moteva/progress.md

# Progress Log

## Session: 2026-07-15 (Vector Reference Follow-up)

### Phases 21-22
- Restored the existing CAD work and regression context after session handoff.
- Confirmed the two independent failures: nested-parenthesis directives bypass the capsule parser, and SVG bytes reach a raster-only image-generation API.
- Locked the product boundary: SVG remains the canvas source; only model-bound references become temporary transparent WebP assets.
- Ran the focused frontend suite and reproduced both English and Chinese nested-parenthesis directives as deterministic failures; the raster WebP baseline still passes.
- Fixed nested-parenthesis directive parsing; all English, Chinese, and existing raster capsule parser cases pass.
- Added browser-side SVG detection by name, URL, response MIME, and content sniffing; model-bound SVG references render to a transparent 2048px WebP derivative, upload once, and cache by source URL.
- Wired both Agent Chat and the canvas image-generator composer through the shared submission adapter while retaining original SVG canvas content and display names.
- The 14-test frontend suite, TypeScript build, and diff whitespace checks pass.
- In-app browser initialization succeeded but no browser backend is currently available, so capsule hover and live request inspection remain unavailable in this environment.
- Production Next/Vite builds pass, the exact nested CAD filename regression passes, and the active Vite preview remains available at `http://127.0.0.1:5174`.
- Restored the pre-existing `frontend/next-env.d.ts` development route import after Next rewrote it during the production build.

## Session: 2026-07-10

### Phase 1: Architecture Discovery
- **Status:** in_progress
- Read repository instructions and the applicable Go, frontend, planning, and browser verification skills.
- Captured the missing backend ownership, project binding, selector, and chat-context requirements.
- Confirmed the existing go-zero API, SQLC/PostgreSQL, memory-store, and code-generation toolchain.
- Located the project domain/repository and established the project object as the server-side Brand Kit context boundary for chat and generation.
- Traced Agent Chat through planning, research, conversation, and asynchronous generation; identified one project-hydration point plus shared prompt builders for complete coverage.
- Added the Home composer Brand Kit picker and empty create action to the implementation scope.
- Mapped the Home composer action row and frontend project hydration paths for `brandKitId` integration.
- Re-read the active plan after session recovery and confirmed the existing frontend edits are limited to the Brand Kit feature surface.
- Loaded the project go-zero workflow plus the applicable planning, Go, and frontend implementation guidance.
- Completed architecture discovery, including authentication enforcement, SQLC persistence, async job reloads, direct image prompts, and frontend project hydration.
- Chose a versioned JSON document API with server-side schema validation and prompt compilation; project responses expose only `brandKitId`, never compiled context.
- Added and validated the API-first contract for Brand Kit list/upsert/delete, project binding, optional project-creation selection, and project response hydration.
- Generated go-zero handlers, logic shells, routes, and types through the local `mcp-zero` stdio server.
- Added SQLC schema and queries for user-owned versioned Brand Kits and optional project bindings, then regenerated SQLC code.
- Implemented memory/PostgreSQL stores, document validation, single-default enforcement, server-side context compilation, project binding cleanup, and API logic.
- Hydrated the active Brand Kit for synchronous chat, asynchronous create/follow-up jobs, conversations, planner memory, creative prompts, and direct/fallback image prompts.
- Added focused ownership/default/binding/context-injection tests.
- Replaced browser-local Brand Kit persistence with authenticated APIs, including a one-time per-user migration.
- Added reusable Brand Kit selectors to the Home composer and canvas title bar; project creation and binding now send only the selected ID.
- Added server-side Brand Kit asset resolution so uploaded logos, covers, and references reach image generation after user references.
- Added Brand Kit API documentation and ownership/default/binding semantics to the server docs.

