9727077dfaef16d5ff01ac689bb8edd3cf777582
8 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 root
|
a617d39a4a |
feat(desktop): drop parked review flow, add publish management
SaaS 侧人工审核后才创建 publish job，desktop 不再做二次审核：移除 manual/waiting_user/parked/from_parked 状态机与 LeaseFromParked 查询， desktop client 只执行发布并新增"发布管理"页（待发布队列 / 历史 / 再次 发送）。同时抽离 @geo/publisher-platforms 共享适配器包、新增 Redis-based desktop_presence 与 publish_record_support，刷新 admin-web 发布弹窗与 媒体库；plan A / spec 文档同步口径。 |
||
|
root
|
e2f26b7468 |
docs(desktop-client): spec v2.5 closes 5 contract gaps from round-5 review
Fifth-round codex+gemini final verification: Gemini gave Ready-to-plan;
codex gave Ready-with-caveats with 5 surgical contract gaps. All 5
closed in v2.5:
1. reconcile status=retry semantics pinned: original task returns to
queued with attempts+1, no cloning, no new job. §6.4 route note,
§7.5 UNKNOWN reconcile table (renamed from "重新创建任务" to "重新
运行"), and §15.1 Mermaid all agree.
2. content_ref workspace boundary rule (Phase 1): tenant-native
entities (article_draft/template_gen/video/brand_asset) must
belong to actor's primary workspace, otherwise 422. Added to
Plan 0 cross-workspace pentration test exit bar.
3. WorkspaceScope input surface unified: removed workspace_id= query
from §6.8.2 modal example; scope solely derived from Actor.
4. Contract drift cleanup: GET /api/desktop/accounts?client=self
return fields add delete_requested_at; retry path clarified to
JSON body.
5. Parked Web cancel endpoint: new POST /api/tenant/tasks/{id}/cancel
(WorkspaceScope) for aborting parked/queued tasks; §15.1 Mermaid
updated with queued→aborted edge and endpoint labels.
Header upgraded to v2.5.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
root
|
256f507bff |
docs(desktop-client): spec v2.3 from architect-level review
Fourth-round Claude+Codex+Gemini architect review produced 1C + 7W
issues. All applied:
Plan 0 scope lock-in (Codex C1 Partial → Closed):
- §12 Plan 0 explicitly adopts narrow-workspace Phase 1 strategy:
workspace first-class ONLY on desktop_clients / platform_accounts /
desktop_tasks / desktop_publish_jobs / tenant_monitoring_quotas.
Existing articles / brands / kol-templates / publish-batches /
images lines keep tenant==workspace (no multi-workspace UI).
- WorkspaceScope middleware attached to a specific route whitelist only.
- Eight concrete Plan 0 deliverables with three exit-bar categories.
Spec consistency sweep (Codex W3):
- §6.4 idempotency contract rewritten: pause/resume references
removed; correct new lease ops enumerated (extend/cancel/result/
park/trace + lease + lease?from_parked).
- §7.5 crash recovery: lease_client_id → target_client_id (the former
never existed after the v2.2 schema restructure).
- §6.6 platform_accounts DDL gains delete_requested_at column so
§6.8.6 two-phase delete protocol actually has its storage.
- §6.4 routes table adds POST /api/tenant/tasks/{id}/reconcile and
POST /api/tenant/accounts/{id}/request-delete (previously only in
prose).
- §14 Waiting-user glossary rewritten to reflect parked+CAS model.
- §13 v2.2 changelog annotated with "v2.3+ supersedes".
Parked / reconcile protocol closure (Codex W2 Partial → Closed):
- §5.3 adds Parked Recovery Protocol: strict CAS SQL sketch for
POST /tasks/{id}/lease?from_parked, five error scenarios with
client action mapping, idempotent repeat-request rule, and five
target_client-offline/revoke/swap/72h-timeout strategies with
a "never auto-rebind" core principle.
- Reconcile moved from /api/desktop/* to /api/tenant/* (Web owns
reconciliation).
- Parked auto-abort threshold lifted 24h → 72h to avoid weekend
false-kills.
Mermaid diagrams pulled forward (Gemini W10):
- §15.1 Lease state machine (Mermaid stateDiagram-v2) inlined.
- §15.2 Account CAS + Tombstone resync sequence diagram inlined.
- §15.3 reserves three remaining diagrams for Plan A.
Spike operability (Codex W4):
- §12 Plan A Spike specs owner pair (runtime + provider owner),
artifact (electron-chromium-cdp-matrix.md with capture/screenshot
evidence), three-state outcome (supported / degraded / blocked),
and fallback decision tree for blocked case.
Modal refactor split (Gemini C1):
- §12 Plan A Block H splits into H1 (weeks 1-2: ui-shared skeleton +
design tokens + useAccountSelection composable + shared components)
and H2 (weeks 4-5: PublishArticleModal rewrite on top of H1).
Design tokens explicit (Gemini W2):
- H1 now required to produce CSS variables (light/dark) + Ant Design
Theme Config as first deliverables of ui-shared.
credential_holder DDL promise softened (Codex W3 Partial → Closed):
- §2 hard constraint 9 reverts to naming soft-convention only; DDL
keeps workspace_id / client_id / target_client_id.
- §11 risk note adjusted.
Header status updated to v2.4. Total effort unchanged at 28-33 weeks.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
root
|
ef978ddbbf |
docs(desktop-client): spec v2.3 from architect-level review
Third-round Claude+Codex+Gemini architect review surfaced foundation-
level issues that prior local patches missed. Codex verdict was
Needs-rework; Gemini verdict was Ready-with-caveats. v2.3 lands all
2 Critical + 9 Warning + 3 Info.
Critical:
- C1 workspace-as-first-class: Prior drafts added a WorkspaceScope
middleware, but Codex verified code: Actor/Claims carry only tenant_id,
cache_support keys scope to tenant, workspaces table migration does
not exist, tenant_monitoring_quotas tracks primary_installation_id.
Add a new Plan 0 (Workspace foundation uplift, 2-3w, blocks Plan A)
covering workspaces + memberships migrations, claims extension,
cache-key rewrite, and the full monitoring-domain migration checklist
(new §6.1.1). §2 hard-constraint 8 rewritten; new hard-constraint 9
reserves credential_holder / account_home naming for future evolution.
- C2 CDP stream-capture path was still inconsistent: Fetch.continueResponse
+ takeResponseBodyAsStream cannot chain per CDP semantics. v2.3 moves
EventSource to Network.eventSourceMessageReceived, fetch-stream to
Network.streamResourceContent + dataReceived (Chromium >=120, OK on
Electron 41), and reserves Fetch only for must-mutate scenarios
without chained continueResponse. Plan A now requires a provider x
transport spike matrix (0.5w) before any adapter work.
Warning:
- W1 Patch-channel minimal loop (G1) promoted from Plan C to Plan B,
so Beta exit criteria are satisfiable.
- W2 waiting_user decoupled from lease: becomes a parked state that
releases the lease, survives hours of human review, and is resumed
via POST /tasks/{id}/lease?from_parked=true.
- W3 credential_holder/account_home evolution seam formalized.
- W4 §6.1.1 lists 8 monitoring-domain migration items that were
previously hidden inside "sqlc rename".
- W5 Deep-link nonce becomes a one-time opaque code bound to
target_client_id, Redis-jti consumed on verify.
- W6 §10.3 block H raised from 1.5w to 2.5-3w after Gemini verified
PublishArticleModal's accounts[0] assumption needs a real rewrite.
- W7 MarkdownPreview extracted into packages/ui-shared so Web preview
and Desktop manual review use the same renderer.
- W8 packages/http-client gains a standardized SseClient (backoff +
Last-Event-ID + snapshot + dedup), shared by both apps.
- W9 Trace viewer now runs inside a CSP-sandboxed iframe with hash
routing for file:// loads; trace data flows in via postMessage.
Info:
- I1 §14 adapter map appendix; Hunyuan renamed to Yuanbao with the
correct entry domain (yuanbao.tencent.com).
- I2 UNKNOWN tasks gain a reconcile workflow (mark-succeeded /
mark-failed / ignore / recreate), plus weekly in-app nudge.
- I3 New §15 listing the 5 Mermaid diagrams Plan A must produce
(sequence, lease state machine, account resync, multi-instance
topology, component tree).
Total effort re-estimated from 24-28w to 28-33w; split expands from
3 plans to 4 (Plan 0 -> A -> B -> C).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
root
|
a83faff211 |
docs(desktop-client): spec v2.2 applies 4C+9W from second cross-review
Second-round Claude+Codex+Gemini cross-review surfaced implementation-
level gaps in the v2.1 admin-web coordination layer. All 4 Critical
and 9 Warning findings addressed:
Critical:
- C1 (multi-account routing): desktop_tasks now has first-class columns
job_id, target_account_id, target_client_id, platform with indexes;
new desktop_publish_jobs aggregation table; §6.3 SSE only pushes to
target_client_id; lease rejects non-target requesters.
- C2 (account consistency): Replace vague "client=SoT, server=projection"
with CAS + Tombstone protocol. platform_accounts gains sync_version
and deleted_at; all client writes require if_sync_version CAS; web-side
delete writes delete_requested_at intent, client resync completes the
delete via normal DELETE path. Added 3-way merge rules and concurrent
case table in §6.8.6.
- C3 (/api/tenant/events auth): WorkspaceScope middleware required
(TenantScope insufficient); topics must be server-derived from
actor+workspace, never accept free query params; symmetric contract
table between /api/desktop/events and /api/tenant/events (multi-
instance fanout, Last-Event-ID replay, snapshot first frame, monotonic
event_id, client dedup).
- C4 (route migration): Full migration map added in §6.8.4 listing
media/platform-accounts -> accounts, articles/:id/publish-batches ->
publish-jobs, publish-records -> publish-jobs/{id} subtasks.
Warning:
- Kimi binary-framed gRPC-Web path added to §5.2 transport table;
login methods (Kimi: wechat/phone; Hunyuan: wechat/qq/email +
loopback) noted in §4.4.
- Offline->online dual-sided reclaim: server scans queued tasks and
re-pushes task_available; client heartbeats+resyncs then enters
lease(limit=20) loop until empty.
- GET /api/desktop/accounts?client=self added to §6.4 for resync.
- Account.tags added; Modal gains tag multiselect + search + three-
level batch select.
- §6.8.5 exposes queue_ahead + eta_seconds for capacity feedback.
- Deep link gains intermediate-state modal + manual-launch/copy
fallbacks + one-time nonce JWT on tasks/<id>/review; Windows/mac/
Linux protocol registration specified.
- content_ref is now polymorphic {type, id} supporting article_draft /
template_gen / video / brand_asset.
- retry endpoint accepts JSON body, not query string.
Info: §10.3 title corrected to 9 blocks; §12 opening synced to 24-28
weeks; §6.8.3 adds "attention-needed accounts" card + per-platform
summary; monitoring LLM UI switched to Grid/Tag responsive layout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
root
|
c41222706b |
docs(desktop-client): spec v2.1 adds admin-web coordination + 2 LLMs
User feedback integrated:
- LLM monitoring scope: 3 → 5 providers (add Hunyuan + Kimi).
Keep-alive table in §4.4 gets 2 rows (default 8 min heartbeat,
re-evaluate on integration). Block B effort 2-3w → 4-5w; total
22-26w → 24-28w; Plan B scope updated.
- New §6.8 "admin-web coordination" covering:
- Publish modal with *account-level* selection (not platform-level):
one workspace has many accounts per platform (e.g., 5 WeChat);
one job expands to N desktop_tasks each bound to (platform, account).
- Media data dashboards at account-level granularity (overview,
publish history, monitoring results).
- New /api/tenant/* aggregation + SSE event bus (separate channel
from /api/desktop/events).
- Offline degradation UX when client(s) are offline.
- Account data consistency: client is SoT for account existence,
server stores projection; startup resync on upsert/delete.
- georankly:// deep links with installed-client detection fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
root
|
2e1a5900ea |
docs(desktop-client): revise spec v2 with triple-review fixes
Address 6 Critical + 10 Warning findings from Claude + Codex + Gemini cross-review: - C1 Replace Network.responseReceivedExtraInfo path with EventSource / Fetch.takeResponseBodyAsStream routing per transport type; add Electron-Chromium CDP compatibility matrix commitment. - C2 Default patch channel to pure-data DSL (no JS exec); executable fallback gated on utilityProcess + isolated-vm sandbox with frozen globals. Full TUF-style signing chain (patch_seq, hash, expires_at, key_id rotation, revokes, runtime hash re-verify). - C3 Add RabbitMQ task_available fanout + Redis presence registry; SSE only pushes signals, task ownership decided atomically by lease endpoint. - C4 platform_accounts gains platform_uid + account_fingerprint + UNIQUE(platform, platform_uid) enforcing workspace-exclusive binding in DB, not by client discipline. - C5 Task protocol adds attempt_id + lease_token with extend/pause/resume/cancel endpoints; manual mode enters waiting_user status with extended lease; 409 on stale lease_token. - C6 Rewrite scope estimate with 7 detect-only publish adapters and DeepSeek monitor placeholder called out explicitly; reshape as 9-bucket 22-26 week effort; introduce Plan A/B/C split. Warnings addressed: BrowserView->WebContentsView everywhere; allowDowngrade spelling fix; client_token decoupled from client_version with rotate/revoke APIs; safeStorage Linux basic_text guard + separate vault-export for machine migration; keep-alive token bucket + 429 backoff + resume warm-up; packages/ui-shared carve-out (no admin-web cloning); state machine gets failed/aborted/unknown terminal states; sqlc regeneration footprint made explicit; crash recovery split by task.kind; autoUpdater unit tests + pre-release smoke; trace phased (Alpha=logs+shots, Phase 2=Playwright-compat export). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
root
|
9ec9314aea |
docs(desktop-client): add Electron 桌面客户端 replacement design spec
Captures the full plan for replacing apps/browser-extension with an Electron tray client: single main process with multi-session isolation, embedded web-view login with OS-encrypted local cookie vault, CDP-based LLM monitoring (no official APIs, cost-driven), unified PublishAdapter and MonitorAdapter interfaces with dual-track updates (per-adapter patch channel + full release channel), Playwright-grade tracing, new /api/desktop/* protocol with SSE + 60s pull, and 5-arch multi-OS packaging strategy. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |