Drop tenant scoping on site_domain_mappings now that the citation query
resolves mappings without tenant filtering. Add a unique index on
registrable_domain plus an updated_at column, and switch the dev-seed
upsert to use ON CONFLICT (registrable_domain). Adds a SiteDomainMapping
type to ops/domain for the upcoming console management UI.
Persistent logins land in localStorage, ephemeral ones in sessionStorage,
and we recall the last username + remember preference on the login form.
Also propagate the indigo brand color through the antd ConfigProvider
theme token so the side nav and avatar match the redesigned login.
Replace the per-row tenant+global LATERAL joins with a single CTE that
materializes filtered citations and resolves domain mappings once per
distinct host/domain/site_key triple. Reduces redundant scans of
site_domain_mappings on large run batches.
Why: avoid showing accounts as not-live during stale-window probes; keep publish gating consistent with runtime view.
- collapse FIRST_PROBE window so initial probe runs immediately
- skip due-probe selection when a probe is already queued/in-flight
- mirror auth-state→health projection on both client report and tenant ingest paths
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the previous split-screen with a brand panel that hosts an
animated mascot (eyeballs whose pupils track the focused form field and
hide while the password is typed) and decorative grid/circles, plus a
mobile brand mark and footer links. Swap Ant Design form controls for
native inputs styled to match. The mascot is composed from new
AnimatedCharacters / EyeBall / Pupil components.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The buffer-backed xdb.Searcher is not safe for concurrent use, so
parallel audit appends could race on Search and corrupt internal state.
Serialize v4 and v6 lookups behind separate mutexes so concurrent
callers fall through one at a time.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add an IPRegionResolver wrapping the ip2region xdb library and attach it
to AuditService so each appended event records both the raw IP and a
resolved region in a new ops.audit_logs.ip_region column. Loopback and
private addresses short-circuit to local labels; missing xdb data or
lookup errors degrade silently so auditing keeps working without it.
The ops console audit view shows the region beneath the IP. Bundle the
v4/v6 xdb data under internal/ops/app/ipregiondata so the resolver works
out of the box, with config paths/env overrides for swapping in updated
data sets.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Free plan now ships with 10 AI points/month and Plus with 1000, replacing
the placeholder zeroes left over when the feature was first wired up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds /admin-users CRUD on the ops backend, covering listing, plan/role/KOL
toggles, subscription expiry, status flips and password resets, with a
configurable default plan code. The ops console exposes a new top-level
"用户管理" view and reorganises the sidebar so 操作员管理 and 审计日志
move under a "系统设置" group; AccountsView is renamed accordingly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Login form takes a phone-or-email identifier; user info now exposes phone
so the shell can fall back through name → phone → email. When membership
expires, the app stays on the current route but renders a minimal blocked
state in the shell instead of redirecting to a dedicated page; an Axios
interceptor flips the local session into the blocked state when the API
returns trial/subscription errors.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phone becomes the required, unique login identifier; email and name turn
optional. Login now accepts either via a single identifier field, refresh
re-checks tenant membership, and the dev seed provides phone numbers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Server callback now rejects succeeded submissions without a non-empty answer,
or whose answer contains [citation:N] markers without any sources. Desktop
adapters mirror this client-side: kimi returns unknown when sources arrive
without a final answer, and yuanbao returns unknown when the answer has
unresolved citation markers. Yuanbao also unwraps redirect URLs, harvests
citations from more DOM attributes and document URL fields, drops links
pointing back at yuanbao itself, and dedupes overlapping streaming
fragments. Runtime controller forwards only an explicit "succeeded" status
as success; anything else becomes failed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Surfaces the new AI point quota in the workspace shell and adds a
Personal Center → AI Point Usage page that shows balance, base-char
rule, and the paginated reservation/refund history. Updates shared
types for the QuotaSummary and ledger payloads.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds an ai_point_usage_logs ledger and a reserve/refund/complete pipeline
that charges AI points for article selection optimize, template analyze
/title/outline, and KOL prompt generate/optimize. Pending reservations
are reconciled when the kol-assist worker and template-assist tasks
finish or fail, so points refund automatically on errors. Workspace now
exposes the AI quota status and a paginated usage ledger.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces ai_points_monthly and ai_point_base_chars on the membership
plan policy, exposes them through TenantPlanAccess and MembershipInfo,
and seeds Pro with a 1500-point monthly allowance across the local,
server, and deploy configs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Vue 3 + Ant Design Vue SPA scaffold for the internal ops console. Ships
the auth, account list, and audit log views that consume the new ops-api
endpoints, plus the nginx/vite/typecheck plumbing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the ops-api container, ops-config volume, and migrate-ops step so
the operations console backend boots alongside the rest of the stack.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Stand up an internal ops-api service with operator account, auth, and
audit log subsystems backed by a dedicated migrations_ops migration set.
Wire Makefile targets and the migrate Dockerfile stage so the new schema
ships alongside the existing tenant + monitoring databases.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The transport/lease-manager/vault JSON dump was a debug artifact and
duplicated information already surfaced in the network and accounts
panels. Remove the panel and its styles.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Daily monitoring tasks were pinned to a single primary client. If that
client went offline the task wedged even when another desktop client of
the same workspace was online and bound to the same account. Drop the
primary-client constraint on the materialized collect rows, and instead
pick a target per-platform from live account/client presence in Redis,
falling back to the DB client_id when the desktop client is still flagged
online. Desktop task lease for kind=monitor now matches by account
ownership in addition to target_client_id, so any client owning the
account can drain the queue.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The deepseek adapter pulls in electron/main when registering ipc listeners,
which made the test fail at import time outside the electron runtime. Stub
ipcMain with vi.mock so the unit test can load the module under vitest.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Use the account session for imagex apply/upload/commit so the requests carry
the same cookies/UA the bind console saw, instead of falling out of the
session via a bare Node fetch — bytedance imagex was rejecting these as
unauthenticated under the bound session. Also align the binding console URL
with the v2 publish article path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Surface the new runtime_health/runtime_checked_at fields through a tiny
desktop-account-runtime helper so PublishArticleModal, MediaView, and
TrackingView fall back to the desktop client's last live signal instead of
the slower DB column. This keeps the publishable card and tracking
breakdown in sync with the desktop probe loop.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace serial probe-on-lock with a bounded probe queue (concurrency 3) that
adds a "queued" probe state, manual cooldown, and retry backoff. After each
probe the runtime debounces a batched POST to the new
/desktop/accounts/health-reports endpoint so the server learns about live,
expired, and risk transitions without waiting for a re-bind. Adds an
account-scoped IPC (probeRuntimeAccount + runtimeAccountSnapshot) so the
renderer can refresh a single row instead of replaying the full snapshot,
and exposes the resulting "重新校验" action in AccountsView/AiPlatformsView.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a POST /desktop/accounts/health-reports endpoint that buffers reports in
Redis, dedupes via signature, and publishes change events to a new
desktop.account.health RabbitMQ queue. A sink worker drains the queue, and
the account service overlays runtime health onto database health when serving
desktop accounts. Publish job creation now consults runtime health so a stale
DB row no longer blocks publishing once the desktop client reports it healthy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move 搜狐 from 待测 to verified now that the v4 console URL fix and
external_article_url emission have been validated end-to-end (image,
text, and table publish), and drop the stale ZOL entry from 待测 since
its self-test was already recorded as passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bump the default LLM from doubao-seed-2-0-lite to doubao-seed-2-0-pro
for higher-quality completions on tenant-side LLM calls; keep the lite
id in a trailing comment for quick rollback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The login shell sets -webkit-app-region: drag on its frameless header,
which captured clicks on the "记住密码" checkbox before v-model could
update. Mark .options-row and its descendants as no-drag, and bind the
checkbox via :checked + @change so the click reliably reaches the
toggle handler.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Switch the publish management page to the hero-card + stats-strip layout
shared with AccountsView for visual consistency: bigger title, stats
row, modern table styling, and a content-section wrapper. Add a
buildSohuArticleUrl helper that reconstructs the sohu article URL from
the task result and the bound account's platform uid when the adapter
result didn't include external_article_url, so older finished tasks
also resolve a viewable link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v3 manage URL has been retired and now redirects through a login
gate, breaking the post-publish "管理" deeplink and login detection.
Switch the binding console URL and the adapter SOHU_MANAGE_URL to the
v4 contentManagement endpoints, and synthesize external_article_url for
publish (not draft) results from the article id and account uid so the
publish list can offer a "查看文章" link without an extra fetch.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Now that desktop clients can be re-registered with a new id under the
same user, listing/searching publish tasks by client.id missed the user's
older history and the retry path forbade jobs created from a previous
client. Switch the list/count queries to join desktop_publish_jobs and
filter by created_by_user_id, and enforce the same ownership when
retrying via desktop task. Qualify column names with the t. alias so the
join doesn't break the existing ORDER BY clauses.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Generate the desktop client_id deterministically from OS machine identifiers
(IOPlatformUUID / MachineGuid / /etc/machine-id) scoped per
tenant+workspace+user, with a persisted UUID fallback when the OS lookup
fails. The renderer now requests the id over a new IPC bridge instead of
keeping a localStorage UUID, so reinstalls and storage clears no longer
fork into duplicate clients. Server enforces the id as required and
rejects empty/malformed UUIDs. Also harden bootstrap reveal flow and
single-instance exit so a second launch focuses the existing window.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Collapse the hero card into a compact header with inline metrics, and rework the table with denser rows, fixed action column, and tooltip-backed time/title cells so more tasks fit on screen without losing the error popover and platform context.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Periodically polls runtime snapshot for accounts in expired/revoked/challenge_required states and reflects the count via tray badge, macOS dock badge, and Windows overlay icon so users see authentication problems without opening the app.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Switch retry/copy/console feedback from inline banners to antd
notifications so the table layout stops jumping on each action.
- Truncate the error message in the table cell and move full text +
copy button into a hover popover, preventing very long adapter
errors from blowing out the row width.
- Pin column widths and force fixed table layout so the meta column
no longer expands the table off-screen on long error strings.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the raw external URL link with an in-app shortcut that opens the
bound account's platform console window, and add a one-click copy button
for failure error messages (with truncation + tooltip preview) so long
adapter errors stay readable in the task table.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Detect zol login redirects via passport/service hostnames and verify
console access by re-detecting the bound account so a different logged
in user is treated as expired instead of active.
- Skip networkPic upload for local/private URLs and fall back to file
upload (with siteType retry) so desktop-hosted assets no longer reach
ZOL as unreachable links and produce blank images.
- Surface zol_content_image_upload_failed and challenge errors instead
of silently substituting empty image URLs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When a public asset URL fails (e.g. stale signed token), retry via the
new /api/desktop/content/assets endpoint with the desktop Bearer token
so editor images keep rendering across token rotations.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lets desktop clients fetch tenant images/articles assets via Bearer-auth
without requiring the public asset signature, so stale-signed assets
served from existing articles still load on the desktop side.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Detect qiehao's real-name auth blocking response (code/message) in the
desktop adapter, surface a Chinese-friendly summary, and propagate the
detail through the failure result.
- Extract a shared publisher-errors module so the renderer can normalize
these messages for the publish task table without duplicating regex.
- Pre-process article HTML for qiehao before upload via a new
packages/publisher-platforms/src/qiehao.ts entry point.
- Update the manual self-test notes for jianshu and qiehao with the
latest results.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Jianshu's HTML editor strips uploaded <img> tags during save, so previously
uploaded images vanished from the rendered article. After image upload,
convert each <img> (and surrounding <p> wrappers) to a markdown image block
in both the desktop and extension publish paths so the references survive.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
root