Track access token expires_at, dedupe concurrent refreshes, retry SSE on
401, and refresh on window focus/visibility so long-lived sessions stop
hitting the login redirect mid-task.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Normalize provider_model so UI shows DeepSeek/DeepSeek-R1 instead of raw toggle text (联网搜索 etc.)
- Unwrap DeepSeek redirect URLs (chat.deepseek.com/api/redirect?url=...) to canonical sources
- Expand reasoning sections and separate reasoning search pages from answer-body citations
- Improve webpages-trigger click heuristics and auxiliary link filtering in answer rendering
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures findings, task plan, and per-phase progress for the daily
monitoring task generation repair, heartbeat primary lease and
snapshot scalability, scheduler metrics HTTP hardening, worker
graceful shutdown, workspace scoping, and daily plan batching.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Dashboard and question-detail views now read platform_authorization_status
from the API. Tracking disables collect-now when the account has no
desktop client, no authorized platforms, or the selected platform is
unauthorized, and keeps the six-platform matrix stable; question-detail
replaces tabs and cards with an explicit unavailable notice when the
account is not authorized for monitoring. Adds the shared type and
en/zh strings covering each status.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Scheduler now runs a token-protected HTTP server on scheduler.http_port
(default 8081, -1 disables) that exposes Prometheus /metrics and the
daily-task JSON snapshot endpoint. Workers gain a blocking Run(ctx) and
are supervised by a WaitGroup: on SIGINT/SIGTERM the metrics server
shuts down first, worker ticks stop scheduling but ongoing runOnce
calls keep their own context and finish, and the process waits up to
60s before exiting. Adds scheduler.http_host/http_port/internal_metrics_token
to config with SCHEDULER_* env overrides and exposes port 8081 in the
Docker image.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a MonitoringDailyTaskWorker that materializes and dispatches
daily collect tasks from active subscription/desktop-client state,
with per-run atomic metrics and a Prometheus collector. Dashboard
and question-detail APIs now surface a platform_authorization_status
so the UI can distinguish no-desktop-client, no-authorized-platforms,
and authorized states; quota/access-state lookups resolve by request
workspace instead of tenant.
Hardens heartbeat: a desktop_client_primary_leases table gives
per-(tenant, workspace) sticky primary selection, read-mostly lease
resolution avoids a per-heartbeat transaction, and unchanged platform
access reports skip snapshot upserts outside a 10-minute refresh
window. Adds heartbeat primary/snapshot metrics exposed via
token-protected tenant-api /api/internal/metrics endpoints plus
Prometheus. Monitoring quota seed is removed from dev-seed since
daily plans now derive from desktop bindings, and the projection
uses the canonical six-platform catalog so platforms with zero
samples still render.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces current-workspace context helpers plus a WorkspaceScope
middleware that validates X-Workspace-ID against workspace memberships,
defaulting to the actor's primary workspace. Prepares monitoring paths
to resolve quota/access-state per request workspace instead of per tenant.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Log the decision to implement publish priority through admission control
and reserved capacity rather than queue sort order, and capture the
preexisting electron.vite.config.ts typecheck mismatch that blocked a
clean desktop-client typecheck run.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Publish is now treated as the runtime foreground channel and AI
monitoring as background. A new in-memory publish-scheduler owns queue
selection, per-platform active locks, and 3-6s post-completion platform
cooldowns.
The runtime controller tracks lease-in-flight per kind so a monitor
lease no longer blocks a publish lease, derives total concurrency from
hardware class, current process health, and an optional
GEO_DESKTOP_MAX_TOTAL_CONCURRENCY override, and reserves a publish slot
when budgeting monitor capacity. Monitor admission returns zero whenever
publish has backlog or an in-flight lease, so a cooldown-blocked publish
queue still prevents monitor from consuming the foreground reserve.
Runtime diagnostics expose publishScheduler alongside monitorScheduler.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop the nested WebContentsView and host the renderer on the main
BrowserWindow's own webContents. Removes the manual bounds sync plumbing
and the extra webContents lifecycle that was only ever a child of the
main window.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move CDPTargetDescriptor and the reclaim predicate out of
playwright-cdp.ts into a dedicated module so the reclamation rule can be
unit-tested in isolation and reused without pulling in the whole hidden
browser manager.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- desktop: new DeepSeek page adapter and monitor registry
- desktop: extract generic AI auth helpers into shared module and
skip binding when challenge signals are present
- admin-web: render DeepSeek HTML answers with inline citation anchors
and surface reference-number badges on source cards
- server: fall back to inline_links/source_panel_links and read
text/siteName fields when extracting DeepSeek citations
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces the Wenxin (文心一言) monitoring adapter and registers it in
the runtime controller and adapter index. Adds a new risk_control
failure classification with custom classifiers for Doubao and Wenxin
that recognize rate-limit, 频控 and 访问环境异常 signals, and propagates
this state through account-health, runtime activity alerts, and the
renderer views so users see "触发风控" instead of a generic challenge
message on the Home, Accounts, and AI Platforms screens.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the stale API-client flow with a CDP-driven page session that
bootstraps the chat UI, captures streaming responses, and extracts the
answer from both the network log and the DOM. Adds mojibake repair for
UTF-8-over-latin1 encoding drift returned by the site, picks the higher
quality source/DOM answer, and tightens source/citation extraction.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Chart now adapts to container size via useElementSize and adds a hover
tooltip with per-point overlay. Prevents grid/flex blowout with min-width
and layers the SVG absolutely inside its wrapper.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add heuristics to distinguish keyword fragments from substantive answers,
enforce a grace period before returning incomplete content, and mark timed-out
or reasoning-only captures as unknown so later passes can re-collect.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- drop brand_time_buckets and sparkline/coverage UI; dashboard now returns a single day
- compute mention rate from total actual samples instead of averaging per-platform rates
- canonicalize ai_platform_id across services and aggregate platform-overview snapshots
- strip mojibake and non-answer noise from callback payloads and question detail answers
- keep Kimi citations panel-only; still store raw search_results for audit
- render linked [n] inline citations for qwen/yuanbao answers with scroll-to-source behavior
- restrict立即采集 to today's business date with a clear i18n hint
- refresh content-citations into an ant-design table with truncation and hover styling
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- reset stale in_progress tasks owned by a client on startup, offline, and lease expiry
- monitor tasks re-queue for another pick; publish tasks move to unknown for manual reconcile
- send startup=true flag on first heartbeat so the server can trigger recovery
- finalize the linked desktop task when a phase2 monitor callback arrives via desktop_tasks path
- short-circuit the desktop monitor attempt write after the callback already finalized it
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- implement kimi/yuanbao monitor adapters with dedicated citation panel detection
- detect Kimi session via kimi-auth cookie during account binding
- harden hidden Playwright and bound windows with skipTaskbar/focusable/hiddenInMissionControl to stop stealing focus
- tag hidden bootstrap windows with a unique token so CDP retention resolves the correct page
- enable yuanbao/kimi/wenxin platforms in dev-seed and default monitoring quota
- update kimi loginUrl to www.kimi.com
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace SSE /desktop/events with priority AMQP dispatch for monitoring
runs, and add phase1/phase2 infrastructure so desktop workers can lease,
resume, report, skip, and cancel monitoring tasks over the existing
dispatch WebSocket.
- Add monitoring collect outbox worker and phase2 desktop task fields
- Add /desktop/monitoring/tasks/{lease,resume,result,skip,cancel} routes
- Introduce execution-devtools and network-observer on desktop runtime
- Refactor runtime-controller, LoginView, and doubao adapter for the new flow
- Add channelName column to tracking views
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduce a desktop.task.dispatch topic exchange with per-client routing
keys. Tenant-api publishes a task_available frame keyed by target client
ID when a publish job is created; every instance binds its own transient
queue and forwards to the matching WebSocket (/api/desktop/dispatch) it
owns. Desktop-client now prefers this push channel and only falls back
to HTTP /lease polling when the socket is down. Also drop admin-web
monitoring-plugin remnants and scope the publish modal account list to
publish platforms.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Added a new Qwen adapter to facilitate monitoring through Playwright, leveraging internal text/chat managers.
- Updated account detection logic to recognize Qwen sessions based on persisted cookies, improving binding reliability.
- Relaxed authentication requirements for monitor tasks, allowing anonymous execution for certain AI platforms.
- Enhanced the generic AI platform detection to include Qwen-specific logic, ensuring accurate session identification.
- Modified the monitoring dashboard to include runtime state indicating if the current user's desktop client is online.
- Updated various files including `account-binder.ts`, `runtime-controller.ts`, and `monitoring_service.go` to support new features and improvements.
Move monitor-task scheduling authority onto the client with a durable
file-backed queue that survives restart, drops stale cross-day tasks,
enforces per-platform serialism, and adapts global concurrency from
Electron process metrics. Publish tasks keep their existing FIFO.
Add a hidden Playwright CDP manager that attaches to Electron Chromium
on account session partitions, lets adapters opt into `executionMode:
"playwright"`, and leaves the existing hidden WebContentsView path in
place for current adapters.
Introduce an account-health subsystem with silent probes, projected
health/auth states, and IPC invalidation events so the renderer can
show accurate auth/probe status and verification timestamps.
Server-side, derive and forward title/business_date/scheduler_group_key/
question_text metadata on desktop task events so the local scheduler
can defer same-question fan-out before leasing.
Inline the card styling on HomeView and PublishManagementView instead of
leaning on the generic MetricCard/SurfaceCard wrappers — larger numerics,
softer radii, clearer section headers, and a stats strip on the Publish hero.
No behavioral changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sidebar now pulls the device name from the runtime snapshot (the client the
backend sees) instead of the stale copy persisted at login, so a rebinding or
hostname change is visible without relogin. Session composable resolves a more
accurate fallback device name/OS from userAgentData and silently re-persists
desktopClient.{device_name,os,cpu_arch} on boot when the resolved values differ
from what's stored. Also replaces the text logout link with an icon button and
adds a status dot to the device tag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
After splitting AI platforms into their own catalog, the admin MediaView and
desktop AccountsView still showed yuanbao/kimi/wenxin/deepseek/doubao/qwen
rows alongside publish platforms. Filter by publish catalog membership so
those views stay scoped to publish accounts only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add ai_platforms table + shared catalog (yuanbao/kimi/wenxin/deepseek/doubao/qwen),
drop FKs from platform_accounts and desktop_tasks to media_platforms, and wire
target_account_id + platform into DesktopTaskEvent so the desktop runtime no
longer has to infer them from local state. Desktop client gains generic AI page
detection for binding, drops stale-business-date monitor tasks at the edge, and
refactors AccountsView/AiPlatformsView around the shared catalog. Admin tracking
view surfaces per-platform sampling status cards.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Hard cutover from the browser-extension plugin flow to desktop clients:
remove plugin_installations/plugin_sessions tables and related service,
handler, router, and generated model code; migrate monitoring quotas
and collector types to desktop_clients (UUID primary_client_id);
recreate platform_access_snapshots keyed by client_id; update dev-seed
and callback types accordingly; mark legacy design docs as historical.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Renderer was registering clients with navigator.platform ("MacIntel") and
a hardcoded "renderer-preview" cpu_arch. Source device info from the main
process (os.hostname + process.platform/arch) via a new device-info IPC,
and let heartbeats always send the authoritative runtime values so stale
registrations self-heal.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ship a Zhihu publish adapter that reuses the shared session fetch and
image pipeline: converts markdown to HTML via marked, uploads cover
and inline images through Zhihu's image token flow, creates a draft,
and publishes it, returning external article URLs. Wire it into the
adapter barrel and runtime-controller's publish adapter selector so
Zhihu publish tasks stop falling through to the scaffold result.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Treat ambiguous terminal states as failures end-to-end: server
normalizes unknown desktop task completions and views to failed, drops
the pending_review aggregate branch, and remaps pending_review to
failed in publish record conversion. admin-web removes the
pending_review status option from article list filters, pushes
pending_review through the failed tone, and folds lingering
publishing/pending entries under the publishing bucket. desktop-client
relabels unknown as 发送失败 in PublishManagement/TasksView, rewrites
the scaffold adapter result to a proper failed error envelope, and
sanitises legacy scaffold-only error messages to a user-friendly note.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Track active bindPublishAccount calls in a per-platform map so a repeat
invocation reuses and focuses the existing window instead of spawning
a second one, and reject new platforms once 2 bind windows are already
open. Surface desktop_account_bind_limit_reached as a warning modal in
the renderer so users know to finish or close an existing authorization
before starting another.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Swap the gradient hero, rounded shadows, and blue-tinted accents for a
neutral card system (gray-50/100 surfaces, indigo eyebrow chip, blue-500
selection ring), tighten checkmark sizing with a fade-in transition, and
normalise list/tag spacing so the modal reads consistently with the
rest of admin-web.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop the eager Antd global import in favour of unplugin-vue-components
on-demand resolution, async route components, defineAsyncComponent for
the shell/login split, and a dynamic Modal import inside
showClientActionError. Pair that with a visibility-aware runtime poller
that stops the 15s snapshot refresh when the window is hidden and kicks
off an immediate refresh on re-show. Refresh DesktopShell nav with
inline icons and a calmer active/hover treatment, and land
ActionButton/DisclosurePanel/PaginationBar primitives for upcoming
views.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace single-shot acquireHotView with retainHotView/releaseHotView
plus a minute-level reaper that closes views idle beyond 5 minutes and
never evicts a view while it still has live retainers. Wrap adapter
calls in try/finally so a failing publish/query still releases the
view. Sample process metrics every minute and expose hot-view policy
and process snapshot via the runtime snapshot for diagnostics.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fall back to looking up article_id from publish_records or publish_batches
when the desktop task payload lacks article_id at the top level. Covers
payloads that only carry content_ref.{article_id,id}, publish_record_id,
or publish_batch_id, preventing spurious 40096 errors when retrying
older desktop tasks.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.
Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.
Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.
Fifth-round codex+gemini final verification: Gemini gave Ready-to-plan;
codex gave Ready-with-caveats with 5 surgical contract gaps. All 5
closed in v2.5:
1. reconcile status=retry semantics pinned: original task returns to
queued with attempts+1, no cloning, no new job. §6.4 route note,
§7.5 UNKNOWN reconcile table (renamed from "重新创建任务" to "重新
运行"), and §15.1 Mermaid all agree.
2. content_ref workspace boundary rule (Phase 1): tenant-native
entities (article_draft/template_gen/video/brand_asset) must
belong to actor's primary workspace, otherwise 422. Added to
Plan 0 cross-workspace pentration test exit bar.
3. WorkspaceScope input surface unified: removed workspace_id= query
from §6.8.2 modal example; scope solely derived from Actor.
4. Contract drift cleanup: GET /api/desktop/accounts?client=self
return fields add delete_requested_at; retry path clarified to
JSON body.
5. Parked Web cancel endpoint: new POST /api/tenant/tasks/{id}/cancel
(WorkspaceScope) for aborting parked/queued tasks; §15.1 Mermaid
updated with queued→aborted edge and endpoint labels.
Header upgraded to v2.5.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Third-round Claude+Codex+Gemini architect review surfaced foundation-
level issues that prior local patches missed. Codex verdict was
Needs-rework; Gemini verdict was Ready-with-caveats. v2.3 lands all
2 Critical + 9 Warning + 3 Info.
Critical:
- C1 workspace-as-first-class: Prior drafts added a WorkspaceScope
middleware, but Codex verified code: Actor/Claims carry only tenant_id,
cache_support keys scope to tenant, workspaces table migration does
not exist, tenant_monitoring_quotas tracks primary_installation_id.
Add a new Plan 0 (Workspace foundation uplift, 2-3w, blocks Plan A)
covering workspaces + memberships migrations, claims extension,
cache-key rewrite, and the full monitoring-domain migration checklist
(new §6.1.1). §2 hard-constraint 8 rewritten; new hard-constraint 9
reserves credential_holder / account_home naming for future evolution.
- C2 CDP stream-capture path was still inconsistent: Fetch.continueResponse
+ takeResponseBodyAsStream cannot chain per CDP semantics. v2.3 moves
EventSource to Network.eventSourceMessageReceived, fetch-stream to
Network.streamResourceContent + dataReceived (Chromium >=120, OK on
Electron 41), and reserves Fetch only for must-mutate scenarios
without chained continueResponse. Plan A now requires a provider x
transport spike matrix (0.5w) before any adapter work.
Warning:
- W1 Patch-channel minimal loop (G1) promoted from Plan C to Plan B,
so Beta exit criteria are satisfiable.
- W2 waiting_user decoupled from lease: becomes a parked state that
releases the lease, survives hours of human review, and is resumed
via POST /tasks/{id}/lease?from_parked=true.
- W3 credential_holder/account_home evolution seam formalized.
- W4 §6.1.1 lists 8 monitoring-domain migration items that were
previously hidden inside "sqlc rename".
- W5 Deep-link nonce becomes a one-time opaque code bound to
target_client_id, Redis-jti consumed on verify.
- W6 §10.3 block H raised from 1.5w to 2.5-3w after Gemini verified
PublishArticleModal's accounts[0] assumption needs a real rewrite.
- W7 MarkdownPreview extracted into packages/ui-shared so Web preview
and Desktop manual review use the same renderer.
- W8 packages/http-client gains a standardized SseClient (backoff +
Last-Event-ID + snapshot + dedup), shared by both apps.
- W9 Trace viewer now runs inside a CSP-sandboxed iframe with hash
routing for file:// loads; trace data flows in via postMessage.
Info:
- I1 §14 adapter map appendix; Hunyuan renamed to Yuanbao with the
correct entry domain (yuanbao.tencent.com).
- I2 UNKNOWN tasks gain a reconcile workflow (mark-succeeded /
mark-failed / ignore / recreate), plus weekly in-app nudge.
- I3 New §15 listing the 5 Mermaid diagrams Plan A must produce
(sequence, lease state machine, account resync, multi-instance
topology, component tree).
Total effort re-estimated from 24-28w to 28-33w; split expands from
3 plans to 4 (Plan 0 -> A -> B -> C).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
User feedback integrated:
- LLM monitoring scope: 3 → 5 providers (add Hunyuan + Kimi).
Keep-alive table in §4.4 gets 2 rows (default 8 min heartbeat,
re-evaluate on integration). Block B effort 2-3w → 4-5w; total
22-26w → 24-28w; Plan B scope updated.
- New §6.8 "admin-web coordination" covering:
- Publish modal with *account-level* selection (not platform-level):
one workspace has many accounts per platform (e.g., 5 WeChat);
one job expands to N desktop_tasks each bound to (platform, account).
- Media data dashboards at account-level granularity (overview,
publish history, monitoring results).
- New /api/tenant/* aggregation + SSE event bus (separate channel
from /api/desktop/events).
- Offline degradation UX when client(s) are offline.
- Account data consistency: client is SoT for account existence,
server stores projection; startup resync on upsert/delete.
- georankly:// deep links with installed-client detection fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
root