mirror of
https://github.com/THU-MAIC/OpenMAIC.git
synced 2026-10-29 00:46:40 +08:00
@openmaic/generation@0.3.18
685
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Hahaa909andwyuc
|
dbb0e3a286 |
Preserve rotation for generated slide shapes (#1855)
* fix preserving generated shape rotation * bump generation package version * fix generation rotation check formatting --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>@openmaic/generation@0.3.18 |
||
|
|
5eae1a430d |
fix(generation): explain exhausted plan quotas (#1831)
* fix(generation): explain exhausted plan quotas * test(generation): use nullable model metadata in quota fixture * fix(generation): keep provider quota detection neutral and scene-scoped Address the review of #1831: - The shared classification no longer reads vendor codes. MiniMax TTS and web search translate base_resp 1008/2056 into ProviderQuotaExhaustedError (thrown, or as the cause of the rate-limit error an HTTP 429 keeps), and isUpstreamQuotaExhausted checks only that marker and the OpenAI-compatible wire codes. - The built-in classification reports PROVIDER_QUOTA_EXHAUSTED, so a host that meters its own QUOTA_EXHAUSTED can tell the two apart, and a host's start refusal keeps the host's own message. - The classroom passes the guidance only while the pending scene card is the scene the run paused at; a scene the run went on past keeps the generic failure text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PyhoDKKJ3gVoPbvCT3T99K * test(generation): cover quota guidance through the classroom hook --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
89290651b8 |
fix(export): hide the no-JavaScript fallback as soon as the standalone player starts (#1850)
The static fallback message is now hidden synchronously when the player script runs (kept in the DOM), so a slow parse of a very large file can no longer reveal it before the first commit. A start failure (sync or async render error) un-hides it with the "couldn't start" text; it is still removed after the first successful commit. Scripts that never run leave it visible as before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
a922dea2de |
fix(storage): bound DocumentStore HTTP requests with a deadline (#1790)
* fix(storage): bound DocumentStore HTTP requests with a deadline HttpDocumentStore issued every request without a deadline, so a request whose peer never answers held its promise forever. The stage autosave keeps at most one save in flight (startFlushRound's flushInFlight guard) and starts the next one only once that promise settles, so a single stalled save silently stranded every later save for the life of the page — generation and the editor kept working from the in-memory store, and the loss only surfaced on reload. Bound the request round trip — sending the body and receiving the response headers — with an AbortController deadline (requestTimeoutMs, default 30s, <= 0 disables). A stalled request now rejects with HttpDocumentStoreError(0, 'HTTP_REQUEST_TIMEOUT'), which the autosave's existing backoff already retries. This mirrors the budget HttpAssetStore applies via probeTimeoutMs / startBoundedOperation. Reading the response body stays outside the bound: a large document on a slow link is slow, not stalled. Co-Authored-By: Claude Code <noreply@anthropic.com> * docs(changelog): describe the request budget's fixed throughput and ceiling The throughput and ceiling are module constants, not HttpDocumentStore options; only requestTimeoutMs is configurable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Code <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>@openmaic/storage@0.37.2 |
||
|
wyucandClaude Opus 5.5
|
6a84dbeb45 |
fix(export): follow-ups from the standalone HTML playback review (#1848)
* fix(export): pause a first hand-started video when a second starts; keep captions off narrow scenes Starting a second video by hand on one slide left both playing. The registry now pauses the other hand-started videos (never the one the sequencer awaits). On narrow viewports the caption bar covered part of the scene (quiz options). It now has its own strip below the scene; from the sm breakpoint up it overlays the scene as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): accurate export messages and menu order; static fallback without JavaScript - Size warnings only suggest exporting without narration when narration was included. - Missing narration clips get their own toast wording instead of being counted as external assets that could not be bundled. - The HTML export submenu prefers 'with narration and video' when the classroom has narration audio or slide video. - The file carries a static message for viewers that do not run scripts (iOS Files preview, scripts disabled or blocked). It sits right before the player script so it never paints while a large file parses, is removed when the player mounts, switches to a generic "couldn't start" message if the player fails, and has a <noscript> copy. Localized through the player strings; the CSP is unchanged. - Caption strip: fixed height, only while playback is active, scrolls long lines, also used on short (landscape) screens. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): fallback message on the first screen; report failed linked images; skip ZIP-only decoding for single files - The static fallback message sat below the empty full-height root, so it started below the first screen. The empty root is now hidden until the player mounts. The fallback is removed after the player's first commit (not right after render()), so a first-render error still shows the "couldn't start" message. - The no-JavaScript hint no longer names a platform-specific sharing step. - Slide images that fail to load from a linked relative path (a missing images folder) now trigger the linked-files notice, also when the audio and video probes load. - Inline data: images are only decoded into files once the ZIP is going to be built (about 0.6 s and +100 MB for 100 MB of images otherwise); the single file and its size estimate are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
9bbd34e6f1 |
feat(export): fall back to a ZIP of classroom.html and its media for large classrooms (#1845)
* feat(export): add a stored ZIP writer that references its entries' Blobs The standalone export's media-folder variant ships already-compressed narration and video. JSZip reads every input Blob into an ArrayBuffer and concatenates its output into one ArrayBuffer, so a multi-hundred-megabyte archive would sit in the tab several times over. This writer stores entries uncompressed, reads each one a slice at a time only to compute its CRC-32, and returns a Blob composed of the entries' own Blobs, so no media is copied. Paths are checked to stay inside the extraction folder, and archives plain ZIP cannot describe (4 GiB) are refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(standalone-player): say so when media shipped next to the page is missing A page whose media table names files by relative path (the ZIP variant of the export) plays nothing when opened without them: straight from inside the ZIP, or copied out alone. The media library now probes one linked file as the player opens and records any linked clip that fails to load, and the player shows a notice asking to extract the whole ZIP. Playback carries on as before: failed narration falls back to the reading timer and a failed video no longer holds the sequence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): fall back to a ZIP of classroom.html and its media folders A classroom whose single HTML file would pass the 400 MB ceiling is now exported as a ZIP instead of refused: classroom.html carries the player and manifest, and its media table names each narration and video file by relative path (audio/..., media/...) next to it, plus a README in the UI locale and English. The ZIP needs no base64 and copies no media, so it is built from the same snapshot without a second collection pass. The page's CSP differs from the single file's only in media-src, which adds 'self' so <audio>/<video> elements may load the sibling files (Chromium and WebKit match it against file: URLs when the page is opened from disk); connect-src stays 'none', so the player never reads the bytes itself. The single file is unchanged, byte for byte. The fallback is automatic, at the same ceiling, because one file is the better format wherever it works; the export menu keeps its two entries. A toast explains why a ZIP was saved and that it must be extracted before opening classroom.html. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep stored ZIP fields below the ZIP64 sentinels 0xFFFF entries and 32-bit sizes or offsets of 0xFFFFFFFF announce ZIP64 records, so a plain archive must stay below them: the writer now refuses 65,535 entries and any size, offset or archive length that would reach 0xFFFFFFFF, and limits entry names by their UTF-8 bytes (what the header field holds) instead of UTF-16 units. The CRC slice size is injectable. Tests now read the raw bytes: every local header is compared field by field with its central directory entry and the end record, and the CRC carry across slices, the boundaries and the DOS date clamp are covered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): report every linked file that fails, and word the notice for both causes WebKit and Firefox reject play() with NotSupportedError for a narration file that is not there, before (or without) an error event, and the clip's handler was gone by the time the event fired: a missing clip after a successful startup probe played silently with no notice. The rejection now reports linked clips, and the narration element keeps a standing error listener for the clip it is loading. When the media table links no file (an export without narration), the startup probe loads a linked slide image instead. A file in a codec the browser cannot play fails exactly like a missing one on file:, so the notice now covers both: "Some images, narration or video couldn't be loaded. If you opened classroom.html from inside the ZIP, extract the whole ZIP first." Adds a SlideScene test for video errors. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): ship slide images as files in the ZIP and refuse an oversized page The ZIP fallback kept slide images, backgrounds, patterns, chart point images and video posters inline as data: URIs, so a classroom heavy in images could produce a ZIP whose classroom.html alone passed the ceiling. In the ZIP they are now files under images/, named by relative path, and the page's CSP adds 'self' to img-src as well as media-src. Image bytes are collected once and encoded as data: URIs only for the single file; the single file's size is estimated from the linked manifest, exactly, without encoding anything. The single file is unchanged. Media inside interactive scenes stays inline: those pages run in sandboxed opaque-origin frames, which Chromium and Firefox do not let load files from disk (WebKit does). A ZIP whose page alone still passes the ceiling is refused with its own message (StandaloneHtmlTooLargeError of kind "page"), and the fallback toast and README name what the ZIP holds. The CSP comment now spells out what 'self' allows when the folder is served over HTTP: same-host GETs, with cookies, from image and media elements (interactive frames included); nothing can be read back, since connect-src stays 'none'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep chart point images inline and ship inline slide images as files in the ZIP Two gaps in the ZIP variant's image handling: - Pictorial charts rendered blank: the chart renderer wraps each point image in a data: SVG symbol, which cannot load a file, so a relative path there drew nothing in any browser. Chart point images now stay inline as data: URIs in the ZIP (a ref named only by a chart ships no file). - Images that were already data: URIs (images, backgrounds, shape patterns, video posters) were never collected and stayed in the page, so such a classroom could still be refused as too large. In the ZIP they are now decoded into files under images/, one per distinct URI; a MIME type no file extension conveys, or a malformed URI, stays inline. The single-file estimate counts each one as the exact escaped URI it replaces, and the single file keeps them as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
70f58bc3c1 |
feat(export): play the standalone HTML classroom with narration, effects and video (#1842)
* feat(export): keep playback actions and embed narration in standalone HTML The standalone HTML manifest now keeps each scene's playback actions, reduced to what an offline player can replay: speech text (plus its audioRef when the bytes ship), spotlight/laser targets, play_video, widget actions, and the discussion topic. Whiteboard actions, unknown types, discussion prompts and agent bindings are left out. With the new includeNarration option the snapshot collects narration (stored and legacy audioUrl) and video bytes. Actions and video elements name them by archive path, and the bytes travel as base64 data blocks (script type="application/octet-stream") indexed by a media table, so the browser keeps them as text until a clip plays. Payload collection is format-neutral so a later folder variant can ship the same paths as files. The export reports its byte size and missing narration; the CSP is unchanged and the file still makes no network requests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(standalone-player): play the classroom with narration, effects and captions A lightweight sequencer replays each scene's actions the way the classroom's playback engine does, without its stores or IndexedDB audio player (only the pure timing helpers are shared): - speech waits for its embedded narration, or for the classroom's reading-time estimate when there is none; its text is shown as a caption that can be toggled; - spotlight and laser drive SlideCanvas effects, fire without blocking so they overlap the next speech, clear 5 s after the latest one and on every scene change; - play_video plays the embedded clip in place and waits for its end (capped); a video without bytes keeps its poster; - discussion shows a card with the topic and a link to the online classroom, closing on its own after a few seconds; - widget actions are posted to the sandboxed interactive iframe; - whiteboard and unknown actions are skipped. Playback starts only from the Play button (or Space), which primes the shared narration element inside the gesture; a refused play() falls back to the reading timer, and video to muted playback. Slide scenes advance automatically; quiz, interactive and PBL scenes hold after their narration, as the classroom's auto-play does, until the learner continues. Navigating cancels the running scene cleanly and, while playing, starts the new scene from its beginning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): choose narration in the HTML export menu and warn on large files "Export as HTML" becomes a submenu, like the PPTX one: "With narration and video" embeds narration audio and video clips, "Without narration" keeps the file small (captions on the reading timer, poster frames for videos). The option that fits the classroom is listed first. Narration that could not be embedded counts as a partial export, and files above 100 MB get a size warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): label narration by the container its bytes are Stored narration can carry the wrong format: a provider that answers WAV without a usable Content-Type is recorded as mp3. Exports then labelled the clip audio/mpeg and named it .mp3, and WebKit, trusting the label, reported a WAV with a streaming placeholder data length as about 44,700 s long. The narration collectors shared by the classroom ZIP and the standalone HTML export now sniff the container from the leading bytes (RIFF/WAVE, ID3 or MPEG frame sync, OggS, fLaC, ftyp, WebM) and use it for the MIME type and archive extension; unrecognized bytes keep the stored label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): tighten standalone media policy and build large files as Blob parts - A slide video whose src is a direct URL no stored asset backs is now fetched (same timeout policy as images) and embedded; when it cannot be fetched it is reported as unresolved media instead of silently falling back to its poster. - "Without narration" now means no audio or video payload anywhere: interactive pages do not fetch their <video>/<audio> sources (new skipMedia inline option) and already-embedded clips are stripped, while their images, posters and other assets are still inlined. - Slide audio elements, which the offline player never plays, are no longer collected or counted as missing narration. - The document is assembled as Blob parts (base64 in pieces, clips encoded one at a time), so no single string approaches V8's length limit. The size is estimated from the media byte counts before anything is encoded; above 400 MB the export stops with a localized explanation (StandaloneHtmlTooLargeError, the hook for a future page-plus-media-folder fallback). The 100 MB warning stays. - Media block comments now say when a block is decoded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): stop videos at their cap and keep controls in step - play_video now pauses the clip when its wait cap passes or the run is cancelled, and clears the losing timer and listeners when the wait settles, so a clip never plays on under the next narration. - The video's own controls stay in step with playback: pausing the awaited clip pauses playback and playing it resumes; starting any other video pauses the narration, and resuming playback pauses that video again. - Space leaves a focused video or audio element to toggle itself, and keeps scrolling quiz and PBL scenes when focus is inside the scene. - A caption lasts as long as its speech, so nothing is left over a held quiz or interactive scene. - Play after the last scene finished starts over from the first scene. - The start overlay shows on whichever scene the file opens on and goes away on any navigation, a hash change included. - Body text is antialiased like the classroom page. - Tests for the media ports (pause racing play, refused and failing clips, muted retry, cap, control sync, widget queue), the media library, the overlay and Space rules, and holding for every held scene type. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): exact size ceiling, thorough media stripping, ADTS behind ID3 - Resuming the awaited video through its own controls now pauses any video started by hand, as resuming playback by any other path does. - The size estimate counts the manifest as the escaped UTF-8 bytes the document carries, and the assembled Blob is checked against the ceiling too, so the 400 MB guard holds exactly (maxBytes is an option for hosts and tests). - Without narration, the src of <video>, <audio> and their <source> elements is stripped for any data: URI whatever MIME it declares, and stripping recurses into nested srcdoc documents (bounded depth; deeper documents are dropped). - Audio sniffing skips a leading ID3v2 tag (syncsafe size) and reads the frame after it: MPEG audio stays mp3, AAC ADTS becomes aac, also for untagged ADTS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): toggle a focused video on Space in every browser WebKit's native video controls ignore Space, so with the slide video focused nothing happened while the video kept playing. The player now handles Space on a focused video or audio element itself, in the capture phase, toggling that element and stopping the press so Chromium's native toggle does not fire as well; the element's play and pause events keep playback in step exactly as its controls do. Verified in Chromium, WebKit and Firefox. The "Without narration" export description no longer promises a still frame for videos (generated videos have none); it says videos are not included, in all locales. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
472b26d0d5 |
fix(math): disable formula-defined macros in KaTeX and Temml rendering (#1827)
* fix(math): disable formula-defined macros in every KaTeX and Temml render Add safeKatexOptions to @openmaic/dsl, the one package every renderer, importer, editor and the app already depend on. It merges hardened settings into each caller's options: macro-defining commands (\def, \gdef, \edef, \xdef, \global, \long, \let, \futurelet, \newcommand, \renewcommand, \providecommand) become inert macros that consume the definition, trust is forced off, maxExpand is pinned, and a fresh macros object is built per call so nothing persists between renders. Caller options and caller-supplied macros are kept. Route every render through it: whiteboard and slide latex elements, quiz math, standalone HTML inline math, PPTX export via Temml, the editor's latex dialog and inline math node, generated latex elements, and the importer's formula paths. Keep the importer's node-globals rollup plugin off the dsl build, whose old parser cannot read `??`. Tests cover each render path with nested-definition inputs, a corpus of legitimate formulas that must render byte-identically, \gdef isolation, and a guard that fails if a new KaTeX/Temml call skips the helper. Bump @openmaic/dsl 0.11.3, editor 0.0.10, generation 0.3.16, importer 0.3.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): harden workbench chat math and newcommand parsing Workbench chat Markdown rendered math through @streamdown/math, which only forwards errorColor to rehype-katex. Add createSafeMathPlugin, which keeps that plugin's remark side and rehype-katex instance but replaces the rehype options with safeKatexOptions, and use it in the chat text block. Rework the inert \newcommand family: peek at unconsumed tokens so a body written as {[} stays a body, accept the starred form, skip [n] and [default] groups with brace-aware scanning, then consume exactly one replacement body. Document that caller-supplied macros are trusted code and must not be derived from content. Replace the call-text coverage check with an import-aware guard built on the TypeScript parser. It finds every runtime import of a math engine (default, aliased, named, namespace, side-effect, import = require, re-export, dynamic import, require) plus injected auto-render script text, and requires each file to be on a reviewed allowlist. Files that import KaTeX or Temml directly must use them only as render calls with safeKatexOptions(...). The interactive post-processor is allowlisted: its page already runs model-written scripts in a sandboxed iframe. Fixtures cover each bypass shape. Add KaTeX and Temml regression tests for the newcommand edge cases, and the workbench chat path to the expansion-input suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): fresh macros per chat formula and stricter render guard KaTeX writes built-in state into the macros object while rendering (an align environment sets \@eqnsw), and rehype-katex spreads one options object into every render. The workbench chat plugin shared one macros object, so that state leaked between formulas and between messages. Make macros an enumerable getter that returns a fresh hardened object on every read, so each render and each error retry gets its own. Add cross-formula and cross-message regression tests. Tighten the guard for files that import KaTeX or Temml directly: any engine reach other than a static default or namespace import (require, dynamic import, re-export, import = require, side-effect import) is rejected; the options argument is checked at each method's own position with nothing after it; and it must be a call to safeKatexOptions imported from @openmaic/dsl, not a local look-alike. Document the guard's scope: module imports only; global access, engine code inside other HTML strings and require.resolve need review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): keep built-in equation numbering with macro definitions disabled KaTeX and Temml implement \tag, \tag*, \nonumber and \notag as built-in macros that expand to \gdef\df@tag{\text{...}} and \gdef\@eqnsw{0}. Swallowing every \gdef therefore dropped equation tags and stopped \nonumber / \notag from suppressing align/gather/equation numbers. The inert \gdef now accepts exactly those two built-in shapes and stores them the way the engines' own \gdef does; every other \gdef, and every other definition command, stays inert. '@' is a letter in both lexers, so formulas can name these macros directly; the allowed shapes add nothing \tag* and \nonumber do not already provide: - \@eqnsw may only be set to 0; - \df@tag may only be one \text{...} group that never mentions \df@tag, so the tag is expanded exactly once (a self-reference would recurse until the call stack or the expansion budget runs out, as it does in the stock engines on \tag{\df@tag}). Tests: tagged and \notag/\nonumber formulas render identically to stock KaTeX (html, mathml, htmlAndMathml) and Temml; the slide element, quiz, editor dialog and Workbench chat renderers show tags and suppress numbers; definitions inside tags, self-referencing tags, nested tags and non-built-in \df@tag/\@eqnsw shapes stay inert. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): expand a tag in full only once per accepted definition A formula can name \df@tag itself, so a long \tag*{...} (or an accepted \gdef\df@tag{\text{...}}) followed by many \df@tag mentions re-expanded the whole tag on every mention, up to the expansion budget: about 12 KB of input produced several MB of output. An accepted \df@tag is now stored as a macro that yields its body on the first expansion and an empty \text{} afterwards. The engines expand \df@tag once per formula, or once per align row before clearing it, so tags render unchanged (stock-equality tests, including an align with a tag on several rows, stay green in KaTeX and Temml). The empty \text{} rather than nothing avoids a Temml TypeError on an empty tag. Also document, and test through the PPTX export, that Temml throws a TypeError on a script left bare by an inert definition (x^\notag); the only Temml consumer catches it and returns null. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(generation): bump to 0.3.17 after main took 0.3.16 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>@openmaic/importer@0.3.1 @openmaic/generation@0.3.17 @openmaic/editor@0.0.10 @openmaic/dsl@0.11.3 |
||
|
wyucandClaude Opus 5.5
|
e982cfeef7 |
fix(export): drop non-woff2 font fallbacks instead of about:invalid (#1826)
* fix(export): drop non-woff2 font fallbacks instead of about:invalid When an inlined stylesheet's @font-face offers a woff2, the inliner kept only the woff2 and pointed the woff/ttf/otf/eot fallbacks at url(about:invalid). Chromium and WebKit check every @font-face src URL against the page's font-src CSP when the rule is parsed, whether or not the face is ever used, so the standalone HTML export (font-src data:) logged one CSP violation per fallback: about 40 for a page that loads the KaTeX stylesheet. The woff2 fonts were inlined and render; the errors were noise. Remove those fallback entries from the src list instead, keeping local() entries and format() hints, and remove a src declaration left empty. @font-face rules without a woff2 are inlined as before, and a woff2 that fails to fetch is still reported through the inline failure report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): prune font fallbacks per src declaration The woff2 check ran across the whole @font-face rule, so a later src declaration without a woff2 (src:url(A.woff2);src:url(B.ttf)) was removed and the earlier woff2 won the cascade instead of the authored B.ttf. Judge each src declaration on its own: only a declaration that offers a woff2 loses its woff/ttf/otf/eot entries, and declarations are never removed. Also treat an entry with a format("woff2") hint as woff2, so an extensionless or mis-named woff2 URL counts and is never pruned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep font fallbacks behind conditional woff2 sources Only prune woff/ttf/otf/eot fallbacks that follow an unconditional woff2 source in the same src list: a single url() with a plain format("woff2") or format(woff2) hint (or none, with a woff2 URL). A woff2 entry gated by tech(), `supports` inside format(), a woff2-variations or multi-format hint is skipped by browsers that lack the feature (WebKit does not support tech(color-COLRv1)), so the fallbacks behind it are kept and inlined. Entries before the first unconditional woff2 are kept as well, since a browser would use them first. Fallbacks after an unconditional woff2 are now also recognised by their format() hint, so extensionless TTF/WOFF URLs are pruned too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): treat malformed woff2 format() hints as conditional parseFontSrcEntry skipped separator tokens inside format(), so the malformed `format("woff2",)` read as a plain woff2 hint and the fallbacks behind it were pruned. Browsers skip such an entry, which left the face with no usable source and no reported asset failure. format() now keeps every token (separators as themselves, nested functions and unclosed strings as empty tokens), and an unclosed url() or format() counts as an extra part, so only an exact single `woff2` keyword or string qualifies as unconditional. Anything else keeps and inlines the fallbacks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
32f592377b |
fix(test): normalize Windows path separators and replace shell grep in test suite (#1642) (#1828)
* test: normalize Windows path separators and replace shell grep in test suite (#1642) * ci: re-trigger checks --------- Co-authored-by: cham <2577781125@qq.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
Yizuki_Ameandwyuc
|
02194d1b2d |
fix(render): isolate preview execution from video exports (#1830)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
ac0d656928 |
fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS (#1798)
* fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS validatePublicUrlForSSRF now passes clientSupplied: true. Opt-in-governed refusals on that call — loopback, localhost, .local, private, link-local, and CGNAT literals, and a DNS answer set whose disqualifying addresses are all in those ranges — use a new string stating that ALLOW_LOCAL_NETWORKS does not apply and that the endpoint must be an operator-managed provider in server-providers.yml. validateUrlForSSRF still returns the existing flag guidance when the flag is unset and still allows those targets when it is set. Cloud-metadata targets keep their own message, and reserved, multicast, and broadcast addresses, including a DNS answer set that contains one, keep the generic local-network message. Fixes #1771 * fix(server): point client TTS URL refusal at openmaic.yml 1.2.0 deprecates server-providers.yml; operator-managed provider endpoints now live in openmaic.yml under providers:. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
TiyatrotistandTiyatrotist
|
3d8ad0096b |
refactor: deduplicate export menu items (#1693)
Co-authored-by: Tiyatrotist <179411334+Tiyatrotist@users.noreply.github.com> |
||
|
Ethereal49
|
07299672c4 |
fix(generation): require explicit state publication and initialize game state (#1795)
* fix(generation): require explicit state publication and initialization * fix(generation): bump package version to 0.3.16 * test(generation): stop old worker before seeding recovery checkpoint@openmaic/generation@0.3.16 |
||
|
wyucandClaude Opus 5.5
|
8b451a33bf |
fix(renderer): repaint clipped chart series on WebKit (#1825)
ECharts reveals line series by growing an SVG clip path from a sliver to the full plot width. WebKit keeps painting the clipped group as it was on the first, nearly empty frame, so the points and labels show and the line does not. Writing the clip shape's attributes again, even with the same values, makes WebKit repaint the group. On WebKit the chart element now re-sets the attributes of the shapes inside its clip paths after every rendered frame. Animations stay on for every browser; Chromium, Firefox and charts without clip paths are left untouched. The standalone player keeps rendering charts without animation. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>@openmaic/renderer@0.1.12 |
||
|
wyucandClaude Opus 5.5
|
9fd9f71b73 |
feat(export): PBL placeholder slides and a per-export choice of placeholders (#1823)
* feat(export): give PBL scenes a placeholder slide in the PPTX PBL scenes now get a placeholder slide at their position in the lesson, in the standalone PPTX and in the Resource Pack PPTX, like interactive and quiz scenes. A project runs only online, so the slide carries the same "Open online" button, QR code, URL and link hotspots, and no offline link (the pack has no page for it). The slide shows the project's briefing: the goal (learning objective, else the scenario goal), the milestone count and up to four milestone titles in order, cut to one line by display width. The briefing comes from the projection the standalone HTML export uses, now shared in lib/export/pbl-briefing.ts, so legacy projects are upgraded the same way and role prompts, evaluations, submissions and chat history never reach the slide. A project that is missing or unreadable falls back to the title and description. PBL narration is not copied into the notes. A lesson with only PBL scenes now exports a PPTX instead of reporting nothing to export. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): let users turn PPTX placeholder slides off The export menu gets an "Include placeholder slides" setting next to "Export PPTX" and "Export Resource Pack". A tooltip (on hover and on keyboard focus) explains that interactive pages, quizzes and PBL projects get a slide at their place in the lesson, with an "Open online" button and a QR code. Toggling it keeps the menu open and starts no export. The setting is on by default and remembered per browser in localStorage; unreadable storage falls back to on. It reaches the exports as an explicit option (useExportPPTX({ includePlaceholders }), planPptxDeck, buildResourcePackZip): - Off: both PPTX exports hold the slide scenes only, and the Resource Pack still ships the interactive HTML pages. - Off with no slide scenes: "Export PPTX" reports there are no slides, and the Resource Pack ships the HTML pages without a PPTX and says so (the "PPTX skipped" message is restored for this case). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): cut placeholder text by grapheme cluster Placeholder titles, quiz stems and PBL lines were cut by UTF-16 code units or code points, which could split an accented letter, a ZWJ emoji sequence or a surrogate pair, and emoji counted as narrow. Text is now split into grapheme clusters with Intl.Segmenter (code points where it is unavailable). Width-limited lines count wide characters and emoji clusters (flags, skin tones, ZWJ sequences, keycaps) as two columns, reserve room for the ellipsis, and never cut inside a cluster. Length-limited titles count clusters, so no lone surrogate is left behind. The export-menu e2e spec now waits on the elements it uses instead of network idle, keeps its download counter across the reload, and checks the setting from the keyboard (focus shows the tooltip; Space and Enter toggle it without closing the menu or exporting). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): choose placeholder slides per export in submenus The "Include placeholder slides" checkbox read like another export action. "Export PPTX" and "Export Resource Pack" are now submenus, built like "Download Script": - Export PPTX: "With placeholder slides (recommended)" or "Slides only", each with a short explanation. - Export Resource Pack: "PPTX with placeholders + interactive pages (recommended)" or "Slides-only PPTX + interactive pages". The choice is made per export, so nothing is remembered: the stored preference, its tooltip and its tests are removed. exportPPTX() and exportResourcePack() take { includePlaceholders } per call (default true) instead of the hook-level option. Gating, the exporting state and the slides-only fallbacks (no slides to export; HTML pages without a PPTX) are unchanged. The e2e spec covers both submenus by pointer and keyboard and checks the slide count of every downloaded deck. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(i18n): match the Resource Pack submenu wording to its parent item Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
08e1447ab7 |
feat(export): export a classroom as a single offline HTML file (#1813)
* refactor(export): share one classroom export snapshot across formats Split buildClassroomExportZip into buildClassroomExportSnapshot, which returns the portable manifest plus the bytes of every payload it names, and a thin ZIP writer on top of it. The upcoming standalone HTML export serializes the same snapshot, so both formats share one serializer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): standalone HTML player bundle A small React app that plays a classroom manifest embedded in the page: slides through @openmaic/renderer's SlideCanvas, interactive scenes in sandboxed srcdoc iframes, client-graded quizzes, and static PBL briefings, with prev/next, keyboard, scene list and fullscreen. scripts/build-standalone-player.mjs compiles it at app build time (dev and build) into public/vendor/standalone-player/: one IIFE via esbuild, Tailwind 4 CSS covering the renderer's classes, KaTeX fonts as an optional sheet, and ECharts as an optional script the player reads from a global, so files without charts do not carry it. Shiki is stubbed; code elements render unhighlighted. esbuild is added as a direct devDependency at the version already in the lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): export a classroom as a single offline HTML file Add "Export as HTML" to the export menu. The export takes the shared classroom snapshot, embeds slide images, backgrounds and video posters as data URIs (archived payloads first, concrete URLs fetched at export time), patches interactive HTML for the sandboxed iframe, and inlines the prebuilt player into <course-name>.html. The file makes no network requests: a restrictive CSP (default-src 'none', connect-src 'none') is set before any script, the manifest and config are embedded as JSON with <, > and & escaped, and interactive pages run only in iframes sandboxed like the classroom's. PBL scenes link to the online classroom only when it is published at export time. No narration or video bytes yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(sanitize): move the scene-content sanitizer to a client-safe module The policy depends only on sanitize-html, so it moves to lib/sanitize/scene-content.ts unchanged; lib/server/sanitize-scene-content.ts re-exports it for the persistence callers. Client export paths can now apply the same policy to working state before it leaves the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): sanitize and trim the standalone HTML classroom - Run slide rich text (text, shape text, table cells, LaTeX snapshots) through the persistence sanitizer before embedding: the renderer injects it into the player's own document, and the export reads working state that has not crossed the persistence boundary. - Embed chart point images as data URIs (or drop and report them); rich text images and CSS url() values are removed by the sanitizer. - Leave out what the player does not use: playback actions, multi-agent settings, the agent roster, the video manifest and PBL runtime state. PBL content is resolved the way the classroom resolves it, legacy projects upgraded, and reduced to its briefing. - Skip narration audio, legacy audio fetches and video bytes when building the snapshot for HTML (captured posters are kept); the ZIP path is unchanged. - Resolve each media ref once, count a video poster as unresolved only when no captured frame covers it, and ship KaTeX fonts only when quiz text or slides actually contain math. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep player scenes scrollable and contain scene failures Navigate with Left/Right only, so Up/Down, PageUp/PageDown and Home/End scroll long quiz and PBL scenes. Wrap each scene in an error boundary that shows it as unavailable instead of blanking the player, and read PBL briefings defensively now that the export resolves legacy projects. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(export): note that dev builds the standalone player once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep inline formulas and report dropped rich-text resources The prose sanitizer cannot express the editor's inline formulas (KaTeX spans with SVG and positioned parts carrying data-inline-math), so the standalone export lifts each formula's LaTeX source out before sanitizing (from data-inline-math, else the KaTeX tex annotation) and puts back a fresh KaTeX render afterwards. The embedded markup is generated from the source, never taken from the document. Images and CSS url() values in rich text, which the sanitizer removes, are inventoried first and reported as unresolved media so the partial-export warning counts them instead of losing them silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): rebuild inline formulas through the DOM, not string markers Rework the standalone export's rich-text pass so authored text is never spliced into strings: - Parse each prose string with the DOM. Inventory resources over the whole tree first, formula subtrees included: image src and srcset, media sources, and CSS url(), image-set() and @import references found by a real CSS parse (comments, quoted URLs and escapes respected). - Replace each inline formula with an empty span whose data-inline-math is set through setAttribute, then run the persistence sanitizer with an export-only option that keeps that one attribute on span. The default persistence policy is unchanged. - Parse the sanitized output and replace each such span with a fresh KaTeX render of the source read back with getAttribute. Generated KaTeX is the only markup added after sanitizing. Tests cover replacement patterns in LaTeX, marker-like and encoded text, resources inside formula wrappers, quoted URLs with parentheses, srcset, escaped url() and commented-out URLs. The export tests now run under jsdom, where the browser DOM the export relies on is available. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): make the rich-text resource inventory spec-correct and fail-safe - Decode CSS escapes per CSS Syntax: zero, surrogates and values above U+10FFFF become U+FFFD instead of throwing, and an escaped newline is a line continuation. - Never let the inventory affect the export: each element is scanned under its own guard and the whole pass is guarded, so a failure can only under-report. - Scan and strip formulas inside template contents, nested ones included, which querySelectorAll does not reach. - Document that the inventory is best-effort and only drives the partial-export warning; the sanitizer and the CSP remove and block these resources regardless. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): bound the public-classroom lookup in the HTML export Every HTML export awaited the stage-meta request for the optional PBL "continue online" link, so a request that never settled left the export stuck in its busy state with no download. The lookup now gives up after 3000 ms: the request is aborted through the fetch it is given, and a race returns even when the response body never finishes. On timeout or failure the link is omitted and the export continues. Courses without a PBL scene skip the lookup entirely. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): always link PBL scenes to the online classroom A classroom is readable by anyone holding its link; the published flag does not gate reading. Gating the PBL "Continue this project online" link on it hid a link that works. The export now always builds the link from the exporting origin and the stage id, with no stage-meta request, so there is nothing to wait on. The explicit classroomUrl option for hosts and the player's http(s)-only guard stay. This replaces the bounded lookup and its timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): render standalone-player charts without entry animation Line series animate in by growing an SVG clipPath from zero width. WebKit does not repaint the clipped group when the clip path's geometry changes afterwards, so in Safari the exported file showed a line chart's points and labels without the connecting line. Re-setting the clip path (or the clip-path attribute) makes the line appear, which confirms the stale paint. The charts runtime the export ships now wraps ECharts init so every chart renders without its entry animation; the clip path is created at its final size. The shared renderer and the online classroom are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
d89f2bd758 |
fix(export): drop the publish hint and status lookup from PPTX placeholders (#1819)
Placeholder slides told viewers to publish the classroom so students
could open it by scanning, based on the stage-meta `isPublic` flag. That
flag does not gate reading: anyone with the link can open a classroom,
including signed-out guests, so the hint was misleading and the lookup
behind it was unnecessary.
- Remove the hint from placeholder slides and the `publishHint` string
from all locales.
- Remove the stage-meta request (and its timeout) from the PPTX export.
The online link is built synchronously as
<origin>/classroom/<id>?scene=<sceneId>; `useExportPPTX({ classroomOrigin })`
still overrides the origin, and a stage without an id still gets no
online link.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
||
|
wyucandClaude Opus 5.5
|
c70ded88f8 |
feat(export): keep interactive and quiz scenes in the PPTX as placeholder slides (#1811)
* feat(export): keep interactive and quiz scenes in the PPTX as placeholder slides The PPTX export (plain and inside the Resource Pack) now follows lesson order: each interactive and quiz scene gets a placeholder slide at its original position. PBL scenes stay out of the PPTX. - Interactive placeholders in the Resource Pack link to the matching interactive/NN_<title>.html page through a relative external link. The page path comes from one shared helper (listInteractivePages), so the link and the ZIP entry cannot drift. A standalone PPTX has no pack next to it, so it shows a hint instead of a dead link. - Quiz placeholders show the question count and the question stems, never options, answers or analysis. - Slide-to-slide links resolve through the final PPTX slide numbers, so inserted placeholders no longer shift link targets. - Placeholder slides carry the scene's narration as speaker notes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): address review of PPTX scene placeholders - Quiz placeholders no longer copy the scene's narration into speaker notes: quiz narration often explains the answers. Interactive placeholders keep their notes. - Exportability now follows the planned deck rather than the slide count. Lessons with only quiz and/or interactive scenes export a PPTX (plain and inside the Resource Pack) with fallback styling; a PBL-only lesson is still reported as empty. Every shipped HTML page now has a placeholder slide, so the "PPTX skipped" path and its message are gone. - Missing or blank scene titles no longer abort the export. Titles are normalized in one helper; an untitled page is saved as interactive/NN.html and its placeholder shows the scene-type label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(classroom): open a classroom at a scene with ?scene=<id> /classroom/<id>?scene=<sceneId> now opens the standalone classroom page at that scene. The parameter is applied right after the course loads, so the opening scene's media is hydrated first. Unknown scene ids are ignored and the page opens as before; the workspace pane does not read the parameter. Opening a link sets the cursor without marking it as an edit. Exported decks use these links to send viewers to a specific scene. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): link placeholder slides to the online classroom with a QR code Every interactive and quiz placeholder slide, in the standalone PPTX and in the Resource Pack PPTX, now carries: - an "Open online" button linking to the scene in the online classroom (<origin>/classroom/<id>?scene=<sceneId>); - a QR code of the same URL, dark on white with a 4-module quiet zone, about a fifth of the slide width, with the URL printed under it; - when the classroom is not public, a hint to publish it so students can open it by scanning. The origin defaults to the exporting page's own origin and can be overridden through useExportPPTX({ classroomOrigin }). Public status comes from the stage-meta endpoint; unreadable metadata counts as not public. Resource Pack interactive placeholders keep the relative link to the offline HTML page as a smaller secondary link. The standalone PPTX no longer shows the "export the Resource Pack" hint. QR matrices come from uqr (MIT, no dependencies), loaded with a dynamic import on the export path only. The PNG is written by a small 1-bit encoder, so no canvas is needed and the same code runs in Node tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): bound the classroom status lookup during PPTX export The export waited on /api/stage-meta with no limit, so a stalled request kept the export (and its guard) locked, even for lessons without any placeholder slide. - The lookup now gives up after 3 seconds: the request is aborted and the classroom counts as not public, as with unreadable metadata. - Lessons with no quiz or interactive placeholder skip the request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): make placeholder links clickable in WPS slideshows WPS follows a link on an uncovered shape but ignores one on a shape that a text box covers, so clicking the "Open online" button advanced the slideshow instead of opening the classroom. Each link on a placeholder slide now also gets a top-most, text-less, fully transparent hotspot with the same hyperlink: over the "Open online" button, over the QR code together with the URL under it, and over the Resource Pack's "Open offline copy" line. The fill is transparent rather than absent, since some viewers only hit-test the outline of an unfilled shape. The visible elements keep their own links and the rendered slides are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
deb2491353 |
fix(sanitize): reject CSS escape sequences in inline style values (#1815)
The inline style value check matches its blocked tokens (url(, expression(, @, script schemes) literally, so a value spelled with CSS escapes such as `u\72l(` or `\65xpression(` did not match it. Reject any value containing a backslash. The editor schemas, the PPTX importer and KaTeX never emit escaped CSS in inline styles, so stored content is unaffected; the rest of the style policy is unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
e79d00c92b |
fix(agent): fence user-authored skill content with an unforgeable end marker (#1816)
User-authored skill content reached the model with only a prose preamble and no end marker, so a body could write a fake end-of-block heading and follow it with text styled as system instructions. The body is not always the user's own prose: the agent can draft a skill from a fetched page or an uploaded material, so this is an indirect prompt injection surface. Enclose the body in a fence whose tag is derived from the body itself (first 128 bits of its SHA-256, with a postcondition check and a deterministic re-derivation on collision). The tag is deterministic rather than a per-call nonce because the virtual SKILL.md hash decides read coverage and the text lands in cached prompt prefixes; an unchanged body must wrap byte-identically. A closing </skill> in the body is made inert so it cannot close the outer skill invocation envelope while the fence is still open. The existing preamble wording is kept verbatim. Title and description were already structurally bounded (JSON-escaped frontmatter, XML-escaped discovery block); the new tests pin that too. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
06b61cd414 |
docs(changelog): add the 1.1.3 security release (#1804)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
ccdc88a5ad |
fix(pi): reject the verified malformed reference snapshots with 400 (#1752)
* fix(pi): reject the verified malformed reference snapshots with 400 Forged reference snapshots could still crash the resolver with an ordinary TypeError and return HTTP 500 before model resolution: table data, rows, cells, colWidths or rowHeights of the wrong shape, code lines of the wrong shape, and, for slide references, a null scenes member or a selected scene without content or canvas. Reject exactly these shapes through the existing ElementReferenceValidationError path, where lookup and projection read them. Optional fields keep their tolerance, and unexpected resolver exceptions still return 500. Refs #1711 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pi): keep previously resolved reference shapes resolving Cross-review found that the first version also rejected shapes outside the #1711 list that used to resolve with 200: a table row `{}` and a non-object `scenes` member. Checking further, string `colWidths`, `rowHeights` and code `lines` changed from 200 to 400 in the same way. Narrow each check to the precondition of the operation that threw for a listed shape, and pin the previously resolved shapes with acceptance regressions. Drop the shared object helper so #1682's element check is unchanged. Refs #1711 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
a3c17b6116 |
feat(generation): host hooks for server-side generation runs (#1807)
* refactor(server): share the host hook registration checks Move the misspelled-hook detection, the "did you mean" hint and the bound-once hook reads out of the persistence hooks registry into lib/server/host-hook-registration.ts, so another host hook registry can validate its registrations the same way. No behavior change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(generation): host hooks for server-side generation runs Add configureGenerationRunHooks, registered once from instrumentation.ts register() like the persistence hooks, for a host that meters usage, enforces a quota or keeps an audit trail around course generation: - authorizeStart: admits or refuses a start on POST /api/generation-runs and POST /api/generate-classroom, after every built-in check, inside the create transaction; a refusal answers with the host's status, code, message and headers, and no run is created. Attributes it returns are stored on the run (generation-runs migration 5, host_attributes JSONB). - wrapExecution: runs every claimed execution of a run (first claim, takeover, the claim after a Retry or an outline confirmation, media-only executions) and each background material extraction inside the host's context, with the run's stored attributes. A wrapper that refuses pauses the run at its step (Retry resumes it) or fails the extraction. - classifyFailure: maps a host error to a stable code and says whether an automatic retry is worthwhile; consulted before the step retries, the outline stream's retries, the model fallback, media failures and extraction failures. A non-retryable host failure pauses the run at the step; the AI SDK's own retries of a retryable provider status stop at it too (callLLM and streamLLM put every model they hand the SDK, v2 or v3, and any model a prepareStep picks, behind a gate that raises it again as not retryable; frozen models included), callLLM's own retries stop at it and throw it rather than an earlier invalid result, and an outline stream that fails with it is not accepted on its partial outlines. - onRunEvent: best-effort notifications after committed transitions (started, outline-ready, scene-appended, paused, completed, ended), in commit order within a process, each with the stored ownerId and the currentOwnerId the run was claimed into since (looked up for at most 5 s; at most 1000 notifications queue per process, newer ones dropped with a counted warning); never awaited, and a failing listener never affects the run. With nothing registered every path behaves as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
7230053af0 |
test(boot): keep register() from starting real background workers (#1803)
The boot tests call instrumentation's register(), which starts the generation runner, the owner material extractor, the legacy classroom import and the instance secret check against a database the tests never provide. Those keep polling and logging after the file's tests end. With resolveAssetPendingTtlMs mocked to undefined, the runner's keep-alive interval is NaN and fires every millisecond. A log that arrives while Vitest closes the worker fails the run with "Closing rpc while onUserConsoleLog was pending", even though every test passed. The push CI run of the 1.2.0-rc.1 release commit failed this way and held back the @openmaic/storage publish until both were re-run. Mock the four background starters in the five boot test files, as access-code-startup already did for the instance secret check. Claude-Session: https://claude.ai/code/session_01X463rEcf2cJD4MapZ2xo3A Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
636fab0d7e |
release: OpenMAIC 1.2.0-rc.1 (server-first) (#1794)
* ci: run CI for the provider-config integration branch
Development of the provider configuration RFC (#1701) lands on
integration/provider-config; build it on push and run CI for pull
requests into it, as with earlier integration branches.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): capability slot registry and stage-to-slot mapping (#1726)
* feat(config): capability slot registry and stage-to-slot mapping
First P0 step of the provider configuration RFC (#1701, tracked in
#1725): define the capability slot forest and map every LLM stage key
to exactly one slot. Pure data with no callers yet, so there is no
behavior change.
