* wip: wire deleted-file stop retry and cover owner-scoped HTTP behavior
* wip: persist published comment backfill state
* wip: connect backfill delivery receipts and preserve completed batches
* wip: expose exact-file backfill state and retry through HTTP and CLI
* wip: wire scoped comment sync pause into preview panel
* test: cover backfill terminal rejection and stale publication receipts
* wip: separate published content from unavailable viewer origin
* feat: distinguish publication success from unavailable viewer links
* fix(web): gate export share guide on authoritative project history
* test: restore publish backfill HTTP proof with current publisher pipeline
* fix(web): show authoritative stopped-share guidance
* fix(web): restore publish help before creating a share
* fix(web): show unread comments on collapsed rail
* fix: share annotated selectors across URL and srcdoc bridges
* test: verify saved comment selector reanchors in Chromium
* fix(web): warn about active shares before project deletion
* fix: authorize and bootstrap public share project bindings
* wip: prepare dispatched live share-chain probe (not run)
* fix(web): deliver per-file share residuals after deletion
* fix(web): prevent stopping shares in read-only viewers
* fix(e2e): retain complete share probe HTTP evidence
* fix(web): name shared projects in delete confirmation titles
* docs(e2e): clarify live share acceptance and human login boundaries
* fix(e2e): preserve share query context in diagnostic evidence
* fix(web): restore share-panel copy and comment-pin visuals per board8
chain1-publish G4: delete the stale "仅支持分享单个文件，内嵌图片等本地
资源暂不支持" sentence from fileViewer.publishSingleFileDescription (19
locales) — it contradicts the current multi-resource share and G4 required
its removal.
chain1-publish S1: add the missing "链接访问" title row + its static
description ("接收者可查看预览和已有评论，不包含对话和代码。") to
ShareTab's public-share section, as new fileViewer.linkAccessTitle /
linkAccessDescription keys (19 locales). No switch added — that control
overlaps the existing "停止分享" button and is left as a 需确认 item.
chain4-owner 4.2b: canvas comment pins go from 20x20/weight 600/2px white
ring/fixed #282828 to 28x28/weight 500/no ring, and now derive their
background/foreground from the same per-author color used by that author's
sidebar avatar (commentAuthorAvatarColor), both pure local CSS/TSX with no
packages/ or protocol change.
chain4-owner O7: formatCommentTime now buckets by calendar day (adds
"昨天", drops the "N 天前/N 周前" buckets, switches the hour bucket to
same-day instead of <24h elapsed, and formats older dates via
toLocaleDateString with year only when it differs from the current year),
and comment-side-time gets a title attribute with the full absolute
timestamp on hover.
Verification: pnpm --filter @open-design/web typecheck passes. Not run
through a real renderer — no pixel-level claim.
* fix(web): share entry icon, delete-confirm title, OP2 read-only hint
chain1-publish E0: swap the share toolbar entry's icon from RemixIcon
share-forward-line to the board's own upload-arrow glyph (13px path
"M12 4v11M7 9l5-5 5 5M5 14v5h14v-5") — same size/shape as the board's
.shareBtn icon, glyph only, no behavior change.
chain6-dialogs D-04: drop the extra "确定" from designs.deleteConfirm's
zh-CN/zh-TW title ("确定删除「{name}」？" → "删除「{name}」？") to match
the board and every other locale, which already read "Delete "{name}"?"
without an "are you sure" prefix.
chain4-owner OP2: add the missing "分享页评论不可编辑" explanation line
under a comment's textarea specifically when the viewer can't edit it
AND the comment is a share-page (external) one — team-member-reads-
external-comment (OP3) is unaffected, matching the board's OP2-only
scope. New comment.sharePageCommentReadOnly key, 19 locales.
Verification: pnpm --filter @open-design/web typecheck passes. Not run
through a real renderer — no pixel-level claim.
* test(web): update FileViewer specs for the G4/O7/4.2b restorations
Three specs encoded the exact pre-fix behavior the previous two commits
intentionally changed, so they went red:
- "reads the publish help without publishing" located the help bubble by
the now-deleted stale sentence ("Only a single file can be shared for
now..."); relocates it by the sentence that remains.
- "keeps relative comment-time boundaries stable across clock boundaries"
asserted the old <24h-elapsed hour bucket; the O7 rewrite buckets by
calendar day, so the fixture's 23h-ago comment (which crosses this
fake clock's midnight) now correctly reads "昨天" instead of "N 小时前".
- "keeps D1-D4 marker and deck-page presentation on the rendered
selectors" asserted the old 20px/weight 600/white-ring pin CSS; updated
to the board's 28px/weight 500/no-ring geometry.
Verification: pnpm --filter @open-design/web typecheck passes;
tests/components/FileViewer.test.tsx: 334/334 passed (via
node_modules/vitest/vitest.mjs --pool=forks, run directly against the
node 24.18.0 binary — this shell's `npx`/`node` wrap nvm in a way that
blows bash's FUNCNEST under vitest's fork pool).
* feat(web): draw the export guide's countdown, title and description
The 10s countdown already existed as state - remainingMs, checkedAt and
paused were computed and consumed - but nothing rendered it, so the guide
showed no sign that it was about to dismiss itself.
The bar is one CSS width transition per run rather than a per-frame timer:
the remaining time is already known when the run starts, so animating to
zero over exactly that duration needs no re-render, and a pause just freezes
the transition.
Board copy added across all 19 locales.
* test(web): update AfterExportShareGuide specs for the P1 card restoration
Three assertions encoded the pre-restoration visual/DOM shape that
d2c72f1624 intentionally changed to match Board8 Chain-6-dialogs.dc.html's
P1 ("导出完成 · 分享引导条", `.s-m1eexportprompt .prompt[role=status]`)
mockup:
- role query changed region -> status: P1's `.prompt` div in the board
markup carries `role="status"`, not the implicit `role="region"` that
came from the old bare `<section aria-label>`.
- button count 3 -> 2, and the close-button-then-never-show sequence was
replaced: the board's P1 card has no `.pclose` element (unlike the
discarded EX1 alternative, which does have one) - its only controls are
the `.pfoot` pair (`.pghost` "不再提示" / never-show, `.paction` "去分享"
/ open-share). The guide is still dismissible via never-show, open-share,
or the unchanged 10s auto-collapse in after-export-share-guide.ts.
- dropped the dead `awaitingDesign` fixture key/assertion now that the P1
design reference is in hand and the placeholder key has been removed.
Scoped run: 3 files / 40 tests passed via direct-node vitest (avoids the
nvm-wrapped node FUNCNEST issue under the fork pool noted in
od-side.md).
* feat(web): render the backfill, align, and shareStopped comment sync banners
CommentSyncBanner.tsx previously only rendered K8 (sessionMissing). The
backfill (K2), align, and shareStopped fields already existed on
CommentSyncState with i18n copy standing by, but no render branch consumed
them — this was flagged in .tmp/share-p0/visual-static/chain1-publish.md (K2)
and chain4-owner.md ("补传横幅/评论对齐横幅/分享已停用横幅").
Adds three branches, single-slot priority sessionMissing > shareStopped >
backfill(failed) > align(diverged), respecting the hard semantics documented
on packages/contracts/src/api/share.ts's CommentSyncState:
- backfill absent/pending/succeeded never renders a warning (absence is
"never attempted", not success); the server already filters stale-revision
backfill records, so any backfill this component sees is for the file's
current publication.
- align absent or 'unknown' never renders as aligned or as a problem; only
'diverged' is actionable.
- shareStopped: null (could not be read) never renders as stopped nor as
healthy; only `true` renders.
Retry buttons call the existing retry endpoints (POST comment-sync-state for
backfill, POST comments/align for align) and re-fetch via a new
`refreshToken` option on useCommentSyncState. The backfill retry button is
only shown when `retryable === false`, per the field's own doc comment:
retryable:true means the server is already retrying on its own.
useCommentSyncState also gained an optional `filePath` param, threaded from
HtmlViewer's `file` prop through CommentSideDock -> CommentSidePanel, because
the backfill answer is per-file and the endpoint requires filePath to compute
it (readPublishedCommentBackfill returns undefined without one) — without
this wiring the backfill branch would be permanently unreachable regardless
of the new rendering code. This is plumbing an existing parameter to an
existing endpoint, not new triggering behavior.
Copy is the parent-approved text verbatim, added as three new i18n keys
across all 19 locales (fileViewer.commentSync.backfillFailedTitle/Body,
alignFailedBody); the retry button reuses the existing preview.retry key.
Tests: new tests/components/share/CommentSyncBanner.test.tsx (12 cases)
covering all silence/render rules above. Full apps/web typecheck, guard, and
tests/components/FileViewer.test.tsx (334/334) all pass.
Not done in this commit: the ShareTab panel's own shareStopped-driven hint
(a separate, pre-existing `publicationStatus === 'stopped'` render in
ShareTab.tsx using project-share-history data, not CommentSyncState) is
untouched — it is a different signal for a different surface.
* feat(web): add the board's "link access" switch to ShareTab
chain1-publish.md's S1/S4 rows show a `role=switch` "链接访问" toggle as
part of the panel's fixed structure that the current implementation never
had (flagged under chain1-publish.md's "需要人确认" #1 and chain6-dialogs.md
D-00). The user explicitly authorized adding it and asked me to resolve its
semantic overlap with the existing "Stop sharing" text button.
Resolution: the switch reads and drives the exact same `filePublished` state
through the exact same handlers already used by the primary button/ghost
button (publishCurrentFilePublic / unpublishCurrentFilePublic) — on -> off
calls unpublish, off -> on calls publish. Because both controls act through
the same two functions on the same state, they can never show or produce
inconsistent results; this is presentation only, not a new trigger path.
Did NOT remove the existing "Stop sharing" ghost button, even though the
board's own S4 mockup has no separate one — chain1-publish.md's own
"需要人确认" #2 explicitly warns not to delete it off this board alone,
since it may belong to a different board's scope (chain2's handoff notes
mention Chain-5). Keeping both is redundant but not contradictory, per the
task's own escape hatch ("你判断不该同时存在，那就说明理由并只做一个" —
here the judgment is the opposite: keep both, and make sure they can't
diverge).
Geometry/colors from chain6-dialogs.md D-00: 32x19 track, r999, off #D6D6D6,
on #282828, 15x15 white thumb. No new i18n keys — the switch's accessible
name reuses the existing `fileViewer.linkAccessTitle` key.
Also updates the pre-existing frozen DOM-baseline fixture
tests/fixtures/share-tab/share-panel.team.html. Confirmed via `git stash`
bisection that this fixture was ALREADY stale/failing before this commit —
the earlier "链接访问" title+description restoration (commit 721cb976cf,
prior round) changed the panel's markup without updating this baseline, and
nothing in CI caught it because this file wasn't in that round's targeted
test run. This commit's switch adds one more, unrelated divergence on top of
that pre-existing one, so the fixture is regenerated from the component's
actual current output rather than hand-edited, and captures both changes at
once. The `personal` fixture is untouched: canPublishPublic is false in that
scenario (no workspace context at all), so the entire link-access section
(switch included) never renders there, exactly as before.
Verification: pnpm --filter @open-design/web typecheck and pnpm guard both
pass. tests/components/FileViewer.share-tab-extraction.test.tsx (22/22),
ShareTab.copy-button/first-publish/publish-error/scope-keyboard.test.tsx,
tests/styles/share-scope-design.test.ts, and FileViewer.test.tsx
(394 tests total) all pass. Not rendered in a real browser — see the
evidence file for the "未经真实渲染验证" caveat.
* fix: scope deletion stops to the selected published file
* feat(contracts): define share bridge v2 geometry boundary
Define authoritative OD v2 viewport geometry, fallback pin bounds, display tokens and geometry-update gates. Add 16 passing boundary tests; root guard and typecheck passed.
Known pre-existing failure: share-contract.test.ts expects SHARE_SNAPSHOT_DISCOVERY_IN_P0=false while baseline bd39802907 exports true. The identical assertion was reproduced against unchanged HEAD source; this unrelated assertion is not modified. Vela runtime and browser acceptance remain separate.
* fix(comments): create anchors for personal public shares
* fix(comments): create anchors for personal public shares
* fix(web): prefer readable element names in comment titles
Use screen labels then element-text snapshots before localized type fallbacks. Keep synthetic pin/page titles and hide internal IDs. Export a pure resolver for share-page parity without new locale strings.
Verified 10 contract tests, all 334 FileViewer tests, all 19 existing locale key sets, root guard and root typecheck. Vela adoption and browser visual acceptance remain separate.
* fix: stop published files before file deletion
* fix: explicitly resume stopped publication generations
* Restore main comment UI styling while retaining share flows
* test: verify guarded resume through real Vela CLI
* fix(web): match main comment composer surface
* fix: register personal project owner before share history lookup
* fix(web): align comment avatar colors with shared page
* fix(share): revoke deleted sources through atomic resource removal
* fix(comments): seed client avatar colors only from authoritative author key
* test(share): expect the additive publish failure detail after merging main
#8402 adds an optional closed-token `failure` to failed publish responses.
The share-origin HTTP test compared the 502 body exactly, so it now also
expects { stage: 'push', reason: 'unknown' } for a synthetic upload error.
* test(contracts): assert deployed snapshot discovery in P0
* fix(share): revoke folder publications before deleting descendants
* fix(web): normalize share controls to supported font weights
* test(web): assert manual copy fallback after clipboard rejection
* test(share): align route fixtures with original owner authority
* feat(comments): expose explicit visitor comment pull to UI and CLI
* feat(cli): expose explicit project share resume command
* fix(cli): emit JSON for files delete
* refactor(share): name the unpublish response contract
* fix(comments): preserve Vela author key in inbound avatar identity
* test(share): use valid sharedAt timestamps in owner fixtures
* fix(share): use promise stat with production folder route fs
* fix(comments): use defined theme red for unread indicators
* fix(cli): preserve workspace context error codes
* fix(files): hide internal paths in deletion failures
* fix(comments): persist local author name and reconcile cloud author key
* fix(share): align owner sharing flows with final UI audit
* test(share): verify unboxed comment sync across owner states
* fix(share): apply second-round final design review to owner share UI
- Share panel: remove every yellow warning; show the public link row above
the copy button in published states; oversized shares stay blocked and
explain why in the red error row.
- Global toast for update success/failure and residual stop failure, with
final design icons and copy; share panel buttons match the design.
- Comment sync: K1 turns the primary action into the sync progress bar, K4
shows a busy "正在同步评论…" button, K5 retry is red.
- Deployment menu layers above the share popover; export-complete guide
rebuilt to the final design.
- Share bridge pin label accepts exactly one letter so a CJK author's
initial can label their pin.
- Update ui-audit capture specs for the intended copy/structure changes.
* fix(share): apply third-round design review to owner share UI
- Share toast rebuilt as ShareFeedbackToast to the design: solid red/green
badge, plain underlined 重试, close; used for update success/failure and
the deleted-project stop failure.
- The ··· deploy menu drops down under the trigger, right-aligned to the
header tools, over the share panel.
- Signed-out share button reads 「登录后分享」; update notice loses its box;
更新链接 / 登录后更新 / K5 retry use the design's blue and retry icon.
- Signed-out observed share reuses the published link row and copy button
(chain icon, green check 已复制) and no longer overflows its card.
- Capture specs follow the intended copy and placement changes.
* fix(share): keep the signed-out share panel instead of re-homing on sign-out
Signing out on a shared file page intermittently landed on Home instead of
the signed-out share panel (Owner-S13), depending on which re-read returned
first:
1. The workspace-context refresh re-adopted the route's bootstrap witness
from the previous account, re-keying ProjectView on the same file.
2. FileWorkspace treated that remount as a file switch and cleared the
observed public link.
3. With no link left, the tab scope reset fell back to Home.
- useProjectRouteWorkspaceContext: a bootstrap witness issued before an
identity refresh is retired and never adopted after it (the hook's
documented rule for resolved authority now covers the witness too).
- isObservedShareFileSwitch: mounting or remounting a file view is not a
file switch; only a change to a different file clears the observed link.
Red specs: hook re-adoption (red on previous source) and FileWorkspace
remount (red on previous source). S13 capture: 8/8 passes, was 2/7.
* fix(share): align remaining owner share copy and K1 sync count with final design
- S0: signed-out description uses the design copy via its own key; the
publish-failure message keeps its original text.
- S5: update notice reads 「文件有新改动，访问者看到的还是上一版。」.
- K2/K5: the failed-sync notice drops the 「分享已发布」 title and uses the
design copy; terminal variants keep their own wording.
- K1: first-publication sync shows 「同步已有评论 · N 条」. The backfill
state carries optional total/synced from the daemon's backfill members
table, driving a determinate bar when progress is known; older daemons
fall back to the previous copy and the indeterminate sweep.
- Refresh the PR screenshot of the Share popup comment-sync state.
* chore(web): restore generated next-env.d.ts accidentally included in 30361fd670
* refactor(share): give each owner share UI element one owning component
Behavior-preserving consolidation of the owner share surfaces, verified by
pixel diff of all 17 Owner capture specs against the pre-refactor baseline
(every state within the known 0-0.25% noise from timestamps, placeholder
animation and the dev badge; the share panel itself is identical).
- Shared components: LinkAccessRow, ShareNoticeRow, ShareProgressButton
(S2 upload + K1 sync), ShareErrorRow, ShareButton (primary / soft /
soft-error / dark-sm on @open-design/components Button), ShareSignInButton
over a new useCloudSignIn hook shared with CloudSignInTip.
- The popover skin moves from a :has(.panel) override to an explicit
.chrome-unified-popover--share class; SignedOutObservedShare reuses
SharePanelHeader and the extracted rows.
- Icons: every inline share SVG moves into components/Icon.tsx with
byte-identical path data.
- Tokens: styles/share-tokens.css holds the share palette and sizes as fixed
light values (not app theme tokens, so dark mode renders as before); share
CSS modules reference them. Single-use decorative values stay local.
- Delete the unreachable React-component share popover (canShareCurrentFile
is false by design, Owner-G3) and its dead state and handlers.
- Toasts: share-adjacent feedback uses ShareFeedbackToast; top toasts share
one stacking order instead of overlapping at top:64px.
- Static CSS-contract tests read share styles through readShareCss, which
resolves share tokens to the design values they assert.
Allowed visual changes (existing defects):
- The sign-in entry is a real button; signing/error messages render below
it instead of inside a nested button (UI-040).
- The comment side panel's retry-failed message is red (UI-042).
- Simultaneous top toasts stack instead of overlapping (UI-039).
- 「正在开启…」 goes through i18n (UI-041).
* feat(daemon): resolve share links only from the Viewer origin
Public share links come from OD_SHARE_VIEWER_URL(S) (HTTPS root origin)
as https://<viewer>/artifact/{projectId}/{slug}; the console origin is
no longer a fallback. GET publish-public derives the URL from the
resolver instead of the stored row, so pre-upgrade console URLs are
never echoed, and reports link unavailable plus the slug when no Viewer
origin is configured. Remotely stopped rows are not live. Manual-revoke
recovery data carries projectId and a nullable url. od project share
prints the slug in the unavailable state. Test fixtures move from
OD_VELA_WEB_URL to OD_SHARE_VIEWER_URL.
* feat(web): show a link-unavailable state for URL-less publications
A publication is published when it has a slug, not a URL. Without a
Viewer origin the share panels show a translated link-unavailable
status with Stop sharing, never the Publish CTA, so the file is not
uploaded twice. registry normalizes the publish and read responses to
{slug, url|null}; auto-copy is skipped without a URL.
* feat(tools-dev): inject a default share Viewer origin for local daemons
The default stays empty until the test Viewer domain is decided
(decision 67 #7), so local shares report link unavailable. An operator
OD_SHARE_VIEWER_URL(S) always overrides it.
* feat(daemon): parse C3-LITE member comment pages in both collab transports
Add a single-page member pull to the Vela CLI and HTTP collab clients
that returns either a typed page or a rebuild-required signal.
- The page envelope is validated strictly; malformed comments are
skipped per item and reported, so one bad stored payload cannot
block the cursor.
- Minimal tombstones ({id, seq, deleted}) are accepted and get the
requested projectId.
- INVALID_CURSOR / CURSOR_STALE / SCOPE_CHANGED map to
rebuild-required; INVALID_PAGE_REQUEST stays an error.
- Paged requests send no If-None-Match.
* feat(daemon): drain member comment pages into SQLite atomically
Team projects on the Vela CLI transport now receive member comments
through bounded C3-LITE pages instead of the unbounded legacy pull.
- Each page's merges, tombstone deletes and cursor advance commit in
one immediate transaction; the persisted cursor is the cloud's
stateless page/resume token.
- The drain continues through empty hasMore pages, hands a finished
snapshot off to an incremental round, and stops at the end of an
incremental round.
- A remote tombstone deletes a row that has a pin_seq; unknown ids
are a no-op.
- A wake during a pull triggers exactly one trailing rerun.
- Merge notifications fire only for committed, changed rows.
- Share-page (user) comments stay on the legacy pull until public
paging exists. The legacy pull also keeps carrying member comments
whenever paging did not complete, and a cursor that needs a
rebuild is latched until the rebuild path lands.
* feat(daemon): rebuild member comment cursors and isolate sync scopes
An unusable member cursor is no longer latched. It is reset and rebuilt
from a fresh snapshot in the same drain.
- A per-scope ledger records the ids the member stream delivered. The
terminal snapshot page, in the same transaction as the handoff cursor,
removes cloud-origin rows the snapshot no longer contains. Rows the
stream never delivered (never-synced local comments, share-page
comments, rows another account learned) are never pruned, and
nothing is deleted before the snapshot completes.
- Writes committed during the snapshot arrive through the handoff
incremental round and are not pruned.
- Scope is (workspace, member, team, project). A scope must prove it is
current before taking a project over. Every page is re-checked after
its await and before its commit (active scope, team-share binding,
bound context), so an old account's or unshared project's in-flight
page is discarded.
- Account switch and stop sharing drop that scope's cursor and ledger
but keep the local comment rows as local copies.
- INVALID_PAGE_REQUEST and repeated transport failures back off per
scope (bounded exponential, capped at 5 minutes). A refused rebuild
snapshot backs off instead of looping.
* feat(daemon): announce comment merges once per pull round
A member page drain used to fire `onMerged` after every committed page,
and the legacy pull fired once more, so one 3-page drain of 250 comments
pushed three or four `comment-changed` events and cost the open web view
as many full list reads.
- Every row a round commits (member pages, prune, tombstones, legacy
share-page rows) is summed into one `onMerged` call when the round
settles, including rounds that pause, lose their scope or throw after
some pages committed. A trailing rerun is its own round.
- A throwing listener is reported through `onError` and neither masks
the round's own error nor turns a successful round into an unredeemed
wake.
* feat(web): single-flight the comment list refresh and keep unchanged comments
Every comment trigger (project SSE, fallback poll, visibility, stream
reconnect, status patch) started its own full list read; the generation
guard only discarded stale answers. A burst of 10 `comment-changed`
events cost 10 reads, and a refresh that found nothing new still
published a new list and re-rendered.
- `refreshPreviewComments` goes through a single-flight runner keyed on
project and conversation: a trigger during a read buys exactly one
trailing read with the latest closure; a different conversation starts
its own read and the old loop stops rerunning.
- Fresh reads are reconciled into the current state: unchanged comments
keep their objects, an unchanged list keeps its array (no re-render),
and attached comments follow the same rule. The initial conversation
read reconciles too.
- The remote half of an explicit pull has a 15s deadline and falls back
to the local list, so a stalled daemon pull cannot hold every later
refresh behind it.
Measured in ProjectView tests (10 SSE events during one read): 10 -> 2
list reads; an equal-data refresh: 1 -> 0 new lists/renders.
* fix(daemon): make a published private team project team-visible before its comment backfill
Publishing a public link for a private project in a team workspace registers
it in the team catalog, but only the later background reconcile marked the
local row team-visible. Until then the row was personal in a team workspace,
which is neither Team- nor personal-relayable: the publish backfill was
cancelled (BACKFILL_DELIVERY_DISCARDED) and comments written right after
publishing were never queued.
- publish-public marks the creator's private row team-visible right after
catalog registration, before the publication transaction enqueues the
backfill (decision 67 #11); the response carries madeTeamVisible.
- The relay re-queues a personal record as Team relay once its creator's
project turned team-visible, and defers (bounded) a personal record in a
team workspace whose publication is still current instead of cancelling it.
- A cloud seq is never adopted as pin_seq when another confirmed row of the
file already holds it, which produced two pins numbered 1.
* feat(share): tell the owner a public link makes a private team project team-visible
The share panel (and the React component viewer's share menu) shows
"After publishing, team members will be able to see this project" before
the first publish of a private project in a team workspace, in all 19
locales, and updates the scope control and team project views once the
daemon reports madeTeamVisible. `od project share publish` prints the same
notice to stderr and --json keeps the madeTeamVisible field.
* feat(packaged): hand the daemon its channel's share Viewer origin
Packaged desktop and headless daemons get the share Viewer origin for
their release channel: stable sends OD_SHARE_VIEWER_URLS with the prod
profile mapped to https://open-design.app; other channels send nothing
until the test Viewer domain is decided (decision 67 #10), so shares
report link unavailable. An explicit OD_SHARE_VIEWER_URL(S) at launch is
forwarded unchanged instead. The daemon resolver stays the only
validator. The legacy payload-desktop handoff strips both keys so a
channel default never becomes a sticky override.
* fix(daemon): report madeTeamVisible when a catalog reconcile marked the project first
Registering a private team-workspace project in the team catalog lets a
concurrent catalog reconcile (hub team-projects-changed, a project list
read) rebind the local row to team before publish-public marks it. The
mark then changed nothing and the response omitted madeTeamVisible, so the
share panel kept showing "only me" and the CLI printed no notice. Seen in
the local integration rerun on the first UI publish.
publish-public now reads whether the row is the creator's private team row
before registration, and reports madeTeamVisible when that row is the
creator's team row afterwards, whichever writer flipped it. A project that
was already team-visible still reports nothing.
* fix(daemon): order synced comment revisions by cloud seq so replays never undo newer state
A share-page comment resolved at cloud seq 10 reverted to open after a daemon
restart: the legacy pull cursor is in memory, so the restarted daemon replays
from seq 0, and the merge stamped Date.now() on the share-page create (which
carries no updatedAt), making the replayed create look newest.
Each preview_comments row now records the highest cloud revision seq it
reflects (cloud_revision_seq) and the seq space it came from
(cloud_revision_stream: relay team + member stream epoch). An incoming
revision at or below that seq in the same stream is a replay and never
overwrites the row. Unseen revisions keep updatedAt last-writer-wins when they
carry an updatedAt; one without updatedAt applies in seq order and is stored
with its createdAt, never the local clock. pin_seq is untouched.
* feat(share): take the canonical share link from AMR
The daemon no longer builds the public share address from a hardcoded or
per-channel Viewer origin. AMR reports it: `vela share publish|bind|resume|
project-status --json` carry `url` (https://<share origin>/artifact/{projectId}/{slug})
for an active binding, or `link: {status: "unavailable", code}`.
Link rule, one place (resolvePublicShareLink): an explicit
OD_SHARE_VIEWER_URL(S) override wins (a present invalid override is
unavailable, never a fallback); otherwise the AMR address, accepted only when
it is byte-for-byte the canonical HTTPS root-origin address of this project
and slug; otherwise unavailable, passing AMR's code
(PUBLIC_SHARE_WEB_URL_UNAVAILABLE / PUBLIC_SHARE_IDENTITY_INVALID) through.
A rejected address is logged without echoing it.
The verified AMR address is persisted with the publication and refreshed on
publish, foreground bind/resume, the background binding retry and every
publish-public status read, without rotating the publication witness. When
the status read fails, GET falls back to the persisted link marked
`stale: true` (not for a queued stop); a stored legacy console URL fails
re-verification and stays hidden until the next online read replaces it.
Packaged daemons no longer get a per-channel Viewer origin and tools-dev has
no default; an explicit launch override is still forwarded. `od project share`
prints the same link, a stale notice on stderr, and says when an alias has no
Viewer address.
* fix(share): keep the link access switch thumb at the left when off
* fix(share): settle the share status after a stop or resume in the open panel
* fix(comments): keep a comment that was handed to the agent
Sending a saved comment to the agent deleted it as soon as the send was
queued, so a run that failed or was stopped left nothing to retry and
pushed a tombstone to the share page.
The hand-off is now carried by status alone. The three send paths no
longer delete after queue acceptance; they only clear the composer and
the selection for the accepted ids. A run that fails, is reported
canceled, or is stopped by the user releases its comments back to open
through releaseCommentsAfterUnsuccessfulRun. A successful run still ends
in needs_review.
* fix(comments): keep an unsent comment draft when another element is picked
Picking another element, lassoing, opening a saved pin, or selecting a
comment in the side panel retargeted the composer at once and dropped
the draft, queued notes, and context without a word.
All four pick paths now retarget through requestComposerRetarget. While
the composer holds unsent work the first pick changes nothing and shows
a notice inside the composer; the next pick confirms the discard and
retargets. Editing the draft disarms the pending discard. Closing the
composer, Escape, and switching files behave as before.
* fix(daemon): walk nested HTML in share/deploy plans and refuse root index.html conflicts
Referenced .html/.htm files (iframes, frames) are now walked like the entry:
their references resolve against their own directory at any depth, so their
stylesheets, images and child pages ship and missing/invalid ones are
reported. Share mode rewrites their root-absolute references relative to
their own directory and maps references to the entry to the published
index.html; standalone deploy keeps their bytes.
Parsing is deduped on each file's real path, which bounds the walk even with
in-project symlink loops (x -> .) and also fixes the existing unbounded CSS
@import recursion through such links.
A reference to an existing root index.html while sharing another page no
longer overwrites the entry: the plan records the conflict (referrer file,
attribute, line, suggested free name) and deploy refuses it with 409
ENTRY_INDEX_CONFLICT carrying a copy-to-agent fix prompt.
* fix(daemon): refuse share entry/index.html conflicts before reserving
The share plan summary carries entry-index-conflict blockers (with the agent
prompt), and publish-public now builds the plan, and refuses on size or
blockers, before reserving an alias or preparing Vela. A conflict returns
409 SHARE_ENTRY_INDEX_CONFLICT with the details in error.data. Freshness is
not compared against a blocked plan.
* fix(daemon): print share blockers and agent prompt in the od CLI
od project share preflight prints each blocker with its copy-to-agent
instruction and exits 1 when blockers exist (also with --json). A publish
refused with SHARE_ENTRY_INDEX_CONFLICT prints the instruction readably in
text mode before the structured error envelope.
* fix(web): explain share index.html conflicts with a copy-to-agent action
The share panel shows the entry-index-conflict blocker from the share plan or
a 409 publish refusal, disables publishing while it stands, and copies the
daemon's agent prompt (falling back to showing it for manual copy). New
strings are translated in all 19 locales.
* fix(comments): release a comment whose queued send never becomes a run
A saved comment is written 'applying' when its send is queued, before any run exists. The release added for unsuccessful runs only fired on run end, cancel and stop, so a send held by the pre-run balance gate, stopped or failed before its run was created, or taken out of the queue left the comment 'applying' and out of the comment list for good.
Queue drains now go through startQueuedChatSend, which releases the comments of a send that ended without a run. A send the gate holds no longer reserves its comments, and removing or editing a queued send releases what it carried. A held send that starts later reserves them again when its run begins.
* fix(share): keep a reopened share busy until its link has been read
A resume answers without a link, so the panel re-reads the share state. The busy state ended with the resume response, and for the seconds the re-read took the panel said the link was temporarily unavailable before swapping to the link.
settlePublicShareAfterMutation now writes the active state only once the re-read has settled, and the publish flow stays busy on it. A re-read that fails or carries no link still ends on link unavailable, without an error.
* fix(web): size the copy-for-agent button to its longest label
The soft share button is a fixed 88px slot sized for short labels, so
"Copy fix for agent" overflowed in English and longer locales. Let the
button grow to fit, and stack both labels in one grid cell so the width
stays put while "Copied" shows.
* test(e2e): reopen a stopped share through the switch in the share audit specs
The share audit specs stopped a share inside the panel and then clicked
the publish button to bring it back, which is the behaviour the panel no
longer has: a stopped share reads as stopped and reopens through the link
access switch with a resume request.
The mocked publish responses also lacked the receipt the client parses,
so they now return the real response shape.
* test(share): align CI cases with current share UI
* test(share): align CI cases with current share UI
* test(web): pin comment time boundary to local noon
* fix(share): allow reopening saved comment after save
* fix(daemon): wallet 401/403 no longer expires the AMR session
Billing is display-only (OPEND-3553). Vela maps internal billing
failures to 403, so a wallet rejection now only reports the balance as
unavailable instead of marking the credential expired, which dropped
workspace context and redirected to sign-in.
* fix(daemon): billing summary failure no longer expires the AMR session
A failed 'vela billing summary' (even an auth-shaped 401) only drops the
optional plan/balance from /status. Credential expiry stays owned by the
non-billing workspace directory path (OPEND-3553).
* fix(daemon): billing projection 403 no longer flushes workspace authority
A rejected workspace billing snapshot only marks the billing runtime
entry. It no longer invalidates the workspace directory, exact authority,
or exact context caches with auth_reject; Vela also maps internal billing
failures to 403, and membership revocation stays owned by the directory
and the hub workspace-access-revoked event (OPEND-3553).
* fix(daemon): carry share content fingerprint across stop and resume
Resume reopens Vela's saved version of the same alias but writes a new
local publication revision, so the fingerprint row (keyed to the old
revision) made freshness permanently 'unknown' and hid the update entry.
Rebind the stored fingerprint to the resumed revision of the same slug so
later edits read as 'outdated' (OPEND-3517).
* fix(daemon): redact identity argv from vela command failures
Node's exec error repeats the full command line in message, cmd and
stack, and presence/member/catalog callers logged it verbatim, leaking
--display-name and activity payloads. The vela command runner now
rewrites the values of --display-name, --name, --email, --activity-json
and --metadata-json before rejecting (stderr and the upstream status
signal are untouched), and the presence failure log records only the
classification and upstream status (OPEND-3520).
* fix(daemon): refuse plain publish of a stopped share before uploading
When Vela reports the file's share as stopped, a plain publish-public POST
now answers 409 SHARE_STOPPED_RESUME_REQUIRED before pushing bytes, since
Vela rejects it with 409 share_binding_stopped anyway; reopening the link
is the explicit { mode: 'resume' } request. The share publish wrapper also
keeps the upstream 'API request failed with status NNN: code' line so the
failure classifies as upstream_http instead of reason=unknown (OPEND-3510).
* test(daemon): satisfy test typecheck for batch-2 share fixes
* fix(daemon): keep vela argv redaction from crashing on non-string args
Some media callers pass optional argv slots through as undefined. The
redaction must never replace the real command failure, so it skips
non-string entries (caught by vela-media-safety-process tests).
* fix(daemon): increase comment id entropy
* fix(share): keep deployment menu alive through pointer press (OPEND-3537)
* fix(share): unify owner Share entry glyphs (OPEND-3535)
* fix(share): show pending link-stop feedback (OPEND-3513)
* fix(share): retain scoped preflight across panel reopen (OPEND-3536)
* fix(comments): wait for preview targets before lost writeback (OPEND-3516)
* fix(share): restore Owner toolbar hierarchy (OPEND-3580)
* test(share): align toolbar style contract with C0 (OPEND-3580)
* fix(web): preserve owner scroll after comment location
* fix(cli): distinguish share size refusals from connection failures
* fix(web): separate share eligibility and preserve comment identity UX
* test(cli): preserve daemon connection failure exit code
* fix(share): expose owner-scoped persisted stop tasks
* fix(contracts): bound share anchors at original selector lengths
* fix(web): recover pending deleted-share stop notices
* fix(contracts): define atomic share pin snapshot metadata
* test(web): provide retry preflight fixture and await completion
* fix(web): keep billing upgrade outside account identity boundary
* fix(share): protect staging and restore client continuations (#8675)
* fix share staging and client continuations
* docs: clarify share batch verification baseline
* fix(web): notify when sending to a deleted project or conversation
* fix(share): dismiss card share popover on conversation scroll (OPEND-3784) (#8689)
* fix(share): keep anchored popover geometry current (OPEND-3783) (#8694)
* fix(share): expose freshness checks and parallelize state reads (OPEND-3791) (#8708)
* fix(share): preserve safe publish errors and actionable messages (OPEND-3796) (#8709)
* fix(share): preserve safe publish failure details and actionable messages
* test(share): align failure copy expectations and cover classified messages
* fix(share): retain Button binding required by CI merge
* fix(share): add bounded state-read and resume diagnostics (#8710)
* Revert "fix(share): expose freshness checks and parallelize state reads (OPEND-3791)" (#8711)
This reverts commit 8f6c09db39.
The reported latency bottleneck remains unproven. Revert the full PR at the user request and defer presentation optimization. Preserve the subsequent OPEND-3796 changes.
* fix(share): preserve entry binding checks when opening Share (OPEND-3594) (#8712)
* fix(share): report preflight failures and allow explicit retry (OPEND-3771) (#8716)
* fix(share): use green for update-link action (OPEND-3790) (#8717)
* fix(share): retain confirmed PDF export guide during history refresh (#8719)
* fix(analytics): add passive share and comment observations (#8723)
* fix(analytics): define passive share observations and contain measurement failures
* fix(analytics): observe share receipts and selected comments without changing actions
* fix(web): isolate after-export guide observation from actions
* fix(analytics): connect passive guide observations and document minimized fields
* fix(analytics): observe saved comment creation and run handoff passively
* fix(analytics): exclude edited composer drafts from saved-comment attribution
* fix(e2e): align Team run fixtures with authoritative workspace catalog
* fix(analytics): wait for comment acceptance readiness in regressions
* fix(share): 修复超限评论恢复与资源读取失败，补验四项验收问题 (#8721)
* fix(share): recover oversized comments and reject unreadable dependencies
* fix(share): close real export completion and cloud failure gaps
* test(share): align export and delete relay regression assertions
* fix(export): handle interrupted ZIP saves in preview actions
---------
Co-authored-by: lefarcen <935902669@qq.com>
Co-authored-by: a1chzt <chizblank@gmail.com>
* test(share): align export failure assertions with current copy
* fix(share): guard user-scoped export guide dismissal (OPEND-3579) (#8738)
* fix(share): guard user-scoped export guide dismissal (OPEND-3579)
* test(web): align export guide failure assertions with product copy
* test(web): settle restored share state before publish assertions
* fix(chat): keep artifact Share actions static (OPEND-3854) (#8747)
Keep ChatPanel artifact Share actions static and remove card-only publication state tracking. Preserve the existing share panel and readonly/generation gates.
* Merge pull request #8750 from nexu-io/fix/opend-3888-comment-age
fix(web): preserve comment creation age (OPEND-3888)
* fix(comments): persist new static comment identities (OPEND-3516) (#8768)
* fix(comments): preserve authored identities through manual and AI edits
* fix(comment): prepare durable static source identities (OPEND-3516)
* fix(comments): integrate durable identity lifecycle (OPEND-3516)
* fix(comment): validate authored HTML identity tokens (OPEND-3516)
* fix(comment): mask raw text before authored tokenization (OPEND-3516)
* fix(comments): enforce prepared document and publication barriers (OPEND-3516)
* fix(comments): revalidate pending documents and guard updates (OPEND-3516)
* fix(comments): require app-owned source preparation consent (OPEND-3516)
* fix(comments): contain preparation consent focus (OPEND-3516)
* fix(sharing): diagnose project bootstrap failures safely (OPEND-3516)
* fix(comments): retire stale publication guard alerts on explicit retry (OPEND-3516)
* fix(comments): locate Personal identities in the live preview (OPEND-3516)
* fix(comments): surface lost Owner identity anchors (OPEND-3516)
* fix(comments): unblock publication after strict target loss
* fix sharing to keep file publication independent of team visibility (OPEND-3855) (#8759)
* fix sharing to keep file publication independent of team visibility (OPEND-3855)
* refactor sharing to one explicit policy path (OPEND-3855)
* test: isolate metadata snapshots from the trailing identity directive
* fix: align collaboration consumers with explicit project visibility
Carry trusted catalog roots through content receivers and suppress stale Team rows after explicit privacy changes. Read shared design-system brand assets from their resource snapshots. Align stopped-publication ordering and protocol/browser fixtures with the existing contracts.
* test: await explicit comment preparation and independent UI states
Complete the existing source-version consent and real frame-readiness flow before opening the comment sidebar. Bind the response waiter to the UI actions so failures retain their real cause. Await the independently loaded account callout and assert exact catalog-bound materialization wiring.
* test: expect private policy when unsharing a team project
Await the explicit visibility-private command instead of deleting the retained root registration. Assert that remove was not invoked and preserve all member quarantine, directory and file-read privacy checks.
* fix(comments): synchronize file lifetimes across member and public shares (#8764)
* fix sharing to keep file publication independent of team visibility (OPEND-3855)
* fix(comments): synchronize current file lifetimes across members and shares
OPEND-3870 / OPEND-3871. Stack on published OPEND-3855 dependency; preserve reviewed source tree exactly. Local validation does not establish PostgreSQL or native acceptance.
* refactor sharing to one explicit policy path (OPEND-3855)
* fix(collab): adapt comment sync to converged project lifecycle
* test: isolate metadata snapshots from the trailing identity directive
* fix(collab): preserve nested publication and pulled file authority
* fix: align collaboration consumers with explicit project visibility
Carry trusted catalog roots through content receivers and suppress stale Team rows after explicit privacy changes. Read shared design-system brand assets from their resource snapshots. Align stopped-publication ordering and protocol/browser fixtures with the existing contracts.
* fix(collab): preserve relay identity and retire captured file batches atomically
* test: await explicit comment preparation and independent UI states
Complete the existing source-version consent and real frame-readiness flow before opening the comment sidebar. Bind the response waiter to the UI actions so failures retain their real cause. Await the independently loaded account callout and assert exact catalog-bound materialization wiring.
* test: expect private policy when unsharing a team project
Await the explicit visibility-private command instead of deleting the retained root registration. Assert that remove was not invoked and preserve all member quarantine, directory and file-read privacy checks.
* fix(collab): retain the actual native root during mirror materialization
* fix(collab): fail closed on unbound active share identity
* fix(collab): retire comment lifetimes after local mutation commits
* fix(collab): commit local artifact invalidation with working-root changes
* fix(collab): reconcile committed root retirement without stopping new links
* test(collab): align CI fixtures with admitted file identities and receipts
* test(collab): model receipt-backed root file admission in the shared hub
* test(collab): distinguish bound and unbound publication recovery
* chore(pack): pin compatible test CLI and exclude dependency dotenv files
* test(share): verify paired CLI policy and immutable share contracts
* fix(share): remove comment preparation interruptions
* fix(web): offer after-export guide when sharing history fails
* fix(comments): preserve unknown ages and repair synced creation times
* style(web): restore comment reference visuals without changing behavior
* test(web): verify colored avatars and document deployed parity
* fix(share): collect literal JavaScript image dependencies
* fix(web): match canvas comment pins to author avatar colors
* test(comments): align existing UI and E2E color expectations
* test(share): align collab flow and snapshot with direct comments UI
* test(campaign): await verification before advancing impression frames
* test(cms): await verification and mount before impression frames
* fix(web): match canvas comment initials to sidebar avatars
---------
Co-authored-by: PerishCode <perishcode@gmail.com>
Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com>
Co-authored-by: lefarcen <935902669@qq.com>
Co-authored-by: alchemist <alchemist@alchemistdeMacBook-Pro.local>
* feat: add Motion Design skill and OD Next task route
* fix(web): rename motion design entry and place it second
* fix(web): reconcile motion design catalog consumers
* feat(web): add motion design templates to Home and Community
Five motion design example templates (3D procedural island, explainer,
product launch, showreel, data story), chosen by community reach, under the
Home motion-design chip and a new Community "Motion design" type.
Each template follows the bundled example layout: an OD-generated
example.html with its runtime libraries under assets/, an HTML preview baked
by the existing preview pipeline, and a SKILL.md that carries example.html
as the reference when the card is picked on the OD Next motion-design route.
Home cards ship curated copy for every UI locale. Motion templates stay off
the Video and HyperFrames chips.
* fix(skills): keep motion-design procedural layers visible in video export
The MP4 exporter seeks timelines with callbacks suppressed
(renderSeek(t, { suppressEvents: true })), so content drawn only from a GSAP
onUpdate callback is missing from exported video. Recommend a per-frame draw
loop that reads the timeline clock, and state that visible content must not
depend on timeline callbacks. The OD Next task asset is re-synced with
scripts/sync-motion-design-skill.ts.
* fix(motion): preserve reference assets and exported animation frames
* feat(skills): integrate curated motion helpers with complete runtime files
* feat(skills): add Huashu, Oil Motion and Motion.Lab adapters
* test: classify animate design guidance in narration guard
* feat(motion): refine five community templates and portable previews
* fix(motion): refine launch transitions and center gallery previews
* fix: allow free-form briefs on automatic motion task route
* feat(motion): add template soundtracks and audio export
* fix(motion): require rendered MP4 alongside editable video source
* test(motion): align strategy activation expectation with package version
* fix: scope motion delivery and make editable sources playable
* fix(motion): bundle source dependencies and valid closing protocol
* feat(motion): rebuild the five templates on the most-viewed community posts
Re-select topics by single-post views in the latest awesome-opus-5.5-video
snapshot and anchor each template to the top eligible post of its genre:
camera-focus explainer, showreel, product launch, procedural island and a
new wordless animated short that replaces the data story.
All five example.html files are hand-authored canvas/Three.js films drawn by
one render(t) from the GSAP master timeline, so preview, scrubbing and MP4
export produce identical frames. Each ships an original procedural
soundtrack, updated SKILL.md and 19-locale copy; Home order follows reach.
* fix(plugins): load bundled fonts in plugin previews
Plugin previews blocked every bundled font: the preview CSP had no font-src,
and relative url() references inside inline <style> blocks kept pointing at
the preview URL instead of the plugin folder. Allow same-origin fonts, map
inline-style url() references through the existing asset route (escapes,
absolute and data: URLs stay untouched), and serve font files with font
MIME types.
* feat(community): make motion template Use match the Home example pick
Community 「做同款」 on a motion design template now binds it as that type's
own example card, carrying the type's project metadata, so the run takes the
same OD Next motion-design route as a pick from Home's motion design list and
delivers the MP4 together with the editable source. Other task types keep
the existing plugin-pinning hand-off.
Community use clicks now record use_source (card | detail_modal) and
use_action (use | use_with_query); the details modal Use is tracked for the
first time. The Home hand-off no longer records a second community_gallery
click for uses Community already tracked.
* fix(plugins): count the five motion templates in the official registry metadata
* fix(media): keep HyperFrames audio filters compatible with FFmpeg 4.1
CI's bundled Linux FFmpeg 4.1 rejects adelay all=1 and amix normalize=0.
Make each track stereo and delay both channels explicitly, skip amix for a
single track, and undo amix averaging with a gain for several tracks.
* fix(motion): keep template previews bakeable on slow CI renderers
CI's software-GL baker skipped the 3D island (preview readiness timeout):
under slow frames GSAP lag smoothing slowed the timeline, so the 8 s
poster frame never arrived within the baker's 15 s wait. Play every
template on the wall clock and move the island poster to 6 s. With
simulated 300 ms frames all five now report ready within 10 s.
* feat(motion): add the kinetic typography template
Template selection now follows the motion design spec's four content types
(brand and product films, kinetic typography, explainer animation, procedural
art). Kinetic typography takes the fifth slot, replacing the animated short.
The new template is a 15-second, 120 BPM type film with an original
soundtrack and 19-locale copy.
* fix(motion): let the project motion player fit template stages
Inside a project the motion source player wraps the composition, fits it and
adds its own controls. The templates also scaled their stage, so editable
sources from Remix and Community use rendered at a fraction of the preview.
Templates now keep their own fit and controls only outside that player.
* feat(motion): restage the 3D island as a midday lagoon
The island moves from golden hour to a bright tropical midday closer to its
anchor post: a shader lagoon coloured by a baked depth map with ripples,
shallow-water shimmer and shore foam, a wide white-sand beach, palms and
instanced bushes, a village with a pier, soft sun shadows and a lower
camera path. The CPU wave mesh is gone, so frames cost no more than before.
Copy is updated in all 19 locales.
* fix(motion): keep each soundtrack inside the composition root
A Community use regenerated the island source tail and dropped the root
<audio> element, so its MP4 had no sound. Templates now place the element
inside the composition root next to the stage.
* docs(motion): state the template selection rule as complete works
* fix(motion): enforce video clocks and bound content verification
* feat(motion): replace the motion templates with remakes of viral posts
The five Motion design templates are now frame-faithful remakes of viral
motion posts, so each preview shows the look users came for: the 15-second
motion designer showreel, a high-energy motion reel (copy set in English), a
one-shape UI motion piece, a pixel-art wizard and a 20-second electric-blue
tech reel. Each ships open-licensed fonts, an original soundtrack, the
creator's published prompt where one exists, and credits its source post.
The explainer, product launch, 3D island and kinetic type templates are
removed. Tests follow the new set; a backward-seek check now covers hidden
WebGL layers.
* feat(motion): feature The Future Is Already Here first and start preview sound with the film
* chore: ensure PR CI
* fix(motion): match The Future Is Already Here controls and reorder the motion templates
* fix(motion): make the one-shape UI preview controls legible
* fix(motion): hide The Future Is Already Here controls inside the project player
* fix(motion): plan suitable sound and synchronize source audio playback
* feat(motion): keep remake soundtracks by default and fade exported audio where it stops
* test(motion): cover audible source controls in Chromium
* fix(test): use explicit ESM imports in audio player regression
* fix(motion): align preview track discovery with video export
* feat(motion): autoplay looping HTML without a player bar
* fix(test): consume the built motion playback contract
* docs(motion): state explicit soundtrack rules for make-same and the music line in replies
* chore(motion): version the audible looping delivery profile
* docs(motion): let template sound rules lead the general policy and freeze the audio contract
* fix(motion): scope autoplay to declared video motion sources
* fix(motion): reject audible MP4s under an explicit silent contract
* docs(motion): drop the routine music note from make-same replies
* test(motion): align delivery regressions with looping source playback
* fix(motion): isolate preview and audio export from legacy HyperFrames
* test(motion): retain the existing desktop legacy audio limitation
* fix(motion): suspend audio when previews leave the active workspace
* feat(motion): replace two motion templates with a product promo and a visual lesson; sign the showreel as Open Design
* feat(motion): give the showreel the Open Design palette and a full-size stacked wordmark
* feat(motion): give the product promo a livelier mascot girl
* refactor(motion): rebuild The Future Is Already Here as readable, editable scene code
* fix(motion): pick gallery cover frames that survive the baker's capture delay
* feat(motion): sharpen the showreel opener, depth, truchet and end card
* feat(motion): make the product promo mascot talk, add a speaking score and the flow pop
* feat(motion): give the visual lesson the original's paper-collage texture
* fix(motion): bundle gallery covers for fresh branch checkouts
* feat(motion): feature and refine Bring Ideas to Life
Adapt the paper story around OpenDesign capabilities, with short rounded hands, clearer timing, continuous paper actions, and a larger audience invitation. Feature it first in Motion and synchronize localized names, metadata, cover, guidance, and regressions.
Keep product promo audio music-only with sparse percussion.
* fix(motion): stabilize artifact cards and capture declared covers
* fix(web): share creation type order with community
* test(motion): exercise audio controls through project UI lifecycle
* fix(motion): scope live cover behavior to actual video sources
* test(motion): use real HEAD responses in cover regressions
---------
Co-authored-by: bone3deep1962-collab <bone3deep1962@gmail.com>
Co-authored-by: William <zhouhaoran@refly.ai>
Co-authored-by: open-design-crew[bot] <4197780+open-design-crew[bot]@users.noreply.github.com>
Co-authored-by: NJUHua <113895241+NJUHua@users.noreply.github.com>
Co-authored-by: Amy <1184569493@qq.com>
* feat(daemon): make OD Next the default route, and keep an opt-out opted out
An installation that configured nothing ran the ordinary strategy route, so
shipping OD Next in a build never changed how a run behaved until someone
opened Settings and asked for it. That made the Labs switch the whole rollout:
the strategy could only reach the users who already knew to look for it.
`resolveRequestedMode` now resolves an unconfigured installation to `active`.
Every other admission condition already defaulted open — assignment bucket,
both content flags, the production approval flag — so this last default was the
only thing holding the route closed.
The one-line change is the small part. Flipping the default inverts which case
is load-bearing. While the strategy was opt-in, an installation that lost its
saved mode kept the behaviour it already had; now an installation that loses
its saved mode is switched back on. So the invariant this has to keep is that
an installation which opted out reads `off` through every later release, and
that rests on opting out being stored rather than erased: `off` is a value the
config carries, `applyConfigValue` drops the key only for a value it cannot
store, and `assertWritableControlValues` refuses those on the way in.
That last guard is the same code as before but now protects the opposite
direction. It used to stop a typo from masquerading as an opt-out; it now stops
a typo from revoking one. Its docblock, the field comments on both sides of the
contract, the `od strategy` help text, and the prompt-composition note all
described the opt-in world and would have read as the reverse of the truth.
Tests carry the semantics:
- a new assertion pins the opt-out invariant, and checks not just the value
read back but that the decision built from it actually evaluates to `off`;
- the route test now separates `default` from a saved `off`, which resolve to
opposite routes and no longer to the same one;
- the app-config acceptance case against a real server is rewritten end to end.
It was "nothing configured takes the ordinary route, and the same running
daemon takes OD Next once you opt in". It is now the opt-out direction, and
proves it from the agent invocation log rather than from the run record: the
first run's prompt is the strategy's, the run after `off` is saved is not.
Packaged installs have no second control — the packaged child environment
allowlist carries no `OD_NEXT_*` key — so the saved mode is the only thing
standing between an opted-out user and this default.
e2e is deliberately untouched here and follows separately. Its specs mostly
never set this mode, so prototype and deck cases now take the OD Next route.
Pinning the env var in the harness is not the fix: the env var outranks the
saved config by design, which would break the spec asserting that an
app-config write takes effect with `app_config` as its source.
* test(daemon): stop the panel-grammar spec failing on the clock
`thinking-stream-panel-grammar` asserted that the whole SSE body contains
neither `Critic` nor `8.1`, on the stated premise that both "只可能来自标记内部".
That premise does not hold for the second one. The body also carries the
daemon's own `start` envelope, and `toolTokenExpiresAt` is an ISO timestamp: a
run whose token expiry lands on a second ending in `8` with milliseconds
starting with `1` produces `…:48.161Z`, which contains `8.1`. Roughly one run in
a hundred, and it hit on CI — with a thinking stream the log shows was clean,
so the spec failed on the clock rather than on a leak.
The two attribute-fragment assertions now run against the concatenated
`thinking_delta` / `text_delta` text instead of the raw body. That is not a
weaker check: persistence consumes exactly those deltas, so it is what the
spec's own "SSE clean ≡ database clean" argument was always about, and the
envelope fields it drops were never a place a leak could surface. The tag regex
stays on the whole body, where an opening `<PANELIST` cannot appear by accident.
The two prose assertions move to the same extracted text, which is what keeps
the negative assertions honest: an extractor that selected the wrong event type
would return an empty string, and every `not.toContain` would pass against it.
* feat(daemon): remove the OD Next stop latch
A run that hit certain failures wrote a row to `strategy_rollout_controls`.
From the next request on, every task on that installation took the legacy
route. The row outranked the saved mode, survived restart, and the Labs switch
kept reading "on" while the notice underneath said the harness had been paused —
with no control to unpause it. The only way back was an operator running
`od strategy rollout reset`.
The code already argued against this. The docblock over
`rolloutStopSignalForBlockedContinuation` says only a failure of the machine
contract itself may raise a latch, because an agent turn that mis-populates a
machine block "is already fail-closed for that task ... and it must not silently
return every later request in the daemon to the legacy path." One signal had
already been retired for doing exactly that: `complex_child_unverified` took OD
Next away from Codex, Claude and OpenCode because a fourth runtime lacks a
child-lifecycle producer. This generalises those narrowings instead of waiting
for the next signal to earn its own.
It also stopped being survivable. While OD Next was opt-in, the latch could only
reach the few installations that had asked for it; with the default flipped it
reaches everyone, and the population exposed to an automatic, restart-surviving,
UI-unrecoverable disable is now the whole install base.
Deleting it changes nothing about how any single failure is handled. All three
live trigger points were additive actions taken *after* the existing handling:
`native_resume_failed` already blocked the continuation, sent
`AGENT_SESSION_RESUME_FAILED` and finished the run failed; the blocked-
continuation cases were already set to `outcome: 'blocked'` with their reason
codes persisted for attribution. What goes away is only the side effect on every
later request. A fourth trigger — the run-duration threshold — never fired at
all: `OD_NEXT_STRATEGY_MAX_RUN_DURATION_MS` has no default anywhere, so the
comparison ran against NaN.
What is removed: the table and its migration, the write path and its telemetry
module, the single read in the run route, the reset endpoint, the
`od strategy rollout reset` subcommand, the latched lock in the Labs switch and
its 19 locale strings, and five contract types. `readOdNextRolloutControlStatus`
stays but no longer takes a database — the effective mode is now a pure function
of the requested mode and the content flags, so two callers reading it at the
same moment cannot disagree. Status is still worth an endpoint because
`requestedModeSource` names the authority, and `default` and a saved `off`
resolve to opposite routes.
Installations currently holding a latch recover on their own: with nothing left
to read the row, their next run is admitted normally. No migration needed, and a
downgrade is safe — older code recreates the table, reads it empty, and treats
the installation as unlatched.
Tests carry the invariant rather than a list. The cases that pinned which
signals were allowed to latch are replaced by one that pins the shape: the
decision is a function of the policy and this run's facts and takes no argument
through which an earlier run could reach it, so there is no signal left to
enumerate and none can be added by accident. The real-server case now asserts
that status still reports the deciding authority while both the reset endpoint
and its CLI subcommand are gone.
* fix(daemon): never leave the harness switch stuck, whatever the config says
Field report from a packaged build of this branch: the Design Harness switch
read on, greyed out, with "detected a problem, generation is using the original
approach" underneath, and every task on the machine taking the legacy route.
Nothing in the UI could clear it.
The diagnostics name the cause exactly. One agent turn ended mid-block —
`Unclosed <open-design-plan-contract> block`, 2 characters of visible text — and
that raised `machine_contract_leak`, whose stop mode is `off`, not `observe`. A
truncated response took the whole install off OD Next; the next daemon start
logged `requestedMode: 'active'`, `effectiveMode: 'off'`,
`od_next_rollout_stop_latched`, which is the screenshot.
That is not a rare condition. A stream ending early is the most ordinary failure
an agent has, and flipping the default hands it the entire install base.
Three changes, one property: the switch a user can see is a switch a user can
use.
1. The stop latch is removed (previously PR #7879, folded in here). A build that
defaults on and still ships an automatic, restart-surviving, UI-unrecoverable
disable is not shippable as two PRs — the window between them is exactly the
build that was reported. Everything the latch did on top of the existing
per-task handling is gone; the per-task handling is untouched.
2. An unreadable saved config no longer reads as an unconfigured one. The read
path kept two states apart where it needed three: no file at all, a readable
choice, and a config that exists but cannot be believed — malformed JSON, a
non-object body, a mode this build does not recognise. The third used to
collapse into the first harmlessly, because unconfigured meant `off` and so
did an opt-out. Now unconfigured means `active`, so the same collapse turns
"we cannot read your choice" into "you chose OD Next", against the
installations most likely to have chosen the opposite. It resolves to `off`
instead — the only answer that cannot override a real decision, and the
recoverable one, since a user who never opted out sees the switch off and can
turn it back on. `assertWritableControlValues` was never enough here: it
guards writes through the API and can say nothing about a file that arrived
bad, was hand-edited, or was written by another version.
3. A failed status read is retried from the switch instead of being permanent.
It rendered the row locked and lifted only on remount, so a transient failure
left a control that does nothing. A click on that lock now re-reads. The
environment lock stays inert deliberately: the daemon would ignore the write,
and pretending otherwise is worse than doing nothing — and no packaged
install can reach it, since the packaged child env allowlist carries no
`OD_NEXT_*`.
After this, the only greyed state a packaged user can reach is the moment before
the first read returns.
Installations already holding a latch recover on their own: with nothing left to
read the row, their next run is admitted normally. No migration, and a downgrade
is safe — older code recreates the table, reads it empty, and treats the
installation as unlatched.
Coverage follows the same split. The config cases run against real files through
`readAppConfig` rather than against the policy reader in isolation, because the
hole was in the join: truncated JSON, a non-object body, an unrecognised mode, a
typo, a non-string — each reads `off`, while a missing file and an explicit
`null` still reach the default. One case asserts the whole chain, saving `off`
then truncating the file and checking the mode survives, with a fresh
installation as the negative control so the guard cannot swallow the rollout it
protects. The UI case fails the first status read, clicks, and asserts the row
becomes operable.
* refactor(daemon): drop the JSDoc left above the removed latch classifier
The block described `MACHINE_CONTRACT_BOUNDARY_CODES` and
`rolloutStopSignalForBlockedContinuation`, both deleted with the stop latch.
Left in place it reads as documentation for the export below it, implying this
service still classifies machine-contract failures when it no longer does.
* fix(daemon): tell operators why `od strategy rollout reset` is gone
The command shipped in 0.21.0 and 0.21.1. Removing it left the subcommand
falling through to the generic usage dump, so an operator who scripted it saw a
list it was simply missing from and had to guess whether the command was
renamed, moved, or broken.
It now names itself: the daemon-instance stop latch it cleared no longer exists,
so there is nothing to reset, and the message points at the two commands that
replaced its use — `od config set odNextStrategyMode off` to opt out, and
`od strategy rollout status` to see which authority decides the mode.
It still exits non-zero rather than succeeding as a deprecated no-op. The
command meant "recover this machine's rollout". Reporting success for a recovery
that neither happened nor can happen is the same lie the latch itself told —
a control that says it acted while nothing changed — and this release is
removing that lie rather than relocating it into the CLI.
* fix(daemon): stop a broken config file from opting an installation out
The previous commit fixed a real hole — a saved `off` could be silently revoked
— but fixed it too widely and in the wrong direction for this rollout. It
treated a config file that failed to parse at all as evidence of an opt-out,
which it is not.
A file that will not parse resets every preference to its default: agent,
telemetry, all of it. Singling this one key out to resolve against its default
was inconsistent with the rest of the file, and the population it hits is the
wrong one — everyone whose config breaks, not everyone who opted out. Since the
second group is a subset of the first, the guard opted more installations out of
the rollout than it protected, in a change whose entire purpose is opting them
in.
The guard now covers only what it can actually see: `odNextStrategyMode` present
with a value that is not one of the modes — a hand edit, a typo, a mode written
by some other version. Something was configured and cannot be read, so it reads
`off` rather than becoming "you chose OD Next". A fresh install, a missing file,
an unparseable file and a config without the key all reach the default, which is
`active`.
That keeps both invariants this step owes: the default is on for anyone who has
not said otherwise, and a user who did say otherwise keeps their answer. The
switch stays operable in every one of these states, so nothing here can leave a
user looking at a control that does nothing.
* style(daemon): drop the blank line left at EOF by the classifier removal
The line separated `resolveAutomaticContinuationEvidence` from the JSDoc and
classifier below it. Removing those left the separator as a trailing blank line,
which `git diff --check` reports. No logic change.
* docs(daemon): stop enumerating which releases shipped `rollout reset`
The comment named 0.21.0 and 0.21.1. 0.22.0 shipped today and carries the
command too, so the enumeration was already wrong the day it was written --
any list of shipped versions goes stale by construction. Say "every release
since 0.21.0" instead, which stays true without maintenance.
The point the sentence is making is unchanged, and slightly stronger: the
surface has been out for three releases, so an operator who scripted it gets
told what happened rather than shown a help list it is missing from.
---------
Co-authored-by: Cheems <216108319+hihicheems@users.noreply.github.com>
* docs: map the two prompt implementations behind the OD Next fork
`composeSystemPrompt` returns early for OD Next runs, so the legacy stack below that return — the designer charter, the discovery layer, and the deck framework directive that embeds deck protocol v1 — never reaches those runs. Nothing in the repository said so, and prompt changes have been landing on one side only. The deck case is live: the OD Next `ppt.md` pins none of `data-od-deck-protocol`, the `od:deck-ready` announce, the `od:slide-state` posts, the `od:slide` listener, `id="deck-stage"`, or the print stylesheet, so a deck generated on that path can fail to be recognized as a v1 deck, paged from the host toolbar, or exported to PDF. Eligibility is re-evaluated per run and can latch down mid-session, which is why the divergence shows up as an intermittent bug.
Adds `apps/daemon/src/prompts/AGENTS.md` (fork point, the four variant axes, and a host runtime contract table naming which side carries each contract today) and `plugins/_official/scenarios/od-next-strategy/AGENTS.md` (asset roster and package-hash rules, and why maintenance notes must stay out of `assets/`, which is sent to the model verbatim). Root AGENTS.md gains an index entry and a Prompt variants section. Pointers go at the two fork sites, both deck-framework copies, and the OD Next atom registry, which is itself declared twice.
Documentation and comments only; no prompt bytes change. Validated with pnpm typecheck, pnpm guard, the daemon prompt suites (207 tests), and the contracts system-prompt / web-clone / deck-protocol suites (28 tests).
* docs: add PR #7568 as the worked example of a one-sided prompt change
The variant map says the two sides exist; it did not show what missing one costs a careful author. #7568 (merged 2026-08-29, `973e868ce`) is the case: it introduced deck protocol v1 across 18 files, handled the daemon/contracts prompt-copy split completely — shared constant, both copies changed, a guard added on each side — ran the full web and contracts suites plus two packaged DMG end-to-end runs, and touched nothing under `plugins/_official/scenarios/`. Its own stated goal was to stop new navigation dialects appearing; the OD Next path kept generating decks with no protocol at all, reported two days after merge.
Records the three reasons the miss stayed invisible, each still true today: both guards it added call `composeSystemPrompt` without an OD Next recipe so they cannot pass the fork (one is named 'ships new Agent decks with OD Deck Protocol v1' and is green), the prompt matrix snapshot updated cleanly because every scenario in it takes the legacy branch, and sharing a constant fixed only the machine-readable half — the surrounding directive prose had already drifted between the two copies before #7568 and still differs on main.
Documentation only. Validated with pnpm guard in a worktree on this branch.
* docs: mark the deck fork at the sites an agent actually edits
The file-top and fork-point pointers only reach an agent that reads from line 1. The edit an agent actually makes for a deck rule lands in the middle of DECK_FRAMEWORK_DIRECTIVE (368 lines below the daemon file's header) or at the push site (446 lines below the fork), typically reached by grepping and reading a short span — where no pointer was in view. Put a two-line marker at each of those four sites instead: above DECK_FRAMEWORK_DIRECTIVE in both prompt copies, and above the deck/freeform push guard in both, which covers both push branches. Line references in the two AGENTS.md files are re-pinned for the shift.
Comments only, placed outside every template literal. Verified byte-identical prompt output against origin/main: 8 scenarios x both composition paths, sha256 and length compared in one worktree with the source files swapped and contracts rebuilt — all 16 pairs identical. pnpm typecheck, pnpm guard, daemon tests/prompts (207), contracts system-prompt / web-clone / deck-protocol (28).
* docs: move the prompt variant map to docs/ and refresh it for #7651
Two changes in one, because main invalidated the old shape while it sat in review. Structural: the guidance moves from two nested AGENTS.md files to one `docs/prompt-composition.md`, matching how the root index already carries `docs/architecture.md` and `docs/skills-protocol.md`. Nested AGENTS.md is not auto-loaded on file access, so proximity bought no delivery that the root pointer and the in-file markers do not already provide. The plugin folder keeps a short AGENTS.md for the one rule that is only meaningful there — never write maintenance notes into `assets/`, which reaches the model verbatim. Naming it after the structure rather than the experiment keeps it valid if OD Next is retired or graduates: two of the four axes are independent of it.
Factual: #7651 closed the deck gap this document reported, by collapsing the scaffold to one source in contracts and reaching OD Next through `resolveOdNextDeckFrameworkMode` rather than the markdown assets. The contract table's deck rows now read supported on both sides, the daemon deck-framework file is a re-export, and the two markers that claimed OD Next never receives the directive are removed rather than reworded. #7568 and #7651 are now presented as a pair — a one-sided change and the follow-up nearly twice its size that repaid it. Remaining gaps are recorded: five daemon/contracts prompt pairs still hand-maintained, and `core-slim.ts` absent on the contracts side.
Documentation and comments only. Prompt output verified byte-identical against the merge base: 8 scenarios x both composition paths, sha256 and length, markers reverted and reapplied in place. pnpm typecheck (0 errors), pnpm guard, daemon tests/prompts (210), contracts system-prompt / web-clone / deck-protocol / od-next-prompt-recipe (53).
---------
Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>
zhouzheng