mirror of
https://github.com/THU-MAIC/OpenMAIC.git
synced 2026-10-29 00:46:40 +08:00
@openmaic/generation@0.3.22
461
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 杨慎andcosarah
|
6e20534fe0 |
fix(svg): validate malformed slide shapes and recover their text (#1915)
Add @openmaic/geometry, a browser-independent validator for SVG path syntax, finite view boxes and transforms and bounded resources, with structured errors and shared shape-to-text recovery. Generation, rendering, both editors and PPTX export use it: invalid shapes with a label render as text, unlabelled ones are omitted, stored records are not rewritten, and recovered shapes cannot be resized. Imported PPTX labels keep their own insets. Bumps generation 0.3.22, renderer 0.1.16, editor 0.0.12 and geometry 0.1.0. Closes #1851 Co-authored-by: cosarah <cosarah@users.noreply.github.com> |
||
|
OliveryfasoandOliveryfaso
|
aaca61742c |
feat(editor): derive current course issues and thumbnail markers (#1903)
Phase 1 of Course issues (#1900): a pure collectCourseIssues in @openmaic/dsl 0.12.0 derives issues from the current course document (speech without audio, generated-media placeholders, dangling cues, action-content lint) with stable ids and structured evidence, and the editor thumbnails show warning markers that clear when the issue is fixed. Narration issues are skipped when the workspace cannot generate audio. Related to #1900 Co-authored-by: Oliveryfaso <Oliveryfaso@users.noreply.github.com> |
||
|
jackandFrank-zhu2000
|
9c872bdde3 |
fix(agents): match generated agent voices to catalogue gender (#1908)
Pass catalogue voice gender to the agent-profile prompt, ask the model to keep voice, name and persona gender consistent, persist a language-independent voiceDesign.gender, and make the fallback voice pick prefer the agent's gender. Catalogues without male/female data keep the previous behavior. Closes #1084 Co-authored-by: Frank-zhu2000 <Frank-zhu2000@users.noreply.github.com> |
||
|
wyucandClaude Opus 5.5
|
729c044b5b |
chore(models): remove the retired Veo 3.1 preview models (#1948)
Google shuts down veo-3.1-generate-preview, veo-3.1-fast-generate-preview and veo-3.1-lite-generate-preview on 2026-10-22. They were the last models of the built-in Veo video provider (Veo 3.0 and 2.0 went in #1939), and the Veo adapter does not speak the API of Google's replacement, gemini-omni-1.1-flash. A catalog entry that cannot generate is worse than an absent one, so the provider is removed as Sora was: its catalog entry, type-union member, adapter, UI name and icon, VIDEO_VEO_* mapping, docs rows and tests. OpenRouter Video keeps google/veo-3.1, which OpenRouter serves from Vertex AI and is not part of this shutdown. Configurations written for earlier versions keep working. RETIRED_PRESETS names the removed preset: an openmaic.yml provider with preset: veo no longer stops the server, the slots that named such a provider (in the file or in workspace settings) follow their parents again, and startup notices ask to remove the provider and any VIDEO_VEO_* variables. Referencing the provider directly fails with the reason instead of "unknown preset". Supporting gemini-omni-1.1-flash is tracked in #1940. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
6b177f7abb |
feat(generation): show page currently being generated on course cards (#1856) (#1926)
* feat(generation): show page currently being generated on course cards (#1856) * fix(generation): derive current page from active step in course cards --------- Co-authored-by: cham <2577781125@qq.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
6b83751a87 |
fix: restore export after switching classrooms (#1934)
* fix: reset failed outlines when loading a classroom * chore(store): write the failedOutlines comment in English Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
AbelWangYaBoandwyuc
|
0be015bbb8 |
fix(media): bound provider media downloads in the video adapters (#1933)
Three adapters read a provider-returned file with a bare `response.arrayBuffer()` before inlining it as a data URL — the Veo and OpenRouter video downloads, and the ComfyUI `/view` image: a declared length past any sane size was still buffered in full, and a body without one (or longer than declared) was read without bound. #1688 bounded the MinerU Cloud reads and #1692 bounded the classroom media downloads; this applies the same shape to the adapters' own downloads. Move `bounded-download.ts` from `lib/server` to `lib/media` so the adapters can share the one mechanism (they run on both the browser and the server and, per the convention kept in #1695, import no `@/lib/server` code). The old path re-exports, so server callers are unchanged. `readResponseBodyWithLimit` gains an optional `label` that names the refused download in the error; without it, messages are byte-identical to before. `Buffer.concat` now takes the chunks directly. New `MAX_PROVIDER_MEDIA_BYTES` (200 MB) aligns with the agent runtime's `MAX_GENERATED_VIDEO_BYTES`, so a clip the persist path accepts is never refused one step earlier at the download. The Veo, OpenRouter-video and ComfyUI call sites swap `arrayBuffer()` for the bounded read at their single download choke point — after the redirect handling, so the `redirect: 'manual'` + `assertNotRedirected` guards (#1636) and the injected-transport paths (#1695) are untouched. Tests cover the fast reject, a stream that lies about or omits its length (and is cancelled on refusal), the unlabeled message shape existing callers assert, and one case per adapter driven through the public generate entry with an oversized declared download. Reverting any of the three call sites turns its adapter case red. AI-assisted commit Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
+13
|
dc88fb5011 |
feat(web-search): add Firecrawl provider (#1834)
* feat(web-search): add Firecrawl provider
* fix(generation): require explicit state publication and initialize game state (#1795)
* fix(generation): require explicit state publication and initialization
* fix(generation): bump package version to 0.3.16
* test(generation): stop old worker before seeding recovery checkpoint
* refactor: deduplicate export menu items (#1693)
Co-authored-by: Tiyatrotist <179411334+Tiyatrotist@users.noreply.github.com>
* fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS (#1798)
* fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS
validatePublicUrlForSSRF now passes clientSupplied: true.
Opt-in-governed refusals on that call — loopback, localhost, .local,
private, link-local, and CGNAT literals, and a DNS answer set whose
disqualifying addresses are all in those ranges — use a new string
stating that ALLOW_LOCAL_NETWORKS does not apply and that the endpoint
must be an operator-managed provider in server-providers.yml.
validateUrlForSSRF still returns the existing flag guidance when the
flag is unset and still allows those targets when it is set.
Cloud-metadata targets keep their own message, and reserved, multicast,
and broadcast addresses, including a DNS answer set that contains one,
keep the generic local-network message.
Fixes #1771
* fix(server): point client TTS URL refusal at openmaic.yml
1.2.0 deprecates server-providers.yml; operator-managed provider
endpoints now live in openmaic.yml under providers:.
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(render): isolate preview execution from video exports (#1830)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(test): normalize Windows path separators and replace shell grep in test suite (#1642) (#1828)
* test: normalize Windows path separators and replace shell grep in test suite (#1642)
* ci: re-trigger checks
---------
Co-authored-by: cham <2577781125@qq.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(export): drop non-woff2 font fallbacks instead of about:invalid (#1826)
* fix(export): drop non-woff2 font fallbacks instead of about:invalid
When an inlined stylesheet's @font-face offers a woff2, the inliner kept
only the woff2 and pointed the woff/ttf/otf/eot fallbacks at
url(about:invalid). Chromium and WebKit check every @font-face src URL
against the page's font-src CSP when the rule is parsed, whether or not
the face is ever used, so the standalone HTML export (font-src data:)
logged one CSP violation per fallback: about 40 for a page that loads the
KaTeX stylesheet. The woff2 fonts were inlined and render; the errors
were noise.
Remove those fallback entries from the src list instead, keeping local()
entries and format() hints, and remove a src declaration left empty.
@font-face rules without a woff2 are inlined as before, and a woff2 that
fails to fetch is still reported through the inline failure report.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): prune font fallbacks per src declaration
The woff2 check ran across the whole @font-face rule, so a later src
declaration without a woff2 (src:url(A.woff2);src:url(B.ttf)) was
removed and the earlier woff2 won the cascade instead of the authored
B.ttf. Judge each src declaration on its own: only a declaration that
offers a woff2 loses its woff/ttf/otf/eot entries, and declarations are
never removed.
Also treat an entry with a format("woff2") hint as woff2, so an
extensionless or mis-named woff2 URL counts and is never pruned.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): keep font fallbacks behind conditional woff2 sources
Only prune woff/ttf/otf/eot fallbacks that follow an unconditional woff2
source in the same src list: a single url() with a plain format("woff2")
or format(woff2) hint (or none, with a woff2 URL). A woff2 entry gated by
tech(), `supports` inside format(), a woff2-variations or multi-format
hint is skipped by browsers that lack the feature (WebKit does not support
tech(color-COLRv1)), so the fallbacks behind it are kept and inlined.
Entries before the first unconditional woff2 are kept as well, since a
browser would use them first.
Fallbacks after an unconditional woff2 are now also recognised by their
format() hint, so extensionless TTF/WOFF URLs are pruned too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): treat malformed woff2 format() hints as conditional
parseFontSrcEntry skipped separator tokens inside format(), so the
malformed `format("woff2",)` read as a plain woff2 hint and the fallbacks
behind it were pruned. Browsers skip such an entry, which left the face
with no usable source and no reported asset failure.
format() now keeps every token (separators as themselves, nested
functions and unclosed strings as empty tokens), and an unclosed url() or
format() counts as an extra part, so only an exact single `woff2`
keyword or string qualifies as unconditional. Anything else keeps and
inlines the fallbacks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(math): disable formula-defined macros in KaTeX and Temml rendering (#1827)
* fix(math): disable formula-defined macros in every KaTeX and Temml render
Add safeKatexOptions to @openmaic/dsl, the one package every renderer,
importer, editor and the app already depend on. It merges hardened
settings into each caller's options: macro-defining commands (\def,
\gdef, \edef, \xdef, \global, \long, \let, \futurelet, \newcommand,
\renewcommand, \providecommand) become inert macros that consume the
definition, trust is forced off, maxExpand is pinned, and a fresh
macros object is built per call so nothing persists between renders.
Caller options and caller-supplied macros are kept.
Route every render through it: whiteboard and slide latex elements,
quiz math, standalone HTML inline math, PPTX export via Temml, the
editor's latex dialog and inline math node, generated latex elements,
and the importer's formula paths. Keep the importer's node-globals
rollup plugin off the dsl build, whose old parser cannot read `??`.
Tests cover each render path with nested-definition inputs, a corpus of
legitimate formulas that must render byte-identically, \gdef isolation,
and a guard that fails if a new KaTeX/Temml call skips the helper.
Bump @openmaic/dsl 0.11.3, editor 0.0.10, generation 0.3.16,
importer 0.3.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(math): harden workbench chat math and newcommand parsing
Workbench chat Markdown rendered math through @streamdown/math, which
only forwards errorColor to rehype-katex. Add createSafeMathPlugin,
which keeps that plugin's remark side and rehype-katex instance but
replaces the rehype options with safeKatexOptions, and use it in the
chat text block.
Rework the inert \newcommand family: peek at unconsumed tokens so a
body written as {[} stays a body, accept the starred form, skip [n]
and [default] groups with brace-aware scanning, then consume exactly
one replacement body. Document that caller-supplied macros are trusted
code and must not be derived from content.
Replace the call-text coverage check with an import-aware guard built
on the TypeScript parser. It finds every runtime import of a math
engine (default, aliased, named, namespace, side-effect, import =
require, re-export, dynamic import, require) plus injected auto-render
script text, and requires each file to be on a reviewed allowlist.
Files that import KaTeX or Temml directly must use them only as render
calls with safeKatexOptions(...). The interactive post-processor is
allowlisted: its page already runs model-written scripts in a sandboxed
iframe. Fixtures cover each bypass shape.
Add KaTeX and Temml regression tests for the newcommand edge cases,
and the workbench chat path to the expansion-input suite.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(math): fresh macros per chat formula and stricter render guard
KaTeX writes built-in state into the macros object while rendering (an
align environment sets \@eqnsw), and rehype-katex spreads one options
object into every render. The workbench chat plugin shared one macros
object, so that state leaked between formulas and between messages.
Make macros an enumerable getter that returns a fresh hardened object
on every read, so each render and each error retry gets its own. Add
cross-formula and cross-message regression tests.
Tighten the guard for files that import KaTeX or Temml directly: any
engine reach other than a static default or namespace import (require,
dynamic import, re-export, import = require, side-effect import) is
rejected; the options argument is checked at each method's own
position with nothing after it; and it must be a call to
safeKatexOptions imported from @openmaic/dsl, not a local look-alike.
Document the guard's scope: module imports only; global access, engine
code inside other HTML strings and require.resolve need review.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(math): keep built-in equation numbering with macro definitions disabled
KaTeX and Temml implement \tag, \tag*, \nonumber and \notag as built-in
macros that expand to \gdef\df@tag{\text{...}} and \gdef\@eqnsw{0}.
Swallowing every \gdef therefore dropped equation tags and stopped
\nonumber / \notag from suppressing align/gather/equation numbers.
The inert \gdef now accepts exactly those two built-in shapes and stores
them the way the engines' own \gdef does; every other \gdef, and every
other definition command, stays inert. '@' is a letter in both lexers,
so formulas can name these macros directly; the allowed shapes add
nothing \tag* and \nonumber do not already provide:
- \@eqnsw may only be set to 0;
- \df@tag may only be one \text{...} group that never mentions \df@tag,
so the tag is expanded exactly once (a self-reference would recurse
until the call stack or the expansion budget runs out, as it does in
the stock engines on \tag{\df@tag}).
Tests: tagged and \notag/\nonumber formulas render identically to stock
KaTeX (html, mathml, htmlAndMathml) and Temml; the slide element, quiz,
editor dialog and Workbench chat renderers show tags and suppress
numbers; definitions inside tags, self-referencing tags, nested tags and
non-built-in \df@tag/\@eqnsw shapes stay inert.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(math): expand a tag in full only once per accepted definition
A formula can name \df@tag itself, so a long \tag*{...} (or an accepted
\gdef\df@tag{\text{...}}) followed by many \df@tag mentions re-expanded
the whole tag on every mention, up to the expansion budget: about 12 KB
of input produced several MB of output.
An accepted \df@tag is now stored as a macro that yields its body on the
first expansion and an empty \text{} afterwards. The engines expand
\df@tag once per formula, or once per align row before clearing it, so
tags render unchanged (stock-equality tests, including an align with a
tag on several rows, stay green in KaTeX and Temml). The empty \text{}
rather than nothing avoids a Temml TypeError on an empty tag.
Also document, and test through the PPTX export, that Temml throws a
TypeError on a script left bare by an inert definition (x^\notag); the
only Temml consumer catches it and returns null.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(generation): bump to 0.3.17 after main took 0.3.16
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(export): play the standalone HTML classroom with narration, effects and video (#1842)
* feat(export): keep playback actions and embed narration in standalone HTML
The standalone HTML manifest now keeps each scene's playback actions,
reduced to what an offline player can replay: speech text (plus its
audioRef when the bytes ship), spotlight/laser targets, play_video,
widget actions, and the discussion topic. Whiteboard actions, unknown
types, discussion prompts and agent bindings are left out.
With the new includeNarration option the snapshot collects narration
(stored and legacy audioUrl) and video bytes. Actions and video elements
name them by archive path, and the bytes travel as base64 data blocks
(script type="application/octet-stream") indexed by a media table, so
the browser keeps them as text until a clip plays. Payload collection is
format-neutral so a later folder variant can ship the same paths as
files. The export reports its byte size and missing narration; the CSP
is unchanged and the file still makes no network requests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(standalone-player): play the classroom with narration, effects and captions
A lightweight sequencer replays each scene's actions the way the
classroom's playback engine does, without its stores or IndexedDB audio
player (only the pure timing helpers are shared):
- speech waits for its embedded narration, or for the classroom's
reading-time estimate when there is none; its text is shown as a
caption that can be toggled;
- spotlight and laser drive SlideCanvas effects, fire without blocking
so they overlap the next speech, clear 5 s after the latest one and
on every scene change;
- play_video plays the embedded clip in place and waits for its end
(capped); a video without bytes keeps its poster;
- discussion shows a card with the topic and a link to the online
classroom, closing on its own after a few seconds;
- widget actions are posted to the sandboxed interactive iframe;
- whiteboard and unknown actions are skipped.
Playback starts only from the Play button (or Space), which primes the
shared narration element inside the gesture; a refused play() falls back
to the reading timer, and video to muted playback. Slide scenes advance
automatically; quiz, interactive and PBL scenes hold after their
narration, as the classroom's auto-play does, until the learner
continues. Navigating cancels the running scene cleanly and, while
playing, starts the new scene from its beginning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(export): choose narration in the HTML export menu and warn on large files
"Export as HTML" becomes a submenu, like the PPTX one: "With narration
and video" embeds narration audio and video clips, "Without narration"
keeps the file small (captions on the reading timer, poster frames for
videos). The option that fits the classroom is listed first. Narration
that could not be embedded counts as a partial export, and files above
100 MB get a size warning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): label narration by the container its bytes are
Stored narration can carry the wrong format: a provider that answers
WAV without a usable Content-Type is recorded as mp3. Exports then
labelled the clip audio/mpeg and named it .mp3, and WebKit, trusting
the label, reported a WAV with a streaming placeholder data length as
about 44,700 s long.
The narration collectors shared by the classroom ZIP and the standalone
HTML export now sniff the container from the leading bytes (RIFF/WAVE,
ID3 or MPEG frame sync, OggS, fLaC, ftyp, WebM) and use it for the MIME
type and archive extension; unrecognized bytes keep the stored label.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): tighten standalone media policy and build large files as Blob parts
- A slide video whose src is a direct URL no stored asset backs is now
fetched (same timeout policy as images) and embedded; when it cannot
be fetched it is reported as unresolved media instead of silently
falling back to its poster.
- "Without narration" now means no audio or video payload anywhere:
interactive pages do not fetch their <video>/<audio> sources (new
skipMedia inline option) and already-embedded clips are stripped,
while their images, posters and other assets are still inlined.
- Slide audio elements, which the offline player never plays, are no
longer collected or counted as missing narration.
- The document is assembled as Blob parts (base64 in pieces, clips
encoded one at a time), so no single string approaches V8's length
limit. The size is estimated from the media byte counts before
anything is encoded; above 400 MB the export stops with a localized
explanation (StandaloneHtmlTooLargeError, the hook for a future
page-plus-media-folder fallback). The 100 MB warning stays.
- Media block comments now say when a block is decoded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(standalone-player): stop videos at their cap and keep controls in step
- play_video now pauses the clip when its wait cap passes or the run is
cancelled, and clears the losing timer and listeners when the wait
settles, so a clip never plays on under the next narration.
- The video's own controls stay in step with playback: pausing the
awaited clip pauses playback and playing it resumes; starting any
other video pauses the narration, and resuming playback pauses that
video again.
- Space leaves a focused video or audio element to toggle itself, and
keeps scrolling quiz and PBL scenes when focus is inside the scene.
- A caption lasts as long as its speech, so nothing is left over a
held quiz or interactive scene.