Requirements are checked on the slot that declares them and are not
passed down to child slots, so agent.title can use a model without
tool calling even though agent requires it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin every stage destination and the capability roots
Review found that the station and root assertions derived their
expectations from the module under test: re-pointing a single-stage
station or dropping a capability root still passed. The tests now
compare against an independently written stage table and root list,
and pin agent.title as config-only. Also document that browserless
outlines still run on the generate-classroom model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin slotForStage and full slot lineages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): provider presets and the openmaic.yml schema (#1727)
* feat(config): provider presets and the openmaic.yml schema
Second P0 step of the provider configuration RFC (#1701, tracked in
#1725).
- lib/config/provider-presets.ts: one preset per built-in registry
entry, plus the token plans as multi-capability presets whose stage
recommendations become slot recommendations. Registry ids that
collide across capabilities get explicit preset ids.
- lib/server/model-config/openmaic-yml.ts: parse and validate the
operator's openmaic.yml (or the file named by OPENMAIC_CONFIG):
${VAR} interpolation, strict schema, and cross-checks that every
assignment names a declared provider whose preset offers the slot's
capability. Every problem is reported with its path.
- instrumentation.ts: an invalid file refuses to start. Without a file
nothing changes, and nothing resolves models through the file yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): harden openmaic.yml validation after review
- Look providers up by own key only, so "constructor:m" is not taken
for a declared provider.
- Refuse non-mapping objects YAML produces (an unquoted timestamp
becomes a Date that the schema would accept as an empty object), and
refuse a YAML alias that refers back to itself instead of overflowing
the stack.
- Accept lowercase variable names; refuse a "${" with no closing
brace, checked on the text as written, never on substituted secrets.
- Cross-check the entries that are valid on their own even when the
schema rejects others, so every problem is reported at once without
duplicate errors for declared-but-invalid providers.
- Name the three valid assignment shapes when a value has none of them.
- Test the boot path: an invalid file exits with code 1 before any
schedule starts; a valid one boots.
- Ignore a root openmaic.yml in git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep secrets out of openmaic.yml diagnostics
Review round 2:
- Read only variables the environment itself has, as non-empty
strings: ${constructor} or an inherited value is not a variable.
- Never print a value that came from ${VAR}, and report YAML syntax
errors by reason and position without js-yaml's source excerpt,
which can quote a literal key.
- Keep the base URL requirement on presets: SearXNG from its registry
entry, and Azure OpenAI and self-hosted MinerU, which have no usable
default endpoint.
- Check slot names and valid model references even inside an entry
that fails the schema, and report a failed placeholder once rather
than again as an empty value.
- Boot test for the no-file case.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* refactor(config): validate openmaic.yml in two phases
Rounds 1-3 of review kept finding edge cases in one feature: running
the cross-checks on the half-valid parts of a file the schema had
rejected, so that every problem showed at once. It hid problems inside
a rejected entry, lost a __proto__ slot key, and built misleading
provider errors from failed placeholders. That feature is gone.
Validation now runs in two phases. Phase 1 is the document itself:
placeholders, key names (checked on the document as written, since the
schema drops a __proto__ key), and the schema. Any problem there stops
before phase 2, the references between entries, which therefore only
ever sees a fully valid file. Each phase reports all of its problems,
one per path.
YAML syntax errors now report only their position: js-yaml's reason
can quote source text too (an alias or tag name), not just its excerpt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(api)!: generate-classroom takes requirement + uploaded materials; capabilities follow server config (#1728)
Narrows POST /api/generate-classroom to { requirement, materialIds? }; capabilities follow server configuration; materials go through the owner material library (upload, reference by id, delete); new GET /api/generate-classroom/capabilities; skill docs updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve a slot through the configuration layers (#1729)
* feat(config): resolve a slot through the configuration layers
Third P0 step of the provider configuration RFC (#1701, tracked in
#1725). resolveSlot walks from a slot to its capability root and
returns the first assignment it meets, consulting the deployment layer
(openmaic.yml, locked) before the workspace layer at every node. An
explicit null disables the subtree; nothing assigned up to the root is
unassigned, with no fallback to any vendor. The result carries the
provider, preset, registry entry, effective base URL, key, model, call
options, fallback, where it was resolved and whether it is locked, and
the requested slot's own requirements checked against the model
catalogue (met, unmet or unknown).
Pure and uncalled for now, so there is no behavior change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): lock only written slots and trust the catalogue only where it applies
Review round 1:
- locked now means the requested slot itself is written in the
deployment layer. Inheriting a deployment value does not lock a slot,
since the workspace may still assign it (source and resolvedAt still
report where the value came from).
- A custom OpenAI-compatible endpoint borrows the OpenAI registry for
transport only, so its preset no longer trusts that model catalogue:
requirements there resolve to unknown.
- The fallback is checked against the slot's requirements too, and the
result exposes fallbackRequirements so retries can refuse it.
- A malformed reference fails with a path-qualified SlotResolutionError
that does not echo the value, which is often a misplaced key.
- Requirement tests use named catalogue models instead of picking one
from the catalogue at run time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): order layers deployment-first and keep references out of errors
Review round 2:
- resolveSlot no longer depends on the order its caller passes the
layers in: deployment layers always come first, for assignments and
provider lookup alike.
- Resolution errors name the path and the preset, never a value taken
from the reference, so a key pasted into the provider position does
not end up in a log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): cover catalogue aliases and fallback capability errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(classroom)!: save server-generated classrooms through server persistence (#1730)
Server-side classroom generation saves the finished course create-only into the request owner's library with media in the owner's asset pool; jobs move to PostgreSQL with owner-scoped polling; /api/classroom is removed; legacy data/classrooms files are imported once in the background. Adds @openmaic/storage 0.36.0 PgAssetStore.releasePending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): translate the legacy configuration into a deployment layer (#1731)
* feat(config): translate the legacy configuration into a deployment layer
Deployments without openmaic.yml keep working: provider variables,
server-providers.yml, DEFAULT_MODEL, MODEL_ROUTES and MODEL_FALLBACK are
translated into the openmaic.yml shape and serve as the deployment layer
for resolveSlot.
- Providers: each configured entry becomes a provider under its preset
id; force-disabled entries are left out; AliDocMind's key pair goes
into credentials.
- DEFAULT_MODEL goes on the llm root. Every other slot that serves stages
gets what those stages used before (their route, or else the default
model), written only where inheritance would give something else, so
an unrouted stage under a routed parent stays on the default model.
- Stages that now share a slot but had different routes, models whose
provider has no server configuration, and stages that used the
browser's model but would now inherit a server one become startup
notices, never failures.
- MODEL_FALLBACK attaches to every chat assignment without its own.
- When openmaic.yml exists it wins, with a notice if legacy variables
are also set.
Nothing reads the layer yet; routes switch over in P1 (#1725).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): follow the agent driver's rules and keep notices value-free
Review round 1:
- The agent never used DEFAULT_MODEL: it needs a valid maic-agent-driver
route and is off otherwise, so the translation writes agent: null where
it would inherit a server model (and a notice for a route that does
not work today). Unrouted conversation titles reuse the driver's model
with thinking off, as the title generator does.
- Notices name registry ids only; a credential pasted into a model
variable is never repeated.
- Provider entries and route options are checked against the new schema
and left out with a notice (field names only) instead of producing a
file that would not parse; driver-only options are dropped elsewhere.
- A route with its own fallback never falls back to MODEL_FALLBACK, even
when that fallback cannot carry over; the retry model is part of the
comparison with the inherited value.
- Force-off switches without a configured entry are reported, a legacy
configuration made only of them is detected, and translating one adds
a deprecation notice.
- loadDeploymentLayer reads the process environment and working
directory like the legacy loaders, instead of taking parameters it
could only partly honor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): compare routes by behavior, validate references, name only known ids
Review round 2:
- Stages sharing a slot are compared by what the route changes for them
(model, thinking, fallback), with bare ids read as openai models and a
route to DEFAULT_MODEL counted as no route; api and contextWindow are
inert outside the driver.
- A model reference carries over only when it names a provider from the
providers section and forms a valid reference.
- Section keys and force-off ids are named in notices only when they are
registry ids with a preset.
- Retries now follow the slot; where a call site picked its retry model
by another label (scene types under scene-content, browserless
generation), the change is reported.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): chat references need a chat entry; one notice for retries
Review round 3:
- A model reference carries over only when its provider was translated
from the providers section, not merely declared by another section
under the same id.
- Routes are compared by the retry model that takes effect, so leaving
out a fallback equals repeating MODEL_FALLBACK.
- The per-call-site retry notices kept missing cases (streaming and
calls outside server-managed routing never retry today). They are
replaced by one notice, given whenever a retry model is configured,
that retries now follow the slot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(config)!: translate only providers and the default model (#1732)
* refactor(config)!: translate only providers and the default model
MODEL_ROUTES does not map one to one onto slots: several stages share a
slot, the agent driver and conversation titles have rules of their own,
and retries are picked by call-site labels. Emulating that took most of
the translation and still ended in notices that are easy to miss.
The translation now carries over only the unambiguous part: providers,
DEFAULT_MODEL as the llm root and MODEL_FALLBACK as its fallback (the
agent stays null, as it never used DEFAULT_MODEL). A deployment that
sets MODEL_ROUTES without openmaic.yml gets LegacyRoutesError asking it
to write the per-stage models as slots. loadDeploymentLayer is not wired
into startup yet; that happens when routes switch to resolveSlot (P1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): say what a dropped MODEL_FALLBACK loses
Without DEFAULT_MODEL there is no assignment to hold MODEL_FALLBACK, and
calls that retried on it (server providers picked in the browser) stop
retrying; the notice says so. thinkingSchema is module-private again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(persistence): workspace model configuration with keys encrypted at rest (#1733)
* feat(persistence): workspace model configuration with keys encrypted at rest
The store behind the web settings of RFC #1701 (#1725, P1): one row per
workspace (owner) in workspace_model_config, the same shape as
openmaic.yml without policy.
- Provider secrets (apiKey, credentials) are sealed per provider with
AES-256-GCM under OPENMAIC_SECRET_KEY, bound to the provider id, and
never stored in the config column. Without the variable, a secret is
created once in data/instance-secret.key (the Docker volume).
- A secret sealed under another instance secret is reported as
unreadable ("enter again"), and a save that brings no new secret for
that provider keeps it, so a misconfigured secret cannot destroy keys.
- Saves replace the document with a compare-and-swap on the revision,
after the owner's identity lock; two concurrent first saves cannot
both land (PostgreSQL contract test).
- A claim moves the anonymous configuration to the account unless the
account has its own (core participant, order 900).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): publish the instance secret atomically; force the races in tests
Review round 1:
- The generated secret is written and flushed under a private name,
then published with an exclusive link, so no process can read it half
written and exactly one of two starting processes creates it. A file
that is not a complete generated secret (empty, truncated) is refused
instead of deriving a key anyone could compute.
- The PostgreSQL test holds both first saves at their insert until both
have read the missing row, and holds the row lock for the update case
until both saves queue behind it (checked by backend pid, not by any
lock waiter in the database).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): verify the written secret; require full GCM tags
Review round 2:
- The generated secret is written in full, read back and checked before
it is published; the temporary file is removed on any failure.
- Sealed values open only with a 12-byte IV and a full 16-byte tag
(authTagLength), so a shortened tag cannot weaken authentication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve slots at request time over deployment, workspace and defaults (#1734)
* feat(config): resolve slots at request time over deployment, workspace and defaults
The runtime half of RFC #1701 resolution (#1725, P1):
- deploymentConfig(): the deployment layer, loaded once per process.
The legacy translation now splits into the deployment's providers and
a separate default layer (DEFAULT_MODEL, MODEL_FALLBACK) that locks
nothing and ranks below the workspace, as DEFAULT_MODEL ranked below
the model a user picked.
- workspaceLayer(owner) reads the web settings; requestWorkspaceId(req)
names the request's owner (none for an owner minted by the request).
- lookupSlot walks deployment and workspace over the whole tree first;
the defaults are a second walk, so a default on a child never outranks
a workspace choice higher up.
- resolveStageModel builds the language model: the configured slot, else
what the request still names the old way (deprecated), else the
defaults, else a loud error; a slot turned off fails whatever the
request names. A workspace provider's endpoint is checked like a
caller-supplied one and gets the transport that refuses redirects.
- resolveSlot gains the default source, and reports which layer declared
the provider, its proxy and credentials.
Nothing calls it yet; call sites switch next.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep request identity and workspace endpoints inside their bounds
Review round 1:
- A refused owner credential throws InvalidOwnerCredentialError (401)
instead of resolving with the deployment's models and keys.
- A retired request owner gets no workspace: canonicalizing it would
hand an old anonymous cookie the claiming account's settings. Only
background work, which names a stored owner, is forwarded.
- A workspace provider may not be Amazon Bedrock (which falls back to
the server's AWS credential chain) or set a proxy (which routes around
the checked, redirect-refusing transport); the deployment still may.
- Test seams for the deployment config and the workspace loader, and
tests for identity, forwarding and caching.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): read only the named owner's settings; refuse unmet requirements
Review round 2:
- workspaceLayer reads exactly the owner it is given. Forwarding through
a claim let a request whose owner was claimed between its check and the
read see the account's settings; background work passes the owner it
works for now instead.
- A model the catalogue says does not meet the slot's requirement is
refused before anything is built (SlotRequirementError), without
consulting the request.
- Tests: a database failure fails the call without falling back, a
workspace provider without a key never gets the deployment's, and the
transport each provider source gets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(identity): exempt the model settings lookup from cookie forwarding
requestWorkspaceId resolves the owner only to pick whose model settings a
generation call uses, and returns no response of its own, like the
vision prompt helper already listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config)!: resolve every LLM call through its capability slot (#1735)
* feat(config)!: resolve every LLM call through its capability slot
The LLM call sites of RFC #1701 switch to slot resolution (#1725, P1):
- resolveModel resolves a stage through its slot for the request's or
job's workspace: the deployment and workspace configuration first; the
model and key a request names (x-model, x-model-routes, body fields)
only for a slot left unassigned, deprecated; then the defaults an
older deployment set with DEFAULT_MODEL. Routes that read headers get
this through resolveModelFromRequest; the chat routes pass their
workspace; background work (agent runs, titles, generation jobs)
passes the owner it works for now.
- Retries follow the slot: a slot-resolved model carries its slot's
fallback (lib/ai/model-fallbacks.ts), which callLLM and the outline
stream use; only a model from the request path still retries on
MODEL_FALLBACK. A fallback that cannot meet the slot is not used.
- The agent driver resolves the agent slot: tool calling required,
api defaults to openai-completions, thinking.effort still refused.
Conversation titles resolve agent.title with thinking off unless the
title slot sets it.
- /api/generate-classroom resolves each step through its slot for the
job's owner, its outline through course.outline.
- MODEL_ROUTES is gone: loadDeploymentLayer runs at startup and a server
that still sets it without openmaic.yml refuses to start. The
pbl-chat and maic-agent stage keys, which nothing resolved, are removed.
BREAKING CHANGE: MODEL_ROUTES is no longer read; write per-stage models
as slots in openmaic.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): a slot fallback needs no serverManaged stamp; follow claims per stage
Review round 1:
- callLLM arms a model's attached slot fallback whether or not the caller
passes serverManaged (the PBL agents pass none); the stamp still gates
MODEL_FALLBACK on the request path.
- /api/generate-classroom resolves the owner the job works for now at each
stage, so stages after a claim follow the moved settings.
Streaming calls (agent driver, classroom chat, PBL streams) still do not
retry on a fallback model, as before this change; that is the #1725 item
on retries at every call site.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve media and tool capabilities through their slots (#1737)
* feat(config): a provider-only reference names the provider's default model
Search and document providers mostly have no model to pick, so a slot
may name just the provider (`webSearch: tavily`); the target then has no
modelId and the adapter uses its default. Chat slots still need
providerId:modelId, checked in openmaic.yml and at resolution.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): resolve media and tool capabilities through their slots
The capability routes and server paths of RFC #1701 (#1725, P1): text
to speech, speech recognition, images, video, web search and document
extraction resolve through their slots, like language models.
- lib/server/model-config/media.ts: the configured slot (deployment,
then workspace); else the provider a request names the old way
(deprecated); else the legacy defaults; else a loud error. A slot turned
off fails whatever the request names, and while the legacy
<CAP>_<VENDOR>_ENABLED=false switches are in effect a switched-off
provider stays off whoever assigns it. A workspace endpoint is checked
like a caller-supplied one and may not use a proxy.
- The legacy translation assigns the media roots the provider the server
picked when a request named none (first configured; web search by its
old priority; DEFAULT_IMAGE_PROVIDER for images), with the first pinned
model.
- Routes: /api/generate/{image,video,tts,voice}, /api/transcription,
/api/web-search, /api/parse-pdf and /api/extract-document. A TTS voice
applies only to the provider it was chosen for; voices register on the
tts slot's provider.
- Server paths: agent image and video generation, scene narration, the
voice catalog and registration, web search and fetch_url, material
extraction (the document slot's service, the asr slot for local
transcription), browserless classroom media, and the generation
capabilities reported by /api/health and the classroom capabilities
endpoint.
- A provider-only reference (`webSearch: tavily`) names the provider's
default model; chat slots still need providerId:modelId.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep slots authoritative on every media path
- Workspace providers reach media, search and document services only at
their preset's endpoints; a custom endpoint or proxy is deployment-only
(403 INVALID_URL).
- A configured or turned-off document slot decides the extraction service:
deprecated request fields may only pick a self-contained extractor, and
legacy operator credentials are no longer reached.
- Request paths resolve their own workspace without following a claim;
background extraction still does.
- A configured TTS slot keeps its own model; legacy pins apply only on the
deprecated and default paths.
- Local transcription and agent voice registration keep the connection's
network policy flags.
- The agent's web search forwards the whole resolved configuration.
- An unusable DEFAULT_IMAGE_PROVIDER leaves the image slot unassigned with a
notice instead of switching vendors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): public presets only for workspaces, plan default models
- A workspace preset whose default endpoint is on the server's own network
(self-hosted TTS, ASR, image) is deployment-only, and a workspace
provider's endpoint runs under the public-only policy.
- A provider-only reference to a token plan means the plan's own default
model for that capability.
- On the legacy default provider, the request's image, video and ASR model
still applies through its allowlist, and image/video without a model is
still MISSING_MODEL.
- An asr assignment a workspace may not use no longer blocks document
extraction, and a refused document service answers 403.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep legacy search and voice choices on their old paths
- Classroom search honours the provider and key a request names while the
webSearch slot is unassigned; only /api/web-search prefers the operator's
configured backend, as before.
- A TTS request's voice applies unless the request chose it for another
provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): legacy search model and capability discovery errors
- On the legacy default search provider, the request's search model still
applies through the server's pins.