## Test Results
| Test | Result | Status |
|------|--------|--------|
| `goctl api validate -api img_infinite_canvas.api` | `api format ok` | pass |
| Targeted Go tests: application, PostgreSQL/memory repositories, logic, service context, error mapping, and prompt agents | all pass | pass |
| `go test ./...` | all packages pass | pass |
| `go build ./...` | build succeeds | pass |
| `npx tsc -b` | typecheck succeeds | pass |
| `npm run build` | Next.js and Vite production builds succeed; existing large-chunk warning only | pass |

## Session: 2026-07-11

### Phase 7: Device Management Discovery and Design
- **Status:** in_progress
- Loaded repository instructions, go-zero workflow rules, frontend design guidance, and the existing planning state.
- Confirmed a clean worktree before starting the device management task.
- Located an existing account-management component and server device list/removal logic for focused inspection.
- Confirmed the current device endpoints are placeholder implementations over stateless user-only tokens; selective revocation is not yet real.
- Completed the session-registry design, including token `sid`, legacy-token migration, request metadata context, throttled last-seen updates, expiry filtering, and atomic revoke semantics.

### Phase 8: Device Management Implementation
- **Status:** in_progress
- Added the maintained `github.com/mileusna/useragent` dependency for normalized, display-only device metadata.
- Implemented token `sid` claims, session context, UA normalization, memory/PostgreSQL session persistence, active-session authentication, last-seen throttling, listing, revoke-others, and logout revocation.
- First targeted test run compiled successfully; the legacy placeholder test failed because removal now correctly requires a current authenticated session context. The test is being upgraded to the production contract.
- Replaced the placeholder test with multi-device lifecycle coverage and added UA parsing, legacy migration, revocation, logout, and middleware metadata/session-context tests.
- Targeted Go tests now pass: `go test ./internal/modules/auth ./internal/handler`.
- Rebuilt the account device section with explicit async states, semantic rows, normalized metadata, responsive stacking, duplicate-submit protection, optimistic post-removal reconciliation, and aligned Chinese/English copy.
- Frontend TypeScript validation passes: `npx tsc -b`.
- Added the follow-up requirement for server-configurable desktop/mobile web-session limits; implementation will extend the API response spec before regeneration.
- Updated and validated `img_infinite_canvas.api`, then regenerated go-zero types with the documented `goctl` fallback; the device list response now includes `limits.desktop` and `limits.mobile`.
- Added `Auth.DeviceLimits.Desktop/Mobile` defaults to local and deployment config, wired them through the auth service, and replaced hard-coded UI counts with API-driven interpolation.
- Documented the configuration and effective API policy in `server/README.md` and `server/API.md`.
- Focused Go tests and frontend TypeScript validation pass after the configurable-limit change.
- Full verification passes: `go mod tidy`, API validation, `go test ./...`, `go build ./...`, and `npm run build` (only the existing Vite large-chunk warning remains).
- Initial alternate-port preview starts exposed two environment constraints: go-zero requires a config filename extension and Next permits one dev server per repo. Switched to a `.yaml` stdin symlink for the backend and the production Next server for the second frontend port.
- The isolated preview is live at `http://localhost:5174` with the new backend on `http://localhost:8889`; the frontend page, auth-options proxy, and protected-device 401 boundary respond correctly.
- The in-app browser runtime has no available browser backend in this environment, so authenticated screenshot inspection could not be completed there.
- Race-enabled auth/middleware tests pass, frontend typecheck and diff checks pass, and the preview proxy still enforces a 401 on unauthenticated device access.
- Reproduced the reported limit bug with a deterministic failing service test: two desktop tokens remained valid with `Desktop: 1`.
- Implemented atomic same-type enforcement in memory and PostgreSQL stores; new logins keep the newest session and revoke oldest overflow sessions.
- Added device-list reconciliation for sessions created before enforcement and verified current-session preservation.
- Changed the device API timestamp contract to RFC3339 UTC and formatted it with the browser's local timezone via `Intl.DateTimeFormat`.
- Regression tests now pass for configured desktop limit 1, pre-enforcement reconciliation, concurrent PostgreSQL logins, and timezone-neutral API timestamps.

### Phase 11: Visual Annotation Discovery and Design
- **Status:** complete
- Loaded the repository workflow, supplied HTML reference, frontend design guidance, and existing planning state.
- Located the image toolbar/action mode owner, the shared canvas action generation route, and the separate general-purpose Agent Chat annotation feature.
- Established the implementation boundary: image-local geometry plus editable per-mark instructions, submitted through the existing image action flow.
- Chose a clean-source plus annotated-guide submission model so freehand and shape marks are visible to the image model without becoming output pixels.
- Confirmed the panel can reuse the active canvas model, existing asset upload, asynchronous node action, task event, and result replacement paths.

### Phase 12: Visual Annotation Implementation
- **Status:** in_progress
- Started the API-first action contract extension and canvas-native visual annotation component implementation.
- Added and validated the API request field for an uploaded annotation guide, then regenerated go-zero types through the local `mcp-zero` stdio server.
- Added the toolbar entry, drawing overlay, four visual tools, numbered mark list, editable instructions, undo/delete, shared model picker, responsive panel placement, and guide rasterization.
- Added backend validation, prompt constraints, clean-source plus guide-image inputs, action lifecycle copy, generator metadata, and focused action coverage.
- Targeted Go tests, locale JSON parsing, and frontend TypeScript validation pass.
- Updated the action contract so visual annotation preserves the original and generates into a sibling copy placed to its right.

## Session: 2026-07-15

### Phase 15: CAD Import Discovery and Design
- **Status:** in_progress
- Loaded the repository go-zero instructions plus the applicable Go, frontend, and file-planning skills.
- Preserved the pre-existing `frontend/next-env.d.ts` change and added the DWG/DXF request as a new plan phase.
- Completed the required workflow/skill reads and confirmed the frontend/backend toolchains and API-first constraint.
- Located the canvas upload/drop surfaces, generic asset upload API, existing SVG render/export support, and canvas node model.
- Traced the exact optimistic upload/save flow and confirmed converted CAD can reuse image-node rendering without changing persistence schemas.
- Confirmed no local CAD converter binary is available and began evaluating a browser-capable dependency that genuinely handles both DXF and DWG.
- Found an MIT-licensed client-side DWG-to-DXF WASM option and isolated the canvas-only import points that need extension.
- Compared candidate packages and selected `@node-projects/acad-ts` for a single browser-side DWG/DXF-to-SVG pipeline, pending package-level verification.
- Downloaded the exact package tarball for API/runtime inspection without changing repository dependencies yet.
- First package source inspection raced extraction in a parallel tool call; no repository files were affected, and inspection will continue from the actual extracted path.
- Verified the extracted package layout and confirmed the required reader/writer exports are browser-neutral.
- Inspected reader and SVG writer internals; scheduled a runtime fixture because the packaged XML closing logic appears incomplete.
- Ran a real DXF line/circle fixture: parsing succeeds, while raw SVG is invalid exactly as suspected. Conversion will include explicit normalization and validation around the third-party writer.
- Completed CAD import discovery and selected a worker-based, frontend-only conversion design with no REST contract changes.
- The first dependency install was blocked by parent-workspace discovery (`workspace:*`); no implementation files were changed by the failed command.
- Installed `@node-projects/acad-ts@2.3.0` with the repository's pnpm toolchain; package manifest and lockfile are now updated.
- Added the worker converter, SVG repair/sanitization, CAD-aware picker/drop flow, localized statuses, toolbar semantics, and README documentation. Initial typecheck found one third-party collection API mismatch.
- Corrected the collection API mismatch; `pnpm exec tsc -b`, locale JSON parsing, and `git diff --check` now pass.
- `pnpm build` passes for Next and Vite; Vite produced an isolated CAD worker chunk. Began real-browser verification against the already-running local stack.
- Confirmed backend 8888 is this project but frontend 5173 is unrelated; will launch this frontend on 5174 and use upstream CAD fixtures for DXF/DWG tests.
- Found a Next/Turbopack worker packaging defect before runtime release; the fix is to use Next's supported webpack mode for dev/build while keeping the existing isolated worker architecture.
- Updated Next dev/build scripts to webpack mode and reran `pnpm build` successfully; both Next and Vite now produce executable isolated worker chunks.
- Authenticated in a real browser, created a blank project, confirmed the CAD-aware toolbar control, and triggered a real AC1015 DXF import. Added a visible error toast because conversion failures were otherwise hidden in the canvas state.
- Reproduced the user-visible failure with an upstream DXF fixture and captured the exact cause: the third-party parser returned no model-space entities. Converter dependency/path replacement is now required.
- Received and identified the user's actual failing DXF as R11/R12 AC1009; switched verification to that exact file and stopped two stalled directory-list commands without touching the file.
- Reproduced the exact failure in Node and reduced it to a minimal R12 DXF: `SvgXmlWriter` crashes when POINT/TEXT fill colors use inherited ByLayer index 256.
- Extracted the worker's conversion core, resolved non-renderable inherited CAD colors before serialization, and added a Node regression test covering R12 point/text entities.
- Imported the exact 915,957-byte user file through the Vite production worker, confirmed upload/save success, visually checked the rendered paper patterns, and confirmed reload persistence with no browser console errors.
- Reproduced a Next-production-only zero-bounds result caused by class-name mangling in the CAD library's metadata lookup; restored exported constructor names inside the worker and added the mangled-name case to the regression test.
- Verified the regular minified Next production build with both the exact R12 DXF and a real DWG fixture; both upload and render successfully without globally disabling minification.

### Phase 18: General CAD Compatibility Follow-up
- **Status:** in_progress
- Reproduced the second user-provided DWG conversion outside the UI: parsing succeeds, but recursive block expansion produces a roughly 50 MB SVG and reaches the browser timeout boundary.
- Profiled model-space entity contributions and isolated repeated `INSERT` serialization as the dominant time and output-size cost.
- Confirmed the third-party insert path also ignores rotation and scale, making reusable block references a correctness fix as well as a performance fix.
- Located the existing compact vector toolbar and confirmed SVG export already downloads the original SVG source.
- Reduced the second DWG conversion from roughly 44 seconds/50 MB to about 9.6 seconds/8.5 MB by emitting 196 reachable block definitions once and 748 transformed references.
- Imported the optimized DWG in the browser and reproduced the remaining tiny-content framing problem; traced the false extents to a source entity explicitly marked invisible.
- Excluded invisible, off-layer, and frozen-layer entities from output and bounds. Reimport now produces a correctly framed 1200 x 839 vector node instead of 4074 x 1005 with large blank extents.
- Confirmed uploaded SVG/CAD nodes show only the compact `矢量` toolbar and download action; corrected the source-SVG filename so downloads do not gain a duplicate `.svg` suffix.
- Added focused regression coverage for inherited R12 colors, reusable repeated inserts, full insert transforms, MINSERT arrays, cyclic blocks, invisible extents, and SVG vector-node detection; all seven tests pass.
- Rechecked the exact R12 DXF after the assembler change: conversion completes in about 0.3 seconds and emits a 2.14 MB reusable SVG.
- Rechecked `/Users/liangxu/Desktop/花语江南6-204方案.dwg`: conversion completes in about 10 seconds, emits an 8.49 MB SVG instead of roughly 50 MB, and frames the visible drawing at a 1.43:1 aspect ratio.
- Browser import, nonblank rendering, compact vector toolbar, source SVG download, save, and reload persistence all pass at `http://127.0.0.1:5174`.
- Final `pnpm test`, TypeScript validation, `pnpm build`, and `git diff --check` pass; the build retains only the repository's existing Vite large-chunk warning.