- Play after the last scene finished starts over from the first scene.
- The start overlay shows on whichever scene the file opens on and goes
away on any navigation, a hash change included.
- Body text is antialiased like the classroom page.
- Tests for the media ports (pause racing play, refused and failing
clips, muted retry, cap, control sync, widget queue), the media
library, the overlay and Space rules, and holding for every held
scene type.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): exact size ceiling, thorough media stripping, ADTS behind ID3
- Resuming the awaited video through its own controls now pauses any
video started by hand, as resuming playback by any other path does.
- The size estimate counts the manifest as the escaped UTF-8 bytes the
document carries, and the assembled Blob is checked against the
ceiling too, so the 400 MB guard holds exactly (maxBytes is an option
for hosts and tests).
- Without narration, the src of <video>, <audio> and their <source>
elements is stripped for any data: URI whatever MIME it declares, and
stripping recurses into nested srcdoc documents (bounded depth; deeper
documents are dropped).
- Audio sniffing skips a leading ID3v2 tag (syncsafe size) and reads
the frame after it: MPEG audio stays mp3, AAC ADTS becomes aac, also
for untagged ADTS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(standalone-player): toggle a focused video on Space in every browser
WebKit's native video controls ignore Space, so with the slide video
focused nothing happened while the video kept playing. The player now
handles Space on a focused video or audio element itself, in the
capture phase, toggling that element and stopping the press so
Chromium's native toggle does not fire as well; the element's play and
pause events keep playback in step exactly as its controls do.
Verified in Chromium, WebKit and Firefox.
The "Without narration" export description no longer promises a still
frame for videos (generated videos have none); it says videos are not
included, in all locales.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(export): fall back to a ZIP of classroom.html and its media for large classrooms (#1845)
* feat(export): add a stored ZIP writer that references its entries' Blobs
The standalone export's media-folder variant ships already-compressed
narration and video. JSZip reads every input Blob into an ArrayBuffer and
concatenates its output into one ArrayBuffer, so a multi-hundred-megabyte
archive would sit in the tab several times over. This writer stores entries
uncompressed, reads each one a slice at a time only to compute its CRC-32,
and returns a Blob composed of the entries' own Blobs, so no media is
copied. Paths are checked to stay inside the extraction folder, and
archives plain ZIP cannot describe (4 GiB) are refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(standalone-player): say so when media shipped next to the page is missing
A page whose media table names files by relative path (the ZIP variant of
the export) plays nothing when opened without them: straight from inside
the ZIP, or copied out alone. The media library now probes one linked file
as the player opens and records any linked clip that fails to load, and the
player shows a notice asking to extract the whole ZIP. Playback carries on
as before: failed narration falls back to the reading timer and a failed
video no longer holds the sequence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(export): fall back to a ZIP of classroom.html and its media folders
A classroom whose single HTML file would pass the 400 MB ceiling is now
exported as a ZIP instead of refused: classroom.html carries the player and
manifest, and its media table names each narration and video file by
relative path (audio/..., media/...) next to it, plus a README in the UI
locale and English. The ZIP needs no base64 and copies no media, so it is
built from the same snapshot without a second collection pass.
The page's CSP differs from the single file's only in media-src, which adds
'self' so <audio>/<video> elements may load the sibling files (Chromium and
WebKit match it against file: URLs when the page is opened from disk);
connect-src stays 'none', so the player never reads the bytes itself. The
single file is unchanged, byte for byte.
The fallback is automatic, at the same ceiling, because one file is the
better format wherever it works; the export menu keeps its two entries.
A toast explains why a ZIP was saved and that it must be extracted before
opening classroom.html.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): keep stored ZIP fields below the ZIP64 sentinels
0xFFFF entries and 32-bit sizes or offsets of 0xFFFFFFFF announce ZIP64
records, so a plain archive must stay below them: the writer now refuses
65,535 entries and any size, offset or archive length that would reach
0xFFFFFFFF, and limits entry names by their UTF-8 bytes (what the header
field holds) instead of UTF-16 units. The CRC slice size is injectable.
Tests now read the raw bytes: every local header is compared field by
field with its central directory entry and the end record, and the CRC
carry across slices, the boundaries and the DOS date clamp are covered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(standalone-player): report every linked file that fails, and word the notice for both causes
WebKit and Firefox reject play() with NotSupportedError for a narration
file that is not there, before (or without) an error event, and the clip's
handler was gone by the time the event fired: a missing clip after a
successful startup probe played silently with no notice. The rejection
now reports linked clips, and the narration element keeps a standing error
listener for the clip it is loading.
When the media table links no file (an export without narration), the
startup probe loads a linked slide image instead.
A file in a codec the browser cannot play fails exactly like a missing one
on file:, so the notice now covers both: "Some images, narration or video
couldn't be loaded. If you opened classroom.html from inside the ZIP,
extract the whole ZIP first." Adds a SlideScene test for video errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): ship slide images as files in the ZIP and refuse an oversized page
The ZIP fallback kept slide images, backgrounds, patterns, chart point
images and video posters inline as data: URIs, so a classroom heavy in
images could produce a ZIP whose classroom.html alone passed the ceiling.
In the ZIP they are now files under images/, named by relative path, and
the page's CSP adds 'self' to img-src as well as media-src. Image bytes
are collected once and encoded as data: URIs only for the single file; the
single file's size is estimated from the linked manifest, exactly, without
encoding anything. The single file is unchanged.
Media inside interactive scenes stays inline: those pages run in sandboxed
opaque-origin frames, which Chromium and Firefox do not let load files
from disk (WebKit does). A ZIP whose page alone still passes the ceiling
is refused with its own message (StandaloneHtmlTooLargeError of kind
"page"), and the fallback toast and README name what the ZIP holds.
The CSP comment now spells out what 'self' allows when the folder is
served over HTTP: same-host GETs, with cookies, from image and media
elements (interactive frames included); nothing can be read back, since
connect-src stays 'none'.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): keep chart point images inline and ship inline slide images as files in the ZIP
Two gaps in the ZIP variant's image handling:
- Pictorial charts rendered blank: the chart renderer wraps each point
image in a data: SVG symbol, which cannot load a file, so a relative
path there drew nothing in any browser. Chart point images now stay
inline as data: URIs in the ZIP (a ref named only by a chart ships no
file).
- Images that were already data: URIs (images, backgrounds, shape
patterns, video posters) were never collected and stayed in the page,
so such a classroom could still be refused as too large. In the ZIP
they are now decoded into files under images/, one per distinct URI;
a MIME type no file extension conveys, or a malformed URI, stays
inline. The single-file estimate counts each one as the exact escaped
URI it replaces, and the single file keeps them as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): follow-ups from the standalone HTML playback review (#1848)
* fix(export): pause a first hand-started video when a second starts; keep captions off narrow scenes
Starting a second video by hand on one slide left both playing. The
registry now pauses the other hand-started videos (never the one the
sequencer awaits).
On narrow viewports the caption bar covered part of the scene (quiz
options). It now has its own strip below the scene; from the sm
breakpoint up it overlays the scene as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): accurate export messages and menu order; static fallback without JavaScript
- Size warnings only suggest exporting without narration when narration
was included.
- Missing narration clips get their own toast wording instead of being
counted as external assets that could not be bundled.
- The HTML export submenu prefers 'with narration and video' when the
classroom has narration audio or slide video.
- The file carries a static message for viewers that do not run scripts
(iOS Files preview, scripts disabled or blocked). It sits right before
the player script so it never paints while a large file parses, is
removed when the player mounts, switches to a generic "couldn't start"
message if the player fails, and has a <noscript> copy. Localized
through the player strings; the CSP is unchanged.
- Caption strip: fixed height, only while playback is active, scrolls long
lines, also used on short (landscape) screens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): fallback message on the first screen; report failed linked images; skip ZIP-only decoding for single files
- The static fallback message sat below the empty full-height root, so it
started below the first screen. The empty root is now hidden until the
player mounts. The fallback is removed after the player's first commit
(not right after render()), so a first-render error still shows the
"couldn't start" message.
- The no-JavaScript hint no longer names a platform-specific sharing step.
- Slide images that fail to load from a linked relative path (a missing
images folder) now trigger the linked-files notice, also when the audio
and video probes load.
- Inline data: images are only decoded into files once the ZIP is going to
be built (about 0.6 s and +100 MB for 100 MB of images otherwise); the
single file and its size estimate are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(storage): bound DocumentStore HTTP requests with a deadline (#1790)
* fix(storage): bound DocumentStore HTTP requests with a deadline
HttpDocumentStore issued every request without a deadline, so a request
whose peer never answers held its promise forever. The stage autosave
keeps at most one save in flight (startFlushRound's flushInFlight guard)
and starts the next one only once that promise settles, so a single
stalled save silently stranded every later save for the life of the page
— generation and the editor kept working from the in-memory store, and
the loss only surfaced on reload.
Bound the request round trip — sending the body and receiving the
response headers — with an AbortController deadline (requestTimeoutMs,
default 30s, <= 0 disables). A stalled request now rejects with
HttpDocumentStoreError(0, 'HTTP_REQUEST_TIMEOUT'), which the autosave's
existing backoff already retries. This mirrors the budget HttpAssetStore
applies via probeTimeoutMs / startBoundedOperation.
Reading the response body stays outside the bound: a large document on a
slow link is slow, not stalled.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* docs(changelog): describe the request budget's fixed throughput and ceiling
The throughput and ceiling are module constants, not HttpDocumentStore
options; only requestTimeoutMs is configurable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(export): hide the no-JavaScript fallback as soon as the standalone player starts (#1850)
The static fallback message is now hidden synchronously when the player
script runs (kept in the DOM), so a slow parse of a very large file can no
longer reveal it before the first commit. A start failure (sync or async
render error) un-hides it with the "couldn't start" text; it is still
removed after the first successful commit. Scripts that never run leave it
visible as before.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(generation): explain exhausted plan quotas (#1831)
* fix(generation): explain exhausted plan quotas
* test(generation): use nullable model metadata in quota fixture
* fix(generation): keep provider quota detection neutral and scene-scoped
Address the review of #1831:
- The shared classification no longer reads vendor codes. MiniMax TTS and
web search translate base_resp 1008/2056 into ProviderQuotaExhaustedError
(thrown, or as the cause of the rate-limit error an HTTP 429 keeps), and
isUpstreamQuotaExhausted checks only that marker and the
OpenAI-compatible wire codes.
- The built-in classification reports PROVIDER_QUOTA_EXHAUSTED, so a host
that meters its own QUOTA_EXHAUSTED can tell the two apart, and a host's
start refusal keeps the host's own message.
- The classroom passes the guidance only while the pending scene card is
the scene the run paused at; a scene the run went on past keeps the
generic failure text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PyhoDKKJ3gVoPbvCT3T99K
* test(generation): cover quota guidance through the classroom hook
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* Preserve rotation for generated slide shapes (#1855)
* fix preserving generated shape rotation
* bump generation package version
* fix generation rotation check formatting
---------
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(storage): support path-style S3 addressing (AI-assisted) (#1849)
Adds an opt-in `AWS_S3_FORCE_PATH_STYLE` (`true` or `1`) that sets the AWS SDK v3 `forcePathStyle` client option for the S3 asset byte store, so S3-compatible stores such as MinIO and Ceph can be addressed as `endpoint/bucket/key`. Unset keeps the existing Amazon S3 behaviour. Bumps `@openmaic/storage` to 0.37.3.
Fixes #1686
Co-authored-by: weinaike <13814354+weinaike@users.noreply.github.com>
* fix(render): bound preview capacity through launch cleanup (#1836)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(sanitize): store inline math as LaTeX source and typeset it in the client (#1829)
* fix(sanitize): keep inline math through the scene-content sanitizer
The prose policy flattened the editor's inline formulas on every
persistence read and write: it dropped data-inline-math, the MathML
annotation, the layout SVG and KaTeX positioning, so saved formulas
rendered broken and their LaTeX source was lost.
Move the lift / sanitize / re-render approach from the standalone HTML
export into lib/sanitize/inline-math.ts and apply it in
sanitizeProseHtml, so the persistence boundary and the export share one
implementation. It parses with parse5, so it needs no DOM and runs on
the server and in the browser alike. Each formula is replaced by an
empty source span before sanitizing, and every surviving source span is
replaced afterwards by a fresh KaTeX render (trust: false); authored
markup never bypasses the policy. Prose without a formula skips the
parse and is sanitized byte-for-byte as before. Renders are cached by
source, and pathological markup falls back to the plain policy instead
of failing the read or write.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(sanitize): bound inline math rendering and detect encoded KaTeX classes
KaTeX markup is 100-150x the size of its source and is regenerated
synchronously on every persistence read and write, so one large formula
could block the event loop for seconds and pin hundreds of MB in the
render cache.
- Render a formula only if its source is at most 2000 characters, and
within a per-call budget of 16000 source characters and 1000
formulas. Anything else stays a source span showing its LaTeX as text,
so nothing is lost and the editor still recovers it. Limits are counted
in document order, never time, so repeated passes stay stable.
- Bound the render cache by markup size (1 MB) and never cache renders
over 32 KB.
- Pre-check on `data-inline-math` or `annotation` instead of `katex`:
element and attribute names cannot be written as character references,
but a class value can, so an encoded `katex` class no longer skips the
lift and loses its source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(sanitize): store inline math as source and typeset it in the client
Rendering formulas on the server made every persistence read and write
run KaTeX on authored input, which user macros and long sources can turn
into seconds of CPU per document. Store each inline formula as its LaTeX
source instead and let the clients that display slides typeset it.
- The prose sanitizer reduces each inline formula (span[data-inline-math],
else span.katex with a TeX annotation, entity-encoded class included)
to <span data-inline-math="SRC">SRC</span> and allows only that
attribute. The source doubles as text for consumers that do not render
math. A source over 2000 characters is kept as plain text. The pre-pass
uses htmlparser2, the parser sanitize-html uses, so it is linear and
sees the same element boundaries; prose without a formula marker is
sanitized exactly as before. The server never runs KaTeX, and the
parse5 lift, render cache and budgets are gone.
- @openmaic/renderer typesets span[data-inline-math] in text, shape and
table prose after injection (renderInlineMath / useInlineMath), with
trust disabled, macro definitions blocked and bounded expansion. It
also re-renders older content that still carries KaTeX markup. The
app's slide renderer components use the same hook. Bump the renderer
to 0.1.12.
- The standalone HTML export ships source-only formulas, which the
player's renderer typesets, and ships the math fonts when a slide has
an inline formula.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(slide-renderer): keep cell markup intact when formatting table text
formatText turned every space in a table cell into , including
the spaces inside tags, which broke any cell markup with attributes. An
inline formula in a cell was shown as its raw source instead of being
typeset. Only format the text between tags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(renderer): allow 1000 macro expansions when typesetting inline math
A cap of 50 expansions rejects realistic long formulas: built-in
commands such as \neq, \iff, \, and \dots each count, and a formula with
a few dozen of them needs over 100. Macro definitions are blocked, so
expansion stays linear in the source and 1000 is only a backstop. This
matches the shared safe KaTeX options.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(sanitize): replace self-closing inline formulas in SVG and MathML once
Inside SVG or MathML the parser honours `/>` and reports the close as
implied while still on the opening token, so the replacement ended
before the formula started and the original span stayed next to the
stored one; the next pass then stored it again. End a formula no earlier
than its opening tag. Adds SVG and MathML cases and fuzzes the pass for
idempotency and formula shape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(renderer): keep inline math typeset across re-renders
React can rewrite `dangerouslySetInnerHTML` markup on a re-render even
when the HTML string is unchanged, which put the stored source spans
back after a move or resize while the effect, keyed on the HTML, did not
run again. Typeset after every commit instead: formulas already typeset
are skipped, and typeset formulas are cached by source and cloned, so a
re-render costs a query and, at most, cheap clones. Typesetting never
updates React state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(renderer): budget inline math typesetting per prose root
One slide packed with large formulas could block the page for hundreds of
milliseconds on every mount. Typeset at most 4000 characters of uncached
source or 100 uncached formulas per pass over a prose root before paint,
and the rest in idle time, a chunk of the same size per idle period. The
next commit, an unmount or new content cancels pending idle work. Past
50 000 characters or 1000 formulas per root, formulas are shown as their
LaTeX text. Slide snapshots typeset everything before capture. Covers
identical-content re-renders and A, B, A, A content sequences in both
renderers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(renderer): keep inline math progress across commits and complete snapshots per root
- Give injected prose a stable dangerouslySetInnerHTML value per markup
string (text, shape label and each table cell, in both renderers), so
React leaves unchanged markup alone. Typeset formulas and pending idle
progress then survive re-renders; formulas too large to cache are no
longer typeset again on every commit. The every-commit pass stays as a
safety net.
- Mark each prose root and complete snapshots root by root, so each text
box keeps its own hard cap as on the live slide instead of sharing one
slide-wide count.
- Apply the hard cap from document order on every pass, whatever earlier
passes typeset, and let a formula shown as text by an earlier cap be
typeset once it falls within its root's cap.
- Note that the render cache bound counts serialized characters.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(renderer): bump to 0.1.13 after rebase
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(renderer): typeset inline math through the shared safeKatexOptions
Replace the local stand-in options (inert macro-definition commands,
trust: false, maxExpand 1000) with safeKatexOptions from @openmaic/dsl,
keeping the inline-specific settings (displayMode: false, output: html,
throwOnError: false, strict: ignore). The shared helper's expansion budget
is the same 1000, and it also keeps the built-in \tag/\notag state and
makes \long inert.
The math engine guard now lists the renderer's inline-math module as a
render-calls site and drops the standalone HTML rich-text module, which no
longer renders KaTeX itself.
Tests: ordinary formulas typeset byte-for-byte as with the previous
options, and formula-defined macros stay inert within one formula and
across formulas in the same prose root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(sanitize): keep over-long inline formulas as formulas; bound typesetting only
The 2000-character bound dropped the data-inline-math marker at save time,
so an over-long formula became plain text for good. The bound now applies
only where formulas are typeset: the slide renderer already shows an
over-long source as text, and the editor's inline_math node now does the same
instead of typesetting it, using the renderer's MAX_INLINE_MATH_SOURCE.
@openmaic/editor 0.0.11.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(sanitize): a 100 KB formula is kept as a formula in the node-environment suite
Follows the sanitizer change: the length bound applies to typesetting only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(media): add GLM (Zhipu CogView) image generation provider [AI-assisted] (#1832)
Co-authored-by: cham <2577781125@qq.com>
* fix(generation): stop retrying explicit provider quota refusals (#1861)
* fix(generation): stop retrying explicit provider quota refusals
* fix(generation): review follow-ups for provider quota refusals
- Leave a quota refusal the host classifies to the host, as documented for
`classifyFailure`: the built-in rule (`isProviderQuotaRefusal`) applies only
to refusals it does not answer for, at every retry site.
- Name an exhausted quota in the fallback log line, from the failure that
fired the fallback rather than an earlier attempt's.
- Stop reporting a retry after the outline fallback returns empty output.
- Drop the PBL loop-fallback change: a provider failure with an HTTP status
already skips the loop, and no LLM adapter throws the native quota marker.
`@openmaic/generation` stays at 0.3.18.
- Document that an explicit quota refusal goes to the fallback at once
(configuration, all six languages) and how it meets `classifyFailure`.
- Test a 403 quota refusal falling back, a quota refusal the host classifies
as retryable, and the stream error shapes the classifier reads.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(generation): persist quota refusal regression coverage
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(persistence): share one AsyncLocalStorage across owner-bound stores (#1871)
* fix(persistence): share one AsyncLocalStorage across owner-bound stores
createOwnerBoundDocumentStore() built a new AsyncLocalStorage on every
call, and servers build a store per request. Every AsyncLocalStorage that
has run stays registered with async_hooks for the life of the process, so
each new promise paid a context propagation for every store ever created.
The cost grew linearly with requests served: under sustained load the main
thread saturated in async_hooks propagation and GC, and the event loop
stalled long enough for health checks to time out.
Carry the pending operation in one module-level AsyncLocalStorage instead.
Each store gets a small OperationScope; running an operation pushes a frame
that names its scope and links to the enclosing frame, and a store reads the
nearest frame of its own. This keeps the previous semantics: a store never
sees another store's operation, an operation of another store started inside
it does not hide the outer one, and the innermost of a store's own nested
operations wins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(persistence): keep only each store's current operation in a context
A context's operation frame linked to every frame that was current when it
started, including other stores' and finished ones, so fire-and-forget work
that kept re-entering stores retained every earlier operation for as long as
its newest callback lived. Hold an immutable map of each store's current
operation instead: a context now keeps at most one operation per store,
exactly as a storage per store did.
Mark OperationScope as exported for tests only, and export the operation
type so the test can name it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(persistence): note the snapshot size and restore the gc flag in tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(security): enforce model authorization for server-managed providers (#1879)
Providers configured with server credentials only send model ids the deployment authorizes (explicit model list plus default/fallback/slot references for the capability); anything else gets the same HTTP 403 before the provider is contacted. Covers chat, verification, media, speech, transcription, model-based search, generation, agent, PBL, quiz grading and workspace assignments. Breaking change: credentialed providers without a model list accept only their default/fallback models.
Co-authored-by: I3ob0 <huzi0404@163.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note automated Codex PR review in CONTRIBUTING (#1882)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(media): stop serving legacy media of deleted courses (#1883)
The classroom media route now checks the course lifecycle before touching the filesystem: a tombstoned course gets the same 404 as a missing file, a lifecycle lookup failure fails closed, and live courses (including legacy media without a course row) are served as before. Successful responses use private, max-age=300, must-revalidate; 416 and errors use private, no-store.
Co-authored-by: duanjialing.777 <duanjialing.777@bytedance.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(render): bind render jobs to the requesting owner (#1884)
Each MP4 render job is bound to the immutable owner of the submitting request: the app proxy asserts the owner on submit, poll, cancel and download, and the render-service only finds jobs for that owner (foreign and unknown jobs get the same 404, with no cancellation or artifact lookup). Job operations live under a separate /owner-bound/render namespace, so an instance that predates owner binding answers 404 without running a job handler and mixed old/new pools fail closed; job responses must carry the owner-bound marker. Upgrade the render-service together with or before the app.
Co-authored-by: duanjialing.777 <duanjialing.777@bytedance.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* release: v1.2.0-rc.2 (#1885)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workbench): refuse oversized material uploads before sending them (#1887)
* fix(workbench): refuse oversized material uploads before sending them
The workbench uploader posted every picked file to /api/materials and only
learned about the size cap from the server's 413. The route does refuse an
oversized declared content-length early, but a reverse proxy that buffers
request bodies (nginx's default) still makes the browser send the whole file
first, so a user picking a 200 MB file waits for the full upload before
being told it is too large. Without such a proxy, the early 413 tends to
surface as a generic network failure instead of the size message.
Read the caps the capabilities endpoint already advertises
(maxDocumentBytes / maxMediaBytes, derived from the upload route's own
limits) and refuse a file over its class cap before any bytes are sent,
with the existing "file too large (limit X)" copy. The caps stay
server-owned, so a deployment that raises them is not blocked by a browser
constant. Discovery is fetched once per page and shared; a failed, invalid
or slow (>5s) read fails open to the server's 413, and once a read has
timed out later uploads do not wait on it again until it answers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(workbench): leave unsupported types to the server's 415
The upload route rejects an unsupported MIME (415) before it applies a size
cap. Only precheck the size of supported types, so an oversized unsupported
file still gets the format error instead of being told to shrink.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(import): preserve committed document on lost response (AI-assisted) (#1864)
* fix(import): preserve committed document on lost response (AI-assisted)
A rejected save response can arrive after the server has committed the imported aggregate. Do not compensate by deleting the stage, because that turns an unknown write outcome into permanent data loss. Keep disposable local-cache cleanup and cover the response-loss path with a stateful regression test.
* fix(import): verify rejected document saves
Read the new document back when saveDocument rejects. Treat a found document as committed, while confirmed absence and read failures keep the import on the error path without destructive cleanup. Cover all three outcomes in the stateful import test.
* ci: cover every app PostgreSQL contract suite (#1867)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(chat): guard Pi classroom tool calling before inference (#1894)
* fix(chat): guard Pi classroom tool calling before inference
* fix(i18n): match Pi model guidance to settings labels
* fix(renderer): cancel idle typesetting with its own pair and keep release-gate tests stable (#1901)
* fix(renderer): cancel idle typesetting with the pair that scheduled it
whenIdle checked requestIdleCallback/cancelIdleCallback when scheduling but
read cancelIdleCallback again when cancelling. If the global was removed or
replaced in between (a test stub restored, a polyfill swapped in), unmounting
a text element with pending inline math threw "scope.cancelIdleCallback is not
a function", or handed the handle to an implementation that never issued it.
Capture the request/cancel pair, and setTimeout/clearTimeout for the fallback,
at schedule time and always cancel through the captured function.
Make the inline-math regression tests fast and deterministic on a loaded
runner without dropping what they pin:
- Budget tests use distinct formulas padded with trailing spaces to 1,900
source characters. The budget counts source characters, so they cross it
exactly like the old 1,357-character matrices, at a fraction of the
typesetting cost.
- The uncacheable-render test uses 40 radicals per formula: each render is
still over the 64,000-character cache entry limit (asserted), several times
cheaper than a large matrix.
- Idle-time work runs through a stubbed idle queue that the test flushes,
instead of polling wall-clock timers; a fake-timer test covers the
setTimeout fallback.
- The snapshot tests replace KaTeX with a trivial typesetter (real
typesetting is covered by the element tests), use the minimum fixture that
crosses the per-root cap (2 x 501 formulas), wait for the deferred unmount
before restoring stubs, and count formulas only within the tree being
measured.
The [600, 600, 600, 600] measurement in the failed release run was a cascade:
slideToPng timed out, kept running, and its off-screen tree was still in
document.body when the next test counted roots across the whole body. Its
deferred unmount then ran after the idle stubs were restored, which is what
raised the unhandled TypeError.
New tests cancel after cancelIdleCallback is removed or replaced, and after
clearTimeout is replaced; they fail on the previous implementation.
Bump @openmaic/renderer to 0.1.14 so the next publish run releases it
(0.1.13 never reached the registry).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(packages): keep release-gate tests stable on a loaded runner
The publish workflow runs every package's tests concurrently on one runner.
Two more checks in that step failed when the suites were run under CPU
contention:
- The macro-safety tests in editor, generation and importer asserted that a
render takes under 100 ms. On a loaded runner a guarded render can exceed
that. Raise the ceiling to 1 s: the unguarded nestedDef expansion takes tens
of seconds, a guarded render a few milliseconds, and the output-size and
error checks that follow are what show the definitions were dropped.
- Editor tests never unmounted their trees, because Testing Library only
registers automatic cleanup when the runner exposes a global afterEach.
React work still queued at the end of a file then ran after jsdom was torn
down ("window is not defined"). Clean up after each test in the shared
setup.
Test-only changes; no package version bumps are required.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(tests): make the suite reliable on Windows and newer Node runtimes (#1890)
- tests/ci/publish-openmaic-skill.test.ts: resolve bash the way PATH
finds it on Windows (/bin/bash elsewhere) and join PATH with
path.delimiter. All 16 cases failed on Windows before this.
- tests/store/kv-persist.test.ts: dedupe standing-problem reports per
key; how many recovery attempts elapse inside flushTasks is
wall-clock, not code.
- tests/workbench/workspace-rail-session-rename.test.ts: wait for the
row/menu with vi.waitFor(..., { timeout: 30_000 }) and give the suite
its own 30s budget for the cold dynamic import of the rail.
- tests/lint-llm-entry-guard.test.ts: 120s suite timeout — every case
runs the real eslint over every guarded path.
The media-orchestrator part of the original change is dropped: upstream
rewrote that suite and removed the fragile microtask-hop waits it
targeted.
No production code, no global config changes, no assertion weakened.
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* fix(generation): parse data URLs without regex and cap vision image size (#1902)
## Summary
Large or unsupported images attached to vision requests can crash prompt building or be rejected by the model provider, and a single bad image fails the whole generation step (retries fail the same way).
- **`@openmaic/generation` 0.3.19**: `buildVisionUserContent` no longer runs a regex over the whole data URL. A new exported `parseBase64DataUrl` splits header and payload with plain string ops, so multi-megabyte payloads are never scanned by the regex engine.
- **Vision image cap (app)**: new `prepareVisionImages` (`lib/server/generation/vision-images.ts`) runs right before every vision call — outline, scene content, scene actions, and the PBL evaluator (which receives uploaded submissions).
- Pass-through only for single-frame, 8-bit sRGB/grayscale png/jpeg/webp/gif whose **base64 payload** is within `MAX_VISION_IMAGE_BASE64_BYTES` (1 MiB — providers measure the encoded payload) and whose longest side is within `MAX_VISION_IMAGE_DIMENSION` (2048 px). Pixels are strictly decoded first so truncated data is caught. http(s) URLs are untouched.
- Everything else (oversized, animated, CMYK, 16-bit, unsupported formats) is decoded once with sharp (first frame, EXIF-rotated, resized inside 2048, flattened on white, sRGB) and encoded to JPEG, stepping quality down until under the cap.
- Images that still don't fit or can't be decoded are dropped with a warning; the step continues.
- Preparation runs where vision images are resolved (outline and scene-content pre-resolution), so the prompt's "[see attached]" placeholders and asset-id mappings only describe images that are actually attached. The PBL evaluator logs when an image submission is evaluated without its image.
- Processing is sequential to bound peak memory.
Non-goals: no change to material upload/extraction, prompts, or generation logic.
## Test plan
- [x] `pnpm check`, `pnpm lint`, `npx tsc --noEmit`
- [x] `@openmaic/generation` build + typecheck + tests (incl. an 8 MiB payload, malformed and non-base64 data URLs, http passthrough)
- [x] New `tests/generation/vision-images.test.ts` (small untouched, large downscaled under caps, unsupported format converted, undecodable dropped while others kept, http untouched); updated scene-content / retry-boundary / evaluator tests
- [x] Full `pnpm test` (Node 22)
- [x] `node scripts/check-package-version-bumps.mjs origin/main`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
* fix: typeset inline math in render-service previews and export it cleanly to PPTX (#1904)
* fix(render-service): typeset inline math in slide previews
Slide prose now stores an inline formula as its LaTeX source
(<span data-inline-math="SRC">SRC</span>) and leaves typesetting to the
renderer. render-service pinned @openmaic/renderer 0.1.4, which predates
that, so a slide preview showed the raw source (for example
"\frac{a}{b}") instead of the formula.
- Bump @openmaic/renderer to 0.1.14 and @openmaic/dsl to 0.11.3. The
changes in between are additive for this service: SlideCanvas props are
unchanged, the new dsl exports are math hardening and chart style types,
and charts still render with the lazily loaded ECharts runtime.
- Call completeInlineMath after mounting the slide. The live renderer
typesets at most 100 formulas per pass before paint and leaves the rest
to idle time; a capture needs all of them.
- Ship KaTeX's stylesheet with slide previews. KaTeX HTML needs its CSS and
math fonts: without them, typeset formulas lose their layout (a/b reads
"ba"). The preview document is an about:blank page, so each font face is
inlined as its woff2 data URL. The CSS is read from the KaTeX copy the
renderer resolves, once per process. This also gives LaTeX elements that
carry a KaTeX HTML snapshot the styles they were missing.
Tests: the stylesheet inlines every face, and a real Chromium preview of
150 stored formulas, with idle callbacks disabled, typesets all of them in
KaTeX fonts before capture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): write inline formulas to PPTX as their LaTeX source
A stored inline formula (<span data-inline-math="SRC">SRC</span>)
already exports as its source text, since the span's text is the source.
Prose that has not been saved yet still carries the editor's rendered
KaTeX tree, and the PPTX text walk wrote every text node in it: the
MathML text, the TeX annotation and each layout glyph as separate runs,
so E=mc^2 became "E=mc2E=mc^2E=mc2". KaTeX from a PPTX import (only a
TeX annotation, no attribute) came out the same way, and table cells
were written verbatim, tags and character references included.
- Treat an inline formula as one run holding its LaTeX source, with the
same parse rules as the editor: span[data-inline-math], else span.katex
with a TeX annotation. The run keeps the surrounding text style.
- Write table cell text as plain text: tags dropped, character
references decoded (stored cells hold "R&D"), breaks and paragraphs
as newlines, formulas as their source. Cells without markup are
unchanged.
Formulas stay LaTeX text, not native equations: inline OMML in a text
run needs PowerPoint's AlternateContent wrapper per text shape, which is
left for a separate change that can be checked in PowerPoint.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): keep table cell lines when converting cells for PPTX
The table cell conversion sent any cell containing `&` through the HTML
path, which dropped newlines: plain text "R&D\nSales" exported as one
paragraph "R&DSales" instead of two. It also dropped empty paragraphs, so
<p>A</p><p></p><p>B</p> lost its blank line.
- Only text with a tag or comment takes the HTML path. Plain text has its
character references decoded and keeps its lines.
- In markup, a newline in the text starts a new line, as the slide
renderer shows it (it turns cell newlines into line breaks), and so do
<br> and each paragraph. An empty paragraph is an empty line; a
paragraph that already ended on a break (a trailing <br>, a nested
block) adds no further line.
Tests read the paragraphs of each exported table cell from the slide XML.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(slide-renderer): keep the uncacheable inline math test fast on a loaded runner
The app slide renderer's "formulas too large to cache" test typeset six
1,360-character matrices (about 170 KB of markup each) in two elements and
polled wall-clock timers for idle work. On a loaded CI runner it ran past
the 5 s test timeout. Apply the approach the renderer package's own tests
already use, keeping what the test pins:
- Each formula is 40 radicals padded with trailing spaces to 1,900 source
characters. Six still cross the 4,000-character per-pass budget, and
each render is still over the typeset cache's 64,000-character
per-entry limit, now asserted, so every re-typeset stays full price.
- Idle work runs through a stubbed idle queue that the test flushes,
instead of polling timers.
- The test now also asserts that the first pass leaves formulas for later.
The other tests in the file typeset one short formula each and are
unchanged. Under CPU load (12 busy loops plus 12 concurrent runs on 12
cores) the test takes about 2.0 s, down from about 4.1 s; unloaded,
0.32 s, down from 1.0 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test(renderer): give heavy inline-math typesetting suites room on loaded runners (#1907)
## Summary
The package release gate (`publish-packages.yml` → "Validate release candidate") runs the `@openmaic/*` package suites concurrently. The suites that typeset ~1,000 KaTeX formulas (the inline-math hard-cap cases) take ~0.3–0.4 s each locally but exceed vitest's 5 s default on a loaded runner: the release run for
|
||
|
wyucandClaude Opus 5.5
|
bf6fe34028 |
chore(models): remove retired models from the built-in registry (#1939)
* chore(models): remove retired models from the built-in registry Check every built-in model catalog against the vendors' current model lists and retirement notices, and remove the models that are already shut down (DeepSeek, Qwen, Kimi, SiliconFlow, xAI, Tencent, Xiaomi, Doubao/Seed, Google image and Veo, and the Ark Agent Plan). Retired defaults are replaced with the vendor's current recommendation (for example `deepseek-flash`), and the Ark Agent Plan gains the replacements its migration notice lists. Models that are deprecated but still served stay in the catalog; the CHANGELOG lists their shutdown dates, the IDs that vendors still route to a successor, and the Qwen voice-clone limitation. The supported-models tables in all six languages are realigned with the catalogs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(models): keep retired DeepSeek Flash IDs resolving to deepseek-flash Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(models): resolve other vendor-routed retired IDs to catalog successors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: restore the App Releases section dropped while rebasing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
fd5e1d4367 |
feat(web-fetch): add Firecrawl provider (#1931)
* feat(web-fetch): add Firecrawl provider * test(web-fetch): pin Firecrawl's post-redirect url as the final URL --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
3d6fe7b6b3 |
feat(web-tools): add DeepSeek search and fetch providers (#1937)
* feat(web-tools): add DeepSeek search and fetch providers Add DeepSeek as a web search provider (POST /v1/tools/search) and a hosted web fetch provider (POST /v1/tools/fetch). Both reuse the `deepseek` chat credentials, following the existing Kimi wiring. - Search is opt-in: `WEB_SEARCH_DEEPSEEK_ENABLED=true`, an explicit `web-search.deepseek` entry, or an explicit `webSearch` slot in openmaic.yml. Adding DeepSeek for chat never assigns search. - Queries are truncated to 128 code points; `summary` is preferred over `snippet`. - Fetch keeps Kimi's timeouts and single transport-error retry; 403/404 surface as clear "cannot fetch" errors. - Official hosts normalize to /v1; a deployment-configured gateway base URL is preserved for both tools. - Docs (6 languages), .env.example, i18n provider names and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(web-search): accept official workspace provider endpoints Reuse registry allowlists for workspace tool endpoint resolution, save validation, and model settings capabilities. Cover DeepSeek and Kimi official URLs with trailing slashes, reject custom endpoints, and preserve web fetch behavior. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
6760c2b764 |
refactor(chat): retire the legacy director-graph classroom chat (#1913)
* refactor(chat): move Pi's shared parser, action schemas and store-state type out of the legacy chat owners Pi classroom chat still imports three pieces from the legacy director-graph chat, which #1814 retires. Give each a Pi or neutral owner first, so the legacy files can later be deleted without touching Pi: - The structured-output parser (createParserState, parseStructuredChunk, finalizeParser, looksLikeStructuredFragment, ParseResult) moves verbatim from lib/orchestration/stateless-generate.ts to lib/chat/structured-output.ts. Only two comments change: they no longer name director-graph as the reader of the per-call ordered indices. This also stops the Pi route from loading director-graph and LangGraph through the parser's module. - lib/orchestration/tool-schemas.ts moves unchanged to lib/chat/pi/tool-schemas.ts. - AgentLoopStoreState moves unchanged from lib/chat/agent-loop.ts to lib/chat/store-state.ts; the Pi request path in use-chat-sessions uses it. The remaining legacy consumers import from the new locations until they are removed. No behavior change. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(chat): cover classroom model precedence on /api/chat/pi with the real resolver The user-route, lock and body precedence for classroom interaction is covered with the real resolveModel only through the legacy /api/chat route, which #1814 removes. Route-level Pi tests mock resolveModel. Add the same four cases against /api/chat/pi, asserting the model handed to the Pi runtime: - a chat-adapter user route wins over the body model; - a locked classroom slot wins over the user route; - with no matching route, the body model is used; - a locked classroom slot is kept despite unlisted body and route models. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(eval): run the whiteboard layout eval against Pi classroom chat The whiteboard eval drove the legacy /api/chat through runAgentLoop. Point it at /api/chat/pi, which #1814 keeps as the only classroom chat: - one Pi request per scripted user turn, with whiteboard tools enabled as the app does for in-class requests; - text and actions grouped by each agent's messageId and sealed into their own history message at agent_end, since one Pi request can hand the turn to several agents; - the previous turn's done.directorState carried into the next request within a scenario run, as the app does within a session; - an error event, a non-200 response, or a stream without done fails the scenario through the existing error path, which skips its remaining turns (previously an error event was swallowed and the turn still captured); - a native whiteboard event fails the run, because the harness cannot see the native child's server-side board. Not seeing one does not prove the server uses the legacy child; run the eval on a server configured for it. Scores are a new baseline and are not comparable with runs of the legacy runner. Scenarios, capture, scoring and reporting are unchanged. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(eval): settle queued actions and cancel the request when a whiteboard turn fails Review of the Pi whiteboard runner (#1913) found two lifecycle gaps on the failure paths it added: - A turn that failed (an SSE error, a native whiteboard event, or EOF without done) returned and disposed the scenario without waiting for its queued actions. The state manager drives shared store singletons, so a pending action could finish inside the next scenario and land in its screenshot. Every turn exit now settles the action queue first. A queued rejection is handled while the stream is still open and is logged at settle time, as on the success path, without replacing the turn's own error. - Stopping early only released the reader lock, so the request kept running. Each turn's request now has its own AbortController, aborted on exit, and an unfinished response body is cancelled before the lock is released. runScenario is exported with its CLI settings passed in, and main() runs only when the file is the entry point, so an offline Vitest suite can exercise the real function: failed turns settle before returning, the native early exit aborts and cancels, a concurrent action rejection is not unhandled, and the success path keeps one Pi request per turn, messageId grouping, directorState carry-over and score:null on scorer failure. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(eval): run the answering and answer-content evals on Pi; retire premature-end Both evals drove the legacy single-step director prompt and agent prompt, which #1814 retires. Run them on the real Pi director in process instead (eval/orchestration/pi-harness.ts): the Pi config helpers supply agent configs and budgets, whiteboard tools are on as for classroom requests, thinking is off, and the legacy child runtime is pinned. The harness skips the HTTP route, so route authorization and tool-capability checks are not exercised. - answering classifies by the first recorded call_agent attempt in the director tool trace: TEACHER, OTHER_AGENT (another or a non-existent agent), NO_DISPATCH (none recorded; wrong, kept in the denominator), or ERROR (a failed run, excluded as before). A later recorded attempt never rescues the first. - answer-content judges the full reply of the first recorded teacher attempt. A failed run, no recorded teacher attempt, or a first one that is skipped, marked isError or empty scores 0. The judge, opening window, threshold and all-samples denominator are unchanged. Pi's short teacher replies make the two metrics nearly coincide, and the score includes routing. - Both score only what the trace records. A schema-rejected attempt is not recorded, so a later one can score, and a legacy child's partial text after a provider failure is judged. Scores can be overstated. Real-chain tests (real Pi loop and agent SDK, scripted StreamFn) pin both limits. - The old prompt A/B variants are removed; results are a Pi baseline. - premature-end is retired: its single END decision has no Pi counterpart, and the close gate does not show a question was answered. - The three remaining eval scripts load with tsx --conditions=import, so ESM-only dependencies resolve. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(chat): always run classroom chat on Pi and fail builds that still opt out The classroom chat hook, the /api/chat/pi route and PlaybackChromeRoot no longer read NEXT_PUBLIC_PI_CHAT_ENABLED. The hook sends every turn through the existing Pi single-request path; the frontend no longer calls the legacy /api/chat loop (fetchStatelessChat and the runAgentLoop tail are removed). The Pi branch itself is unchanged apart from indentation. isPiChatEnabled and its readDefaultOnBoolean helper are removed. The independent courseware-reference gate stays default-off. next.config.ts now exports a phase function. In the production-build phase it fails when NEXT_PUBLIC_PI_CHAT_ENABLED is set to anything other than '', 'true' or '1' (exact match), which covers every value that used to select the legacy runtime. The error names the value and points to the Classroom model setting, the google native preset for Gemini, and the administrator for managed configurations. Other phases do not check the flag. The fixed env pin for the flag is removed. This is an intermediate step of #1814 PR 3: the legacy route, director graph and agent loop are still present and are removed in a follow-up commit, and Docker/Compose wiring and docs still describe the old rollback. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(chat): remove the legacy director-graph classroom chat backend The frontend has run every classroom turn on /api/chat/pi since the previous commit, so nothing reaches the legacy stack any more. Remove it: - app/api/chat/route.ts (no stub, redirect or 410; /api/chat/pi stays) - lib/orchestration/{stateless-generate,director-graph,ai-sdk-adapter, director-prompt,prompt-builder}.ts and lib/chat/agent-loop.ts - summarizers/{conversation-summary,message-converter}.ts - the director, agent-system and agent-system-wb-* templates, the speech-guidelines and whiteboard-reference snippets, and their prompt and snippet IDs Pi's default legacy child, the shared structured-output parser, the Pi tool schemas, the shared summarizers, the registry and the protocol types are unchanged. Dependency declarations are left for a follow-up commit. Tests: - Drop the legacy chat route from the model-authorization tests and the coverage matrix. The mixed compatibility cases keep their six and eight stage assertions, and the exhaustive resolver call-site scan is unchanged. The locked-classroom case now goes through /api/chat/pi. - Retire chat-route-user-routes (its precedence cases are rebuilt on the Pi route in route-model-precedence), the agent-loop async-state test, and the conversation-summary test. - Keep the #511 intent as a history input contract on Pi: toHistoryMessages keeps the human challenge as a user turn in order, and buildUserPrompt still reports it after a later agent reply. - Move the role, peer-context and language-directive prompt checks onto Pi's buildChildPrompt. Keep the PBL and placeholder-lint template tests and the getActionDescriptions LaTeX guard. - Add middleware cases for POST /api/chat (401 without access, pass-through otherwise) and a Playwright spec that expects a plain 404 from the running app. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * build(deps): drop the unused @langchain/langgraph dependency The legacy director graph was its only consumer and was removed in the previous commit. Remove the root declaration and let pnpm update the lockfile: @langchain/langgraph and @langchain/langgraph-checkpoint are no longer installed. @langchain/langgraph-sdk stays (an optional CopilotKit peer and a direct dependency of @ag-ui/langgraph). @langchain/core is kept: CopilotKit requires it as a peer and pnpm would install it anyway. partial-json and jsonrepair are kept for the Pi parser. The re-resolution also moved vite 8.0.0's postcss from 8.5.15 to 8.5.23 (both were already in the lockfile; Next's postcss is unchanged) and shortened four eslint-import snapshot keys without changing versions. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * build(docker): keep the Pi chat flag only as an input to the build check NEXT_PUBLIC_PI_CHAT_ENABLED no longer selects a chat runtime; next.config.ts only reads it to fail a production build that still opts out of Pi. Keep the builder ARG and the Compose build-arg forwarding so an explicit false still reaches that check, and drop the ENV line: build args are already visible to the builder's RUN steps, and the value has nothing to configure in the image. Remove the legacy-chat rollback comment and command from docker-compose.yml and replace the rollback section of .env.example with a short note that the legacy runtime is gone and which values now fail the build. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: describe classroom chat after the legacy runtime removal - Configuration docs (all six locales): drop the Pi rollback example, the advice to rebuild with the flag set to false and the Compose rollback command. Say instead that classroom chat always runs on Pi and needs a tool-calling Classroom model (google preset for Gemini), that the flag should be removed, which exact values a production build still accepts, and that the Compose service env_file supplies runtime values only. - READMEs: drop the LangGraph badge and describe lib/orchestration and the Pi director loop as they now are. - CHANGELOG: add the breaking change (model requirement, the flag, POST /api/chat answering 404 after the access gate) and the dependency removal. - lib/prompts/README.md: point the role and length guidelines at lib/chat/pi/prompts.ts, correct which tests check placeholders, use a missing snippet in the error example, and start the whiteboard eval server with the native child runtime off. - Remove the two comments that told CI and Playwright to leave the flag unset. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(chat): pin the server key on a user-route model; document answering eval limits - route-model-precedence: when the user route switches the classroom model to another provider without a key of its own, assert that the model is built with the server key rather than the body's key. - answering eval: state in the header comment and the generated report that a run which throws, is aborted or ends without done is ERROR even after it dispatched an agent, that ERROR samples stay out of the correct-rate denominator, and what the rate therefore does and does not measure. The scoring rules are unchanged. Refs #1814 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
|
6e25625a12 |
feat(chat): add suggested replies to cue_user (#1379)
* feat(chat): mature learner handoff flow * refactor(roundtable): embed learner handoff in dialogue * fix(chat): preserve learner handoffs across server restore * style(roundtable): clarify learner quick replies * fix(chat): address durable learner handoff review * fix(chat): preserve long sessions and learner cue presentation * feat(chat): limit cue_user to optional string suggestions * feat(chat): show cue_user suggestions in the learner's reply bubble Move the quick replies out of the separate chip row and into a "suggested reply" bubble in the user-bubble slot: same right alignment, corner and avatar as the real user bubble, but a light dashed outline so it reads as "you could say". Chips wrap (two visible rows, scrolling inside the bubble's existing max height, with a fade when more are below) and truncate long labels with a tooltip. In fullscreen the bubble sits in the right-hand stack above the dock. The centered "Your turn" cue is unchanged on normal-width stages; on very narrow stages it yields its space while suggestions are shown. The roundtable stays 192px. Drop the hard JSON-schema bounds on cue_user (prompt length, option count and option length) and keep them in the parameter descriptions, so an over-limit call is normalized by normalizeCueUserOptions instead of being rejected during argument validation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
d128ef67c9 |
fix(chat): save chats without Web Locks on insecure origins (#1929)
* fix(chat): save chats without Web Locks on insecure origins On plain HTTP at a non-localhost address (a LAN IP, a Tailscale IP or MagicDNS name) the page is not a secure context and navigator.locks is undefined. The chat partition lock still required it for the default store, so loading chats failed silently and every stage flush threw ChatStorageLockUnavailableError, retrying with backoff and re-uploading the document each time. The rule dates from when the default path also migrated and cleared a browser database shared across tabs. That migration is gone, and the isolated write mode already used without a shared mutex gives the same per-chat last-writer-wins result as the locked path. When Web Locks are missing, use it and log a one-time notice. Also include the error name and message when a WebKit stack lists only frames, and document the HTTP limitation in the deployment guide. Fixes #1800. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(logger): check for the Name: message header, not a substring A frame-only stack can contain the message by coincidence (a function named like it) and every stack contains an empty message. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(deployment): note that deletes win over concurrent edits without Web Locks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyuc
|
797d501367 |
feat(token-plan): let plans declare web fetch; Kimi Coding Plan takes over web fetch (#1927)
* feat(token-plan): support declared web fetch capabilities * fix(token-plan): take over implicit builtin fetch defaults * docs(token-plan): include web fetch in modality descriptions |
||
|
John Costaandwyuc
|
9f6c1419ec |
fix(i18n): resolve the initial locale on the server so SSR and hydration agree (AI-assisted) (#1874)
* fix(i18n): resolve the initial locale once on the server and hydrate with it The root layout now picks the UI locale from the locale cookie, then Accept-Language, then defaultLocale, renders <html lang> with it, and hands the locale and its bundle to I18nProvider. The client starts from that value instead of re-detecting, so the first client render matches the server HTML. setLocale persists the choice to the cookie (and localStorage) immediately, loads the new bundle, and commits the locale to React state only once the bundle is in, dropping a slower earlier switch. A failed load keeps the current locale and restores the previous choice; a later attempt loads again. The provider keeps its useTranslation subscription so loads still re-render. A choice stored only in localStorage by earlier versions is carried over to the cookie once. Fixes #1445 Fixes #1536 * fix(i18n): refresh the locale cookie and localStorage mirror on load When the locale cookie matches the server's choice, write it again on mount so Safari's 7-day cap on script-set cookies doesn't expire it, and so localStorage.locale (still read by PBL) follows the server's choice. --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyuc
|
f86e1949dd |
feat(web-fetch): add webFetch capability slot with a provider registry (builtin, Kimi) (#1912)
* feat(web-fetch): add provider registry and capability slot * fix(web-fetch): protect defaults and unify capability execution * fix(web-fetch): preserve workspace credentials and reuse proxy agents * fix(web-fetch): retry transient Kimi transport failures * feat(settings): show web fetch inside the research station Draw the web fetch slot as a third line (fetch) of the research station instead of an unconnected station of its own, and describe it as the agent's page reader, since course generation itself only searches. - Offer the implicit built-in reader as the slot's server default, so the picker shows the same server-default row as with a configured provider. - Anchor slot pickers to their station card so an open picker never covers the card it belongs to. - Localize the picker's provider group label in zh-CN and zh-TW. * test(config): verify shared Kimi search and fetch capabilities |
||
|
wyuc
|
941f68816d |
feat(web-search): add Kimi search with shared chat credentials (opt-in) (#1911)
* feat(web-search): add Kimi search with shared chat credentials * fix(web-search): require explicit Kimi search opt-in * fix(web-search): preserve search defaults after Kimi opt-in * fix(web-search): warn when Kimi opt-in needs a slot assignment |
||
|
yipwingtimandwyuc
|
93cceb3205 |
feat(settings): warn users before submitting API keys (#1158)
* fix(settings): warn for all rendered credentials / 修复所有凭据输入字段的安全提示 * fix(settings): preserve credential notices after upstream merge * fix(settings): remove stale credential notice import * fix(i18n): align credential storage hint translations * refactor(settings): compact credential storage hint --------- Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
LING DUANandwyuc
|
b5c83842d3 |
fix(pi): require Google native for official Gemini compatible route (#1897)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
a0e2c0e02b |
fix: typeset inline math in render-service previews and export it cleanly to PPTX (#1904)
* fix(render-service): typeset inline math in slide previews
Slide prose now stores an inline formula as its LaTeX source
(<span data-inline-math="SRC">SRC</span>) and leaves typesetting to the
renderer. render-service pinned @openmaic/renderer 0.1.4, which predates
that, so a slide preview showed the raw source (for example
"\frac{a}{b}") instead of the formula.
- Bump @openmaic/renderer to 0.1.14 and @openmaic/dsl to 0.11.3. The
changes in between are additive for this service: SlideCanvas props are
unchanged, the new dsl exports are math hardening and chart style types,
and charts still render with the lazily loaded ECharts runtime.
- Call completeInlineMath after mounting the slide. The live renderer
typesets at most 100 formulas per pass before paint and leaves the rest
to idle time; a capture needs all of them.
- Ship KaTeX's stylesheet with slide previews. KaTeX HTML needs its CSS and
math fonts: without them, typeset formulas lose their layout (a/b reads
"ba"). The preview document is an about:blank page, so each font face is
inlined as its woff2 data URL. The CSS is read from the KaTeX copy the
renderer resolves, once per process. This also gives LaTeX elements that
carry a KaTeX HTML snapshot the styles they were missing.
Tests: the stylesheet inlines every face, and a real Chromium preview of
150 stored formulas, with idle callbacks disabled, typesets all of them in
KaTeX fonts before capture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): write inline formulas to PPTX as their LaTeX source
A stored inline formula (<span data-inline-math="SRC">SRC</span>)
already exports as its source text, since the span's text is the source.
Prose that has not been saved yet still carries the editor's rendered
KaTeX tree, and the PPTX text walk wrote every text node in it: the
MathML text, the TeX annotation and each layout glyph as separate runs,
so E=mc^2 became "E=mc2E=mc^2E=mc2". KaTeX from a PPTX import (only a
TeX annotation, no attribute) came out the same way, and table cells
were written verbatim, tags and character references included.
- Treat an inline formula as one run holding its LaTeX source, with the
same parse rules as the editor: span[data-inline-math], else span.katex
with a TeX annotation. The run keeps the surrounding text style.
- Write table cell text as plain text: tags dropped, character
references decoded (stored cells hold "R&D"), breaks and paragraphs
as newlines, formulas as their source. Cells without markup are
unchanged.
Formulas stay LaTeX text, not native equations: inline OMML in a text
run needs PowerPoint's AlternateContent wrapper per text shape, which is
left for a separate change that can be checked in PowerPoint.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(export): keep table cell lines when converting cells for PPTX
The table cell conversion sent any cell containing `&` through the HTML
path, which dropped newlines: plain text "R&D\nSales" exported as one
paragraph "R&DSales" instead of two. It also dropped empty paragraphs, so
<p>A</p><p></p><p>B</p> lost its blank line.
- Only text with a tag or comment takes the HTML path. Plain text has its
character references decoded and keeps its lines.
- In markup, a newline in the text starts a new line, as the slide
renderer shows it (it turns cell newlines into line breaks), and so do
<br> and each paragraph. An empty paragraph is an empty line; a
paragraph that already ended on a break (a trailing <br>, a nested
block) adds no further line.
Tests read the paragraphs of each exported table cell from the slide XML.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(slide-renderer): keep the uncacheable inline math test fast on a loaded runner
The app slide renderer's "formulas too large to cache" test typeset six
1,360-character matrices (about 170 KB of markup each) in two elements and
polled wall-clock timers for idle work. On a loaded CI runner it ran past
the 5 s test timeout. Apply the approach the renderer package's own tests
already use, keeping what the test pins:
- Each formula is 40 radicals padded with trailing spaces to 1,900 source
characters. Six still cross the 4,000-character per-pass budget, and
each render is still over the typeset cache's 64,000-character
per-entry limit, now asserted, so every re-typeset stays full price.
- Idle work runs through a stubbed idle queue that the test flushes,
instead of polling timers.
- The test now also asserts that the first pass leaves formulas for later.