- Capability discovery answers a refused credential (401) or a workspace
service it may not use (403) instead of 500.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): classroom submission refuses a workspace service with 403
A classroom submission whose materials would go to a document or speech
service the workspace may not use answers 403 INVALID_URL instead of 500, and
its material check resolves the request's own workspace without following a
claim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): workspace image and video providers run public-only
A workspace-configured image or video provider now uses the strict public
transport for its requests and for the redirects its clip download follows,
whatever ALLOW_LOCAL_NETWORKS says; the operator's own providers and the
deprecated per-request path keep their policies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* Revert "fix(config): workspace image and video providers run public-only"
This reverts commit
v1.2.0-rc.1
@openmaic/storage@0.37.1
|
||
|
UOYABAYOUandwyuc
|
6bfdfa989e |
fix(quiz): reject duplicate option values during generation (#1713)
* fix: reject duplicate quiz option values * fix: guard quiz rendering against malformed content * fix(quiz): internationalize invalid content warning * test(quiz): cover malformed playback content * chore(generation): bump package version * fix(quiz): address maintainer review --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>@openmaic/generation@0.3.15 |
||
|
|
c8e4b2fa2a |
fix(playback): end an armed reference picker on whiteboard transitions (#1738)
An armed element-reference picker survived the whiteboard opening or closing and silently moved to the other surface. Only a manual open cancelled it; a manual close, a Teacher wb_open/wb_close, or a runtime visibility change left it armed on the destination surface. Cancel an armed picker whenever whiteboardOpen changes, whatever triggered it, and keep an already-selected reference draft. This replaces the open-only special case in the whiteboard toggle. Refs #1711 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
764d91e669 |
fix(export): export tables that have no outline to PPTX (#1797)
The PPTX table branch read `el.outline.width` without a guard, so a slide table stored without an `outline` threw a TypeError and failed the whole PPTX (and resource pack) export with a generic "export failed" toast. The slide renderer already treats the outline as optional; the exporter now does too and simply omits the border. Claude-Session: https://claude.ai/code/session_01H5k2jng7f8wbobbMX8Tdwx Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
5312c2b4b4 |
feat(config): openmaic.yml, capability slots and server-side model configuration (RFC #1701) (#1765)
* ci: run CI for the provider-config integration branch
Development of the provider configuration RFC (#1701) lands on
integration/provider-config; build it on push and run CI for pull
requests into it, as with earlier integration branches.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): capability slot registry and stage-to-slot mapping (#1726)
* feat(config): capability slot registry and stage-to-slot mapping
First P0 step of the provider configuration RFC (#1701, tracked in
#1725): define the capability slot forest and map every LLM stage key
to exactly one slot. Pure data with no callers yet, so there is no
behavior change.
Requirements are checked on the slot that declares them and are not
passed down to child slots, so agent.title can use a model without
tool calling even though agent requires it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin every stage destination and the capability roots
Review found that the station and root assertions derived their
expectations from the module under test: re-pointing a single-stage
station or dropping a capability root still passed. The tests now
compare against an independently written stage table and root list,
and pin agent.title as config-only. Also document that browserless
outlines still run on the generate-classroom model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin slotForStage and full slot lineages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): provider presets and the openmaic.yml schema (#1727)
* feat(config): provider presets and the openmaic.yml schema
Second P0 step of the provider configuration RFC (#1701, tracked in
#1725).
- lib/config/provider-presets.ts: one preset per built-in registry
entry, plus the token plans as multi-capability presets whose stage
recommendations become slot recommendations. Registry ids that
collide across capabilities get explicit preset ids.
- lib/server/model-config/openmaic-yml.ts: parse and validate the
operator's openmaic.yml (or the file named by OPENMAIC_CONFIG):
${VAR} interpolation, strict schema, and cross-checks that every
assignment names a declared provider whose preset offers the slot's
capability. Every problem is reported with its path.
- instrumentation.ts: an invalid file refuses to start. Without a file
nothing changes, and nothing resolves models through the file yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): harden openmaic.yml validation after review
- Look providers up by own key only, so "constructor:m" is not taken
for a declared provider.
- Refuse non-mapping objects YAML produces (an unquoted timestamp
becomes a Date that the schema would accept as an empty object), and
refuse a YAML alias that refers back to itself instead of overflowing
the stack.
- Accept lowercase variable names; refuse a "${" with no closing
brace, checked on the text as written, never on substituted secrets.
- Cross-check the entries that are valid on their own even when the
schema rejects others, so every problem is reported at once without
duplicate errors for declared-but-invalid providers.
- Name the three valid assignment shapes when a value has none of them.
- Test the boot path: an invalid file exits with code 1 before any
schedule starts; a valid one boots.
- Ignore a root openmaic.yml in git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep secrets out of openmaic.yml diagnostics
Review round 2:
- Read only variables the environment itself has, as non-empty
strings: ${constructor} or an inherited value is not a variable.
- Never print a value that came from ${VAR}, and report YAML syntax
errors by reason and position without js-yaml's source excerpt,
which can quote a literal key.
- Keep the base URL requirement on presets: SearXNG from its registry
entry, and Azure OpenAI and self-hosted MinerU, which have no usable
default endpoint.
- Check slot names and valid model references even inside an entry
that fails the schema, and report a failed placeholder once rather
than again as an empty value.
- Boot test for the no-file case.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* refactor(config): validate openmaic.yml in two phases
Rounds 1-3 of review kept finding edge cases in one feature: running
the cross-checks on the half-valid parts of a file the schema had
rejected, so that every problem showed at once. It hid problems inside
a rejected entry, lost a __proto__ slot key, and built misleading
provider errors from failed placeholders. That feature is gone.
Validation now runs in two phases. Phase 1 is the document itself:
placeholders, key names (checked on the document as written, since the
schema drops a __proto__ key), and the schema. Any problem there stops
before phase 2, the references between entries, which therefore only
ever sees a fully valid file. Each phase reports all of its problems,
one per path.
YAML syntax errors now report only their position: js-yaml's reason
can quote source text too (an alias or tag name), not just its excerpt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(api)!: generate-classroom takes requirement + uploaded materials; capabilities follow server config (#1728)
Narrows POST /api/generate-classroom to { requirement, materialIds? }; capabilities follow server configuration; materials go through the owner material library (upload, reference by id, delete); new GET /api/generate-classroom/capabilities; skill docs updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve a slot through the configuration layers (#1729)
* feat(config): resolve a slot through the configuration layers
Third P0 step of the provider configuration RFC (#1701, tracked in
#1725). resolveSlot walks from a slot to its capability root and
returns the first assignment it meets, consulting the deployment layer
(openmaic.yml, locked) before the workspace layer at every node. An
explicit null disables the subtree; nothing assigned up to the root is
unassigned, with no fallback to any vendor. The result carries the
provider, preset, registry entry, effective base URL, key, model, call
options, fallback, where it was resolved and whether it is locked, and
the requested slot's own requirements checked against the model
catalogue (met, unmet or unknown).
Pure and uncalled for now, so there is no behavior change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): lock only written slots and trust the catalogue only where it applies
Review round 1:
- locked now means the requested slot itself is written in the
deployment layer. Inheriting a deployment value does not lock a slot,
since the workspace may still assign it (source and resolvedAt still
report where the value came from).
- A custom OpenAI-compatible endpoint borrows the OpenAI registry for
transport only, so its preset no longer trusts that model catalogue:
requirements there resolve to unknown.
- The fallback is checked against the slot's requirements too, and the
result exposes fallbackRequirements so retries can refuse it.
- A malformed reference fails with a path-qualified SlotResolutionError
that does not echo the value, which is often a misplaced key.
- Requirement tests use named catalogue models instead of picking one
from the catalogue at run time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): order layers deployment-first and keep references out of errors
Review round 2:
- resolveSlot no longer depends on the order its caller passes the
layers in: deployment layers always come first, for assignments and
provider lookup alike.
- Resolution errors name the path and the preset, never a value taken
from the reference, so a key pasted into the provider position does
not end up in a log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): cover catalogue aliases and fallback capability errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(classroom)!: save server-generated classrooms through server persistence (#1730)
Server-side classroom generation saves the finished course create-only into the request owner's library with media in the owner's asset pool; jobs move to PostgreSQL with owner-scoped polling; /api/classroom is removed; legacy data/classrooms files are imported once in the background. Adds @openmaic/storage 0.36.0 PgAssetStore.releasePending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): translate the legacy configuration into a deployment layer (#1731)
* feat(config): translate the legacy configuration into a deployment layer
Deployments without openmaic.yml keep working: provider variables,
server-providers.yml, DEFAULT_MODEL, MODEL_ROUTES and MODEL_FALLBACK are
translated into the openmaic.yml shape and serve as the deployment layer
for resolveSlot.
- Providers: each configured entry becomes a provider under its preset
id; force-disabled entries are left out; AliDocMind's key pair goes
into credentials.
- DEFAULT_MODEL goes on the llm root. Every other slot that serves stages
gets what those stages used before (their route, or else the default
model), written only where inheritance would give something else, so
an unrouted stage under a routed parent stays on the default model.
- Stages that now share a slot but had different routes, models whose
provider has no server configuration, and stages that used the
browser's model but would now inherit a server one become startup
notices, never failures.
- MODEL_FALLBACK attaches to every chat assignment without its own.
- When openmaic.yml exists it wins, with a notice if legacy variables
are also set.
Nothing reads the layer yet; routes switch over in P1 (#1725).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): follow the agent driver's rules and keep notices value-free
Review round 1:
- The agent never used DEFAULT_MODEL: it needs a valid maic-agent-driver
route and is off otherwise, so the translation writes agent: null where
it would inherit a server model (and a notice for a route that does
not work today). Unrouted conversation titles reuse the driver's model
with thinking off, as the title generator does.
- Notices name registry ids only; a credential pasted into a model
variable is never repeated.
- Provider entries and route options are checked against the new schema
and left out with a notice (field names only) instead of producing a
file that would not parse; driver-only options are dropped elsewhere.
- A route with its own fallback never falls back to MODEL_FALLBACK, even
when that fallback cannot carry over; the retry model is part of the
comparison with the inherited value.
- Force-off switches without a configured entry are reported, a legacy
configuration made only of them is detected, and translating one adds
a deprecation notice.
- loadDeploymentLayer reads the process environment and working
directory like the legacy loaders, instead of taking parameters it
could only partly honor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): compare routes by behavior, validate references, name only known ids
Review round 2:
- Stages sharing a slot are compared by what the route changes for them
(model, thinking, fallback), with bare ids read as openai models and a
route to DEFAULT_MODEL counted as no route; api and contextWindow are
inert outside the driver.
- A model reference carries over only when it names a provider from the
providers section and forms a valid reference.
- Section keys and force-off ids are named in notices only when they are
registry ids with a preset.
- Retries now follow the slot; where a call site picked its retry model
by another label (scene types under scene-content, browserless
generation), the change is reported.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): chat references need a chat entry; one notice for retries
Review round 3:
- A model reference carries over only when its provider was translated
from the providers section, not merely declared by another section
under the same id.
- Routes are compared by the retry model that takes effect, so leaving
out a fallback equals repeating MODEL_FALLBACK.
- The per-call-site retry notices kept missing cases (streaming and
calls outside server-managed routing never retry today). They are
replaced by one notice, given whenever a retry model is configured,
that retries now follow the slot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(config)!: translate only providers and the default model (#1732)
* refactor(config)!: translate only providers and the default model
MODEL_ROUTES does not map one to one onto slots: several stages share a
slot, the agent driver and conversation titles have rules of their own,
and retries are picked by call-site labels. Emulating that took most of
the translation and still ended in notices that are easy to miss.
The translation now carries over only the unambiguous part: providers,
DEFAULT_MODEL as the llm root and MODEL_FALLBACK as its fallback (the
agent stays null, as it never used DEFAULT_MODEL). A deployment that
sets MODEL_ROUTES without openmaic.yml gets LegacyRoutesError asking it
to write the per-stage models as slots. loadDeploymentLayer is not wired
into startup yet; that happens when routes switch to resolveSlot (P1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): say what a dropped MODEL_FALLBACK loses
Without DEFAULT_MODEL there is no assignment to hold MODEL_FALLBACK, and
calls that retried on it (server providers picked in the browser) stop
retrying; the notice says so. thinkingSchema is module-private again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(persistence): workspace model configuration with keys encrypted at rest (#1733)
* feat(persistence): workspace model configuration with keys encrypted at rest
The store behind the web settings of RFC #1701 (#1725, P1): one row per
workspace (owner) in workspace_model_config, the same shape as
openmaic.yml without policy.
- Provider secrets (apiKey, credentials) are sealed per provider with
AES-256-GCM under OPENMAIC_SECRET_KEY, bound to the provider id, and
never stored in the config column. Without the variable, a secret is
created once in data/instance-secret.key (the Docker volume).
- A secret sealed under another instance secret is reported as
unreadable ("enter again"), and a save that brings no new secret for
that provider keeps it, so a misconfigured secret cannot destroy keys.
- Saves replace the document with a compare-and-swap on the revision,
after the owner's identity lock; two concurrent first saves cannot
both land (PostgreSQL contract test).
- A claim moves the anonymous configuration to the account unless the
account has its own (core participant, order 900).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): publish the instance secret atomically; force the races in tests
Review round 1:
- The generated secret is written and flushed under a private name,
then published with an exclusive link, so no process can read it half
written and exactly one of two starting processes creates it. A file
that is not a complete generated secret (empty, truncated) is refused
instead of deriving a key anyone could compute.
- The PostgreSQL test holds both first saves at their insert until both
have read the missing row, and holds the row lock for the update case
until both saves queue behind it (checked by backend pid, not by any
lock waiter in the database).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): verify the written secret; require full GCM tags
Review round 2:
- The generated secret is written in full, read back and checked before
it is published; the temporary file is removed on any failure.
- Sealed values open only with a 12-byte IV and a full 16-byte tag
(authTagLength), so a shortened tag cannot weaken authentication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve slots at request time over deployment, workspace and defaults (#1734)
* feat(config): resolve slots at request time over deployment, workspace and defaults
The runtime half of RFC #1701 resolution (#1725, P1):
- deploymentConfig(): the deployment layer, loaded once per process.
The legacy translation now splits into the deployment's providers and
a separate default layer (DEFAULT_MODEL, MODEL_FALLBACK) that locks
nothing and ranks below the workspace, as DEFAULT_MODEL ranked below
the model a user picked.
- workspaceLayer(owner) reads the web settings; requestWorkspaceId(req)
names the request's owner (none for an owner minted by the request).
- lookupSlot walks deployment and workspace over the whole tree first;
the defaults are a second walk, so a default on a child never outranks
a workspace choice higher up.
- resolveStageModel builds the language model: the configured slot, else
what the request still names the old way (deprecated), else the
defaults, else a loud error; a slot turned off fails whatever the
request names. A workspace provider's endpoint is checked like a
caller-supplied one and gets the transport that refuses redirects.
- resolveSlot gains the default source, and reports which layer declared
the provider, its proxy and credentials.
Nothing calls it yet; call sites switch next.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep request identity and workspace endpoints inside their bounds
Review round 1:
- A refused owner credential throws InvalidOwnerCredentialError (401)
instead of resolving with the deployment's models and keys.
- A retired request owner gets no workspace: canonicalizing it would
hand an old anonymous cookie the claiming account's settings. Only
background work, which names a stored owner, is forwarded.
- A workspace provider may not be Amazon Bedrock (which falls back to
the server's AWS credential chain) or set a proxy (which routes around
the checked, redirect-refusing transport); the deployment still may.
- Test seams for the deployment config and the workspace loader, and
tests for identity, forwarding and caching.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): read only the named owner's settings; refuse unmet requirements
Review round 2:
- workspaceLayer reads exactly the owner it is given. Forwarding through
a claim let a request whose owner was claimed between its check and the
read see the account's settings; background work passes the owner it
works for now instead.
- A model the catalogue says does not meet the slot's requirement is
refused before anything is built (SlotRequirementError), without
consulting the request.
- Tests: a database failure fails the call without falling back, a
workspace provider without a key never gets the deployment's, and the
transport each provider source gets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(identity): exempt the model settings lookup from cookie forwarding
requestWorkspaceId resolves the owner only to pick whose model settings a
generation call uses, and returns no response of its own, like the
vision prompt helper already listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config)!: resolve every LLM call through its capability slot (#1735)
* feat(config)!: resolve every LLM call through its capability slot
The LLM call sites of RFC #1701 switch to slot resolution (#1725, P1):
- resolveModel resolves a stage through its slot for the request's or
job's workspace: the deployment and workspace configuration first; the
model and key a request names (x-model, x-model-routes, body fields)
only for a slot left unassigned, deprecated; then the defaults an
older deployment set with DEFAULT_MODEL. Routes that read headers get
this through resolveModelFromRequest; the chat routes pass their
workspace; background work (agent runs, titles, generation jobs)
passes the owner it works for now.
- Retries follow the slot: a slot-resolved model carries its slot's
fallback (lib/ai/model-fallbacks.ts), which callLLM and the outline
stream use; only a model from the request path still retries on
MODEL_FALLBACK. A fallback that cannot meet the slot is not used.
- The agent driver resolves the agent slot: tool calling required,
api defaults to openai-completions, thinking.effort still refused.
Conversation titles resolve agent.title with thinking off unless the
title slot sets it.
- /api/generate-classroom resolves each step through its slot for the
job's owner, its outline through course.outline.
- MODEL_ROUTES is gone: loadDeploymentLayer runs at startup and a server
that still sets it without openmaic.yml refuses to start. The
pbl-chat and maic-agent stage keys, which nothing resolved, are removed.
BREAKING CHANGE: MODEL_ROUTES is no longer read; write per-stage models
as slots in openmaic.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): a slot fallback needs no serverManaged stamp; follow claims per stage
Review round 1:
- callLLM arms a model's attached slot fallback whether or not the caller
passes serverManaged (the PBL agents pass none); the stamp still gates
MODEL_FALLBACK on the request path.
- /api/generate-classroom resolves the owner the job works for now at each
stage, so stages after a claim follow the moved settings.
Streaming calls (agent driver, classroom chat, PBL streams) still do not
retry on a fallback model, as before this change; that is the #1725 item
on retries at every call site.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve media and tool capabilities through their slots (#1737)
* feat(config): a provider-only reference names the provider's default model
Search and document providers mostly have no model to pick, so a slot
may name just the provider (`webSearch: tavily`); the target then has no
modelId and the adapter uses its default. Chat slots still need
providerId:modelId, checked in openmaic.yml and at resolution.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): resolve media and tool capabilities through their slots
The capability routes and server paths of RFC #1701 (#1725, P1): text
to speech, speech recognition, images, video, web search and document
extraction resolve through their slots, like language models.
- lib/server/model-config/media.ts: the configured slot (deployment,
then workspace); else the provider a request names the old way
(deprecated); else the legacy defaults; else a loud error. A slot turned
off fails whatever the request names, and while the legacy
<CAP>_<VENDOR>_ENABLED=false switches are in effect a switched-off
provider stays off whoever assigns it. A workspace endpoint is checked
like a caller-supplied one and may not use a proxy.
- The legacy translation assigns the media roots the provider the server
picked when a request named none (first configured; web search by its
old priority; DEFAULT_IMAGE_PROVIDER for images), with the first pinned
model.
- Routes: /api/generate/{image,video,tts,voice}, /api/transcription,
/api/web-search, /api/parse-pdf and /api/extract-document. A TTS voice
applies only to the provider it was chosen for; voices register on the
tts slot's provider.
- Server paths: agent image and video generation, scene narration, the
voice catalog and registration, web search and fetch_url, material
extraction (the document slot's service, the asr slot for local
transcription), browserless classroom media, and the generation
capabilities reported by /api/health and the classroom capabilities
endpoint.
- A provider-only reference (`webSearch: tavily`) names the provider's
default model; chat slots still need providerId:modelId.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep slots authoritative on every media path
- Workspace providers reach media, search and document services only at
their preset's endpoints; a custom endpoint or proxy is deployment-only
(403 INVALID_URL).
- A configured or turned-off document slot decides the extraction service:
deprecated request fields may only pick a self-contained extractor, and
legacy operator credentials are no longer reached.
- Request paths resolve their own workspace without following a claim;
background extraction still does.
- A configured TTS slot keeps its own model; legacy pins apply only on the
deprecated and default paths.
- Local transcription and agent voice registration keep the connection's
network policy flags.
- The agent's web search forwards the whole resolved configuration.
- An unusable DEFAULT_IMAGE_PROVIDER leaves the image slot unassigned with a
notice instead of switching vendors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): public presets only for workspaces, plan default models
- A workspace preset whose default endpoint is on the server's own network
(self-hosted TTS, ASR, image) is deployment-only, and a workspace
provider's endpoint runs under the public-only policy.
- A provider-only reference to a token plan means the plan's own default
model for that capability.
- On the legacy default provider, the request's image, video and ASR model
still applies through its allowlist, and image/video without a model is
still MISSING_MODEL.
- An asr assignment a workspace may not use no longer blocks document
extraction, and a refused document service answers 403.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep legacy search and voice choices on their old paths
- Classroom search honours the provider and key a request names while the
webSearch slot is unassigned; only /api/web-search prefers the operator's
configured backend, as before.
- A TTS request's voice applies unless the request chose it for another
provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): legacy search model and capability discovery errors
- On the legacy default search provider, the request's search model still
applies through the server's pins.
- Capability discovery answers a refused credential (401) or a workspace
service it may not use (403) instead of 500.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): classroom submission refuses a workspace service with 403
A classroom submission whose materials would go to a document or speech
service the workspace may not use answers 403 INVALID_URL instead of 500, and
its material check resolves the request's own workspace without following a
claim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): workspace image and video providers run public-only
A workspace-configured image or video provider now uses the strict public
transport for its requests and for the redirects its clip download follows,
whatever ALLOW_LOCAL_NETWORKS says; the operator's own providers and the
deprecated per-request path keep their policies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* Revert "fix(config): workspace image and video providers run public-only"
This reverts commit
@openmaic/storage@0.36.0
|
||
|
MengMa-devandwyuc
|
c72a64b4b6 |
feat(tts): add Google Gemini TTS provider (Interactions API) (#1687)
* feat(tts): add Google Gemini TTS provider (Interactions API) Register google-tts with TTS_GOOGLE env, wrap 24 kHz PCM as WAV for classroom playback. * test(tts): cover Google Gemini Interactions TTS adapter Lock request shape, defaults, and PCM-to-WAV wrapping. * fix(tts): restore generateGoogleTTS and prettier format CI failed because the adapter function was missing from the switch target. * style(tts): format google-tts files with project Prettier config Previous format used Prettier defaults (double quotes) because the worktree lacked .prettierrc. * test(providers): allow google-tts env mapping in neutrality debt TTS_GOOGLE / google-tts add two google tokens to provider-config; bump temporary debt 2 → 4. * fix(tts): parse Gemini Interactions REST audio steps HTTP responses place PCM on steps[].content[], not the SDK output_audio field. The settings preview now includes /interactions and disables speed for this provider. * refactor(tts): read speed support from provider metadata Add an optional supportsSpeed capability to TTSProviderConfig and set it to false for google-tts. The settings speed control now reads that flag instead of checking the provider id, and the hint text is provider-neutral. --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
4320f986cf |
ci: list the live integration branches in the CI triggers (#1724)
* ci: stop triggering on the landed persistence integration branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * ci: list the live integration branches in the CI triggers Add integration/provider-config and integration/material-library to the push and pull_request branch lists, and drop the feat/maic-editor-v0 and feat/maic-editor-v1 entries, which no longer exist on the remote. Branches cut from main now inherit triggers for every open integration branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: leave integration/provider-config to its own branch It merges into main next, so main need not trigger on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Xinyu Mu
|
1635b16899 | docs: add multilingual vocational task engine guide (#1749) | ||
|
|
8f7d51e5ac |
fix(playback): replay sentence visual cues after navigation (#1720)
Co-authored-by: sophietao20-star <283060850+sophietao20-star@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
fa47efe1b3 |
feat(persistence)!: server-backed persistence only, with a one-way legacy browser import (#1710)
* ci: run CI for the persistence-default integration branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(docker): start PostgreSQL by default and add a single-user owner * feat(docker): start PostgreSQL by default and add a single-user owner `docker compose up` now runs a server-backed app against a bundled PostgreSQL, started only once PostgreSQL is healthy and published on 127.0.0.1 only, with a new built-in singleUser owner auth method: every request resolves to one fixed owner that may publish, and no anonymous cookie is minted. Single-user mode (OWNER_SINGLE_USER=true, OWNER_SINGLE_USER_ID default "local") runs with or without ACCESS_CODE. Without one, the server logs one prominent startup warning that anyone who can reach it shares, edits and can delete the single library; it never inspects request peers or forwarding headers. It excludes PERSISTENCE_SHARED_OWNER_ID and follows the sharedTeam registration rules. Its principal gets a claim candidate, so a browser's earlier anonymous work is claimed into the single owner (OWNER_CLAIM_TRIGGER=auto in the Compose defaults). Compose defaults live in docker-compose.defaults.env, read before .env.local so they can be overridden. The app warns when its declared published address (OPENMAIC_PUBLISH_ADDRESS, passed by Compose) is not loopback while PostgreSQL uses the default password. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(docker): keep claims explicit and let .env.local set DATABASE_URL - Compose no longer defaults OWNER_CLAIM_TRIGGER to auto: an irreversible merge of every browser's anonymous library into the single owner must not happen on upgrade. The single-user principal still gets a claim candidate, so POST /api/identity/claim works; the docs explain it and warn about auto on a deployment several people used. - The bundled DATABASE_URL moves to docker-compose.defaults.env, read before .env.local, so an external database or a rotated password set there keeps working. The password is inserted unencoded, so it must be letters and digits (documented). - Upgrade docs no longer claim browser-stored courses are copied as they are opened: they stay in the browser, are not deleted, and are moved by the automatic browser-to-server migration shipped with this work. - Single-user mode without ACCESS_CODE now logs one warning instead of two; the docs note that the single owner id is permanent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(persistence)!: server-backed persistence is the only persistence (#1707) * feat(persistence)!: make server-backed persistence the only persistence Courses, folders and folder membership, chat history and learner runtime, and generated media are now always stored on the server through the embedded /api/persistence endpoint. The browser keeps no durable data of its own. - Remove the build-time NEXT_PUBLIC_PERSISTENCE switch: the client bootstrap always configures the HTTP document, runtime and asset seams, and the Dockerfile, docker-compose.yml, the Pi route and the whiteboard runtime no longer read it. Unconfigured seams refuse to resolve instead of falling back to IndexedDB, and the learner key is always the server-derived one. - Remove the browser write paths: the browser document, runtime and asset stores as backends, the browser-mode branches of stage, folder, chat, media, narration and import storage, the Dexie backup export/import and the whole-database clear. The library lists through /api/stages, folders through /api/folders, and membership now goes through /api/folders/members. Regeneration always forks to a fresh asset. - Device-local state moves to its own IndexedDB database (lib/device-storage, maic-device-cache): the local media and narration cache and refused-bytes retention, staged PDF images, undo history, browser voice profiles (carried over once from the old database) and the auto-voice cache. "Clear Local Cache" clears exactly that and no longer claims to delete classrooms or chat history. - Keep the pre-server data readable for the one-way importer: the Dexie schema and read-only accessors for its tables and for the browser document, runtime and asset databases live in lib/legacy-browser-storage, which nothing on the regular paths reads and which has no write path. - Require a database: the server exits at boot without DATABASE_URL, with a message naming `pnpm db:up` and `docker compose up`. `pnpm db:up` / `pnpm db:down` start and stop the Compose postgres service alone, published on 127.0.0.1 through docker-compose.db.yml; .env.example carries the matching local DATABASE_URL. - E2E specs seed their courses through the persistence endpoint, each under a fresh id, instead of writing IndexedDB. - Guard tests pin the boot requirement, the absence of any NEXT_PUBLIC_PERSISTENCE read, and the legacy-storage boundary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: run the E2E suite against PostgreSQL The app refuses to start without DATABASE_URL, so the E2E job gets a postgres:16 service and a job-level DATABASE_URL. The unit, storage and render-service jobs are unchanged and need no database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: document always-on server persistence and the database requirement README (English and Chinese), the deployment guide in every locale, the extension cookbook and the changelog now describe PostgreSQL as required: `pnpm db:up` for local development, `docker compose up` for a deployment, and an external database for Vercel and other serverless hosts (the Deploy button prompts for DATABASE_URL). They list what stays in the browser, drop the NEXT_PUBLIC_PERSISTENCE instructions, and say that courses an earlier browser-only build stored stay in the browser until the one-way importer moves them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pbl): use the server-derived learner key for PBL v2 runtime PBL v2 synchronization, hydration and drain resolved the learner key from their default watermark KV store, which reads or mints a device key in localStorage instead of asking runtime configuration. The runtime store is the server one, which refuses any key but the owner's, so saving a course with a PBL v2 scene failed before the document write, and the minted key landed in the slot the one-way importer reads as the pre-server runtime partition. The learner key now comes from getLearnerKey(args.kv): the configured server-derived key, or an explicitly injected store. The default KV store still holds the drain watermarks and nothing else. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(persistence): pin that clearing the cache keeps legacy databases - Seed the four pre-server databases (MAIC-Database, maic-documents, maic-runtime, maic-asset-pool) with real rows, run Clear Local Cache, and assert every database and row survives; assert the device database name differs from every legacy name. - The legacy-module import rule now also catches relative static, side-effect, dynamic and require imports at any depth. - New rule: the runtime learner key is never read from a KV store the caller made up, only from configuration or an injected store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * build(dev-db): run the development database as its own Compose project `pnpm db:up` / `db:down` shared the checkout's default Compose project with `docker compose up`, so they recreated or stopped a running stack's database. docker-compose.db.yml now declares its own project (`openmaic-dev-db`), which gives the development database its own container and data volume; it no longer touches the stack, and the two do not share data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: start the development database before `pnpm dev` CONTRIBUTING, the getting-started guide in every locale and the startup modes reference now run `pnpm db:up` and set DATABASE_URL before `pnpm dev`. README, the deployment guides, the cookbook and the changelog describe `pnpm db:up` as a separate development database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(persistence): sharpen the legacy-storage and learner-key guards - The Clear Local Cache test closes its seeding connections to maic-documents and maic-runtime, so a regression deleting either fails on the assertion that names the database instead of by timeout. - The legacy-module and Dexie import rules accept comments inside import() / require(), so a webpackIgnore hint no longer hides one. - The learner-key rule also flags an injected-looking name that is bound to a default local store in the same file; its remaining limit is documented, with the behavioural PBL test as the guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * build(dev-db): pin the development database's Compose project `pnpm db:up` / `db:down` now pass `-p openmaic-dev-db`, which takes precedence over COMPOSE_PROJECT_NAME from the shell or a .env file; the file's `name:` alone could be overridden and point the scripts at a running stack's database. The compose test pins the flag. The docs (all locales) and the file header say the development database is shared by every checkout on the machine, and how to run a separate one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(persistence): import legacy browser data into the server, once (#1708) * refactor(persistence): prepare the seams the legacy browser importer uses - Legacy module: read-only accessors for the auto-voice cache, the course ids the old media and narration tables name, the pre-server learner key, and asset bytes from the browser asset pool. - Narration adoption exports its row ownership rule so the importer applies the same one to rows of the old database. - The quiz legacy migration is split into a non-deleting core (importLegacyQuizSnapshot) and the regular path, which still deletes the keys it migrated. - The lazy document migration exports its snapshot canonicalizer. - Clear Local Cache keeps the importer's per-owner ledgers, as it keeps the pre-server learner key. - A library-changed window event lets an open library list courses that arrive in the background. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * feat(persistence): import legacy browser data into the server, once On the first load after the upgrade, the client moves what earlier builds kept in this browser to the server, for the owner the server resolves: courses from the browser document store and the original tables (with chat, learner runtime, playback position, roster, folders and membership, pre-runtime quiz state), their media bytes through commitToPool and the existing write-back funnels, the bytes of server courses from earlier opt-in server builds that only the old tables hold, and device-only rows (failure records, refused bytes, auto-voice clips) into the device cache. It is automatic and silent, runs after the page is idle, never writes to a legacy store, and records every step in a per-owner ledger so it resumes after a crash and never imports twice. Runs are serialized across tabs with Web Locks. A course the owner already has stays authoritative; one whose id another owner holds is imported under a derived fresh id; one the owner deleted on the server stays deleted. Transient failures retry on a later load with backoff; permanent ones are recorded per item. The module is temporary and self-contained; its README lists the removal steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): pin that each owner keeps its own import ledger Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): run the legacy import against the app routes and a browser A PostgreSQL suite routes every request the importer and the app seams send to the real persistence, library and folder handlers, owner resolved from the anonymous cookie: a full import, a course another owner holds, a course the owner deleted, and an existing course whose media is filled in. An end-to-end spec seeds an old pre-server database in Chromium, loads the app, and checks that the course reaches the library with its narration uploaded, stays in the browser untouched, and is visible from a fresh browser context with the same owner cookie. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs: describe the one-way import of legacy browser data The README (and its Chinese version), the deployment guide in every locale and the changelog now say what the importer does instead of announcing it: courses an earlier browser-only build kept in the browser move to the server automatically on the first load after the upgrade, and the browser copy stays untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): probe server assets through the shared asset-URL owner The importer asked the pool directly whether an id exists, which the asset-URL ownership boundary forbids outside use-asset-url. It now uses assetRefExists, the existing metadata-only probe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): guard the importer's pool probe like every other entry point Only a reference the pool could have issued is probed, as the lease guard requires; the importer is added to the list of guarded entry points. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): import legacy browser data once per browser Review round 1 of the legacy browser importer. - Once per browser, not once per owner: the data belongs to whoever used the browser before the upgrade, so the first owner the import runs for claims it and any other owner gets nothing. The ledger is one key, maic:legacy-import:v2, recording the owner only as a SHA-256 digest (an anonymous owner id is a bearer credential) and a random salt. - Handoff: when the claiming owner is retired (403 OWNER_RETIRED), or the current owner holds courses or folders the importer created (a claim moved them), the current owner continues the unfinished items; courses already done are never imported again, so a claim neither duplicates nor resurrects them, and a half-copied course keeps its runtime. - Fresh ids come from the salt and the legacy id through SHA-256, not from the owner: unlinkable, unpredictable, and the same in every tab. - 401 pauses with backoff instead of closing the import; 403 FORBIDDEN_LEARNER stops the run and leaves the item pending. - Without Web Locks: ledger writes merge with the stored copy, and the library is listed again right before a course is placed, so a second tab does not import a course the first one just created. - Media the server refuses for good gets the app's failed-media record instead of a dangling reference; the legacy bytes stay. - A legacy whiteboard or PBL session is not created when the server already has an active one of that kind. - A folder that is gone leaves the course unfiled instead of failed, and a membership naming a folder the old database lacks counts as unfiled. - Narration rows from before the course column are adopted when exactly one legacy course names their key; unconvertible chat rows are noted; an unreadable document-store copy falls back to the original tables; PBL v2 documents go through the save-path strip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): cover the importer's handoff, tabs, refusals and review gaps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs: say the legacy import runs once per browser The README (and its Chinese version), the deployment guide in every locale, the changelog and the module README now say that the first owner to load the upgraded app in a browser claims its legacy data, what the handoff to an account does, that the ledger holds no owner id, and how refused media and the new pause and skip cases behave. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): note runtime the importer cannot find without the old learner key Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * feat(identity): let an owner confirm it absorbed a given owner through a claim GET /api/identity/merged-from?salt=<hex>&digest=<hex> answers whether a claim merged into the requesting owner an owner whose id hashes to SHA-256(salt, id). It reads only the requester's own owner_merges rows, never lists or names an owner, resolves the owner like every other owner-scoped route, and is uncacheable. The one-way import of pre-server browser data uses it to decide whether a different owner may continue an import the first owner started. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): hand the legacy import to another owner only on a confirmed claim Review round 2 of the legacy browser importer. - The only way the browser's legacy data moves from the owner that claimed it to a different owner is the server confirming, through GET /api/identity/merged-from, that the current owner absorbed that owner through a claim. The inferred signals (an owner that never wrote, a library listing that holds imported courses) and the retired flag are gone; a 403 OWNER_RETIRED only stops the run and leaves items pending. - The first owner is bound only once the run's first authenticated request of its own (the library listing) succeeded, so a run that dies before that leaves the ledger unclaimed. - The owner is recorded as SHA-256 of the per-browser salt and the owner id; the server computes the same value from the salt the browser sends. - A "not absorbed" answer is reused for an hour instead of asking on every load, and the claiming owner stored first survives another tab's save unless that tab handed the import over; completion survives too. - Run-level failures (401, OWNER_RETIRED, FORBIDDEN_LEARNER, OWNER_BUSY) from any call stop the run and leave the course pending, including the "is the id taken" read and the library re-list, which could previously mark the course failed and close the import. - Refused media without a generation request (the user's own) gets a new non-retryable ASSET_REFUSED code, so it shows as failed without a Retry that could only fail; a skipped singleton runtime session leaves a note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): pin the importer ledger's owner merge and the singleton-skip note Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs: the legacy import moves to another owner only on a confirmed claim The README (and its Chinese version), the deployment guide in every locale, the changelog and the module README now say that the import runs once per browser and moves to another owner only when that owner claimed the original one, confirmed by GET /api/identity/merged-from; that the owner is recorded as a salted digest; and how refused user media shows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): never let a transient failure settle a legacy import item Review round 3 of the legacy browser importer. - A read of the old browser stores that fails in storage (an aborted IndexedDB transaction, a closed database) now pauses the run and leaves the course pending. Only a record that cannot be migrated, parsed or validated is skipped. This covers the course read (which no longer falls back to the older table copy on a storage failure), and the quiz-scene and speech indexes, which used to read a failure as "no scenes" or "no holder" and drop quiz state or narration for good. - After a session-id collision, a failed read of the session propagates and is retried; only a successful read that shows the id taken skips it. - Without Web Locks, two tabs of different owners can both find the ledger unbound. Every ledger write keeps the owner stored first, and the run now re-reads the stored ledger after binding, before folders, before each course and before each course document is created, and stops if another owner holds it. - The "not yours" answer is reused for ten minutes instead of an hour, a stored wait further ahead than the longest the importer sets (a clock that ran ahead) counts as passed, and expired answers are pruned. - Generated media refused without an error code keeps its Retry; only media nothing can regenerate gets ASSET_REFUSED. A poster that fails transiently leaves the video pending instead of being dropped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): cover transient reads, racing owners, the not-yours cache and the claim client Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(persistence): say what the ledger's salt protects, and the new pauses The salt defeats precomputed and cross-browser tables, not a targeted guess against one browser's ledger; the module README and the digest's comment now say so. The README also covers storage read failures, which pause instead of skipping, the two-owner race without Web Locks, and the ten-minute recheck. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * feat(identity): bind a browser's legacy data to one owner on the server The one-way import of pre-server browser data now asks the server whose data it is, instead of deciding in the browser. - legacy_import_bindings (browser_id primary key, owner_id, timestamps), provisioned with owner_merges on fresh and upgraded databases. - POST /api/identity/legacy-import-binding {browserId}: one atomic insert (ON CONFLICT DO NOTHING) and a read-back; answers only whether the requesting owner holds the browser. Same-origin JSON, resolved and write-fenced like every owner write, 400 for a malformed id. - A claim participant re-keys the claimed owner's bindings to the account inside the claim transaction, so the account simply holds the browser. - Owner resolution refuses any request carrying X-OpenMAIC-Legacy-Import with 409 LEGACY_IMPORT_NOT_BOUND unless the owner it resolves to holds that browser: one central fence every owner-scoped route goes through. Requests without the header are unaffected. - GET /api/identity/merged-from is removed; the binding replaces it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): import through fenced clients bound by the server Review round 4 of the legacy browser importer. - The ledger holds a random browser id and no owner information; the owner digest, the "not yours" cache and the client-side handoff are gone. A run first asks the server to bind the browser and imports only when the requesting owner holds it. - Every importer request goes through its own clients that carry the browser id, so the server refuses any write under an owner that does not hold the browser: after a cookie switch in another tab, from a page whose memoized owner is stale, or from a tab that lost the binding race. The runtime learner key is asked for during each run, never taken from the page. 409 LEGACY_IMPORT_NOT_BOUND stops the run with items pending. - The write-back funnels, commitToPool and the PBL save-path strip take an optional store, put or runtime, so the importer passes its fenced ones. - A failed read of one legacy course holds up only what it could affect: the quiz-scene and speech indexes leave the course out as unindexed, and only quiz state or narration it could own waits. Read failures are counted per course; after five failing runs over at least a day, a course whose document-store copy cannot be read falls back to the table copy, or is skipped with the reason when there is none. - Runtime ids are rewritten by replacing only their course segment, so a short course id cannot corrupt the prefix or the learner segment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): cover the server binding, its fence, bounded reads and short ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs: the server binds a browser's legacy data to its first owner The README (and its Chinese version), the deployment guide in every locale, the changelog and the module README now say: once per browser; the server binds the browser to the first owner; a claim carries the binding to the account; the importer's requests are refused for any other owner. They also describe the bounded pause for a course the old storage cannot read, and the removal steps for the server side. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): keep a dropped asset request pending in the legacy import The asset client reports a fetch that got no answer (a dropped request, an aborted upload, the existence probe's deadline) as status 0 with HTTP_REQUEST_FAILED, which the importer read as a final refusal: the media was marked failed and the course could complete without it. Read that code as transient, keep the client's local validation failures final, and treat a 2xx/3xx answer a client could not use as transient too. Unit tests drive every client the importer uses with a rejected fetch and a non-JSON answer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(persistence): ask a refused binding again only every ten minutes A browser whose legacy data another owner holds sent the binding request (a write) on every page load. Record a ten-minute recheck in the ledger (clamped like every other deferral), so a claim that moves the binding is still picked up, and open the old databases only once the browser is bound. The read budget now counts consecutive failing runs (a run that reads the course resets it) and counts a first failure dated in the future from the next one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(identity): answer 503 with the cookie when the import fence cannot read The legacy import fence now reads the header name from the shared constant, and a database error while reading the binding answers the usual JSON error (503 PERSISTENCE_UNAVAILABLE) with the resolution's Set-Cookie values instead of escaping as a bare 500. Route tests cover that, a bind by an owner a claim retired (403 OWNER_RETIRED, no row), and one header name on both sides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(persistence): cover dropped asset requests, the recheck and the read budget With the real asset client's error for an upload and an existence probe, the media stays pending and a later run imports it. A non-holder's five loads send one binding request and never open the old databases, and a claim still hands the import to the account after the delay. The read budget's run count and time span each hold on their own, a clock that ran ahead does not hold a course open, and a good read resets the count. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(persistence): complete the legacy import removal steps List every file the removal touches (the claim scenarios test, the claim participant table and list, every doc), keep the bindings table for one release after the code goes because of rolling deploys and give the DROP statement for that release. Add the claim's eighth participant to the README lists, fix the fresh-id wording in the changelog, and describe the recheck delay, the transient status-0 asset failures and the consecutive read budget. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): keep legacy quiz state through Clear Local Cache until the import completes Pre-runtime quiz drafts, answers, results and attempt ids exist only in localStorage, and the one-way importer copies them to the server with their course. Clear Local Cache deleted them even while the import was still pending (it waits for an idle page and can stay pending after a failure), so that quiz progress was lost for good. Clear Local Cache now keeps the four quiz key families unless the importer's ledger records the import as complete, read through a new `legacyImportIsComplete` helper in the ledger module. The ledger key moves there too, so the two modules do not import each other. Once the import is complete, the keys are cleared as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs: show DATABASE_URL set in the local development setup The getting-started guide showed the required DATABASE_URL line commented out, so copying the block left the server unable to start. Each locale now shows `pnpm db:up` and, separately, the `.env.local` line to set. The `.env.example` header said every variable is optional; it now says that provider variables are, and that DATABASE_URL is required except under docker-compose.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(changelog): drop two upgrade notes the final code contradicts The Compose entry said its default DATABASE_URL overrides .env.local; the defaults file is read first, so a value in .env.local wins, as the same entry says further on. The runtime-session entry offered turning server persistence off as an upgrade path; that switch no longer exists. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(env): restore the ACCESS_CODE warning notes in .env.example A later change to the example file dropped the lines saying that an unset ACCESS_CODE fails open, that the server then logs a one-time startup warning and GET /api/health reports accessCodeConfigured: false. They are back, and say that single-user mode logs its own warning in place of the generic one, as the startup code does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * ci: run every app PostgreSQL suite in the contract job The app-domain step named its suites one by one, and seven had been left off, among them the legacy importer's route suite. No other job gives the app suites a database, so they skipped everywhere. The step now lists every app `*.pg.test.ts`; all of them work in a schema or database of their own, or truncate only their own tables, and pass before and after the storage package suite in the same database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(identity): establish the anonymous owner before the first API request (#1721) * fix(identity): establish the anonymous owner on the page response On a browser's first load the page sent several API requests without an owner cookie; each minted its own anonymous owner and set its own cookie, and the last answer to arrive won. Work done in between (the legacy import binding, a first course write) then belonged to an owner the browser no longer presented. The middleware now mints the anonymous cookie on document navigations that carry no valid one, with the route handlers' own value format and attributes (the cookie module is Edge-safe now: Web Crypto instead of node:crypto), and forwards it on the request so the page render resolves the same owner. API, RSC, prefetch and Server Action requests never mint there, and a valid cookie is never replaced. It mints only when neither OWNER_SINGLE_USER nor PERSISTENCE_SHARED_OWNER_ID is set; host registrations are invisible to an Edge middleware, so the README tells hosts where to skip it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(legacy-import): bind only an owner the browser already presents A binding request whose owner was minted by that very request answers 409 OWNER_NOT_ESTABLISHED with the minted cookie and binds nothing: other cookieless requests may still be minting owners of their own, and a binding to this one could be left with an owner nobody presents. The importer treats it as transient and retries on a later load. It also says plainly when a request after its own successful bind is refused as another owner (the owner cookie changed mid-run); items stay pending. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(legacy-import): cover a first visit whose first answers arrive out of order Against the real routes and PostgreSQL: a browser without a cookie loads a page, sends two requests at once, and the first answer reaches it only after the importer bound the browser; the import completes under the one owner the page established. A second case binds nothing for an owner the bind itself minted and imports on the next run. The E2E drives the same ordering in Chromium by holding the first owner-scoped answer until the binding answered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * test(legacy-import): drop an unused initial assignment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(changelog): note the page response now sets the anonymous owner cookie Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(identity): let hosts turn page-response minting off The middleware cannot see owner auth methods a host registers, so a host with anonymousFallback: false still got an anonymous cookie on a cookieless page load. Beside the host credential it is a claim candidate; with OWNER_CLAIM_TRIGGER=auto it is claimed and cleared on the next request, again after every such page load. OWNER_ANONYMOUS_PREMINT (default on; true/1/false/0, anything else fails startup) is read by the middleware before minting. At startup the server warns once when a registration turns the anonymous fallback off while pre-minting is still on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(identity): document OWNER_ANONYMOUS_PREMINT Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(identity): keep the anonymous identity for 400 days and renew it in use The anonymous cookie had a fixed 30-day lifetime from its mint and was never renewed, so every anonymous visitor lost their whole library 30 days after the first visit however active they were; with persistence on the server only, that affects every anonymous deployment. It now lasts 400 days (the browser cap, one shared constant), and every route handler and Server Action response that resolves to a valid anonymous cookie re-sends the same value with a fresh Max-Age (best-effort where next/headers refuses writes). Page responses never renew, so pages stay cacheable, and a host principal never renews the anonymous cookie beside it. A response that clears the cookie (a claim, a retired owner) must not renew it, whatever order a route merged its headers in: withRequestOwner, and the owner-events retired answer, keep only the clearing value for a cookie a value clears. A renewal that lands after a claim cleared the cookie is pinned by a test: the next write with it, alone or beside the account, writes nothing, and its answer clears it again without renewing it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * docs(identity): 400-day renewed anonymous cookie; when to turn pre-minting off Hosts set OWNER_ANONYMOUS_PREMINT=false only when their registration sets anonymousFallback: false; hosts that keep anonymous visitors need pre-minting and skip it per request in middleware for requests their methods authenticate. The CHANGELOG notes the new lifetime and renewal, and that a lost cookie means a new owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz * fix(identity): forward owner cookies from routes that resolve the owner directly The Pi chat and whiteboard-visibility routes and asset-id document extraction resolved the owner themselves and never sent its Set-Cookie values back, so an anonymous identity used only through them was never renewed (and a minted one never stored). attachOwnerCookies attaches a resolution's cookies to a response a route built itself, with the clear-wins rule, before a stream's body starts. Both Pi routes answer through it, success and error alike; resolveServerAsset hands the cookies back with every answer and the extraction route attaches them. A guard test scans for every module outside the identity seam that calls the owner resolution (or the asset helper) directly and requires it to forward the cookies; the two callers that cannot are listed with the reason. Behaviour tests cover the three paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRME5T4oEaQ4EBUzrDXMKz --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <dhq1204@yahoo.com> |
||
|
|
3948688cfc |
fix(agent): preserve tool-result images in model requests [AI-assisted] (#1718)
* fix(agent): preserve tool-result images in model requests * fix(agent): omit tool images when vision capability is unknown --------- Co-authored-by: sophietao20-star <283060850+sophietao20-star@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
be2eaf0a82 |
docs(readme): bring the News section up to v1.1.2 (#1715)
The section stopped at v1.0.0 (2026-08-27) and did not point readers at the six releases published since, so anyone landing on the README had no route to the current release history. Adds one entry per release from v1.0.1 to v1.1.2 in the existing format, each linking its GitHub release and the changelog. The four security releases name their advisories and flag the Behavior/Breaking Changes sections, since v1.1.x changes several defaults (caller-supplied provider base URLs, ALLOW_LOCAL_NETWORKS, Pi as the default chat runtime) that an upgrading user needs to read. Dates are taken from the CHANGELOG headings. They differ by a day from the GitHub Releases publish date for v1.0.2 and v1.1.1; the README already carries the same kind of difference for v0.3.0, so say the word if the release dates are preferred. Refs #1714 Co-authored-by: Yi-111-a <41898262+github-actions[bot]@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
Ethereal49
|
877bf792d7 | fix(generation): preserve template literals in interactive HTML (#1706) @openmaic/generation@0.3.14 | ||
|
HEOJUNFOandClaude Opus 5.5
|
1c70e86a13 |
fix(media): poll and download Veo videos the Gemini API way (#1695)
* fix(media): poll and download Veo videos the Gemini API way
The Veo adapter targets generativelanguage.googleapis.com but polled
with Vertex AI's models/{model}:fetchPredictOperation and read inline
response.videos[].bytesBase64Encoded. The Gemini API reads operations
with GET v1beta/{name} and returns
response.generateVideoResponse.generatedSamples[].video.uri, fetched
with the same API key.
- Poll with GET v1beta/{operationName}.
- Download the sample URI with x-goog-api-key into a data URL, always
through the configured base URL's origin and without following
redirects, like the other adapter calls. Inline bytes are still
accepted when present.
- Report RAI-filtered operations as a failure with their reasons.
- Catalog: Gemini API model IDs for Veo 3.1 (-preview, plus Lite) and
only the 16:9 / 9:16 aspect ratios the API accepts.
Fixes #1694
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(media): follow the Veo download redirect through a validated transport
The Gemini API file URI can answer with a redirect to storage (Google's
own example downloads it with `curl -L`), which the download refused, so
a generation could fail after a successful poll.
- VideoGenerationConfig gets an optional downloadFetchImpl. fetchImpl is
the pinned transport that refuses every 3xx, so the download needs its
own one.
- lib/server/media-provider-fetch.ts adds mediaDownloadFetch and
managedMediaDownloadFetch: providerFetch with redirects followed, each
hop re-validated under the operator address policy, pinned to the
vetted DNS answers, and stripped of x-goog-api-key once it leaves the
origin (fetchWithRedirectValidation). withVideoProviderFetch installs
both transports.
- The server video call sites (the generate route, classroom media
generation, the agent runtime) inject it; the adapter still does not
import server code.
- downloadVideo follows redirects only through the injected transport and
keeps redirect: 'manual' + assertNotRedirected without it.
- Test: a 302 to another origin yields the data URL and the second hop
carries no x-goog-api-key; without the transport the 302 is refused.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
||
|
wyucandClaude Opus 5.5
|
3dcb158f3d |
docs(changelog): record the 1.1.2 security release (#1705)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
cd7d6a1a59 |
fix(providers): pin caller-chosen provider requests and keep upstream detail out of errors (#1704)
* fix(pdf): pin verify-pdf-provider probes to the strict provider transport The MinerU Cloud and self-hosted connectivity probes validated a caller-supplied base URL once and then issued a plain fetch that resolved DNS again, so a rebinding hostname could pass validation and connect to a loopback or private address. The response also echoed the target's status, its 401/403 body, and per-errno connection errors. Both probes now go through providerFetch with reject-redirects and the operator address policy (the same ALLOW_LOCAL_NETWORKS policy the route already validates against), so the connect address is pinned to the vetted DNS answers. A 3xx still maps to REDIRECT_NOT_ALLOWED. Authentication failures return a fixed message, every other connection failure returns a single generic message, and the success payload no longer includes the target status. Details are logged server-side only. Tests drive the real route, guard and pinned transport against loopback servers, covering rebinding, auth body suppression, identical refused/not-found/timeout answers, redirect refusal and the managed path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pdf): pin self-hosted MinerU parsing to the strict provider transport Self-hosted MinerU parsing validated a caller-supplied base URL once and then posted the document with a plain fetch that re-resolved DNS and followed redirects, so a public host could hand the upload (and API key) to a loopback or private address. The /file_parse request now goes through providerFetch under the operator address policy with redirects refused. Transport failures, policy blocks and redirects collapse into one fixed message; an unknown error status is reported without its body (the missing-dependency classification stays), a non-JSON body no longer surfaces the parser's input snippet, and the empty-result error no longer lists response keys. MinerU Cloud control plane, upload and ZIP errors likewise stop quoting raw response bodies. Tests drive the real parse route and pinned transport against loopback servers: rebinding, redirect refusal, body suppression, the multipart upload shape and the managed path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(tts): pin the Azure voice list request to the strict provider transport The voice list request validated the caller-supplied base URL once and then fetched it with a plain fetch that resolved DNS again. It also mirrored the target's HTTP status as the route's own status and returned the full error body, plus any JSON the target answered on success. The request now goes through providerFetch under the operator address policy with redirects refused and a 20s deadline. Non-2xx answers return a fixed 502 (authentication failures get their own fixed message), only a JSON array is returned as the voice list, and transport failures share one fixed 500 message. Details are logged server-side only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): pin model-list probing to the strict provider transport Model discovery validated the caller-supplied base URL and models URL once and then issued a plain fetch per candidate, which resolved DNS again. Non-2xx answers carried up to 512 bytes of the provider's body into the route response, and a non-JSON success body surfaced the parser's input snippet. fetchModels now defaults to providerFetch under the operator address policy with redirects refused (a refused hop keeps the REDIRECT_NOT_ALLOWED contract), and accepts an injected transport for tests. Error bodies are never read; the route keeps its 401/404/403 contracts, reports other HTTP failures by status class only, answers a non-JSON list and every transport failure with fixed messages, and returns 400 for a malformed request body. The rejected-redirect detector is shared from the transport module instead of being copied per caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(media): run image/video provider requests on the strict provider transport The image and video routes validated a caller-supplied provider base URL once, then every adapter issued plain fetch calls that resolved DNS again. Adapter errors carried full non-2xx bodies into the route responses, the auth-only probes returned the 401/403 body, and connectivity failures echoed the transport error text. Adapters now take a `fetchImpl` from their config and use it for every provider request (submit, poll, download and connectivity probe). The adapters are also imported by the settings UI, so they cannot import the server transport; every server caller (the four routes, classroom media generation and the agent runtime tools) injects mediaProviderFetch, which is providerFetch under the operator address policy with redirects refused. Connectivity results are fixed text: authentication failures, redirects, other HTTP statuses and transport failures each have one message, and no provider body is read. The generation routes log the adapter error and answer a fixed message, keeping the content-safety classification. A malformed Kling key is still reported before any request. The rejected-redirect detector moves to a dependency-free module so the browser-bundled probe helper can share it with the server transport. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(llm): pin LLM calls to a client-supplied base URL resolveModel validated a client-supplied base URL once and then handed the AI SDK a redirect-validating fetch whose only dispatcher was the timeout-only agent, so connect-time DNS was resolved again without the guard. verify-model also echoed the provider's error message (which can carry its response body) and distinguished errno classes. A client-supplied base URL now gets providerFetch under the operator address policy with redirects refused. The pinned dispatcher accepts headers/body timeouts, and this path uses the same 15-minute budget as the default LLM dispatcher; the transport's body normalization and streaming are unchanged. Operator-configured endpoints keep the existing redirect-validating transport. verify-model now classifies failures by the provider's HTTP status only (401/403, 404, 429, other status class) and answers every transport or parse failure with one fixed message. Tests stream a real SSE chat completion through the pinned path and check that deltas arrive before the server finishes, plus rebinding, redirect refusal and the managed path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pdf): accept only official AliDocMind endpoints from clients AliDocMind requests go through the vendor SDK, which builds its own HTTPS agent and resolves the endpoint itself, so a client-supplied endpoint that passed the URL guard could not be pinned to the validated address. The credential check also returned the SDK's error code and message, which told a refused port from a TLS failure or a timeout. When the provider is not server-managed, verify-pdf-provider, parse-pdf and extract-document (document and media paths) now accept a client endpoint only when it is an official docmind-api.<region>.aliyuncs.com host over https with no port, path or credentials, and answer INVALID_URL before any SDK call otherwise. The accepted endpoint is passed on as the normalized host. Server-managed endpoints are unchanged. Credential verification failures now return fixed messages and log the SDK detail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(agent-runtime): download provider result URLs under the strict public policy The agent-runtime image and video tools downloaded the URL a provider returned with a plain fetch, validating each redirect hop with the operator policy but connecting without pinning, and accepting http. A data: URL from an adapter that inlines its result (the OpenRouter video adapter) was rejected instead of decoded. The classroom download helper's policy is extracted into fetchProviderResultUrl: data: URLs are decoded locally, anything else must be https and pass the strict public policy (allowLocalNetworks false, regardless of ALLOW_LOCAL_NETWORKS), and the request goes through providerFetch, which re-validates redirect hops under the same policy and pins connect-time DNS. The agent-runtime tools and the classroom helper share it; the existing bounded reads and content-type checks are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(changelog): note pinned provider transports and body-free provider errors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): keep vendor endpoint rules out of provider-neutral modules The provider-neutrality guard keeps vendor knowledge out of the capability routes and model resolution. The AliDocMind endpoint rule now sits behind provider-neutral helpers (checkClientDocumentExtractorBaseUrl and checkClientMediaExtractorBaseUrl), which apply the official-endpoint rule to extractors whose SDK cannot be pinned and the URL guard to the rest. The pinned LLM transport policy moves out of resolve-model into its own module. Behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): hold IP-literal request hosts to the transport address policy The pinned dispatcher judges hostnames in its connect-time lookup, but Node never runs that lookup for an IP-literal host, so a request to a loopback or private IP reached it without the local-network opt-in. The provider transport now checks an IP-literal origin against the same policy before connecting, so it enforces the policy on its own rather than relying on every caller to validate the URL first. Tests that reached loopback IP literals without the opt-in now set it, as a self-hosted deployment would; cloud metadata stays refused under every policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): let operator-configured local providers connect without the opt-in Image/video providers and self-hosted MinerU moved to the pinned transport under the operator address policy for every base URL, so a server-managed endpoint on a local network (for example a local Lemonade image server or a MinerU container) stopped working unless ALLOW_LOCAL_NETWORKS was set. A server-managed base URL is operator configuration: it now runs with local networks allowed, still pinned and still refusing redirects, while cloud metadata and reserved ranges stay refused. Caller-supplied base URLs keep the operator policy. Media routes pick the transport by the provider's managed flag; server-internal media generation uses the managed transport; document extraction carries a `managed` flag to the MinerU parsers and the PDF verification probe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(llm): pin every caller-chosen endpoint and keep transport detail out of errors An unmanaged provider picked by the caller without a base URL fell back to its catalog default (for example a localhost Ollama or Lemonade endpoint) on the operator transport, which neither validated nor pinned the origin. The pinned client transport is now chosen whenever the caller picked the model or sent a base URL, and the effective endpoint (client URL or catalog default) is validated under the operator policy first. A model the operator selected through MODEL_ROUTES or DEFAULT_MODEL keeps the operator transport. Routes relay LLM error messages, and the AI SDK builds them from the fetch failure cause and from the provider's error body. On the caller-chosen transport a failed request now surfaces a fixed reason ("connection failed", "request timed out" or "redirects are not allowed") with the system error logged server-side, and an HTTP error response reaches the SDK with an empty body and the standard reason phrase, keeping its status and headers for retry and status classification. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pdf): keep MinerU Cloud envelope text out of errors and refuse query/fragment base URLs MinerU Cloud errors quoted the endpoint's envelope `msg`, a failed row's `err_msg` and the batch id, and the parse routes relay error messages. They now report the context with the HTTP status or, for a rejected request, the numeric code only; the endpoint text is logged server-side. Provider paths are appended to a base URL as text, so a client base URL ending in `?` or `#` (or carrying a query) absorbs the fixed path and leaves the request target to the caller. Client-supplied provider base URLs are now refused when they contain a query string or fragment, across the LLM, media, document extraction, PDF verification, model probe and Azure voice routes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(media): bound provider data: URL results before decoding them `fetchProviderResultUrl` decoded a provider-returned `data:` URL in full and left the size check to the caller's body reader, so an oversized payload was materialized first. Callers now pass their byte limit, and the payload size is estimated from the encoded length (base64: 3/4 less padding; percent-encoded: at least one byte per three characters) and refused over the limit before any buffer is built, then checked exactly after decoding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(changelog): describe provider transport behavior changes accurately Note which base URLs refuse redirects (MinerU Cloud API roots still follow validated, pinned hops), the query/fragment base URL refusal, IP-literal hosts under the address policy, validation of an unmanaged LLM provider's built-in default, server-configured local providers working without the opt-in, HTTPS for agent-runtime video and poster downloads, pinned requests bypassing the environment proxy, and the fixed LLM and MinerU Cloud error text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(llm): bound the logged error body and map out-of-range statuses to 502 An error response from a caller-chosen LLM endpoint was read in full only to log 500 characters, and a status of 600-999 (passed through by the transport) made the replacement Response constructor throw. Read at most 1 KB (or 1 s) of the body before cancelling it, and report statuses above 599 as 502. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pdf): hold MinerU Cloud redirect hops to the operator policy for a managed root A server-managed MinerU Cloud API root runs with local networks allowed, and the same policy applied to every redirect it answered with, so a hop to a private address was followed without ALLOW_LOCAL_NETWORKS. The provider transport now takes a separate address policy for redirect hops (`redirectAllowLocalNetworks`): each hop is validated and pinned on a dispatcher for that policy. A managed MinerU Cloud root keeps local access for itself while its hops use the operator policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): match server-configured providers by own keys only Provider ids come from requests and were looked up on plain config objects, so an id such as `constructor` or `toString` read an inherited property and counted as server-configured (and its key, base URL and models resolved from that property). All per-provider config lookups now go through one helper that accepts only the section's own keys. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(audio): let server-configured TTS/ASR endpoints reach local networks Server-configured image/video, MinerU and LLM providers on a local network work without ALLOW_LOCAL_NETWORKS, but a server-configured TTS/ASR or voice-registration endpoint given as a loopback or private IP literal (for example a VoxCPM server at 127.0.0.1:8000) was refused unless the opt-in was set. The routes and the server-side narration, classroom TTS and voice-clone paths now mark server-configured providers as `managed`; their endpoint requests run with local networks allowed, still pinned, with cloud metadata and reserved ranges refused, and redirect hops held to the operator policy. Client-supplied endpoints keep the strict public policy, and an unmanaged provider's catalog default keeps the operator policy. Provider-returned result URLs are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(changelog): server-configured TTS/ASR local endpoints and config id lookups Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Yizuki_Ameandwyuc
|
4f43b48abe |
fix(whiteboard): anchor code replacements in document order (#1696)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
小魔andwyuc
|
a41bbac239 |
feat(llm): retry once on a fallback model for retryable failures (#1614)
* feat: configurable model escalation scheduler ## Motivation Course generation can stall when the model configured for a heavy stage (e.g. `scene-content:interactive` / `scene-content:pbl`) is repeatedly rate-limited, times out, or returns empty output. Today the operator must manually switch models in `MODEL_ROUTES` and re-trigger the page; long-running generations die on a single bad call. This PR makes the fallback automatic and observable: an optional per-stage **escalation policy** that re-runs the failed scene once with an explicitly chosen upgrade model, and logs every decision to a durable ledger viewable from a new Settings section. ## Design - **Disabled by default, zero behavior change.** No `data/model-schedule.json` → the engine behaves exactly as before. The config is hot-read per call (250 ms cache), so saving from the panel takes effect without a server restart. - **Explicit escalation only.** The upgrade model is resolved through the existing `resolveModel` pipeline **outside** `MODEL_ROUTES` (unrouted model string wins), reusing the full provider/model parsing (`openai:...`, `qwen:...`). - **Trigger semantics.** `onTimeout` requires a timeout error; `onRetryableError` accepts any retryable generation error (`isRetryableGenerationError`). Content-safety style rejections are **not** retryable and **never** escalate — the safety boundary is preserved. - **Budget guard.** Optional `budget.dailyEscalationCap` stops escalations for the day once exhausted; per-stage `max` limits retries. - **Ledger.** Every escalation appends one line to `data/schedule-events.jsonl` (stage, scene, base → used, error class, reason); the Settings panel shows the last 20. ## Screenshots Settings > Model Scheduling (config present):  Ledger after an escalation (example entry):  ## Verification - `pnpm lint` — 0 errors - `pnpm check` (prettier) / `pnpm check:i18n-keys` — pass (12 locales) - `pnpm build` — Next.js production build passes - Engine logic script — 8/8 assertions (disabled default, policy parsing, budget guard, ledger I/O) - API A/B flow — GET null without config; PUT template → served immediately (hot reload); DELETE → back to null ## Notes - The config schema is minimal free-form JSON (optional `models` / `budget` / `escalation` / `strictMode`); a stricter TS schema can follow in a later PR. - `strictMode` is reserved (not enforced yet). - The 3-tier preset template lives in the panel's "Load 3-tier preset template" button; no example file is shipped. * feat: configurable model escalation scheduler ## Motivation Course generation can stall when the model configured for a heavy stage (e.g. `scene-content:interactive` / `scene-content:pbl`) is repeatedly rate-limited, times out, or returns empty output. Today the operator must manually switch models in `MODEL_ROUTES` and re-trigger the page; long-running generations die on a single bad call. This PR makes the fallback automatic and observable: an optional per-stage **escalation policy** that re-runs the failed scene once with an explicitly chosen upgrade model, and logs every decision to a durable ledger viewable from a new Settings section. ## Design - **Disabled by default, zero behavior change.** No `data/model-schedule.json` → the engine behaves exactly as before. The config is hot-read per call (250 ms cache), so saving from the panel takes effect without a server restart. - **Explicit escalation only.** The upgrade model is resolved through the existing `resolveModel` pipeline **outside** `MODEL_ROUTES` (unrouted model string wins), reusing the full provider/model parsing (`openai:...`, `qwen:...`). - **Trigger semantics.** `onTimeout` requires a timeout error; `onRetryableError` accepts any retryable generation error (`isRetryableGenerationError`). Content-safety style rejections are **not** retryable and **never** escalate — the safety boundary is preserved. - **Budget guard.** Optional `budget.dailyEscalationCap` stops escalations for the day once exhausted; per-stage `max` limits retries. - **Ledger.** Every escalation appends one line to `data/schedule-events.jsonl` (stage, scene, base → used, error class, reason); the Settings panel shows the last 20. ## Screenshots Settings > Model Scheduling (config present):  Ledger after an escalation (example entry):  ## Verification - `pnpm lint` — 0 errors - `pnpm check` (prettier) / `pnpm check:i18n-keys` — pass (12 locales) - `pnpm build` — Next.js production build passes - Engine logic script — 8/8 assertions (disabled default, policy parsing, budget guard, ledger I/O) - API A/B flow — GET null without config; PUT template → served immediately (hot reload); DELETE → back to null ## Notes - The config schema is minimal free-form JSON (optional `models` / `budget` / `escalation` / `strictMode`); a stricter TS schema can follow in a later PR. - `strictMode` is reserved (not enforced yet). - The 3-tier preset template lives in the panel's "Load 3-tier preset template" button; no example file is shipped. * Delete omai-upload-tree directory * fix: ensure trailing newline in locale files fix: ensure trailing newline in locale files * chore: english comments for upstream review chore: english comments for upstream review * Delete components/settings/model-schedule-settings.tsx * Delete lib/server/model-schedule.ts * Delete app/api/model-schedule/route.ts * Delete assets/model-schedule/ledger-with-entry.png * Delete assets/model-schedule/settings-panel.png * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Update .env.example * Enhance access control comments in .env.example Added additional context and warnings for access control configuration. * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload * run ci * Add files via upload * Add files via upload * Add files via upload * Supplement. env.example Supplement. env.example * Add files via upload * Update .env.example * Update fallback notes in .env.example Clarified fallback behavior in callLLM layer documentation. * Update llm.ts * Update llm-fallback.test.ts * fix(llm): round-4 fallback hardening fix(llm): round-4 fallback hardening — server-managed gate, content-filter refusal, APICallError unwrap stop, outlines fullStream errors * fix(llm): rebase round-4 onto main v1.1.1 fix(llm): rebase round-4 onto main v1.1.1 * fix(llm): round4c-prettier formatting+retry test fix(llm): round4c-prettier formatting+retry test * test(llm): round-4d-align outline-stream test(llm): align outline-stream and title-generator tests with round-4 call signatures --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
44ad72beba |
fix(persistence): serve the course library without the agent runtime; exit on invalid boot config
* fix(persistence): serve the course library without the agent runtime The course library and folder routes (/api/stages/** and /api/folders/**) gated on isAgentRuntimeConfigured(), so a deployment with server persistence (DATABASE_URL set, client built with NEXT_PUBLIC_PERSISTENCE=1) but the agent runtime off answered 404 there: the home library showed an empty, "persistence unavailable" list and folder creation failed, although imports persisted. These routes only need the persistence provider and the owner-bound document store, so they now gate on isServerPersistenceConfigured(). Agent features (/api/agent/**, /api/skills/**, /api/materials/**) keep the runtime gate, and without a DATABASE_URL every route still answers 404. GET /api/agent/runtime also reports `persistence`; `enabled` and `runtimeEnabled` are unchanged and the workbench entry still keys on `enabled`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(boot): exit the server when boot validation refuses the configuration Next.js logs a throw from the instrumentation register() hook as "Failed to prepare server" but keeps listening and answers every request with 500, so a refused configuration (malformed asset quota, pending TTL or owner lock waits, PERSISTENCE_SHARED_OWNER_ID without ACCESS_CODE, the removed OWNER_AUTHENTICATOR / TRUSTED_PROXY_* variables, invalid owner auth or host hook registrations) left a process that looked alive and served nothing. The fatal validations now run in one validateBootConfiguration() step. When it throws, register() calls exitOnInvalidBootConfiguration(), which prints one "[boot] Invalid server configuration" line carrying the original message, waits for stderr to flush, and exits with code 1. The wrapper lives in its own module so tests stub it (or process.exit) and still assert the thrown error. register() already returns before any validation on the Edge runtime, and warnings (unset ACCESS_CODE, model-routing checks) never exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: document library gating and exit on invalid boot configuration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(boot): tell refused configuration apart from other startup failures Every throw from the boot validation step was printed as "Invalid server configuration" with its message only, so a startup failure that has nothing to do with settings (a module missing from a standalone build, a bug in startup code, a host registration call that throws) sent operators looking for a bad environment variable. Each fatal configuration check now runs through runConfigurationCheck(), which marks what it throws as an InvalidBootConfigurationError with the same message. exitOnBootFailure() (renamed from exitOnInvalidBootConfiguration) keeps the one-line message for those, and prints anything else as "[boot] Server startup failed" with its stack and cause. Both exit with code 1. The README (EN and zh) and CHANGELOG now list exactly the settings the boot validation refuses, adding OWNER_CLAIM_TRIGGER, the ASSET_S3_BUCKET conflict with a registered byte store and the sharedTeamAuthMethod() placement rule. Also fixes a stray comment marker in feature-flags.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
ba7d707b0f |
fix(media): route classroom media downloads through strict provider transport (#1692)
* fix(media): route classroom media downloads through strict provider transport * style: apply prettier to classroom media transport changes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
a686481e73 |
feat(auth): owner identity seam — composable auth methods, owner-keyed persistence, host hooks, claims
* ci: run CI for the owner identity seam integration branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(auth): owner identity seam, phase 1 — pluggable authenticator with today's behavior * feat(auth): add the owner identity seam with built-in authenticators Introduce lib/server/identity/: an OwnerAuthenticator contract (SubjectKind, OwnerPrincipal, AuthOutcome), a single-shot, boot-validated configureOwnerAuthenticator() registry, and the anonymousCookie and sharedTeam built-ins that reproduce today's owner resolution exactly (same anonymous_id cookie, owner id strings, statuses and env semantics). Every owner-scoped route handler and the workspace Server Action now resolve their owner through one memoized per-request resolution instead of the three previous copies (agent-runtime/owner.ts, with-owner.ts and the Server Action re-implementation). Publish and unpublish decide from the principal's course:publish role instead of an anon: id prefix. An invalid credential from an authenticator is answered with 401 on every surface and never falls back to an anonymous owner. A source scan keeps the anonymous owner cookie and anon: prefix checks out of code outside the identity module. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(auth): describe the owner identity seam and host registration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(auth): tighten the identity boundary guard and Server Action cookies - Scan workspace package sources too, flag imports of the concrete built-in authenticators outside lib/server/identity, and police the slice/substring/indexOf/includes spellings of an anon: id-shape check. Stop re-exporting the built-ins from the host-facing index. - Refuse setCookies returned by authenticateFromContext, as the authenticate() fallback already did, and document that it must write cookies itself through next/headers. - Let the route-test owner stub carry explicit kind/roles, and cover the 403 forbidden branch of publish and unpublish for a signed-in owner without course:publish. - README: registration conflicts fail the boot; an invalid principal is rejected per request with a 500. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(auth): owner identity seam, phase 2 — runtime and assets keyed by the owner * feat(auth): owner identity seam, phase 2 — runtime and assets keyed by the owner Runtime sessions and assets on /api/persistence now take their identity from the same memoized owner resolution as documents, instead of a client-chosen x-learner-key behind a development bearer token that shipped in the public bundle. - Runtime: the storage handler's learner key is principal.ownerId. A path or body naming another learner answers 403 FORBIDDEN_LEARNER and another learner's session answers 404, whatever x-learner-key says; the header is no longer read. The browser learns its key from the new GET /api/persistence/learner-key and sends no credential of its own. The Pi whiteboard routes derive the same key from the owner. PERSISTENCE_DEV_TOKEN, NEXT_PUBLIC_PERSISTENCE_TOKEN and PERSISTENCE_ALLOW_INSECURE_DEV_AUTH are gone from the server path and the client, and server-auth.ts is deleted. Learner merge stays refused. - Assets: allocations land in a per-owner partition (owner:<ownerId>), so quota is per owner and replace/delete reach only the owner's entries. Reads stay capability-by-id where a course viewer needs them: another owner's committed entry is readable while a live course references it. Legacy entries in the old shared partition stay readable by id, and may be replaced or deleted only by an owner who owns every course referencing them. Server-generated media is stored under the run owner's partition; asset-id extraction and vision image resolution use the same rule. - Tombstones: runtime of a deleted course reads as absent (404, empty lists) and takes no new sessions or records, through a guard in the app's runtime composition; no package schema change. The identity boundary scan now also fails on any source that reads x-learner-key or the retired development token variables. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(persistence): describe owner-keyed runtime and assets, drop the dev token Remove the development persistence token from the server-persistence recipe, .env.example, the Docker build arguments and the deployment docs; describe runtime learner keys, per-owner asset partitions and quota, the legacy shared-partition rule and the tombstone behavior; and record the breaking change for existing server-persistence runtime data under Unreleased. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(storage): scope asset references to principals, typed stage refusal, uniform create collision @openmaic/storage 0.32.0. - PgDocumentStore takes assetReferencePrincipals: with reference tracking on, a write references and commits only entries held by the listed principals. An id naming another principal's entry records no row and changes no lifecycle column, like an unknown id, and the write is never refused. Without the option any held entry is referenced, as before. AssetCollector takes a matching per-document-owner function so the one-time backfill scopes each document the same way. This keeps a document naming a leaked id from committing, exposing or pinning another owner's allocation. - RuntimeStageNotFoundError: a store may refuse createSession for a stage its host considers absent; the runtime handler answers 404 STAGE_NOT_FOUND, recognizing the error by class or by code. - A session create over a taken id answers 409 SESSION_ALREADY_EXISTS whoever holds it. It used to answer 403 for another learner's session and 409 for one's own, which told a caller whose session an id was. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): close owner-seam boundary gaps in references, tombstones and legacy assets - Document writes reference and commit only the writer's own asset entries and legacy shared ones (owner-bound document store and the collector backfill), so another owner's course naming a pending id can no longer commit, expose or pin it. - The foreign-read rule additionally requires the referencing live course to belong to the entry's owner, as defense in depth for reference rows that did not come from a scoped write. - The tombstone refusal for new runtime sessions moved from a raw path comparison in the route into the guarded store's createSession (RuntimeStageNotFoundError, 404 STAGE_NOT_FOUND), so no encoded spelling of the path routes around it. - Replacing or deleting a legacy shared entry checks reference ownership and mutates in one transaction under the entry row lock, which a concurrent reference insert must wait for. - Tests build the uncommitted-but-referenced, tombstoned-with-rows and foreign-reference states directly so each half of the read rule is observable, and a PostgreSQL suite holds a competing reference open across a legacy delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(persistence): upgrade note for dev-token-gated deployments, owner-scoped references Tell operators whose only access gate was the development token to put the deployment behind an access code or gateway, register an owner authenticator, or turn server persistence off before upgrading, and describe that a course references only its owner's media. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(storage): per-owner reference principals and a typed taken-id conflict - PgDocumentStore's assetReferencePrincipals is now a function of the store's bound owner, evaluated per write, instead of a fixed list. A store re-bound with forOwner therefore scopes to the new owner rather than carrying the previous owner's principals onto its writes. It has the same shape as AssetCollector's backfill option, so one function serves both. - PgRuntimeStore and BrowserRuntimeStore raise RuntimeSessionExistsError for a taken session id, and the runtime handler classifies it as 409 SESSION_ALREADY_EXISTS even when its re-read cannot see the holder (for example a session a host-side wrapper hides). Recognized by class or by code. Still the unreleased 0.32.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): guard the Pi whiteboard runtime and answer hidden collisions with 409 - Every server-side runtime writer now uses the tombstone-guarded store: the Pi native whiteboard service gets it through the same helper as /api/persistence/runtime/*, so a deleted course takes no new whiteboard runtime either. - Creating a session whose id is held by a session a tombstone hides answers the uniform 409 SESSION_ALREADY_EXISTS instead of a 500, covered on PGlite and on real PostgreSQL. - The owner-bound document store passes its reference-principal function, so the scoping follows the bound owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(auth): owner identity seam, phase 3 — accounts through an identity gateway (trustedProxyHeader) * feat(auth): owner identity seam, phase 3 — trusted-proxy-header authenticator Add the trustedProxyHeader built-in: real accounts through an identity gateway (oauth2-proxy, Authelia, a Keycloak-based proxy, an institutional reverse proxy) that signs the user in and forwards the verified user in a request header. OpenMAIC never handles passwords or tokens. - Selected with OWNER_AUTHENTICATOR=trusted-proxy and validated in instrumentation register(). TRUSTED_PROXY_SECRET (32-1024 printable ASCII characters) is required; header names default to x-openmaic-proxy-secret and x-forwarded-user, and an optional groups header with TRUSTED_PROXY_ADMIN_GROUPS grants admin. An unknown selector, a TRUSTED_PROXY_* variable without the selector, a shared owner id or a host-registered authenticator alongside it, and malformed, reserved or repeated header names fail the boot. - Trust boundary: Next.js exposes no TCP peer address to route handlers, middleware or Server Actions, and fills x-forwarded-for from the socket only when the client sent none, so no address allowlist is offered. The gateway secret is compared in constant time (hashed, timingSafeEqual). - Per request: a missing or wrong secret, a missing or blank user, a user header with a comma (duplicate lines arrive comma-joined), or a user whose proxy:<user> id fails the owner id guard is 401 INVALID_CREDENTIAL, never an anonymous owner. The guard failure is a 401 rather than a 500 because the value comes with the request. The user is trimmed and keeps its case. Every gateway user holds course:publish; kind user, assurance verified, channel proxy; no cookie. Route handlers and Server Actions share one code path. - The unset-ACCESS_CODE boot warning is skipped in this mode; the gateway is the access gate and ACCESS_CODE stays independent. - The identity boundary scan now also fails on gateway identity headers (x-forwarded-user/-groups/-email, x-auth-request-*, remote-user, the secret header) and TRUSTED_PROXY_* read outside lib/server/identity. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(auth): document accounts through an identity gateway Describe the trustedProxyHeader built-in in the README owner identity section (and its Chinese counterpart): configuration, request semantics, the trust boundary and why it is a shared secret, the interaction with ACCESS_CODE, boot-time validation, and an oauth2-proxy example that injects the user, groups and secret headers. Add the .env.example block, a SECURITY.md note and an Unreleased changelog entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(auth): harden the trusted-proxy authenticator after review - Reserve the header names HTTP, Next.js and forwarding proxies set themselves: configuring the user, groups or secret header to rsc, next-action, forwarded, x-forwarded-for/-host/-proto/-port, x-real-ip, or anything starting with x-middleware-, x-invoke-, x-nextjs- or next-router- now fails the boot. - Log a one-time boot warning when TRUSTED_PROXY_ADMIN_GROUPS is set: the admin role is granted from the groups header, which is trusted on the strength of the shared secret alone, so the gateway must overwrite or strip it. - POST /api/chat/pi resolves the owner up front and answers 401 when the authenticator rejects the credential, like every other owner-resolving route, instead of continuing without an owner. The anonymous default always resolves, so it is unaffected. - The identity boundary scan also covers the Authentik, Azure App Service authentication, WebAuth, Cloudflare Access, Google IAP and AWS ALB OIDC header families. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(auth): admin-groups warning and a corrected oauth2-proxy example - Warn next to TRUSTED_PROXY_ADMIN_GROUPS (README, README-zh, .env.example) that the groups header is trusted on the strength of the shared secret alone, and list the reserved header names. - The oauth2-proxy example now states it targets v7.14+ (nested claimSource/secretSource), uses the canonical bindAddress, sets preserveRequestValue: false on all three headers and insecureSkipNonce: false, forwards the subject with `claim: user`, and notes that the secret variable holds the literal secret. It adds the legacy-option migration caveat, a warning not to exempt app routes via skip-auth or trusted-ip options, and notes that the IdP must release the groups claim and group names must not contain commas. - Changelog: the new boot checks and the /api/chat/pi 401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(persistence): owner identity seam, phase 4 — host extension hooks * feat(persistence): owner identity seam, phase 4 — host extension hooks Let a host add product behavior at four points without forking a route, registered once from instrumentation.ts register() like the owner authenticator and sealed on first use. Nothing changes when no hook is registered. - configurePersistenceHooks({ name, authorizeCreate, onCreate, library, beforeAssetAllocate }): - authorizeCreate / onCreate run once per created course, inside the create transaction, in the transaction that inserts the course's ownership row. Saves of a course the owner already holds, and a create that loses a race to a concurrent create of the same id, are updates and run no create hook. A refusal answers 403 CREATE_REFUSED; a throw rolls the course, its ownership row and the host's writes back together. The hooks receive the request principal, or only the owner id for a background agent run. - library chooses which stage ids GET /api/stages lists; the route builds the usual summaries in the provider's order and drops every id the read path would refuse (deleted or unclaimed). folderId is shown only on the principal's own courses. - beforeAssetAllocate runs inside the storage handler's asset authorization step for POST /assets, after the owner is resolved and before the body is read; a returned Response is sent instead, with nothing stored and no quota counted. - configureAssetByteStore({ name, create, signsReadUrls }) replaces the ASSET_S3_BUCKET switch for both the persistence provider and the asset collector. A host store must keep bytes outside the registry database. Under ASSET_BYTE_EGRESS=redirect a store that does not declare signsReadUrls stops the server at boot; the built-in layers keep their behavior. - @openmaic/storage 0.33.0: DocumentWriteRefusedError lets a store refuse a write as policy; the document HTTP handler answers 403 with its code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): harden the host extension hooks after review Correctness: - Registration reads every hook once and stores it bound to the object the host passed, so hooks defined on a class prototype or as non-enumerable properties are kept. A spread copy dropped them silently, including the authorizeCreate and beforeAssetAllocate gates. Same for configureAssetByteStore. The unknown-key check now applies to plain objects only, since class instances carry their own state fields. - The owner-bound document store carries each call's operation in its own async context (AsyncLocalStorage) instead of a field on the instance. One store is shared by every tool of an agent run; a concurrent call could overwrite the field before the transaction read it, so a create was gated as a read (no ownership row, no create hooks) or claimed another stage. create_stage also runs sequentially within a tool batch. Hardening: - isDocumentWriteRefusedError recognizes a refusal from another copy of the storage package by name and shape (not by code alone). The document handler and POST /api/stages use it. - beforeAssetAllocate also gates PUT /assets/{id}/content. The request carries operation ('create' | 'replace') and the decoded assetId from the handler's own routing. - Agent runs: a refusal on a background write carries a fixed message, and create_stage answers it with a stable tool result. The host's message never reaches the model. - A byte store declaring signsReadUrls without a signer degrades to direct bytes with a warning instead of failing reads, and the collector no longer requires signing. - DocumentActor is discriminated by source ('request' with the principal, 'background' without one). - Library ids the read path cannot address are dropped, and a provider answer is capped at 5000 ids. - The boot-time ownership backfill logs how many courses it adopted without hooks. - The server persistence provider no longer exposes an unscoped document store. - The writesOutsideRegistryDatabase trust boundary and the scope of upload admission (HTTP uploads, not server-generated media) are documented. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): refuse misspelled hooks on host classes too A class instance skipped the unknown-key check, so a misspelled hook such as authorizeCreat registered cleanly and never ran, leaving creation ungated. Both configurePersistenceHooks and configureAssetByteStore now reject any function-valued property of a class instance (own or on its prototype chain up to Object.prototype, constructor excluded) that is not a known key, and any unknown key of a plain object. The error names the key and suggests the known key within edit distance 2. Host classes keep their helpers private (#helper) or register a plain object; the README says so. Also: - isDocumentWriteRefusedError requires a string message from a cross-copy candidate, and documents that the name is the effective discriminator. - CHANGELOG: ServerPersistenceProvider no longer exposes an unscoped documentStore; use the owner-bound store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(persistence): owner identity seam, phase 5 — tenancy lives in stage_meta only * feat(persistence): owner identity seam, phase 5 — tenancy lives in stage_meta only Course ownership was recorded twice: in stage_meta, which already answers every access decision, and in document_stages.owner_id, which the storage package scoped by. Two tenancy records double what a later claim has to re-key, and a host that keeps ownership in its own table had to rewrite the package's SQL to strip the column. @openmaic/storage 0.34.0: - PgDocumentStore never reads or writes document_stages.owner_id. An owner-bound store scopes listings, writes, deletes, the freshness manifest and folder membership through the host's ownership relation, named with the new documentOwnership option ({ table, stageIdColumn, ownerIdColumn, tombstoneColumn, claimOnCreate }, or false for no document scoping). Identifiers are validated, never quoted into SQL from arbitrary input. - forOwner / ownerId without documentOwnership throws at construction, so a direct consumer cannot upgrade into a store that silently scopes nothing. An unbound store is tenant-agnostic. - claimOnCreate inserts the ownership row in the create transaction; a concurrent create of the same id by another owner rolls back. - folders: false lets a host whose document_stages has no folder_id use the store; folder ids are unique per owner, so membership goes through the ownership relation too. - AssetCollector reads each document's owner from documentOwnership for assetReferencePrincipals, and refuses the function without it. - Schema: fresh installs get no owner_id column and none of its indexes; an existing column is kept for one release, made nullable with its default dropped (each ALTER guarded by a catalog check, so a replay takes no lock), and its two indexes are dropped. document_stages_folder_idx replaces the owner/folder index. Application: - The owner-bound store binds the package to stage_meta (STAGE_META_OWNERSHIP) and lists through it in one query; the asset collector schedule passes the same relation. - The boot backfill copies column-only owners into stage_meta before any store is built, only when the legacy column exists, idempotently, and logs how many it adopted and how many disagree (stage_meta stands). Tests cover a fresh install and an upgrade from the previous schema on PGlite and PostgreSQL 16, a host table with neither ownership nor folder columns, folder isolation across owners sharing a folder id, and the concurrent-create race. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): serialize schema bootstrap; guard unscoped owner-bound stores Review follow-ups for the tenancy change. - Concurrent starts: two instances starting against one database raced on the schema DDL (a duplicate pg_class / pg_type entry, or "tuple concurrently updated"), failing one instance's first request. Every schema bootstrap the application runs -- the persistence provider's sequence (runtime, documents, stage_meta and its ownership backfill, owner materials, assets), the agent-session, session-material and user-skill stores, and the asset collector's -- now runs under one PostgreSQL advisory lock held on a dedicated connection and released in finally. It lives in the application because what needs serializing is the whole sequence, including tables the package does not own. A PostgreSQL test boots eight instances at once, four rounds each, on a fresh and on an upgraded database; without the lock it fails every run. - documentOwnership: false on an owner-bound PgDocumentStore now also requires allowCrossOwnerDocumentAccess: true, so binding an owner for folders or asset principals cannot silently expose every owner's documents. - Documented that an ownership relation must cascade with the document rows (a leftover row keeps the id reserved for its owner, which is also how a host keeps retired ids from being reused), with tests for both. Leftover rows are deliberately not made claimable: a host cannot be told apart from one that keeps them as retirement markers. - Upgrade notes: the one-time table locks on the first start, and the out-of-band CREATE INDEX CONCURRENTLY / DROP INDEX CONCURRENTLY path that leaves the start with nothing to build or drop. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(persistence): leave the schema bootstrap lock out of the held-lock check The create-hooks suite asserts that its host lock is released with the create transaction by counting granted advisory locks database-wide. A suite booting a provider against the same database at that moment now holds the schema bootstrap lock, which is not the lock under test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(auth): owner identity seam, phase 6 — claiming anonymous work on sign-in * feat(storage): owner merge primitives for claiming anonymous work (0.35.0) Add the per-store pieces a host needs to move one owner's data to another inside a single transaction of its own: - reassignDocumentFolders(tx, { fromOwnerId, toOwnerId, documentOwnership }) moves folders and filing: a same-named folder merges into the target's, a colliding id is renumbered, and filing is rewritten in one statement from the old ids. - PgAssetStore.reassignPrincipal(fromKey, toKey) moves a principal's entries under both principals' write locks, in key order; quota is not re-checked. - PgUserSkillStore.mergeOwner(from, to) moves skills, renaming a live handle the target already uses with the first free numeric suffix. - PgUserSkillStore takes a resolveFinalOwner hook, run as the create transaction's first statement, like the agent-session store's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(auth): owner identity seam, phase 6 — claiming anonymous work on sign-in A visitor who works anonymously and then signs in can move that work to their account in one transaction, and the anonymous id is retired afterwards. - Principal: pendingClaim { fromOwnerId, assurance }. The trusted-proxy built-in sets it when a gateway request also carries a valid anonymous cookie; the anonymous and shared-team built-ins never do. Authenticators may implement describeStoredOwner, canonicalize and clearPendingClaim; principalFromStoredOwner describes a stored id for work without a request. - Claims: claimOwner / claimPendingOwner and registerClaimParticipant (sealed on first claim). One transaction, both owners' identity locks taken exclusively in key order, participants in a fixed order (folders, courses, materials, agent sessions, skills, runtime, assets), recorded in the new owner_merges table. Idempotent per pair; refuses a non-anonymous source, an anonymous target, a source already claimed elsewhere, and chains. Same-named folders merge, colliding folder ids are renumbered, colliding skill handles get a suffix, and quotas are not applied to what moves. - Identity lock: every owner write (documents, folders, asset allocations, material registration, agent sessions, skills) takes the owner's advisory lock in shared mode first, so a write racing a claim is moved or refused, never orphaned or deadlocked. - Retired ids: request writes are refused with 403 OWNER_RETIRED; agent runs and media generation that started before the claim follow the id to the account (forwarding document store, canonicalized stage probes, forwarded generated assets and skills). - Trigger: POST /api/identity/claim (same-origin JSON only; clears the anonymous cookie), or OWNER_CLAIM_TRIGGER=auto on the first request carrying a pending claim. The runtime contract's learner merge now performs the same claim, allowed only for the request's own pending claim. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(persistence): count only the suite's own advisory locks after concurrent creates The check that a host's transaction-scoped lock is released counted every granted advisory lock in the database. Suites that run against the same database at the same time hold advisory locks of their own (a schema bootstrap, the owner identity locks a claim takes), which made it fail depending on timing. Count only locks held by this suite's connections. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(auth): use a neutral example table for host claim participants Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(storage): owner merge fixes and store policy errors over HTTP (review round 1) - PgUserSkillStore.mergeOwner reserves every handle either owner holds before renaming: a claimed skill whose handle the target uses could be renamed into a handle another claimed skill still held, which violated the per-owner unique index and made that merge fail every time. - PgUserSkillStore.list orders ties by id. - PgRuntimeStore takes resolveFinalLearner(tx, learnerKey), run as the create transaction's first statement, so a host can fence session creates against its owner merges; reassignLearner(from, to) re-keys sessions without re-validating them, so one session a newer version wrote cannot block a merge. - Every HTTP handler (runtime, documents, assets) answers a DocumentWriteRefusedError as 403 with its code, and the new StorageBusyError (code, message, retryAfterSeconds) as 503 with Retry-After. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(auth): claims review round 1 — fenced runtime creates, bounded locks, retired-cookie recovery - Runtime session creates take the owner's identity lock as the create transaction's first statement and refuse a retired owner, closing the window in which a create racing a claim was left under the retired id. - Lock waits are bounded: a claim waits OWNER_CLAIM_LOCK_WAIT_MS (default 5 s) for its identity locks, a write OWNER_WRITE_LOCK_WAIT_MS (default 30 s); running out, or losing a deadlock or serialization race, answers 503 OWNER_BUSY with Retry-After on the claim routes and on every fenced write. - Every 403 OWNER_RETIRED carries the Set-Cookie values that drop the retired anonymous credential (the anonymous built-in now implements clearPendingClaim), so a browser whose claim response was lost recovers. Writes by id to rows that moved (skill delete, session messages) answer OWNER_RETIRED instead of not-found or a bare 403. - OWNER_CLAIM_TRIGGER=auto no longer claims ahead of the explicit claim routes, which now report their own claim instead of a false refusal. - The owner-events stream tells a retired owner only that it moved, never the claiming account's id. - Creates of one course id take turns (a per-id advisory lock before the ownership probe), so a concurrent second create saves as an update instead of failing as reserved-document. - A claim's source must be described as anonymous by the authenticator; the write fences skip the retirement lookup for every other owner. The host canonicalize hook is removed: forwarding is core's owner_merges alone. - The folders participant locks the source's stage_meta rows first; runtime sessions are re-keyed without re-validation; the owner asset store fences every allocation and refuses to allocate without transactions; background skill reads and patches follow a mid-run claim; the forwarding document store forwards methods only. - Docs: when a pending claim can arise with the shipped authenticators, the anonymous cookie as a bearer credential, bounded waits, the exact scope of OWNER_RETIRED, and claims narrowed to what the tests show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(auth): claims review round 2 — merge-record guard, boot-checked lock waits, stream credential drop - owner_merges records claims of anonymous owners only, since the write fences enforce retirement only for ids the authenticator describes as anonymous. Reading a row that retires any other owner now fails loudly instead of being followed but not enforced. The comment that pointed hosts at claimOwner for their own account merges is corrected: a host merging two signed-in accounts moves the rows itself and refuses the merged-away account in its authenticator. describeStoredOwner must classify ids stably. - OWNER_WRITE_LOCK_WAIT_MS and OWNER_CLAIM_LOCK_WAIT_MS are validated at boot with the same parser the lock paths use, so a malformed value stops the server instead of failing every write. - The owner-events stream answers a connect by an already retired identity with one owner_moved event and the Set-Cookie values that drop the retired credential, so a stale tab's reconnect loop ends after one round trip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * chore(auth): final polish before landing the owner identity seam * chore(auth): final polish before landing the owner identity seam - Pi routes refuse a rejected credential with the seam's INVALID_CREDENTIAL body. - Drop the unused LegacyAssetMutations alias and resolveLockWaitMs re-export. - Scope the document_stages.owner_id deprecation wording: the store no longer reads or writes it; the boot backfill reads it and a claim mirrors ownership into it for rollback. - Document OWNER_CLAIM_TRIGGER and the two lock-wait variables in .env.example. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(storage): 0.35.1 for the README wording fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * feat(identity): one identity entry point with composable auth methods * feat(identity): compose owner auth methods behind one entry point Owner resolution now asks an ordered list of owner auth methods instead of one configured authenticator. Each method answers `authenticated`, `not-applicable` (no credential of its kind) or `invalid` (its credential is present but bad). Core keeps the first `authenticated` answer, refuses any `invalid` answer with 401 INVALID_CREDENTIAL without asking later methods, and when no method applies falls back to the anonymous cookie owner, or answers 401 when the host turned the fallback off. Route handlers and Server Actions share the same order and per-request memoization. - configureOwnerAuthentication({ methods, anonymousFallback? }) replaces configureOwnerAuthenticator: single-shot, sealed on first use, and validated at registration and at boot. - anonymousCookie becomes the built-in fallback method; sharedTeam becomes a method, selected by PERSISTENCE_SHARED_OWNER_ID as before when nothing is registered, and kept beside host methods only when the host lists sharedTeamAuthMethod() last. The variable set beside a registration that leaves it out fails the boot. - Core attaches pendingClaim itself: a host method's non-anonymous principal on a request that also carries a valid anonymous cookie. A method may not set one. Claim cookie clearing and OWNER_RETIRED recovery go through the anonymous method's clearCredential. - principalFromStoredOwner consults the anonymous method first, then the configured methods' describeStoredOwner in order. - Remove the built-in trusted-proxy header authenticator with OWNER_AUTHENTICATOR and every TRUSTED_PROXY_* variable. The boundary test now also keeps the resolution internals inside lib/server/identity/ and asserts no source reads the removed variables. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(identity): document owner auth methods and a gateway JWT recipe Rewrite the owner identity section around the ordered auth methods: the three answers and what resolution does with each, the anonymous fallback, registration and its boot checks, and the sharedTeam rules. Replace the removed built-in gateway authenticator's documentation with a short host-owned recipe that verifies a gateway-forwarded signed JWT (oauth2-proxy, Cloudflare Access, IAP) against the identity provider's keys with the jose library. Update the claim section for the core-owned claim candidate, and the Chinese README, SECURITY.md, CHANGELOG and the deployment docs in every locale to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(identity): tighten retired-owner cookies, retired config and the boundary - On 403 OWNER_RETIRED, core now calls clearCredential only on the anonymous fallback and on methods that declare `issuesAnonymousOwners: true`, so an account method's session cookie is never cleared there. A clearCredential that throws is logged and skipped instead of turning the refusal into a 500. - Setting any retired OWNER_AUTHENTICATOR / TRUSTED_PROXY_* variable fails the boot with a pointer to the auth-methods docs, instead of silently serving every request anonymously. Only the names are matched, in one module the boundary test checks never reads a value. - Add lib/server/identity/host/ for host auth methods. The boundary test now scans core identity files for gateway identity headers too, polices reads of an incoming Authorization header everywhere but the host directory, and keeps resolution internals out of host code. - Document on OwnerAuthMethodResult that a present but unusable credential must answer `invalid`, never `not-applicable`, and that a method that cannot decide throws. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(identity): fix the gateway JWT recipe's error split and add notes - The recipe now answers `invalid` only for token failures (expired, claim validation, malformed JWS/JWT, bad signature, no or several matching keys, disallowed or unsupported algorithm) and rethrows everything else: jose reports a key endpoint that is down, answers non-200 or returns unparsable data as a generic JOSEError, which the previous version turned into a 401 for every user. - The recipe file goes in lib/server/identity/host/, with an accurate description of what the boundary test enforces. - Document invalid versus not-applicable for malformed credentials, issuesAnonymousOwners, the boot failure on retired variables, and that the claim candidate is an unsigned bearer cookie a sibling subdomain can shadow (serve on a registrable domain of its own; cookie hardening is deferred). Mirror the notes in the Chinese README, SECURITY.md and the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>@openmaic/storage@0.35.1 |
||
|
Nguyen Quang Thiepandwyuc
|
f2875426ae |
fix: pass reasoning_content back to DeepSeek in thinking mode (multi-turn) (#1486)
* fix: pass reasoning_content back to DeepSeek in thinking mode (multi-turn)
DeepSeek rejects multi-turn thinking-mode requests whose assistant messages
lack reasoning_content:
400 invalid_request_error:
"The `reasoning_content` in the thinking mode must be passed back to the API."
Two gaps caused it:
1. Round-trip loss. Responses fold reasoning_content into an inline
<think> block (then extractReasoningMiddleware splits it into reasoning
parts), but on the next turn the OpenAI chat adapter drops reasoning
parts. Kimi already had a preservation mechanism (marker encoding +
restore); extend it to DeepSeek, in both compatFetch and the middleware
assembly.
2. Missing field. A response that skipped reasoning (direct tool call)
produces an assistant message with no reasoning part at all. When
thinking is enabled, DeepSeek still requires the field, so inject an
empty reasoning_content for such messages.
Also: send the thinking toggle alone (no reasoning_effort) when the route
sets no explicit effort. Tool-using transports (maic-agent-driver) cannot
combine reasoning_effort with function tools; DeepSeek applies its own
default effort.
Verified: vitest (reasoning-sse, thinking-config, openai-sdk-integration),
Docker production build, and end-to-end multi-turn agent sessions with
thinking enabled (DeepSeek v4-pro + v4-flash) completing successfully.
* fix: close the DeepSeek reasoning round-trip on the agent-driver path
Review follow-up on the DeepSeek reasoning_content fix.
- One shared predicate, preservesReasoning(providerId, modelId), derived from
the resolved request adapter (deepseek + atlascloud deepseek models) plus
Kimi K3, now gates both the request-side wiring and the agent driver's
includeReasoning. The driver previously gated on kimi-k3 alone, so every
thinking block was dropped before the AI SDK saw the messages and the
middleware had nothing to encode.
- Driving the gate through the predicate covers atlascloud deepseek models,
which share the request adapter but were previously excluded by a literal
provider-id check.
- Scope the effort-less thinking toggle to requests that carry tools: a
tool-carrying request can never set reasoning_effort, while non-tool calls
keep the historical default effort.
- Inject the catalog thinking default for preserved providers so the wire
always states the mode explicitly, and gate both restore and backfill on
that resolved mode (a disabled turn carries neither markers nor field).
- Tests: DeepSeek counterparts of the Kimi K3 recorded-shape test covering
the round-trip across tool continuations, the empty backfill, the
reasoning_effort scoping, a non-preserving provider, the non-streaming
path, and the predicate itself. Verified they fail when the predicate is
disabled.
* fix: key the reasoning round-trip on the resolved thinking mode; cover the driver wire
Round-2 review follow-up.
- A disabled turn no longer ships the internal marker. The request-side step
now keys on the resolved ThinkingConfig instead of the serialized body, so a
disabled turn strips the sentinel instead of sending it verbatim; this also
covers Kimi K3, whose adapter emits reasoning_effort and no thinking object.
- Backfill an empty reasoning_content only for the DeepSeek request adapter.
- Add the missing driver-wire test: createCallLlmStreamFn with a DeepSeek turn
carries the prior thinking block as non-empty reasoning_content, and a
disabled turn strips the marker. Reverting the driver gate to the old
Kimi-K3-only check fails the first test; disabling the strip fails the second.
- Formatting: prettier clean for the touched files.
* fix: scope the effort-less thinking toggle to tool-carrying requests
Review follow-up. `options.hasTools || config.effort === undefined` also
dropped reasoning_effort for NON-tool calls that enable thinking without an
explicit effort (e.g. {enabled:true}), where the historical wire carried
reasoning_effort:'high'. Only a tool-carrying request must omit the effort
(the transport rejects function tools combined with it); every other request
keeps the explicit value or the default.
Updated the scoping test to assert reasoning_effort:'high' for the non-tool
no-effort case, and verified the assertion fails when the old condition is
restored.
* fix: derive the round-trip decision from the wire, not the requested mode
Round-3 review follow-up. Two remaining issues:
1. Kimi K3 disabled strips reasoning_content while the request still reasons.
getThinkingMode({enabled:false}) is 'disabled', but the openai-adapter body
builder emits reasoning_effort:'low' (no 'none' level exists), so thinking
was never actually off on the wire. getCompatThinkingBodyParams now also
reports disablesThinking, computed per adapter from the params it really
emits (true only where the wire carries an explicit off switch); the
round-trip gate keys on that instead of the requested config. Same fix
covers DeepSeek {effort:'none'}, which sends thinking:{type:'disabled'} but
previously went through restore.
2. Empty reasoning leaks the private marker into content. extractKimiReasoning
now reports a found flag, restore/strip act on it (marker removed in both
cases; field emitted only by restore), and the preservation middleware no
longer encodes empty reasoning parts, so the degenerate `:0:` marker is
never produced. Restore/strip share one internal helper.
Tests: Kimi K3 {enabled:false} recorded body (field kept + reasoning_effort
low present, no thinking object); DeepSeek {effort:'none'} (disabled object,
no field, no marker); driver-wire empty-thinking cases (enabled: field '' +
clean, disabled: no field + clean); Kimi K3 no-backfill pin; unit cases for
the empty marker. Each pinned by mutation: old gate fails T1+T2, serialized
absent-strip gate fails T1 plus the pre-existing Kimi test, found-revert
fails the empty-marker tests, widened backfill fails T4. Full suites green,
tsc and prettier clean.
---------
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
|
||
|
Oliveryfasoandwyuc
|
c125a7ac58 |
fix(workbench): localize material upload type and quota errors (#1672)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
LING DUANandwyuc
|
bc8d304bb3 |
fix(pi): reject malformed reference elements with validation errors (#1682)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
LING DUANandwyuc
|
04baad7c45 |
fix(pi): distinguish state errors from stale whiteboard references (#1681)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |