root
a83faff211
docs(desktop-client): spec v2.2 applies 4C+9W from second cross-review
...
Second-round Claude+Codex+Gemini cross-review surfaced implementation-
level gaps in the v2.1 admin-web coordination layer. All 4 Critical
and 9 Warning findings addressed:
Critical:
- C1 (multi-account routing): desktop_tasks now has first-class columns
job_id, target_account_id, target_client_id, platform with indexes;
new desktop_publish_jobs aggregation table; §6.3 SSE only pushes to
target_client_id; lease rejects non-target requesters.
- C2 (account consistency): Replace vague "client=SoT, server=projection"
with CAS + Tombstone protocol. platform_accounts gains sync_version
and deleted_at; all client writes require if_sync_version CAS; web-side
delete writes delete_requested_at intent, client resync completes the
delete via normal DELETE path. Added 3-way merge rules and concurrent
case table in §6.8.6.
- C3 (/api/tenant/events auth): WorkspaceScope middleware required
(TenantScope insufficient); topics must be server-derived from
actor+workspace, never accept free query params; symmetric contract
table between /api/desktop/events and /api/tenant/events (multi-
instance fanout, Last-Event-ID replay, snapshot first frame, monotonic
event_id, client dedup).
- C4 (route migration): Full migration map added in §6.8.4 listing
media/platform-accounts -> accounts, articles/:id/publish-batches ->
publish-jobs, publish-records -> publish-jobs/{id} subtasks.
Warning:
- Kimi binary-framed gRPC-Web path added to §5.2 transport table;
login methods (Kimi: wechat/phone; Hunyuan: wechat/qq/email +
loopback) noted in §4.4.
- Offline->online dual-sided reclaim: server scans queued tasks and
re-pushes task_available; client heartbeats+resyncs then enters
lease(limit=20) loop until empty.
- GET /api/desktop/accounts?client=self added to §6.4 for resync.
- Account.tags added; Modal gains tag multiselect + search + three-
level batch select.
- §6.8.5 exposes queue_ahead + eta_seconds for capacity feedback.
- Deep link gains intermediate-state modal + manual-launch/copy
fallbacks + one-time nonce JWT on tasks/<id>/review; Windows/mac/
Linux protocol registration specified.
- content_ref is now polymorphic {type, id} supporting article_draft /
template_gen / video / brand_asset.
- retry endpoint accepts JSON body, not query string.
Info: §10.3 title corrected to 9 blocks; §12 opening synced to 24-28
weeks; §6.8.3 adds "attention-needed accounts" card + per-platform
summary; monitoring LLM UI switched to Grid/Tag responsive layout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-18 21:48:02 +08:00
root
c41222706b
docs(desktop-client): spec v2.1 adds admin-web coordination + 2 LLMs
...
User feedback integrated:
- LLM monitoring scope: 3 → 5 providers (add Hunyuan + Kimi).
Keep-alive table in §4.4 gets 2 rows (default 8 min heartbeat,
re-evaluate on integration). Block B effort 2-3w → 4-5w; total
22-26w → 24-28w; Plan B scope updated.
- New §6.8 "admin-web coordination" covering:
- Publish modal with *account-level* selection (not platform-level):
one workspace has many accounts per platform (e.g., 5 WeChat);
one job expands to N desktop_tasks each bound to (platform, account).
- Media data dashboards at account-level granularity (overview,
publish history, monitoring results).
- New /api/tenant/* aggregation + SSE event bus (separate channel
from /api/desktop/events).
- Offline degradation UX when client(s) are offline.
- Account data consistency: client is SoT for account existence,
server stores projection; startup resync on upsert/delete.
- georankly:// deep links with installed-client detection fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-18 21:22:38 +08:00
root
2e1a5900ea
docs(desktop-client): revise spec v2 with triple-review fixes
...
Address 6 Critical + 10 Warning findings from Claude + Codex + Gemini
cross-review:
- C1 Replace Network.responseReceivedExtraInfo path with EventSource /
Fetch.takeResponseBodyAsStream routing per transport type; add
Electron-Chromium CDP compatibility matrix commitment.
- C2 Default patch channel to pure-data DSL (no JS exec); executable
fallback gated on utilityProcess + isolated-vm sandbox with frozen
globals. Full TUF-style signing chain (patch_seq, hash, expires_at,
key_id rotation, revokes, runtime hash re-verify).
- C3 Add RabbitMQ task_available fanout + Redis presence registry;
SSE only pushes signals, task ownership decided atomically by
lease endpoint.
- C4 platform_accounts gains platform_uid + account_fingerprint +
UNIQUE(platform, platform_uid) enforcing workspace-exclusive
binding in DB, not by client discipline.
- C5 Task protocol adds attempt_id + lease_token with
extend/pause/resume/cancel endpoints; manual mode enters
waiting_user status with extended lease; 409 on stale lease_token.
- C6 Rewrite scope estimate with 7 detect-only publish adapters and
DeepSeek monitor placeholder called out explicitly; reshape as
9-bucket 22-26 week effort; introduce Plan A/B/C split.
Warnings addressed: BrowserView->WebContentsView everywhere;
allowDowngrade spelling fix; client_token decoupled from
client_version with rotate/revoke APIs; safeStorage Linux
basic_text guard + separate vault-export for machine migration;
keep-alive token bucket + 429 backoff + resume warm-up;
packages/ui-shared carve-out (no admin-web cloning); state machine
gets failed/aborted/unknown terminal states; sqlc regeneration
footprint made explicit; crash recovery split by task.kind;
autoUpdater unit tests + pre-release smoke; trace phased
(Alpha=logs+shots, Phase 2=Playwright-compat export).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-18 21:05:41 +08:00
root
9ec9314aea
docs(desktop-client): add Electron 桌面客户端 replacement design spec
...
Captures the full plan for replacing apps/browser-extension with an
Electron tray client: single main process with multi-session isolation,
embedded web-view login with OS-encrypted local cookie vault, CDP-based
LLM monitoring (no official APIs, cost-driven), unified PublishAdapter
and MonitorAdapter interfaces with dual-track updates (per-adapter patch
channel + full release channel), Playwright-grade tracing, new
/api/desktop/* protocol with SSE + 60s pull, and 5-arch multi-OS
packaging strategy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-18 20:28:42 +08:00
root