The other tests in the file typeset one short formula each and are
unchanged. Under CPU load (12 busy loops plus 12 concurrent runs on 12
cores) the test takes about 2.0 s, down from about 4.1 s; unloaded,
0.32 s, down from 1.0 s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
||
|
wyuc
|
fccbf82c24 |
fix(generation): parse data URLs without regex and cap vision image size (#1902)
## Summary Large or unsupported images attached to vision requests can crash prompt building or be rejected by the model provider, and a single bad image fails the whole generation step (retries fail the same way). - **`@openmaic/generation` 0.3.19**: `buildVisionUserContent` no longer runs a regex over the whole data URL. A new exported `parseBase64DataUrl` splits header and payload with plain string ops, so multi-megabyte payloads are never scanned by the regex engine. - **Vision image cap (app)**: new `prepareVisionImages` (`lib/server/generation/vision-images.ts`) runs right before every vision call — outline, scene content, scene actions, and the PBL evaluator (which receives uploaded submissions). - Pass-through only for single-frame, 8-bit sRGB/grayscale png/jpeg/webp/gif whose **base64 payload** is within `MAX_VISION_IMAGE_BASE64_BYTES` (1 MiB — providers measure the encoded payload) and whose longest side is within `MAX_VISION_IMAGE_DIMENSION` (2048 px). Pixels are strictly decoded first so truncated data is caught. http(s) URLs are untouched. - Everything else (oversized, animated, CMYK, 16-bit, unsupported formats) is decoded once with sharp (first frame, EXIF-rotated, resized inside 2048, flattened on white, sRGB) and encoded to JPEG, stepping quality down until under the cap. - Images that still don't fit or can't be decoded are dropped with a warning; the step continues. - Preparation runs where vision images are resolved (outline and scene-content pre-resolution), so the prompt's "[see attached]" placeholders and asset-id mappings only describe images that are actually attached. The PBL evaluator logs when an image submission is evaluated without its image. - Processing is sequential to bound peak memory. Non-goals: no change to material upload/extraction, prompts, or generation logic. ## Test plan - [x] `pnpm check`, `pnpm lint`, `npx tsc --noEmit` - [x] `@openmaic/generation` build + typecheck + tests (incl. an 8 MiB payload, malformed and non-base64 data URLs, http passthrough) - [x] New `tests/generation/vision-images.test.ts` (small untouched, large downscaled under caps, unsupported format converted, undecodable dropped while others kept, http untouched); updated scene-content / retry-boundary / evaluator tests - [x] Full `pnpm test` (Node 22) - [x] `node scripts/check-package-version-bumps.mjs origin/main` 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
LING DUAN
|
da8c92a4a8 |
fix(chat): guard Pi classroom tool calling before inference (#1894)
* fix(chat): guard Pi classroom tool calling before inference * fix(i18n): match Pi model guidance to settings labels |
||
|
DDL
|
9d2eface53 |
fix(import): preserve committed document on lost response (AI-assisted) (#1864)
* fix(import): preserve committed document on lost response (AI-assisted) A rejected save response can arrive after the server has committed the imported aggregate. Do not compensate by deleting the stage, because that turns an unknown write outcome into permanent data loss. Keep disposable local-cache cleanup and cover the response-loss path with a stateful regression test. * fix(import): verify rejected document saves Read the new document back when saveDocument rejects. Treat a found document as committed, while confirmed absence and read failures keep the import on the error path without destructive cleanup. Cover all three outcomes in the stateful import test. |
||
|
wyucandClaude Opus 5.5
|
7ca6077cdd |
fix(workbench): refuse oversized material uploads before sending them (#1887)
* fix(workbench): refuse oversized material uploads before sending them The workbench uploader posted every picked file to /api/materials and only learned about the size cap from the server's 413. The route does refuse an oversized declared content-length early, but a reverse proxy that buffers request bodies (nginx's default) still makes the browser send the whole file first, so a user picking a 200 MB file waits for the full upload before being told it is too large. Without such a proxy, the early 413 tends to surface as a generic network failure instead of the size message. Read the caps the capabilities endpoint already advertises (maxDocumentBytes / maxMediaBytes, derived from the upload route's own limits) and refuse a file over its class cap before any bytes are sent, with the existing "file too large (limit X)" copy. The caps stay server-owned, so a deployment that raises them is not blocked by a browser constant. Discovery is fetched once per page and shared; a failed, invalid or slow (>5s) read fails open to the server's 413, and once a read has timed out later uploads do not wait on it again until it answers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(workbench): leave unsupported types to the server's 415 The upload route rejects an unsupported MIME (415) before it applies a size cap. Only precheck the size of supported types, so an oversized unsupported file still gets the format error instead of being told to shrink. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
2833c6c036 |
fix(render): bind render jobs to the requesting owner (#1884)
Each MP4 render job is bound to the immutable owner of the submitting request: the app proxy asserts the owner on submit, poll, cancel and download, and the render-service only finds jobs for that owner (foreign and unknown jobs get the same 404, with no cancellation or artifact lookup). Job operations live under a separate /owner-bound/render namespace, so an instance that predates owner binding answers 404 without running a job handler and mixed old/new pools fail closed; job responses must carry the owner-bound marker. Upgrade the render-service together with or before the app. Co-authored-by: duanjialing.777 <duanjialing.777@bytedance.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
90b2d90bca |
fix(security): enforce model authorization for server-managed providers (#1879)
Providers configured with server credentials only send model ids the deployment authorizes (explicit model list plus default/fallback/slot references for the capability); anything else gets the same HTTP 403 before the provider is contacted. Covers chat, verification, media, speech, transcription, model-based search, generation, agent, PBL, quiz grading and workspace assignments. Breaking change: credentialed providers without a model list accept only their default/fallback models. Co-authored-by: I3ob0 <huzi0404@163.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
7d324aa84a |
fix(persistence): share one AsyncLocalStorage across owner-bound stores (#1871)
* fix(persistence): share one AsyncLocalStorage across owner-bound stores createOwnerBoundDocumentStore() built a new AsyncLocalStorage on every call, and servers build a store per request. Every AsyncLocalStorage that has run stays registered with async_hooks for the life of the process, so each new promise paid a context propagation for every store ever created. The cost grew linearly with requests served: under sustained load the main thread saturated in async_hooks propagation and GC, and the event loop stalled long enough for health checks to time out. Carry the pending operation in one module-level AsyncLocalStorage instead. Each store gets a small OperationScope; running an operation pushes a frame that names its scope and links to the enclosing frame, and a store reads the nearest frame of its own. This keeps the previous semantics: a store never sees another store's operation, an operation of another store started inside it does not hide the outer one, and the innermost of a store's own nested operations wins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(persistence): keep only each store's current operation in a context A context's operation frame linked to every frame that was current when it started, including other stores' and finished ones, so fire-and-forget work that kept re-entering stores retained every earlier operation for as long as its newest callback lived. Hold an immutable map of each store's current operation instead: a context now keeps at most one operation per store, exactly as a storage per store did. Mark OperationScope as exported for tests only, and export the operation type so the test can name it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(persistence): note the snapshot size and restore the gc flag in tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
adecc4847e |
fix(generation): stop retrying explicit provider quota refusals (#1861)
* fix(generation): stop retrying explicit provider quota refusals * fix(generation): review follow-ups for provider quota refusals - Leave a quota refusal the host classifies to the host, as documented for `classifyFailure`: the built-in rule (`isProviderQuotaRefusal`) applies only to refusals it does not answer for, at every retry site. - Name an exhausted quota in the fallback log line, from the failure that fired the fallback rather than an earlier attempt's. - Stop reporting a retry after the outline fallback returns empty output. - Drop the PBL loop-fallback change: a provider failure with an HTTP status already skips the loop, and no LLM adapter throws the native quota marker. `@openmaic/generation` stays at 0.3.18. - Document that an explicit quota refusal goes to the fallback at once (configuration, all six languages) and how it meets `classifyFailure`. - Test a 403 quota refusal falling back, a quota refusal the host classifies as retryable, and the stream error shapes the classifier reads. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(generation): persist quota refusal regression coverage --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
Cham1229andcham
|
8ad8a24e95 |
feat(media): add GLM (Zhipu CogView) image generation provider [AI-assisted] (#1832)
Co-authored-by: cham <2577781125@qq.com> |
||
|
wyucandClaude Opus 5.5
|
e07e629261 |
fix(sanitize): store inline math as LaTeX source and typeset it in the client (#1829)
* fix(sanitize): keep inline math through the scene-content sanitizer The prose policy flattened the editor's inline formulas on every persistence read and write: it dropped data-inline-math, the MathML annotation, the layout SVG and KaTeX positioning, so saved formulas rendered broken and their LaTeX source was lost. Move the lift / sanitize / re-render approach from the standalone HTML export into lib/sanitize/inline-math.ts and apply it in sanitizeProseHtml, so the persistence boundary and the export share one implementation. It parses with parse5, so it needs no DOM and runs on the server and in the browser alike. Each formula is replaced by an empty source span before sanitizing, and every surviving source span is replaced afterwards by a fresh KaTeX render (trust: false); authored markup never bypasses the policy. Prose without a formula skips the parse and is sanitized byte-for-byte as before. Renders are cached by source, and pathological markup falls back to the plain policy instead of failing the read or write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sanitize): bound inline math rendering and detect encoded KaTeX classes KaTeX markup is 100-150x the size of its source and is regenerated synchronously on every persistence read and write, so one large formula could block the event loop for seconds and pin hundreds of MB in the render cache. - Render a formula only if its source is at most 2000 characters, and within a per-call budget of 16000 source characters and 1000 formulas. Anything else stays a source span showing its LaTeX as text, so nothing is lost and the editor still recovers it. Limits are counted in document order, never time, so repeated passes stay stable. - Bound the render cache by markup size (1 MB) and never cache renders over 32 KB. - Pre-check on `data-inline-math` or `annotation` instead of `katex`: element and attribute names cannot be written as character references, but a class value can, so an encoded `katex` class no longer skips the lift and loses its source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sanitize): store inline math as source and typeset it in the client Rendering formulas on the server made every persistence read and write run KaTeX on authored input, which user macros and long sources can turn into seconds of CPU per document. Store each inline formula as its LaTeX source instead and let the clients that display slides typeset it. - The prose sanitizer reduces each inline formula (span[data-inline-math], else span.katex with a TeX annotation, entity-encoded class included) to <span data-inline-math="SRC">SRC</span> and allows only that attribute. The source doubles as text for consumers that do not render math. A source over 2000 characters is kept as plain text. The pre-pass uses htmlparser2, the parser sanitize-html uses, so it is linear and sees the same element boundaries; prose without a formula marker is sanitized exactly as before. The server never runs KaTeX, and the parse5 lift, render cache and budgets are gone. - @openmaic/renderer typesets span[data-inline-math] in text, shape and table prose after injection (renderInlineMath / useInlineMath), with trust disabled, macro definitions blocked and bounded expansion. It also re-renders older content that still carries KaTeX markup. The app's slide renderer components use the same hook. Bump the renderer to 0.1.12. - The standalone HTML export ships source-only formulas, which the player's renderer typesets, and ships the math fonts when a slide has an inline formula. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(slide-renderer): keep cell markup intact when formatting table text formatText turned every space in a table cell into , including the spaces inside tags, which broke any cell markup with attributes. An inline formula in a cell was shown as its raw source instead of being typeset. Only format the text between tags. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(renderer): allow 1000 macro expansions when typesetting inline math A cap of 50 expansions rejects realistic long formulas: built-in commands such as \neq, \iff, \, and \dots each count, and a formula with a few dozen of them needs over 100. Macro definitions are blocked, so expansion stays linear in the source and 1000 is only a backstop. This matches the shared safe KaTeX options. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sanitize): replace self-closing inline formulas in SVG and MathML once Inside SVG or MathML the parser honours `/>` and reports the close as implied while still on the opening token, so the replacement ended before the formula started and the original span stayed next to the stored one; the next pass then stored it again. End a formula no earlier than its opening tag. Adds SVG and MathML cases and fuzzes the pass for idempotency and formula shape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(renderer): keep inline math typeset across re-renders React can rewrite `dangerouslySetInnerHTML` markup on a re-render even when the HTML string is unchanged, which put the stored source spans back after a move or resize while the effect, keyed on the HTML, did not run again. Typeset after every commit instead: formulas already typeset are skipped, and typeset formulas are cached by source and cloned, so a re-render costs a query and, at most, cheap clones. Typesetting never updates React state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(renderer): budget inline math typesetting per prose root One slide packed with large formulas could block the page for hundreds of milliseconds on every mount. Typeset at most 4000 characters of uncached source or 100 uncached formulas per pass over a prose root before paint, and the rest in idle time, a chunk of the same size per idle period. The next commit, an unmount or new content cancels pending idle work. Past 50 000 characters or 1000 formulas per root, formulas are shown as their LaTeX text. Slide snapshots typeset everything before capture. Covers identical-content re-renders and A, B, A, A content sequences in both renderers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(renderer): keep inline math progress across commits and complete snapshots per root - Give injected prose a stable dangerouslySetInnerHTML value per markup string (text, shape label and each table cell, in both renderers), so React leaves unchanged markup alone. Typeset formulas and pending idle progress then survive re-renders; formulas too large to cache are no longer typeset again on every commit. The every-commit pass stays as a safety net. - Mark each prose root and complete snapshots root by root, so each text box keeps its own hard cap as on the live slide instead of sharing one slide-wide count. - Apply the hard cap from document order on every pass, whatever earlier passes typeset, and let a formula shown as text by an earlier cap be typeset once it falls within its root's cap. - Note that the render cache bound counts serialized characters. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(renderer): bump to 0.1.13 after rebase Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(renderer): typeset inline math through the shared safeKatexOptions Replace the local stand-in options (inert macro-definition commands, trust: false, maxExpand 1000) with safeKatexOptions from @openmaic/dsl, keeping the inline-specific settings (displayMode: false, output: html, throwOnError: false, strict: ignore). The shared helper's expansion budget is the same 1000, and it also keeps the built-in \tag/\notag state and makes \long inert. The math engine guard now lists the renderer's inline-math module as a render-calls site and drops the standalone HTML rich-text module, which no longer renders KaTeX itself. Tests: ordinary formulas typeset byte-for-byte as with the previous options, and formula-defined macros stay inert within one formula and across formulas in the same prose root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(sanitize): keep over-long inline formulas as formulas; bound typesetting only The 2000-character bound dropped the data-inline-math marker at save time, so an over-long formula became plain text for good. The bound now applies only where formulas are typeset: the slide renderer already shows an over-long source as text, and the editor's inline_math node now does the same instead of typesetting it, using the renderer's MAX_INLINE_MATH_SOURCE. @openmaic/editor 0.0.11. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(sanitize): a 100 KB formula is kept as a formula in the node-environment suite Follows the sanitizer change: the length bound applies to typesetting only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
5eae1a430d |
fix(generation): explain exhausted plan quotas (#1831)
* fix(generation): explain exhausted plan quotas * test(generation): use nullable model metadata in quota fixture * fix(generation): keep provider quota detection neutral and scene-scoped Address the review of #1831: - The shared classification no longer reads vendor codes. MiniMax TTS and web search translate base_resp 1008/2056 into ProviderQuotaExhaustedError (thrown, or as the cause of the rate-limit error an HTTP 429 keeps), and isUpstreamQuotaExhausted checks only that marker and the OpenAI-compatible wire codes. - The built-in classification reports PROVIDER_QUOTA_EXHAUSTED, so a host that meters its own QUOTA_EXHAUSTED can tell the two apart, and a host's start refusal keeps the host's own message. - The classroom passes the guidance only while the pending scene card is the scene the run paused at; a scene the run went on past keeps the generic failure text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PyhoDKKJ3gVoPbvCT3T99K * test(generation): cover quota guidance through the classroom hook --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
89290651b8 |
fix(export): hide the no-JavaScript fallback as soon as the standalone player starts (#1850)
The static fallback message is now hidden synchronously when the player script runs (kept in the DOM), so a slow parse of a very large file can no longer reveal it before the first commit. A start failure (sync or async render error) un-hides it with the "couldn't start" text; it is still removed after the first successful commit. Scripts that never run leave it visible as before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
6a84dbeb45 |
fix(export): follow-ups from the standalone HTML playback review (#1848)
* fix(export): pause a first hand-started video when a second starts; keep captions off narrow scenes Starting a second video by hand on one slide left both playing. The registry now pauses the other hand-started videos (never the one the sequencer awaits). On narrow viewports the caption bar covered part of the scene (quiz options). It now has its own strip below the scene; from the sm breakpoint up it overlays the scene as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): accurate export messages and menu order; static fallback without JavaScript - Size warnings only suggest exporting without narration when narration was included. - Missing narration clips get their own toast wording instead of being counted as external assets that could not be bundled. - The HTML export submenu prefers 'with narration and video' when the classroom has narration audio or slide video. - The file carries a static message for viewers that do not run scripts (iOS Files preview, scripts disabled or blocked). It sits right before the player script so it never paints while a large file parses, is removed when the player mounts, switches to a generic "couldn't start" message if the player fails, and has a <noscript> copy. Localized through the player strings; the CSP is unchanged. - Caption strip: fixed height, only while playback is active, scrolls long lines, also used on short (landscape) screens. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): fallback message on the first screen; report failed linked images; skip ZIP-only decoding for single files - The static fallback message sat below the empty full-height root, so it started below the first screen. The empty root is now hidden until the player mounts. The fallback is removed after the player's first commit (not right after render()), so a first-render error still shows the "couldn't start" message. - The no-JavaScript hint no longer names a platform-specific sharing step. - Slide images that fail to load from a linked relative path (a missing images folder) now trigger the linked-files notice, also when the audio and video probes load. - Inline data: images are only decoded into files once the ZIP is going to be built (about 0.6 s and +100 MB for 100 MB of images otherwise); the single file and its size estimate are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
9bbd34e6f1 |
feat(export): fall back to a ZIP of classroom.html and its media for large classrooms (#1845)
* feat(export): add a stored ZIP writer that references its entries' Blobs The standalone export's media-folder variant ships already-compressed narration and video. JSZip reads every input Blob into an ArrayBuffer and concatenates its output into one ArrayBuffer, so a multi-hundred-megabyte archive would sit in the tab several times over. This writer stores entries uncompressed, reads each one a slice at a time only to compute its CRC-32, and returns a Blob composed of the entries' own Blobs, so no media is copied. Paths are checked to stay inside the extraction folder, and archives plain ZIP cannot describe (4 GiB) are refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(standalone-player): say so when media shipped next to the page is missing A page whose media table names files by relative path (the ZIP variant of the export) plays nothing when opened without them: straight from inside the ZIP, or copied out alone. The media library now probes one linked file as the player opens and records any linked clip that fails to load, and the player shows a notice asking to extract the whole ZIP. Playback carries on as before: failed narration falls back to the reading timer and a failed video no longer holds the sequence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): fall back to a ZIP of classroom.html and its media folders A classroom whose single HTML file would pass the 400 MB ceiling is now exported as a ZIP instead of refused: classroom.html carries the player and manifest, and its media table names each narration and video file by relative path (audio/..., media/...) next to it, plus a README in the UI locale and English. The ZIP needs no base64 and copies no media, so it is built from the same snapshot without a second collection pass. The page's CSP differs from the single file's only in media-src, which adds 'self' so <audio>/<video> elements may load the sibling files (Chromium and WebKit match it against file: URLs when the page is opened from disk); connect-src stays 'none', so the player never reads the bytes itself. The single file is unchanged, byte for byte. The fallback is automatic, at the same ceiling, because one file is the better format wherever it works; the export menu keeps its two entries. A toast explains why a ZIP was saved and that it must be extracted before opening classroom.html. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep stored ZIP fields below the ZIP64 sentinels 0xFFFF entries and 32-bit sizes or offsets of 0xFFFFFFFF announce ZIP64 records, so a plain archive must stay below them: the writer now refuses 65,535 entries and any size, offset or archive length that would reach 0xFFFFFFFF, and limits entry names by their UTF-8 bytes (what the header field holds) instead of UTF-16 units. The CRC slice size is injectable. Tests now read the raw bytes: every local header is compared field by field with its central directory entry and the end record, and the CRC carry across slices, the boundaries and the DOS date clamp are covered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): report every linked file that fails, and word the notice for both causes WebKit and Firefox reject play() with NotSupportedError for a narration file that is not there, before (or without) an error event, and the clip's handler was gone by the time the event fired: a missing clip after a successful startup probe played silently with no notice. The rejection now reports linked clips, and the narration element keeps a standing error listener for the clip it is loading. When the media table links no file (an export without narration), the startup probe loads a linked slide image instead. A file in a codec the browser cannot play fails exactly like a missing one on file:, so the notice now covers both: "Some images, narration or video couldn't be loaded. If you opened classroom.html from inside the ZIP, extract the whole ZIP first." Adds a SlideScene test for video errors. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): ship slide images as files in the ZIP and refuse an oversized page The ZIP fallback kept slide images, backgrounds, patterns, chart point images and video posters inline as data: URIs, so a classroom heavy in images could produce a ZIP whose classroom.html alone passed the ceiling. In the ZIP they are now files under images/, named by relative path, and the page's CSP adds 'self' to img-src as well as media-src. Image bytes are collected once and encoded as data: URIs only for the single file; the single file's size is estimated from the linked manifest, exactly, without encoding anything. The single file is unchanged. Media inside interactive scenes stays inline: those pages run in sandboxed opaque-origin frames, which Chromium and Firefox do not let load files from disk (WebKit does). A ZIP whose page alone still passes the ceiling is refused with its own message (StandaloneHtmlTooLargeError of kind "page"), and the fallback toast and README name what the ZIP holds. The CSP comment now spells out what 'self' allows when the folder is served over HTTP: same-host GETs, with cookies, from image and media elements (interactive frames included); nothing can be read back, since connect-src stays 'none'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep chart point images inline and ship inline slide images as files in the ZIP Two gaps in the ZIP variant's image handling: - Pictorial charts rendered blank: the chart renderer wraps each point image in a data: SVG symbol, which cannot load a file, so a relative path there drew nothing in any browser. Chart point images now stay inline as data: URIs in the ZIP (a ref named only by a chart ships no file). - Images that were already data: URIs (images, backgrounds, shape patterns, video posters) were never collected and stayed in the page, so such a classroom could still be refused as too large. In the ZIP they are now decoded into files under images/, one per distinct URI; a MIME type no file extension conveys, or a malformed URI, stays inline. The single-file estimate counts each one as the exact escaped URI it replaces, and the single file keeps them as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
70f58bc3c1 |
feat(export): play the standalone HTML classroom with narration, effects and video (#1842)
* feat(export): keep playback actions and embed narration in standalone HTML The standalone HTML manifest now keeps each scene's playback actions, reduced to what an offline player can replay: speech text (plus its audioRef when the bytes ship), spotlight/laser targets, play_video, widget actions, and the discussion topic. Whiteboard actions, unknown types, discussion prompts and agent bindings are left out. With the new includeNarration option the snapshot collects narration (stored and legacy audioUrl) and video bytes. Actions and video elements name them by archive path, and the bytes travel as base64 data blocks (script type="application/octet-stream") indexed by a media table, so the browser keeps them as text until a clip plays. Payload collection is format-neutral so a later folder variant can ship the same paths as files. The export reports its byte size and missing narration; the CSP is unchanged and the file still makes no network requests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(standalone-player): play the classroom with narration, effects and captions A lightweight sequencer replays each scene's actions the way the classroom's playback engine does, without its stores or IndexedDB audio player (only the pure timing helpers are shared): - speech waits for its embedded narration, or for the classroom's reading-time estimate when there is none; its text is shown as a caption that can be toggled; - spotlight and laser drive SlideCanvas effects, fire without blocking so they overlap the next speech, clear 5 s after the latest one and on every scene change; - play_video plays the embedded clip in place and waits for its end (capped); a video without bytes keeps its poster; - discussion shows a card with the topic and a link to the online classroom, closing on its own after a few seconds; - widget actions are posted to the sandboxed interactive iframe; - whiteboard and unknown actions are skipped. Playback starts only from the Play button (or Space), which primes the shared narration element inside the gesture; a refused play() falls back to the reading timer, and video to muted playback. Slide scenes advance automatically; quiz, interactive and PBL scenes hold after their narration, as the classroom's auto-play does, until the learner continues. Navigating cancels the running scene cleanly and, while playing, starts the new scene from its beginning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): choose narration in the HTML export menu and warn on large files "Export as HTML" becomes a submenu, like the PPTX one: "With narration and video" embeds narration audio and video clips, "Without narration" keeps the file small (captions on the reading timer, poster frames for videos). The option that fits the classroom is listed first. Narration that could not be embedded counts as a partial export, and files above 100 MB get a size warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): label narration by the container its bytes are Stored narration can carry the wrong format: a provider that answers WAV without a usable Content-Type is recorded as mp3. Exports then labelled the clip audio/mpeg and named it .mp3, and WebKit, trusting the label, reported a WAV with a streaming placeholder data length as about 44,700 s long. The narration collectors shared by the classroom ZIP and the standalone HTML export now sniff the container from the leading bytes (RIFF/WAVE, ID3 or MPEG frame sync, OggS, fLaC, ftyp, WebM) and use it for the MIME type and archive extension; unrecognized bytes keep the stored label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): tighten standalone media policy and build large files as Blob parts - A slide video whose src is a direct URL no stored asset backs is now fetched (same timeout policy as images) and embedded; when it cannot be fetched it is reported as unresolved media instead of silently falling back to its poster. - "Without narration" now means no audio or video payload anywhere: interactive pages do not fetch their <video>/<audio> sources (new skipMedia inline option) and already-embedded clips are stripped, while their images, posters and other assets are still inlined. - Slide audio elements, which the offline player never plays, are no longer collected or counted as missing narration. - The document is assembled as Blob parts (base64 in pieces, clips encoded one at a time), so no single string approaches V8's length limit. The size is estimated from the media byte counts before anything is encoded; above 400 MB the export stops with a localized explanation (StandaloneHtmlTooLargeError, the hook for a future page-plus-media-folder fallback). The 100 MB warning stays. - Media block comments now say when a block is decoded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): stop videos at their cap and keep controls in step - play_video now pauses the clip when its wait cap passes or the run is cancelled, and clears the losing timer and listeners when the wait settles, so a clip never plays on under the next narration. - The video's own controls stay in step with playback: pausing the awaited clip pauses playback and playing it resumes; starting any other video pauses the narration, and resuming playback pauses that video again. - Space leaves a focused video or audio element to toggle itself, and keeps scrolling quiz and PBL scenes when focus is inside the scene. - A caption lasts as long as its speech, so nothing is left over a held quiz or interactive scene. - Play after the last scene finished starts over from the first scene. - The start overlay shows on whichever scene the file opens on and goes away on any navigation, a hash change included. - Body text is antialiased like the classroom page. - Tests for the media ports (pause racing play, refused and failing clips, muted retry, cap, control sync, widget queue), the media library, the overlay and Space rules, and holding for every held scene type. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): exact size ceiling, thorough media stripping, ADTS behind ID3 - Resuming the awaited video through its own controls now pauses any video started by hand, as resuming playback by any other path does. - The size estimate counts the manifest as the escaped UTF-8 bytes the document carries, and the assembled Blob is checked against the ceiling too, so the 400 MB guard holds exactly (maxBytes is an option for hosts and tests). - Without narration, the src of <video>, <audio> and their <source> elements is stripped for any data: URI whatever MIME it declares, and stripping recurses into nested srcdoc documents (bounded depth; deeper documents are dropped). - Audio sniffing skips a leading ID3v2 tag (syncsafe size) and reads the frame after it: MPEG audio stays mp3, AAC ADTS becomes aac, also for untagged ADTS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(standalone-player): toggle a focused video on Space in every browser WebKit's native video controls ignore Space, so with the slide video focused nothing happened while the video kept playing. The player now handles Space on a focused video or audio element itself, in the capture phase, toggling that element and stopping the press so Chromium's native toggle does not fire as well; the element's play and pause events keep playback in step exactly as its controls do. Verified in Chromium, WebKit and Firefox. The "Without narration" export description no longer promises a still frame for videos (generated videos have none); it says videos are not included, in all locales. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
472b26d0d5 |
fix(math): disable formula-defined macros in KaTeX and Temml rendering (#1827)
* fix(math): disable formula-defined macros in every KaTeX and Temml render Add safeKatexOptions to @openmaic/dsl, the one package every renderer, importer, editor and the app already depend on. It merges hardened settings into each caller's options: macro-defining commands (\def, \gdef, \edef, \xdef, \global, \long, \let, \futurelet, \newcommand, \renewcommand, \providecommand) become inert macros that consume the definition, trust is forced off, maxExpand is pinned, and a fresh macros object is built per call so nothing persists between renders. Caller options and caller-supplied macros are kept. Route every render through it: whiteboard and slide latex elements, quiz math, standalone HTML inline math, PPTX export via Temml, the editor's latex dialog and inline math node, generated latex elements, and the importer's formula paths. Keep the importer's node-globals rollup plugin off the dsl build, whose old parser cannot read `??`. Tests cover each render path with nested-definition inputs, a corpus of legitimate formulas that must render byte-identically, \gdef isolation, and a guard that fails if a new KaTeX/Temml call skips the helper. Bump @openmaic/dsl 0.11.3, editor 0.0.10, generation 0.3.16, importer 0.3.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): harden workbench chat math and newcommand parsing Workbench chat Markdown rendered math through @streamdown/math, which only forwards errorColor to rehype-katex. Add createSafeMathPlugin, which keeps that plugin's remark side and rehype-katex instance but replaces the rehype options with safeKatexOptions, and use it in the chat text block. Rework the inert \newcommand family: peek at unconsumed tokens so a body written as {[} stays a body, accept the starred form, skip [n] and [default] groups with brace-aware scanning, then consume exactly one replacement body. Document that caller-supplied macros are trusted code and must not be derived from content. Replace the call-text coverage check with an import-aware guard built on the TypeScript parser. It finds every runtime import of a math engine (default, aliased, named, namespace, side-effect, import = require, re-export, dynamic import, require) plus injected auto-render script text, and requires each file to be on a reviewed allowlist. Files that import KaTeX or Temml directly must use them only as render calls with safeKatexOptions(...). The interactive post-processor is allowlisted: its page already runs model-written scripts in a sandboxed iframe. Fixtures cover each bypass shape. Add KaTeX and Temml regression tests for the newcommand edge cases, and the workbench chat path to the expansion-input suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): fresh macros per chat formula and stricter render guard KaTeX writes built-in state into the macros object while rendering (an align environment sets \@eqnsw), and rehype-katex spreads one options object into every render. The workbench chat plugin shared one macros object, so that state leaked between formulas and between messages. Make macros an enumerable getter that returns a fresh hardened object on every read, so each render and each error retry gets its own. Add cross-formula and cross-message regression tests. Tighten the guard for files that import KaTeX or Temml directly: any engine reach other than a static default or namespace import (require, dynamic import, re-export, import = require, side-effect import) is rejected; the options argument is checked at each method's own position with nothing after it; and it must be a call to safeKatexOptions imported from @openmaic/dsl, not a local look-alike. Document the guard's scope: module imports only; global access, engine code inside other HTML strings and require.resolve need review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): keep built-in equation numbering with macro definitions disabled KaTeX and Temml implement \tag, \tag*, \nonumber and \notag as built-in macros that expand to \gdef\df@tag{\text{...}} and \gdef\@eqnsw{0}. Swallowing every \gdef therefore dropped equation tags and stopped \nonumber / \notag from suppressing align/gather/equation numbers. The inert \gdef now accepts exactly those two built-in shapes and stores them the way the engines' own \gdef does; every other \gdef, and every other definition command, stays inert. '@' is a letter in both lexers, so formulas can name these macros directly; the allowed shapes add nothing \tag* and \nonumber do not already provide: - \@eqnsw may only be set to 0; - \df@tag may only be one \text{...} group that never mentions \df@tag, so the tag is expanded exactly once (a self-reference would recurse until the call stack or the expansion budget runs out, as it does in the stock engines on \tag{\df@tag}). Tests: tagged and \notag/\nonumber formulas render identically to stock KaTeX (html, mathml, htmlAndMathml) and Temml; the slide element, quiz, editor dialog and Workbench chat renderers show tags and suppress numbers; definitions inside tags, self-referencing tags, nested tags and non-built-in \df@tag/\@eqnsw shapes stay inert. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(math): expand a tag in full only once per accepted definition A formula can name \df@tag itself, so a long \tag*{...} (or an accepted \gdef\df@tag{\text{...}}) followed by many \df@tag mentions re-expanded the whole tag on every mention, up to the expansion budget: about 12 KB of input produced several MB of output. An accepted \df@tag is now stored as a macro that yields its body on the first expansion and an empty \text{} afterwards. The engines expand \df@tag once per formula, or once per align row before clearing it, so tags render unchanged (stock-equality tests, including an align with a tag on several rows, stay green in KaTeX and Temml). The empty \text{} rather than nothing avoids a Temml TypeError on an empty tag. Also document, and test through the PPTX export, that Temml throws a TypeError on a script left bare by an inert definition (x^\notag); the only Temml consumer catches it and returns null. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(generation): bump to 0.3.17 after main took 0.3.16 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
e982cfeef7 |
fix(export): drop non-woff2 font fallbacks instead of about:invalid (#1826)
* fix(export): drop non-woff2 font fallbacks instead of about:invalid When an inlined stylesheet's @font-face offers a woff2, the inliner kept only the woff2 and pointed the woff/ttf/otf/eot fallbacks at url(about:invalid). Chromium and WebKit check every @font-face src URL against the page's font-src CSP when the rule is parsed, whether or not the face is ever used, so the standalone HTML export (font-src data:) logged one CSP violation per fallback: about 40 for a page that loads the KaTeX stylesheet. The woff2 fonts were inlined and render; the errors were noise. Remove those fallback entries from the src list instead, keeping local() entries and format() hints, and remove a src declaration left empty. @font-face rules without a woff2 are inlined as before, and a woff2 that fails to fetch is still reported through the inline failure report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): prune font fallbacks per src declaration The woff2 check ran across the whole @font-face rule, so a later src declaration without a woff2 (src:url(A.woff2);src:url(B.ttf)) was removed and the earlier woff2 won the cascade instead of the authored B.ttf. Judge each src declaration on its own: only a declaration that offers a woff2 loses its woff/ttf/otf/eot entries, and declarations are never removed. Also treat an entry with a format("woff2") hint as woff2, so an extensionless or mis-named woff2 URL counts and is never pruned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep font fallbacks behind conditional woff2 sources Only prune woff/ttf/otf/eot fallbacks that follow an unconditional woff2 source in the same src list: a single url() with a plain format("woff2") or format(woff2) hint (or none, with a woff2 URL). A woff2 entry gated by tech(), `supports` inside format(), a woff2-variations or multi-format hint is skipped by browsers that lack the feature (WebKit does not support tech(color-COLRv1)), so the fallbacks behind it are kept and inlined. Entries before the first unconditional woff2 are kept as well, since a browser would use them first. Fallbacks after an unconditional woff2 are now also recognised by their format() hint, so extensionless TTF/WOFF URLs are pruned too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): treat malformed woff2 format() hints as conditional parseFontSrcEntry skipped separator tokens inside format(), so the malformed `format("woff2",)` read as a plain woff2 hint and the fallbacks behind it were pruned. Browsers skip such an entry, which left the face with no usable source and no reported asset failure. format() now keeps every token (separators as themselves, nested functions and unclosed strings as empty tokens), and an unclosed url() or format() counts as an extra part, so only an exact single `woff2` keyword or string qualifies as unconditional. Anything else keeps and inlines the fallbacks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
ac0d656928 |
fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS (#1798)
* fix(server): client TTS URL refusal must not promise ALLOW_LOCAL_NETWORKS validatePublicUrlForSSRF now passes clientSupplied: true. Opt-in-governed refusals on that call — loopback, localhost, .local, private, link-local, and CGNAT literals, and a DNS answer set whose disqualifying addresses are all in those ranges — use a new string stating that ALLOW_LOCAL_NETWORKS does not apply and that the endpoint must be an operator-managed provider in server-providers.yml. validateUrlForSSRF still returns the existing flag guidance when the flag is unset and still allows those targets when it is set. Cloud-metadata targets keep their own message, and reserved, multicast, and broadcast addresses, including a DNS answer set that contains one, keep the generic local-network message. Fixes #1771 * fix(server): point client TTS URL refusal at openmaic.yml 1.2.0 deprecates server-providers.yml; operator-managed provider endpoints now live in openmaic.yml under providers:. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
8b451a33bf |
fix(renderer): repaint clipped chart series on WebKit (#1825)
ECharts reveals line series by growing an SVG clip path from a sliver to the full plot width. WebKit keeps painting the clipped group as it was on the first, nearly empty frame, so the points and labels show and the line does not. Writing the clip shape's attributes again, even with the same values, makes WebKit repaint the group. On WebKit the chart element now re-sets the attributes of the shapes inside its clip paths after every rendered frame. Animations stay on for every browser; Chromium, Firefox and charts without clip paths are left untouched. The standalone player keeps rendering charts without animation. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
9fd9f71b73 |
feat(export): PBL placeholder slides and a per-export choice of placeholders (#1823)
* feat(export): give PBL scenes a placeholder slide in the PPTX PBL scenes now get a placeholder slide at their position in the lesson, in the standalone PPTX and in the Resource Pack PPTX, like interactive and quiz scenes. A project runs only online, so the slide carries the same "Open online" button, QR code, URL and link hotspots, and no offline link (the pack has no page for it). The slide shows the project's briefing: the goal (learning objective, else the scenario goal), the milestone count and up to four milestone titles in order, cut to one line by display width. The briefing comes from the projection the standalone HTML export uses, now shared in lib/export/pbl-briefing.ts, so legacy projects are upgraded the same way and role prompts, evaluations, submissions and chat history never reach the slide. A project that is missing or unreadable falls back to the title and description. PBL narration is not copied into the notes. A lesson with only PBL scenes now exports a PPTX instead of reporting nothing to export. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): let users turn PPTX placeholder slides off The export menu gets an "Include placeholder slides" setting next to "Export PPTX" and "Export Resource Pack". A tooltip (on hover and on keyboard focus) explains that interactive pages, quizzes and PBL projects get a slide at their place in the lesson, with an "Open online" button and a QR code. Toggling it keeps the menu open and starts no export. The setting is on by default and remembered per browser in localStorage; unreadable storage falls back to on. It reaches the exports as an explicit option (useExportPPTX({ includePlaceholders }), planPptxDeck, buildResourcePackZip): - Off: both PPTX exports hold the slide scenes only, and the Resource Pack still ships the interactive HTML pages. - Off with no slide scenes: "Export PPTX" reports there are no slides, and the Resource Pack ships the HTML pages without a PPTX and says so (the "PPTX skipped" message is restored for this case). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): cut placeholder text by grapheme cluster Placeholder titles, quiz stems and PBL lines were cut by UTF-16 code units or code points, which could split an accented letter, a ZWJ emoji sequence or a surrogate pair, and emoji counted as narrow. Text is now split into grapheme clusters with Intl.Segmenter (code points where it is unavailable). Width-limited lines count wide characters and emoji clusters (flags, skin tones, ZWJ sequences, keycaps) as two columns, reserve room for the ellipsis, and never cut inside a cluster. Length-limited titles count clusters, so no lone surrogate is left behind. The export-menu e2e spec now waits on the elements it uses instead of network idle, keeps its download counter across the reload, and checks the setting from the keyboard (focus shows the tooltip; Space and Enter toggle it without closing the menu or exporting). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): choose placeholder slides per export in submenus The "Include placeholder slides" checkbox read like another export action. "Export PPTX" and "Export Resource Pack" are now submenus, built like "Download Script": - Export PPTX: "With placeholder slides (recommended)" or "Slides only", each with a short explanation. - Export Resource Pack: "PPTX with placeholders + interactive pages (recommended)" or "Slides-only PPTX + interactive pages". The choice is made per export, so nothing is remembered: the stored preference, its tooltip and its tests are removed. exportPPTX() and exportResourcePack() take { includePlaceholders } per call (default true) instead of the hook-level option. Gating, the exporting state and the slides-only fallbacks (no slides to export; HTML pages without a PPTX) are unchanged. The e2e spec covers both submenus by pointer and keyboard and checks the slide count of every downloaded deck. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(i18n): match the Resource Pack submenu wording to its parent item Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
08e1447ab7 |
feat(export): export a classroom as a single offline HTML file (#1813)
* refactor(export): share one classroom export snapshot across formats Split buildClassroomExportZip into buildClassroomExportSnapshot, which returns the portable manifest plus the bytes of every payload it names, and a thin ZIP writer on top of it. The upcoming standalone HTML export serializes the same snapshot, so both formats share one serializer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): standalone HTML player bundle A small React app that plays a classroom manifest embedded in the page: slides through @openmaic/renderer's SlideCanvas, interactive scenes in sandboxed srcdoc iframes, client-graded quizzes, and static PBL briefings, with prev/next, keyboard, scene list and fullscreen. scripts/build-standalone-player.mjs compiles it at app build time (dev and build) into public/vendor/standalone-player/: one IIFE via esbuild, Tailwind 4 CSS covering the renderer's classes, KaTeX fonts as an optional sheet, and ECharts as an optional script the player reads from a global, so files without charts do not carry it. Shiki is stubbed; code elements render unhighlighted. esbuild is added as a direct devDependency at the version already in the lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): export a classroom as a single offline HTML file Add "Export as HTML" to the export menu. The export takes the shared classroom snapshot, embeds slide images, backgrounds and video posters as data URIs (archived payloads first, concrete URLs fetched at export time), patches interactive HTML for the sandboxed iframe, and inlines the prebuilt player into <course-name>.html. The file makes no network requests: a restrictive CSP (default-src 'none', connect-src 'none') is set before any script, the manifest and config are embedded as JSON with <, > and & escaped, and interactive pages run only in iframes sandboxed like the classroom's. PBL scenes link to the online classroom only when it is published at export time. No narration or video bytes yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(sanitize): move the scene-content sanitizer to a client-safe module The policy depends only on sanitize-html, so it moves to lib/sanitize/scene-content.ts unchanged; lib/server/sanitize-scene-content.ts re-exports it for the persistence callers. Client export paths can now apply the same policy to working state before it leaves the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): sanitize and trim the standalone HTML classroom - Run slide rich text (text, shape text, table cells, LaTeX snapshots) through the persistence sanitizer before embedding: the renderer injects it into the player's own document, and the export reads working state that has not crossed the persistence boundary. - Embed chart point images as data URIs (or drop and report them); rich text images and CSS url() values are removed by the sanitizer. - Leave out what the player does not use: playback actions, multi-agent settings, the agent roster, the video manifest and PBL runtime state. PBL content is resolved the way the classroom resolves it, legacy projects upgraded, and reduced to its briefing. - Skip narration audio, legacy audio fetches and video bytes when building the snapshot for HTML (captured posters are kept); the ZIP path is unchanged. - Resolve each media ref once, count a video poster as unresolved only when no captured frame covers it, and ship KaTeX fonts only when quiz text or slides actually contain math. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep player scenes scrollable and contain scene failures Navigate with Left/Right only, so Up/Down, PageUp/PageDown and Home/End scroll long quiz and PBL scenes. Wrap each scene in an error boundary that shows it as unavailable instead of blanking the player, and read PBL briefings defensively now that the export resolves legacy projects. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(export): note that dev builds the standalone player once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): keep inline formulas and report dropped rich-text resources The prose sanitizer cannot express the editor's inline formulas (KaTeX spans with SVG and positioned parts carrying data-inline-math), so the standalone export lifts each formula's LaTeX source out before sanitizing (from data-inline-math, else the KaTeX tex annotation) and puts back a fresh KaTeX render afterwards. The embedded markup is generated from the source, never taken from the document. Images and CSS url() values in rich text, which the sanitizer removes, are inventoried first and reported as unresolved media so the partial-export warning counts them instead of losing them silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): rebuild inline formulas through the DOM, not string markers Rework the standalone export's rich-text pass so authored text is never spliced into strings: - Parse each prose string with the DOM. Inventory resources over the whole tree first, formula subtrees included: image src and srcset, media sources, and CSS url(), image-set() and @import references found by a real CSS parse (comments, quoted URLs and escapes respected). - Replace each inline formula with an empty span whose data-inline-math is set through setAttribute, then run the persistence sanitizer with an export-only option that keeps that one attribute on span. The default persistence policy is unchanged. - Parse the sanitized output and replace each such span with a fresh KaTeX render of the source read back with getAttribute. Generated KaTeX is the only markup added after sanitizing. Tests cover replacement patterns in LaTeX, marker-like and encoded text, resources inside formula wrappers, quoted URLs with parentheses, srcset, escaped url() and commented-out URLs. The export tests now run under jsdom, where the browser DOM the export relies on is available. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): make the rich-text resource inventory spec-correct and fail-safe - Decode CSS escapes per CSS Syntax: zero, surrogates and values above U+10FFFF become U+FFFD instead of throwing, and an escaped newline is a line continuation. - Never let the inventory affect the export: each element is scanned under its own guard and the whole pass is guarded, so a failure can only under-report. - Scan and strip formulas inside template contents, nested ones included, which querySelectorAll does not reach. - Document that the inventory is best-effort and only drives the partial-export warning; the sanitizer and the CSP remove and block these resources regardless. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): bound the public-classroom lookup in the HTML export Every HTML export awaited the stage-meta request for the optional PBL "continue online" link, so a request that never settled left the export stuck in its busy state with no download. The lookup now gives up after 3000 ms: the request is aborted through the fetch it is given, and a race returns even when the response body never finishes. On timeout or failure the link is omitted and the export continues. Courses without a PBL scene skip the lookup entirely. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): always link PBL scenes to the online classroom A classroom is readable by anyone holding its link; the published flag does not gate reading. Gating the PBL "Continue this project online" link on it hid a link that works. The export now always builds the link from the exporting origin and the stage id, with no stage-meta request, so there is nothing to wait on. The explicit classroomUrl option for hosts and the player's http(s)-only guard stay. This replaces the bounded lookup and its timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): render standalone-player charts without entry animation Line series animate in by growing an SVG clipPath from zero width. WebKit does not repaint the clipped group when the clip path's geometry changes afterwards, so in Safari the exported file showed a line chart's points and labels without the connecting line. Re-setting the clip path (or the clip-path attribute) makes the line appear, which confirms the stale paint. The charts runtime the export ships now wraps ECharts init so every chart renders without its entry animation; the clip path is created at its final size. The shared renderer and the online classroom are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
d89f2bd758 |
fix(export): drop the publish hint and status lookup from PPTX placeholders (#1819)
Placeholder slides told viewers to publish the classroom so students
could open it by scanning, based on the stage-meta `isPublic` flag. That
flag does not gate reading: anyone with the link can open a classroom,
including signed-out guests, so the hint was misleading and the lookup
behind it was unnecessary.
- Remove the hint from placeholder slides and the `publishHint` string
from all locales.
- Remove the stage-meta request (and its timeout) from the PPTX export.
The online link is built synchronously as
<origin>/classroom/<id>?scene=<sceneId>; `useExportPPTX({ classroomOrigin })`
still overrides the origin, and a stage without an id still gets no
online link.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
||
|
wyucandClaude Opus 5.5
|
c70ded88f8 |
feat(export): keep interactive and quiz scenes in the PPTX as placeholder slides (#1811)
* feat(export): keep interactive and quiz scenes in the PPTX as placeholder slides The PPTX export (plain and inside the Resource Pack) now follows lesson order: each interactive and quiz scene gets a placeholder slide at its original position. PBL scenes stay out of the PPTX. - Interactive placeholders in the Resource Pack link to the matching interactive/NN_<title>.html page through a relative external link. The page path comes from one shared helper (listInteractivePages), so the link and the ZIP entry cannot drift. A standalone PPTX has no pack next to it, so it shows a hint instead of a dead link. - Quiz placeholders show the question count and the question stems, never options, answers or analysis. - Slide-to-slide links resolve through the final PPTX slide numbers, so inserted placeholders no longer shift link targets. - Placeholder slides carry the scene's narration as speaker notes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): address review of PPTX scene placeholders - Quiz placeholders no longer copy the scene's narration into speaker notes: quiz narration often explains the answers. Interactive placeholders keep their notes. - Exportability now follows the planned deck rather than the slide count. Lessons with only quiz and/or interactive scenes export a PPTX (plain and inside the Resource Pack) with fallback styling; a PBL-only lesson is still reported as empty. Every shipped HTML page now has a placeholder slide, so the "PPTX skipped" path and its message are gone. - Missing or blank scene titles no longer abort the export. Titles are normalized in one helper; an untitled page is saved as interactive/NN.html and its placeholder shows the scene-type label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(classroom): open a classroom at a scene with ?scene=<id> /classroom/<id>?scene=<sceneId> now opens the standalone classroom page at that scene. The parameter is applied right after the course loads, so the opening scene's media is hydrated first. Unknown scene ids are ignored and the page opens as before; the workspace pane does not read the parameter. Opening a link sets the cursor without marking it as an edit. Exported decks use these links to send viewers to a specific scene. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(export): link placeholder slides to the online classroom with a QR code Every interactive and quiz placeholder slide, in the standalone PPTX and in the Resource Pack PPTX, now carries: - an "Open online" button linking to the scene in the online classroom (<origin>/classroom/<id>?scene=<sceneId>); - a QR code of the same URL, dark on white with a 4-module quiet zone, about a fifth of the slide width, with the URL printed under it; - when the classroom is not public, a hint to publish it so students can open it by scanning. The origin defaults to the exporting page's own origin and can be overridden through useExportPPTX({ classroomOrigin }). Public status comes from the stage-meta endpoint; unreadable metadata counts as not public. Resource Pack interactive placeholders keep the relative link to the offline HTML page as a smaller secondary link. The standalone PPTX no longer shows the "export the Resource Pack" hint. QR matrices come from uqr (MIT, no dependencies), loaded with a dynamic import on the export path only. The PNG is written by a small 1-bit encoder, so no canvas is needed and the same code runs in Node tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): bound the classroom status lookup during PPTX export The export waited on /api/stage-meta with no limit, so a stalled request kept the export (and its guard) locked, even for lessons without any placeholder slide. - The lookup now gives up after 3 seconds: the request is aborted and the classroom counts as not public, as with unreadable metadata. - Lessons with no quiz or interactive placeholder skip the request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(export): make placeholder links clickable in WPS slideshows WPS follows a link on an uncovered shape but ignores one on a shape that a text box covers, so clicking the "Open online" button advanced the slideshow instead of opening the classroom. Each link on a placeholder slide now also gets a top-most, text-less, fully transparent hotspot with the same hyperlink: over the "Open online" button, over the QR code together with the URL under it, and over the Resource Pack's "Open offline copy" line. The fill is transparent rather than absent, since some viewers only hit-test the outline of an unfilled shape. The visible elements keep their own links and the rendered slides are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
deb2491353 |
fix(sanitize): reject CSS escape sequences in inline style values (#1815)
The inline style value check matches its blocked tokens (url(, expression(, @, script schemes) literally, so a value spelled with CSS escapes such as `u\72l(` or `\65xpression(` did not match it. Reject any value containing a backslash. The editor schemas, the PPTX importer and KaTeX never emit escaped CSS in inline styles, so stored content is unaffected; the rest of the style policy is unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
e79d00c92b |
fix(agent): fence user-authored skill content with an unforgeable end marker (#1816)
User-authored skill content reached the model with only a prose preamble and no end marker, so a body could write a fake end-of-block heading and follow it with text styled as system instructions. The body is not always the user's own prose: the agent can draft a skill from a fetched page or an uploaded material, so this is an indirect prompt injection surface. Enclose the body in a fence whose tag is derived from the body itself (first 128 bits of its SHA-256, with a postcondition check and a deterministic re-derivation on collision). The tag is deterministic rather than a per-call nonce because the virtual SKILL.md hash decides read coverage and the text lands in cached prompt prefixes; an unchanged body must wrap byte-identically. A closing </skill> in the body is made inert so it cannot close the outer skill invocation envelope while the fence is still open. The existing preamble wording is kept verbatim. Title and description were already structurally bounded (JSON-escaped frontmatter, XML-escaped discovery block); the new tests pin that too. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
ccdc88a5ad |
fix(pi): reject the verified malformed reference snapshots with 400 (#1752)
* fix(pi): reject the verified malformed reference snapshots with 400 Forged reference snapshots could still crash the resolver with an ordinary TypeError and return HTTP 500 before model resolution: table data, rows, cells, colWidths or rowHeights of the wrong shape, code lines of the wrong shape, and, for slide references, a null scenes member or a selected scene without content or canvas. Reject exactly these shapes through the existing ElementReferenceValidationError path, where lookup and projection read them. Optional fields keep their tolerance, and unexpected resolver exceptions still return 500. Refs #1711 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(pi): keep previously resolved reference shapes resolving Cross-review found that the first version also rejected shapes outside the #1711 list that used to resolve with 200: a table row `{}` and a non-object `scenes` member. Checking further, string `colWidths`, `rowHeights` and code `lines` changed from 200 to 400 in the same way. Narrow each check to the precondition of the operation that threw for a listed shape, and pin the previously resolved shapes with acceptance regressions. Drop the shared object helper so #1682's element check is unchanged. Refs #1711 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn> |
||
|
wyucandClaude Opus 5.5
|
a3c17b6116 |
feat(generation): host hooks for server-side generation runs (#1807)
* refactor(server): share the host hook registration checks Move the misspelled-hook detection, the "did you mean" hint and the bound-once hook reads out of the persistence hooks registry into lib/server/host-hook-registration.ts, so another host hook registry can validate its registrations the same way. No behavior change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(generation): host hooks for server-side generation runs Add configureGenerationRunHooks, registered once from instrumentation.ts register() like the persistence hooks, for a host that meters usage, enforces a quota or keeps an audit trail around course generation: - authorizeStart: admits or refuses a start on POST /api/generation-runs and POST /api/generate-classroom, after every built-in check, inside the create transaction; a refusal answers with the host's status, code, message and headers, and no run is created. Attributes it returns are stored on the run (generation-runs migration 5, host_attributes JSONB). - wrapExecution: runs every claimed execution of a run (first claim, takeover, the claim after a Retry or an outline confirmation, media-only executions) and each background material extraction inside the host's context, with the run's stored attributes. A wrapper that refuses pauses the run at its step (Retry resumes it) or fails the extraction. - classifyFailure: maps a host error to a stable code and says whether an automatic retry is worthwhile; consulted before the step retries, the outline stream's retries, the model fallback, media failures and extraction failures. A non-retryable host failure pauses the run at the step; the AI SDK's own retries of a retryable provider status stop at it too (callLLM and streamLLM put every model they hand the SDK, v2 or v3, and any model a prepareStep picks, behind a gate that raises it again as not retryable; frozen models included), callLLM's own retries stop at it and throw it rather than an earlier invalid result, and an outline stream that fails with it is not accepted on its partial outlines. - onRunEvent: best-effort notifications after committed transitions (started, outline-ready, scene-appended, paused, completed, ended), in commit order within a process, each with the stored ownerId and the currentOwnerId the run was claimed into since (looked up for at most 5 s; at most 1000 notifications queue per process, newer ones dropped with a counted warning); never awaited, and a failing listener never affects the run. With nothing registered every path behaves as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
wyucandClaude Opus 5.5
|
636fab0d7e |
release: OpenMAIC 1.2.0-rc.1 (server-first) (#1794)
* ci: run CI for the provider-config integration branch
Development of the provider configuration RFC (#1701) lands on
integration/provider-config; build it on push and run CI for pull
requests into it, as with earlier integration branches.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): capability slot registry and stage-to-slot mapping (#1726)
* feat(config): capability slot registry and stage-to-slot mapping
First P0 step of the provider configuration RFC (#1701, tracked in
#1725): define the capability slot forest and map every LLM stage key
to exactly one slot. Pure data with no callers yet, so there is no
behavior change.
Requirements are checked on the slot that declares them and are not
passed down to child slots, so agent.title can use a model without
tool calling even though agent requires it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin every stage destination and the capability roots
Review found that the station and root assertions derived their
expectations from the module under test: re-pointing a single-stage
station or dropping a capability root still passed. The tests now
compare against an independently written stage table and root list,
and pin agent.title as config-only. Also document that browserless
outlines still run on the generate-classroom model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): pin slotForStage and full slot lineages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): provider presets and the openmaic.yml schema (#1727)
* feat(config): provider presets and the openmaic.yml schema
Second P0 step of the provider configuration RFC (#1701, tracked in
#1725).
- lib/config/provider-presets.ts: one preset per built-in registry
entry, plus the token plans as multi-capability presets whose stage
recommendations become slot recommendations. Registry ids that
collide across capabilities get explicit preset ids.
- lib/server/model-config/openmaic-yml.ts: parse and validate the
operator's openmaic.yml (or the file named by OPENMAIC_CONFIG):
${VAR} interpolation, strict schema, and cross-checks that every
assignment names a declared provider whose preset offers the slot's
capability. Every problem is reported with its path.
- instrumentation.ts: an invalid file refuses to start. Without a file
nothing changes, and nothing resolves models through the file yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): harden openmaic.yml validation after review
- Look providers up by own key only, so "constructor:m" is not taken
for a declared provider.
- Refuse non-mapping objects YAML produces (an unquoted timestamp
becomes a Date that the schema would accept as an empty object), and
refuse a YAML alias that refers back to itself instead of overflowing
the stack.
- Accept lowercase variable names; refuse a "${" with no closing
brace, checked on the text as written, never on substituted secrets.
- Cross-check the entries that are valid on their own even when the
schema rejects others, so every problem is reported at once without
duplicate errors for declared-but-invalid providers.
- Name the three valid assignment shapes when a value has none of them.
- Test the boot path: an invalid file exits with code 1 before any
schedule starts; a valid one boots.
- Ignore a root openmaic.yml in git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep secrets out of openmaic.yml diagnostics
Review round 2:
- Read only variables the environment itself has, as non-empty
strings: ${constructor} or an inherited value is not a variable.
- Never print a value that came from ${VAR}, and report YAML syntax
errors by reason and position without js-yaml's source excerpt,
which can quote a literal key.
- Keep the base URL requirement on presets: SearXNG from its registry
entry, and Azure OpenAI and self-hosted MinerU, which have no usable
default endpoint.
- Check slot names and valid model references even inside an entry
that fails the schema, and report a failed placeholder once rather
than again as an empty value.
- Boot test for the no-file case.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* refactor(config): validate openmaic.yml in two phases
Rounds 1-3 of review kept finding edge cases in one feature: running
the cross-checks on the half-valid parts of a file the schema had
rejected, so that every problem showed at once. It hid problems inside
a rejected entry, lost a __proto__ slot key, and built misleading
provider errors from failed placeholders. That feature is gone.
Validation now runs in two phases. Phase 1 is the document itself:
placeholders, key names (checked on the document as written, since the
schema drops a __proto__ key), and the schema. Any problem there stops
before phase 2, the references between entries, which therefore only
ever sees a fully valid file. Each phase reports all of its problems,
one per path.
YAML syntax errors now report only their position: js-yaml's reason
can quote source text too (an alias or tag name), not just its excerpt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(api)!: generate-classroom takes requirement + uploaded materials; capabilities follow server config (#1728)
Narrows POST /api/generate-classroom to { requirement, materialIds? }; capabilities follow server configuration; materials go through the owner material library (upload, reference by id, delete); new GET /api/generate-classroom/capabilities; skill docs updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve a slot through the configuration layers (#1729)
* feat(config): resolve a slot through the configuration layers
Third P0 step of the provider configuration RFC (#1701, tracked in
#1725). resolveSlot walks from a slot to its capability root and
returns the first assignment it meets, consulting the deployment layer
(openmaic.yml, locked) before the workspace layer at every node. An
explicit null disables the subtree; nothing assigned up to the root is
unassigned, with no fallback to any vendor. The result carries the
provider, preset, registry entry, effective base URL, key, model, call
options, fallback, where it was resolved and whether it is locked, and
the requested slot's own requirements checked against the model
catalogue (met, unmet or unknown).
Pure and uncalled for now, so there is no behavior change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): lock only written slots and trust the catalogue only where it applies
Review round 1:
- locked now means the requested slot itself is written in the
deployment layer. Inheriting a deployment value does not lock a slot,
since the workspace may still assign it (source and resolvedAt still
report where the value came from).
- A custom OpenAI-compatible endpoint borrows the OpenAI registry for
transport only, so its preset no longer trusts that model catalogue:
requirements there resolve to unknown.
- The fallback is checked against the slot's requirements too, and the
result exposes fallbackRequirements so retries can refuse it.
- A malformed reference fails with a path-qualified SlotResolutionError
that does not echo the value, which is often a misplaced key.
- Requirement tests use named catalogue models instead of picking one
from the catalogue at run time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): order layers deployment-first and keep references out of errors
Review round 2:
- resolveSlot no longer depends on the order its caller passes the
layers in: deployment layers always come first, for assignments and
provider lookup alike.
- Resolution errors name the path and the preset, never a value taken
from the reference, so a key pasted into the provider position does
not end up in a log.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(config): cover catalogue aliases and fallback capability errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(classroom)!: save server-generated classrooms through server persistence (#1730)
Server-side classroom generation saves the finished course create-only into the request owner's library with media in the owner's asset pool; jobs move to PostgreSQL with owner-scoped polling; /api/classroom is removed; legacy data/classrooms files are imported once in the background. Adds @openmaic/storage 0.36.0 PgAssetStore.releasePending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): translate the legacy configuration into a deployment layer (#1731)
* feat(config): translate the legacy configuration into a deployment layer
Deployments without openmaic.yml keep working: provider variables,
server-providers.yml, DEFAULT_MODEL, MODEL_ROUTES and MODEL_FALLBACK are
translated into the openmaic.yml shape and serve as the deployment layer
for resolveSlot.
- Providers: each configured entry becomes a provider under its preset
id; force-disabled entries are left out; AliDocMind's key pair goes
into credentials.
- DEFAULT_MODEL goes on the llm root. Every other slot that serves stages
gets what those stages used before (their route, or else the default
model), written only where inheritance would give something else, so
an unrouted stage under a routed parent stays on the default model.
- Stages that now share a slot but had different routes, models whose
provider has no server configuration, and stages that used the
browser's model but would now inherit a server one become startup
notices, never failures.
- MODEL_FALLBACK attaches to every chat assignment without its own.
- When openmaic.yml exists it wins, with a notice if legacy variables
are also set.
Nothing reads the layer yet; routes switch over in P1 (#1725).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): follow the agent driver's rules and keep notices value-free
Review round 1:
- The agent never used DEFAULT_MODEL: it needs a valid maic-agent-driver
route and is off otherwise, so the translation writes agent: null where
it would inherit a server model (and a notice for a route that does
not work today). Unrouted conversation titles reuse the driver's model
with thinking off, as the title generator does.
- Notices name registry ids only; a credential pasted into a model
variable is never repeated.
- Provider entries and route options are checked against the new schema
and left out with a notice (field names only) instead of producing a
file that would not parse; driver-only options are dropped elsewhere.
- A route with its own fallback never falls back to MODEL_FALLBACK, even
when that fallback cannot carry over; the retry model is part of the
comparison with the inherited value.
- Force-off switches without a configured entry are reported, a legacy
configuration made only of them is detected, and translating one adds
a deprecation notice.
- loadDeploymentLayer reads the process environment and working
directory like the legacy loaders, instead of taking parameters it
could only partly honor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): compare routes by behavior, validate references, name only known ids
Review round 2:
- Stages sharing a slot are compared by what the route changes for them
(model, thinking, fallback), with bare ids read as openai models and a
route to DEFAULT_MODEL counted as no route; api and contextWindow are
inert outside the driver.
- A model reference carries over only when it names a provider from the
providers section and forms a valid reference.
- Section keys and force-off ids are named in notices only when they are
registry ids with a preset.
- Retries now follow the slot; where a call site picked its retry model
by another label (scene types under scene-content, browserless
generation), the change is reported.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): chat references need a chat entry; one notice for retries
Review round 3:
- A model reference carries over only when its provider was translated
from the providers section, not merely declared by another section
under the same id.
- Routes are compared by the retry model that takes effect, so leaving
out a fallback equals repeating MODEL_FALLBACK.
- The per-call-site retry notices kept missing cases (streaming and
calls outside server-managed routing never retry today). They are
replaced by one notice, given whenever a retry model is configured,
that retries now follow the slot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(config)!: translate only providers and the default model (#1732)
* refactor(config)!: translate only providers and the default model
MODEL_ROUTES does not map one to one onto slots: several stages share a
slot, the agent driver and conversation titles have rules of their own,
and retries are picked by call-site labels. Emulating that took most of
the translation and still ended in notices that are easy to miss.
The translation now carries over only the unambiguous part: providers,
DEFAULT_MODEL as the llm root and MODEL_FALLBACK as its fallback (the
agent stays null, as it never used DEFAULT_MODEL). A deployment that
sets MODEL_ROUTES without openmaic.yml gets LegacyRoutesError asking it
to write the per-stage models as slots. loadDeploymentLayer is not wired
into startup yet; that happens when routes switch to resolveSlot (P1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): say what a dropped MODEL_FALLBACK loses
Without DEFAULT_MODEL there is no assignment to hold MODEL_FALLBACK, and
calls that retried on it (server providers picked in the browser) stop
retrying; the notice says so. thinkingSchema is module-private again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(persistence): workspace model configuration with keys encrypted at rest (#1733)
* feat(persistence): workspace model configuration with keys encrypted at rest
The store behind the web settings of RFC #1701 (#1725, P1): one row per
workspace (owner) in workspace_model_config, the same shape as
openmaic.yml without policy.
- Provider secrets (apiKey, credentials) are sealed per provider with
AES-256-GCM under OPENMAIC_SECRET_KEY, bound to the provider id, and
never stored in the config column. Without the variable, a secret is
created once in data/instance-secret.key (the Docker volume).
- A secret sealed under another instance secret is reported as
unreadable ("enter again"), and a save that brings no new secret for
that provider keeps it, so a misconfigured secret cannot destroy keys.
- Saves replace the document with a compare-and-swap on the revision,
after the owner's identity lock; two concurrent first saves cannot
both land (PostgreSQL contract test).
- A claim moves the anonymous configuration to the account unless the
account has its own (core participant, order 900).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): publish the instance secret atomically; force the races in tests
Review round 1:
- The generated secret is written and flushed under a private name,
then published with an exclusive link, so no process can read it half
written and exactly one of two starting processes creates it. A file
that is not a complete generated secret (empty, truncated) is refused
instead of deriving a key anyone could compute.
- The PostgreSQL test holds both first saves at their insert until both
have read the missing row, and holds the row lock for the update case
until both saves queue behind it (checked by backend pid, not by any
lock waiter in the database).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(persistence): verify the written secret; require full GCM tags
Review round 2:
- The generated secret is written in full, read back and checked before
it is published; the temporary file is removed on any failure.
- Sealed values open only with a 12-byte IV and a full 16-byte tag
(authTagLength), so a shortened tag cannot weaken authentication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve slots at request time over deployment, workspace and defaults (#1734)
* feat(config): resolve slots at request time over deployment, workspace and defaults
The runtime half of RFC #1701 resolution (#1725, P1):
- deploymentConfig(): the deployment layer, loaded once per process.
The legacy translation now splits into the deployment's providers and
a separate default layer (DEFAULT_MODEL, MODEL_FALLBACK) that locks
nothing and ranks below the workspace, as DEFAULT_MODEL ranked below
the model a user picked.
- workspaceLayer(owner) reads the web settings; requestWorkspaceId(req)
names the request's owner (none for an owner minted by the request).
- lookupSlot walks deployment and workspace over the whole tree first;
the defaults are a second walk, so a default on a child never outranks
a workspace choice higher up.
- resolveStageModel builds the language model: the configured slot, else
what the request still names the old way (deprecated), else the
defaults, else a loud error; a slot turned off fails whatever the
request names. A workspace provider's endpoint is checked like a
caller-supplied one and gets the transport that refuses redirects.
- resolveSlot gains the default source, and reports which layer declared
the provider, its proxy and credentials.
Nothing calls it yet; call sites switch next.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep request identity and workspace endpoints inside their bounds
Review round 1:
- A refused owner credential throws InvalidOwnerCredentialError (401)
instead of resolving with the deployment's models and keys.
- A retired request owner gets no workspace: canonicalizing it would
hand an old anonymous cookie the claiming account's settings. Only
background work, which names a stored owner, is forwarded.
- A workspace provider may not be Amazon Bedrock (which falls back to
the server's AWS credential chain) or set a proxy (which routes around
the checked, redirect-refusing transport); the deployment still may.
- Test seams for the deployment config and the workspace loader, and
tests for identity, forwarding and caching.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): read only the named owner's settings; refuse unmet requirements
Review round 2:
- workspaceLayer reads exactly the owner it is given. Forwarding through
a claim let a request whose owner was claimed between its check and the
read see the account's settings; background work passes the owner it
works for now instead.
- A model the catalogue says does not meet the slot's requirement is
refused before anything is built (SlotRequirementError), without
consulting the request.
- Tests: a database failure fails the call without falling back, a
workspace provider without a key never gets the deployment's, and the
transport each provider source gets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* test(identity): exempt the model settings lookup from cookie forwarding
requestWorkspaceId resolves the owner only to pick whose model settings a
generation call uses, and returns no response of its own, like the
vision prompt helper already listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config)!: resolve every LLM call through its capability slot (#1735)
* feat(config)!: resolve every LLM call through its capability slot
The LLM call sites of RFC #1701 switch to slot resolution (#1725, P1):
- resolveModel resolves a stage through its slot for the request's or
job's workspace: the deployment and workspace configuration first; the
model and key a request names (x-model, x-model-routes, body fields)
only for a slot left unassigned, deprecated; then the defaults an
older deployment set with DEFAULT_MODEL. Routes that read headers get
this through resolveModelFromRequest; the chat routes pass their
workspace; background work (agent runs, titles, generation jobs)
passes the owner it works for now.
- Retries follow the slot: a slot-resolved model carries its slot's
fallback (lib/ai/model-fallbacks.ts), which callLLM and the outline
stream use; only a model from the request path still retries on
MODEL_FALLBACK. A fallback that cannot meet the slot is not used.
- The agent driver resolves the agent slot: tool calling required,
api defaults to openai-completions, thinking.effort still refused.
Conversation titles resolve agent.title with thinking off unless the
title slot sets it.
- /api/generate-classroom resolves each step through its slot for the
job's owner, its outline through course.outline.
- MODEL_ROUTES is gone: loadDeploymentLayer runs at startup and a server
that still sets it without openmaic.yml refuses to start. The
pbl-chat and maic-agent stage keys, which nothing resolved, are removed.
BREAKING CHANGE: MODEL_ROUTES is no longer read; write per-stage models
as slots in openmaic.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): a slot fallback needs no serverManaged stamp; follow claims per stage
Review round 1:
- callLLM arms a model's attached slot fallback whether or not the caller
passes serverManaged (the PBL agents pass none); the stamp still gates
MODEL_FALLBACK on the request path.
- /api/generate-classroom resolves the owner the job works for now at each
stage, so stages after a claim follow the moved settings.
Streaming calls (agent driver, classroom chat, PBL streams) still do not
retry on a fallback model, as before this change; that is the #1725 item
on retries at every call site.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(config): resolve media and tool capabilities through their slots (#1737)
* feat(config): a provider-only reference names the provider's default model
Search and document providers mostly have no model to pick, so a slot
may name just the provider (`webSearch: tavily`); the target then has no
modelId and the adapter uses its default. Chat slots still need
providerId:modelId, checked in openmaic.yml and at resolution.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* feat(config): resolve media and tool capabilities through their slots
The capability routes and server paths of RFC #1701 (#1725, P1): text
to speech, speech recognition, images, video, web search and document
extraction resolve through their slots, like language models.
- lib/server/model-config/media.ts: the configured slot (deployment,
then workspace); else the provider a request names the old way
(deprecated); else the legacy defaults; else a loud error. A slot turned
off fails whatever the request names, and while the legacy
<CAP>_<VENDOR>_ENABLED=false switches are in effect a switched-off
provider stays off whoever assigns it. A workspace endpoint is checked
like a caller-supplied one and may not use a proxy.
- The legacy translation assigns the media roots the provider the server
picked when a request named none (first configured; web search by its
old priority; DEFAULT_IMAGE_PROVIDER for images), with the first pinned
model.
- Routes: /api/generate/{image,video,tts,voice}, /api/transcription,
/api/web-search, /api/parse-pdf and /api/extract-document. A TTS voice
applies only to the provider it was chosen for; voices register on the
tts slot's provider.
- Server paths: agent image and video generation, scene narration, the
voice catalog and registration, web search and fetch_url, material
extraction (the document slot's service, the asr slot for local
transcription), browserless classroom media, and the generation
capabilities reported by /api/health and the classroom capabilities
endpoint.
- A provider-only reference (`webSearch: tavily`) names the provider's
default model; chat slots still need providerId:modelId.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep slots authoritative on every media path
- Workspace providers reach media, search and document services only at
their preset's endpoints; a custom endpoint or proxy is deployment-only
(403 INVALID_URL).
- A configured or turned-off document slot decides the extraction service:
deprecated request fields may only pick a self-contained extractor, and
legacy operator credentials are no longer reached.
- Request paths resolve their own workspace without following a claim;
background extraction still does.
- A configured TTS slot keeps its own model; legacy pins apply only on the
deprecated and default paths.
- Local transcription and agent voice registration keep the connection's
network policy flags.
- The agent's web search forwards the whole resolved configuration.
- An unusable DEFAULT_IMAGE_PROVIDER leaves the image slot unassigned with a
notice instead of switching vendors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): public presets only for workspaces, plan default models
- A workspace preset whose default endpoint is on the server's own network
(self-hosted TTS, ASR, image) is deployment-only, and a workspace
provider's endpoint runs under the public-only policy.
- A provider-only reference to a token plan means the plan's own default
model for that capability.
- On the legacy default provider, the request's image, video and ASR model
still applies through its allowlist, and image/video without a model is
still MISSING_MODEL.
- An asr assignment a workspace may not use no longer blocks document
extraction, and a refused document service answers 403.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): keep legacy search and voice choices on their old paths
- Classroom search honours the provider and key a request names while the
webSearch slot is unassigned; only /api/web-search prefers the operator's
configured backend, as before.
- A TTS request's voice applies unless the request chose it for another
provider.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): legacy search model and capability discovery errors
- On the legacy default search provider, the request's search model still
applies through the server's pins.
- Capability discovery answers a refused credential (401) or a workspace
service it may not use (403) instead of 500.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): classroom submission refuses a workspace service with 403
A classroom submission whose materials would go to a document or speech
service the workspace may not use answers 403 INVALID_URL instead of 500, and
its material check resolves the request's own workspace without following a
claim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* fix(config): workspace image and video providers run public-only
A workspace-configured image or video provider now uses the strict public
transport for its requests and for the redirects its clip download follows,
whatever ALLOW_LOCAL_NETWORKS says; the operator's own providers and the
deprecated per-request path keep their policies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EF6G824rLqUXidRrqrMskR
* Revert "fix(config): workspace image and video providers run public-only"
This reverts commit
|
||
|
wyucandClaude Opus 5.5
|
764d91e669 |
fix(export): export tables that have no outline to PPTX (#1797)
The PPTX table branch read `el.outline.width` without a guard, so a slide table stored without an `outline` threw a TypeError and failed the whole PPTX (and resource pack) export with a generic "export failed" toast. The slide renderer already treats the outline as optional; the exporter now does too and simply omits the border. Claude-Session: https://claude.ai/code/session_01H5k2jng7f8wbobbMX8Tdwx Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |