CJK non-Latin scripts (ar, vi, ...) keep the previous behavior — their templates already read tolerably with English names. If that turns out to be wrong on a real audit, the same guard generalizes by adding the matching Unicode range and locale set. * feat(plugins): translate image-templates bucket title/description across 17 locales 44 of 45 image-templates plugins get title_i18n + description_i18n filled for all 17 non-English locales (zh-CN, zh-TW, ja, ko, de, fr, ru, es, pt-BR, it, vi, pl, id, nl, ar, tr, uk). Generated via Claude Sonnet 4.5 over the OpenRouter gateway, ~$1.38 in API spend, 156s wall-clock. Brand and cultural references stay literal (Open Design, Lego, Hanfu, Showa, Pokémon, Black Myth: Wukong). Long AI generation prompts collapse to a 1-2 sentence summary capturing what the plugin does — the description doubles as catalog blurb on the landing site, not as the actual generation prompt (which lives in example.html / the manifest's preview entry). Skipped: `profile-avatar-realistically-imperfect-ai-selfie` returned malformed JSON on three retries; will rerun with a tighter prompt in a follow-up commit. Catalog rows for that plugin keep falling back to the raw English fields per #3010's reader change, so nothing breaks. Tracking: closes the image-templates row in #3028. * feat(plugins): translate video-templates bucket title/description across 17 locales 49 of 50 video-templates plugins get title_i18n + description_i18n filled for the 17 non-English landing locales. Generated via Claude Sonnet 4.5 over OpenRouter, ~$1.47 in API spend, 177s wall-clock. HyperFrames templates, the Three Kingdoms cinematic series, the Seedance/short-film prompts, and the K-pop / wuxia / anime variants all get a 1-2 sentence catalog blurb in each locale; brand and cultural tokens (Black Myth: Wukong, Hanfu, Showa, Pokémon, Three Kingdoms / 三国志, Lego, Disney, K-pop, HyperFrames) stay literal. Skipped: `live-action-anime-adaptation-water-vs-thunder-breathing-duel` returned malformed JSON on three retries; will rerun in followup. Falls back to the raw English fields per the reader landed in 7ddfe36. Tracking: closes the video-templates row in #3028. * feat(plugins): translate examples bucket (117/140) title/description across 17 locales 117 of 140 examples plugins get title_i18n + description_i18n filled for the 17 non-English landing locales. Generated via Claude Sonnet 4.5 over OpenRouter, $3.94 in API spend, ~13 min wall-clock at 8-way concurrency. Existing zh-CN translations on 24 manifests are preserved (the merge keeps author-supplied entries and only adds missing locales). 23 of 140 returned malformed JSON on three retries — the output likely hit the 4000 max_tokens ceiling on plugins whose description balloons across 17 locales. Those manifests fall back to English on non-`en` rendering per the reader landed in 7ddfe36, and will rerun in a follow-up commit with a larger token budget and a stricter output schema. Tracking: closes 117/140 of the examples row in #3028; the remaining 23 stay open in that issue's failure list. * feat(plugins): translate design-systems bucket (141/142) title/description across 17 locales 141 of 142 design-systems plugins get title_i18n + description_i18n filled for the 17 non-English landing locales. Generated via Claude Sonnet 4.5 over OpenRouter, $2.55 in API spend, 301s wall-clock at 8-way concurrency. Translator script gained two improvements between examples and this bucket: - max_tokens bumped from 4000 to 8000 so 17-locale outputs stop truncating on the long-tail manifests with verbose descriptions - a balanced-brace JSON extractor that pulls the outermost `{ ... }` from the response, tolerating trailing prose Claude occasionally appends after the JSON object. Result: only 1 manifest (`totality-festival`) failed parse this batch, down from ~16% on the examples bucket. The next commit re-runs the prior buckets' failures with the improved script. Tracking: closes 141/142 of the design-systems row in #3028. * fix(plugins): backfill 4 plugins that retried green after JSON extractor improvement dcf-valuation, social-media-dashboard, wireframe-sketch (examples bucket) and live-action-anime-adaptation-water-vs-thunder-breathing-duel (video-templates bucket) parse cleanly under the balanced-brace extractor introduced for the design-systems batch. The remaining 22 failures from the prior runs hit a different parse mode (Claude emitting unescaped double quotes inside string values when the source description contains its own English quotes like 'make it professional'); those will need a tighter prompt and rerun. * fix(plugins): translate the last 22 plugins with quote-handling prompt fix The 22 stuck plugins all carried English / Chinese double-quoted phrases inside their description (\"make it professional\", \"What's inside\", \"电子杂志 × 电子墨水\") that Claude was emitting back inside JSON string values without escaping, breaking the parse. Added one rule to the translator prompt — never use a straight double quote inside a translated string, prefer single quotes / curly quotes / CJK 『 』 / 《 》 — and the previously stuck batch sailed through clean: 22/22 ok, 0 retries, $0.85. This closes the long tail of #3028: - scenarios 11/11 ✓ - image-templates 45/45 ✓ - video-templates 50/50 ✓ - examples 140/140 ✓ - design-systems 142/142 ✓ - atoms N/A (filtered from public catalog) All 388 catalog-visible plugins now ship title_i18n + description_i18n for all 17 non-English locales the landing page serves. * fix(plugins): clean up four review-flagged i18n data issues - apps/landing-page/app/_lib/plugins-i18n.ts:759 — Polish bucket label `examples: 'Przyklad'` was missing the diacritic; every other Polish string in the same block uses proper diacritics. Restore to 'Przykład'. (Reviewer: looper #4364985878.) - video-templates/cinematic-route-navigation-guide — German title_i18n.de was a byte-for-byte copy of en ("Cinematic Route Navigation Guide") while the German description was already translated. Replace with "Cinematischer Routen-Navigationsleitfaden" to match the German voice the description sets. - video-templates/hollywood-haute-couture-fantasy-video-prompt — Dutch title_i18n.nl was identical to en for the same reason. Translate the trailing noun phrase: "Hollywood Haute Couture Fantasy Videoprompt" (mirrors the Dutch description's compound word style). - video-templates/video-seedance-three-kingdoms-guanyu-slaying-yanliang — Korean Hangul `돌진` had leaked into the Turkish description (a translation-pipeline artifact where the model copied the verb from the Korean output without translating it). Replace "saflarına돌진 eder" with the idiomatic Turkish "saflarına dalar". All four are data-only fixes against existing manifests; no schema changes, no reader changes. typecheck stays at 0 errors. * fix(landing-page): localize aria-labels, alt text and BreadcrumbList JSON-LD on plugin detail page The PR's prior rounds left six accessibility / structured-data surfaces on `/{locale}/plugins/<slug>/` either entirely English or mixing English chrome with the localized plugin title. Reviewer flagged each one across multiple loops; this commit clears them all: 1. `aria-label` on the open-in-new-tab popout no longer reuses the visible label `pcopy.detailOpenInNewTab` (which carries the decorative `↗`). Added `detailOpenInNewTabAria` — same wording, no glyph — and the `<a aria-label>` consumes that key. The visible link text still ends in `↗`. 2. `<nav class="breadcrumb" aria-label="Breadcrumb">` now reads `aria-label={pcopy.breadcrumbLabel}`. Eighteen locales filled ("面包屑导航", "パンくずリスト", "Brotkrumen-Navigation", "Fil d'Ariane", "مسار التنقل", "İçerik haritası", ...). 3. Share-dialog `<button aria-label="Close">` now reads `aria-label={pcopy.shareDialogClose}`. Eighteen locales filled ("关闭", "閉じる", "Cerrar", "Закрыть", "إغلاق", ...). 4. Three template-literal a11y strings (`${pluginTitle} preview`, `Open interactive preview for ${pluginTitle}`, `${pluginTitle} interactive preview`) become function calls (`pcopy.previewImageAlt(t)`, `previewSummaryAria(t)`, `previewIframeTitle(t)`) so the sentence frame around the plugin title rotates with the page locale. Two `<img alt>` call sites (the static preview at line 210 and the click-to-expand thumbnail at line 179) both consume `previewImageAlt`. 5. `BreadcrumbList` JSON-LD position-2 now reads `name: pcopy.hubLabel` instead of hardcoded English `"Plugins"`. The visible breadcrumb at line 105 already renders `pcopy.hubLabel`; this aligns the structured data with the rendered chrome on every locale. The new function-typed keys deliberately interpolate `pluginTitle` (which is itself locale-resolved via `resolveBundledTitle`) so the mixed-language guard from commit 002d457 is preserved: a manifest without a per-locale title still flows through to a coherent single-language a11y string because `pluginTitle` falls back to English along with the rest of the section. apps/landing-page typecheck stays at 0 errors. Closes reviewer threads: - #pullrequestreview-4364985878 (Open in new tab aria) - #pullrequestreview-4368926224 (Polish typo + plus mixed-language alt/aria) - #4373... (BreadcrumbList JSON-LD) - #4374... (aria-label="Close" + aria-label="Breadcrumb") * fix(landing-page): redirect legacy fa/hu/th /plugins/ paths to canonical When the new `/{locale}/plugins/...` short-code wrappers landed, the legacy catch-all `pages/[locale]/[...path].astro` dropped `'plugins'` from its `paths` list. That intentionally avoids serving stale marketplace-registry placeholder routes for the modern landing locales — but it also takes `/fa/plugins/`, `/hu/plugins/`, and `/th/plugins/` from 200 to 404, because those three legacy locales live only in the old `_lib/i18n.ts:LOCALES` set and are not part of `LANDING_LOCALES` (the modern 18-locale list the new wrappers serve). Three `301`s in `_redirects` send those legacy URLs to the canonical English `/plugins/...` so SEO and inbound links keep working until the legacy locale set is retired entirely. Reviewer thread (#pullrequestreview-4364052045) flagged this as a non-blocking regression across multiple loops; this commit closes it. * ci(landing-page): add merge_group trigger so the queue can clear PRs `landing-page-ci.yml` only fired on `pull_request` and `push:main`, which meant the required `Validate landing page` and `Strict PR visual tests` checks never dispatched against the `merge_group` ref the merge queue creates. The queue then sat at "awaiting checks" until it timed out and ejected the PR (the deadlock observed during the 5/26 release window). Adding a `merge_group: { types: [checks_requested] }` trigger to the same workflow lets the queued ref reuse the existing job graph, matching the pattern in `ci.yml` which already wires `merge_group`. Also drops `plugins/**` into the same paths filter as `pull_request` since the new bundled-plugins reader (commit 7ddfe364) consumes those manifests' `title_i18n` / `description_i18n` maps and the landing-page CI must rerun when manifest data changes. --------- Co-authored-by: Joey-nexu <joeylee12629@gmail.com>	2026-05-27 09:30:59 +00:00
Jane	ceb636aa1b	feat(landing-page): plugin detail page interactive preview + share dialog (#2958) ... * feat(landing-page): plugin detail page interactive preview + share dialog The new `/plugins/<manifest-id>/` detail page that shipped in #2926 landed without the two affordances PR #2679 added to the legacy `/skills/<slug>/` and `/templates/<slug>/` pages: a click-to-expand iframe of the live artifact, and a share dialog with brand-keyword copy plus four-channel jump buttons (X / LinkedIn / Reddit / Facebook). This restores both, sourced from the bundled-plugin manifest under `plugins/_official/<bucket>/<slug>/open-design.json`. ## Interactive preview Three preview-type behaviours, gated on `od.preview.type`: - `video` (Cloudflare Stream URLs already in the manifest) — inline `<video controls poster=...>` with the playable MP4 as `<source>`. Detail-page row is unchanged from #2926; controls double as the open-full affordance. - `html` (a local `example.html` referenced by `od.preview.entry`, only the `examples/` bucket today) — `<details>` toggle wraps the poster image as the summary; clicking opens a sandboxed `<iframe>` that loads the entry HTML lazily, with an "Open in new tab ↗" pill in the frame's top-right corner so the artifact can be inspected at full screen. - `image` or no entry — static `<img>` (existing behaviour). `copy-example-html.ts` is extended to mirror the local entry and any `./assets/...` siblings to `out/plugins/<manifest-id>/<entry>` so the iframe URL resolves on Cloudflare Pages instead of SPA-falling-back to the homepage. The four examples carrying sibling-asset references (flowai-live-dashboard-template, trading-analysis-dashboard-template, open-design-landing, open-design-landing-deck) all render in-place. ## Share dialog Same `<dialog data-share-dialog>` markup the legacy detail pages use, so the global click handlers in `header-enhancer.astro` (`data-share-open` / `data-share-copy` / `data-copy-link`) wire up the open / copy actions automatically — no extra client bundle. Four platform jumps (X / LinkedIn / Reddit / Facebook) plus a Copy-text / Copy-link pair, with a single English template for now (the new `/plugins/...` routes only generate English pages; localisation can land alongside the i18n catch-all follow-up). ## Bundled in - The `copy-example-html.ts` sibling-assets fix from open PR #2880. Without it the existing `/skills/<slug>/` iframe still 404s on Cloudflare Pages for after-hours-editorial-template and the four others; bundling it here means the same script handles both sources in one pass and sidesteps two PRs touching identical helper code. * fix(plugins): remove dangling preview.entry from example-hyperframes The hyperframes example folder ships a SKILL.md (it's an instruction manual for using the HyperFrames HTML format) but no runnable `example.html`. The manifest still claimed `preview.type: html` / `preview.entry: ./example.html`, which made the marketing site try to iframe a non-existent file and forced the preview pipeline into its `Path 3` fallback card — leaving the catalog row visually inconsistent with the eleven sibling `video-template-hyperframes-*` plugins that have real Cloudflare-Stream poster URLs. Drop the preview block entirely so the manifest stops promising a demo it can't deliver. The landing-page detail row continues to render the typographic fallback card (sourced from title / description / mode), which is now the honest representation: "this is an instruction skill, not a renderable template". * fix(landing-page): address PR #2958 review feedback on plugin preview pipeline Two blocking issues called out in code review: 1) `bundled-plugins.ts` exposed `previewEntryUrl` for every manifest that declared `preview.type: "html"`, even when the entry file wasn't shipped. Several first-party manifests fall in this state (example-design-brief's `./brief-preview.html`, example-x-research, example-pptx-html-fidelity-audit, example-hatch-pet, example-last30days, example-guizang-ppt, example-replit-deck, example-live-artifact, example-html-ppt, example-dcf-valuation). The detail page then rendered a click-to-expand iframe and popout link to a file that copy-example-html.ts had skipped, so the iframe URL SPA-fell-back to the homepage on Cloudflare Pages. `entryRelativeUrl()` now `existsSync()`-checks the resolved local path before returning a URL. When the file's missing the detail page falls through to the static thumbnail branch, exactly like plugins that ship no preview entry at all. 2) `copy-example-html.ts` recognised only `(src|href|poster)="./assets/..."` and then bulk-copied the entry's sibling `assets/` folder, so it missed two real ref shapes: bare-relative (`href="assets/styles.css"`, `src="assets/deck-stage.js"` under example-html-ppt-zhangzara-pin-and-paper) and cross-folder (`src="../open-design-landing/assets/hero.png"` under example-open-design-landing-deck). Replaced the heuristic with a generic walker that: - Parses every relative ref in the entry HTML (`(src|href|poster|srcset|data-src)=` plus `url(...)`), splitting srcset on whitespace/commas so multi-URL attrs are honoured. - Resolves each ref against `dirname(entrypointSrc)` for the source and against `dirname(iframeAbsPath)` for the destination — identical to how a browser resolves the same ref against the iframe URL. Files outside the source root or the iframe root are dropped. - Recurses into copied HTML / CSS / JS / SVG so multi-step chains (entry → assets/template.html → assets/fonts/foo.woff) don't strand intermediate files. - Tracks visited *destinations* rather than sources, so a single source that legitimately needs to land at two different out-paths (same-folder copy at /plugins/example-X/assets/foo.png AND a cross-folder copy at /plugins/open-design-landing/assets/foo.png for sibling decks that use `../open-design-landing/assets/foo.png`) gets both copies. Verified manually: - /plugins/example-html-ppt-zhangzara-pin-and-paper/assets/styles.css and assets/deck-stage.js → 200 (bare-relative) - /plugins/open-design-landing/assets/hero.png and assets/about.png → 200 (cross-folder destination, no manifest-id prefix because iframe URL `..` collapses the prefix) - /plugins/example-design-brief/ renders the static thumbnail only, no click-to-expand iframe (broken entry guard) - /plugins/example-flowai-live-dashboard-template/assets/template.html → 200 (existing same-folder behaviour preserved) Build now reports `copied 266 entry files + 65 referenced files`, where the 65 includes both the same-folder `./assets/...` payloads the previous heuristic captured and the bare-relative + cross-folder shapes it didn't. --------- Co-authored-by: Joey-nexu <joeylee12629@gmail.com>	2026-05-26 07:43:46 +00:00
icc	587f6de46d	fix: restore Atelier Zero deck plugin prompt (#2822) ... Co-authored-by: icc <iccccccccccccc@users.noreply.github.com>	2026-05-24 14:20:25 +00:00
lefarcen	c14baf07d3	Merge origin/main into release/v0.8.0 ... PR #2461 sync prep — resolves 14 conflicts merging 84 main-side commits on top of 58 release-side commits accumulated during the 0.8.0 cycle. Resolution summary: Take main (theirs) where main carried deliberate forward progress: - apps/web/src/components/PluginCard.tsx — 7 hunks, i18n migration: hardcoded English aria-labels/titles replaced with t() calls keyed on pluginCard.* (all 8 keys verified present in en.ts). - apps/web/src/components/TasksView.tsx — 1 hunk, source-ingestion feature: sortedRoutines (newest-first), sourceIngestionTemplates, patchSourceForm, submitSourceIngestion. activeCount/pausedCount semantics preserved (now keyed on sortedRoutines, count unchanged). - e2e/ui/app.test.ts — new node:fs/promises + tmpdir + path + @/timeouts imports needed by main-side test helpers. - e2e/ui/settings-local-cli-codex-fallback.test.ts — menu-dismissal helper block added by main. Keep both sides where each added a different field to the same object literal: - apps/web/src/components/ProjectView.tsx (locale + analyticsHints spread). - apps/web/src/components/DesignSystemFlow.tsx (locale + analyticsHints). Take release (ours) where release carried deliberate work that ships 0.8.0: - CHANGELOG.md — release-side 0.8.0 entry + PR link refs; main's Unreleased section was the same body of work, now finalized. - apps/landing-page/public/{apple-touch-icon,favicon}.png + apps/web/public/app-icon.svg — release-side visual refresh assets consistent with 0.8.0 stable ship. - tools/pack/src/linux.ts — packageVersion const required by line 466; taking main's empty line would build-error. - e2e/ui/project-management-flows.test.ts + e2e/ui/settings-api-protocol.test.ts + e2e/ui/settings-memory-routines.test.ts — release-side release-smoke hardening (shangxinyu1 + PerishFire) takes precedence on overlap. Closes-issue / unblocks: PR #2461 sync release/v0.8.0 → main.	2026-05-23 12:17:18 +08:00
Eli-tangerine	10e11531a1	Improve deck home previews and plugin gallery performance (#2698) ... Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-05-22 17:47:28 +08:00
Siri-Ray	e6da01e998	Add i18n metadata for official content (#2692)	2026-05-22 16:39:32 +08:00
Tuola-waj	0ba88a064d	Add Codex interactive capability map example (#2657) ... * Add Codex interactive capability map example * Fix Codex map preview entry --------- Co-authored-by: tuolaji <tuola@tuolajideMacBook-Air.local>	2026-05-22 15:49:16 +08:00
Yuhao Chen	bddec2391d	Fix Simple Deck discovery form contract (#2602)	2026-05-22 14:05:24 +08:00
Eli-tangerine	ce95266586	[codex] Polish home composer working-directory controls (#2468) ... * Polish design system home flows * Polish home prompt presets * Polish home working directory controls * test: align home hero chrome smoke * fix: stabilize home composer ci checks --------- Co-authored-by: qiongyu1999 <2694684348@qq.com>	2026-05-21 00:22:46 +08:00
lefarcen	c80acfefeb	fix(daemon,web): block pitch-deck placeholder publishes and unbreak framework decks (#2384) ... Two preview-time bugs surfaced ahead of 0.8.0: 1. Pitch-deck example (#2215): the official html-ppt-pitch-deck prompt asked the agent to confirm three facts first, but the manifest had no structured `od.inputs`, so the platform's required-input gate had no fields to enforce and the run could publish HTML that still contained unresolved fundraising placeholders (`Name to confirm`, `$X.XM`, `Replace this panel with`, ...). Add structured required inputs to the manifest and a daemon-side publication guard that rejects HTML/deck artifact writes whose body still contains those placeholders. Scope is the file-write boundary only (no assistant-text scanning), so the guard cannot trip on the agent's chat prose mid-clarification. 2. Framework deck preview off-screen: `injectDeckBridge` injected `place-content: center !important` on `.deck-shell` for every deck-mode srcdoc, which forced the framework's `display: grid` shell to re-center its implicit track. The framework's `fit()` already centers a `transform-origin: top left` stage with an explicit `translate(tx, ty)` that assumes the stage's natural layout position is (0, 0); the two centerings stacked and the scaled stage landed ~1000px off-screen, so the preview showed a sliver of slide content in the top-left with the rest black. Skip the override when the framework's `id="deck-stage"` marker is in the doc, and drop the dead `display: grid; place-items: center` from the deck framework template so future drift can't re-introduce the same stack.	2026-05-20 16:20:34 +08:00
Joey-nexu	f1870cbf3d	chore(featured): curate Featured picks down to top 10 across categories (#1966) ... * chore(featured): curate Featured picks down to top 10 across categories The picker's Featured chip currently surfaces 64 plugins because `isFeaturedPlugin` (apps/web/src/components/plugins-home/facets.ts) treats any finite `od.featured` number as featured, and the field had been adopted incrementally by 51 skills + 13 templates without a curation step. The result is a "Featured" tab that's effectively "everything tagged at all" — no editorial signal. Curate down to 10 picks, allocated to keep the showcase legible: 0.001 skills/deck-swiss-international 0.01 skills/deck-guizang-editorial 0.02 design-templates/magazine-poster [add] 0.04 skills/doc-kami-parchment 0.10 design-templates/web-prototype-taste-brutalist [add od: block] 0.13 skills/video-hyperframes 0.14 skills/frame-glitch-title 0.15 skills/vfx-text-cursor 0.16 skills/frame-logo-outro 0.17 skills/deck-open-slide-canvas Selection mirrors the html-anything `recommended: 1..10` ranking (html-anything is the upstream content source for these skills, per the `od.upstream` field on each SKILL.md). Two of those 10 picks weren't in the prior featured set at all — `magazine-poster` had no `od.featured` field and `web-prototype-taste-brutalist` had no `od:` block at all — so they get added rather than just rebalanced. Removes `od.featured` from the other 56 files. No UI code change; the existing `isFeaturedPlugin` logic now reads a curated set instead of an accidental one. * chore(featured): align baked plugin manifests with curated top 10 The picker reads `od.featured` from each plugin's `plugins/_official/examples/<id>/open-design.json` manifest, not from the SKILL.md frontmatter the previous commit edited. Without this follow-up the curated set of 10 would be invisible to users — the picker's Featured chip would still surface 27 baked plugins from the pre-existing manifests. Mirror the SKILL.md curation into the baked layer: removed `od.featured` from 19 manifests: article-magazine, card-xiaohongshu, data-report, frame-data-chart-nyt, frame-flowchart-sticky, frame-light-leak-cinema, frame-liquid-bg-hero, frame-macos-notification, guizang-ppt, html-ppt, kami-deck, kami-landing, mockup-device-3d, open-design-landing-deck, ppt-keynote, resume-modern, social-reddit-card, social-spotify-card, social-x-post-card added `od.featured` to 2 manifests: magazine-poster -> 0.02 web-prototype-taste-brutalist -> 0.10 Verified locally against `daemon /api/plugins`: featured count is now exactly 10, matching the SKILL.md source of truth from the previous commit.	2026-05-18 12:56:26 +08:00
pftom	9ea33e076b	feat(context-plugins): add support for context plugins in project metadata and UI ... - Introduced a new `contextPlugins` field in the `ProjectMetadata` type to accommodate plugins selected via `@` mentions, allowing for additive context in project creation. - Updated the `HomeHero` and `EntryShell` components to handle and display context plugins, enhancing user interaction with selected plugins. - Implemented rendering logic for context plugins in the metadata block, providing clear visibility of selected plugins and their descriptions. - Enhanced the UI to support the removal of context plugins and display additional details on hover, improving the overall user experience. This update significantly enriches the project creation process by allowing users to incorporate multiple context plugins seamlessly.	2026-05-14 15:29:49 +08:00
pftom	0edbf38171	feat(plugins): add specVersion and version fields to plugin and marketplace schemas ... - Introduced `specVersion` and `version` fields to the plugin and marketplace schemas, ensuring better versioning and compatibility tracking. - Updated various components and functions to handle the new fields, including database migrations, plugin snapshots, and marketplace management. - Enhanced tests to validate the presence and correctness of the new fields in plugin manifests and marketplace entries. - Improved documentation to reflect the changes in schema requirements and provide guidance on the new versioning system. This update strengthens the plugin ecosystem by providing clear versioning, enhancing the reliability and maintainability of plugins and marketplaces.	2026-05-13 22:24:50 +08:00
pftom	d3d95121f3	feat(plugins): enhance visual score sorting and add new example templates ... - Updated the `sortByVisualAppeal` function to prioritize featured ranks, ensuring that curated plugins are displayed prominently. - Added tests to verify the new sorting logic, ensuring that plugins with numeric featured ranks are sorted correctly ahead of others. - Introduced new example templates for a magazine article layout, a Twitter share card, and a Xiaohongshu card, expanding the available options for users. - Enhanced the overall plugin preview experience by integrating these new templates, providing users with more visually appealing and functional examples. This update significantly improves the plugin sorting mechanism and enriches the template offerings, enhancing user engagement and experience.	2026-05-13 21:02:05 +08:00
pftom	8b2d48a258	feat(daemon, web): enhance plugin preview handling and add new templates ... - Introduced logic to assemble example slides with a companion template when the declared entry is missing, improving the user experience for plugin previews. - Updated the server logic to handle special cases for `example-slides.html`, ensuring proper fallback to `template.html` when applicable. - Enhanced tests to verify the new preview assembly functionality and ensure correct rendering of fallback content. - Added new HTML and Markdown examples for various skills, including a magazine article layout and a Twitter share card, expanding the available templates for users. This update significantly improves the plugin preview experience, providing users with more robust and visually appealing fallback options.	2026-05-13 20:58:24 +08:00