@bigduu/lotus-next 2026.9.22 → 2026.10.8

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 bigduu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,142 +1,94 @@
-# lotus-next
+# Lotus Next
 
-An experimental, ground-up rebuild of the [Lotus](https://github.com/bigduu/Lotus) web frontend for the Bamboo agent runtime. It uses React 19, TypeScript, Vite, Tailwind CSS v4, and hand-written components built on Radix primitives.
+[English](README.md) · [简体中文](README.zh-CN.md)
 
-Lotus Next is the canonical forward-development target. Production cutover is tracked in [issue #11](https://github.com/bigduu/lotus-next/issues/11); the legacy Ant Design frontend remains only as the current production and rollback baseline while that migration is incomplete.
+![Lotus Next brand illustration: a luminous lotus flower by the water, symbolizing clarity and beauty.](docs/assets/lotus-next-nature-hero.png)
 
-This repository documents the implementation that exists here today. It does not yet claim feature parity with Lotus or production readiness.
+*Brand illustration, not a software screenshot. The lotus symbolizes clarity and beauty.*
 
-## Quick start
+**Follow your agent's work from a browser or the Bodhi desktop app.** Lotus Next is the React interface for [Bamboo](https://github.com/bigduu/Bamboo-agent), the core of the [Zenith](https://github.com/bigduu/Zenith) local AI agent harness suite. It puts conversations, tool activity, permission requests and runtime settings in one place.
 
-Run a Bamboo server on `127.0.0.1:9562`, then start the frontend:
+Use the browser interface when you already run Bamboo, or install [Bodhi](https://github.com/bigduu/Bodhi-AI/releases/latest) for a desktop shell that manages the engine. Lotus Next supplies the UI; Bamboo runs the agent and connects to your configured model provider and tools.
 
-```bash
-npm ci
-npm run dev
-```
-
-Vite listens on port `9563` and proxies `/api` and `/v2` to Bamboo on port
-`9562`. Lotus Next sends every Bamboo-native REST request through the single
-canonical `/api/v1` client; the historical `/v1` alias is deliberately not a
-frontend proxy or fallback.
+## What you can do
 
-`VITE_BACKEND_BASE_URL` and newly persisted browser overrides accept a bare
-HTTP(S) origin or exact `/api/v1`. New `/v1` input fails closed. During the
-migration window, `src/runtime/browserRuntime.ts` alone may read the legacy
-`copilot_backend_base_url` key, write and verify
-`lotus_next_backend_endpoint_v1`, and only then delete the legacy value. That
-reader is removed after every default consumer has run an artifact containing
-the migration and its declared rollback window has ended.
+- **Follow a task as it happens:** read streaming responses, reasoning and tool activity, and respond to approval or question dialogs.
+- **Keep project conversations organized:** switch sessions, preserve drafts and export a conversation as Markdown or PDF. A desktop split view supports a second interactive chat pane.
+- **Configure the tools behind the conversation:** open settings for providers, MCP servers, plugins, skills and permissions, plus runtime features such as workflows and schedules where supported by the connected Bamboo version.
+- **Work at different screen sizes:** use responsive desktop/mobile layouts, light/dark/system themes and a graphics-safe mode for constrained environments.
 
-## Implemented surface
+These describe the source checkout, not a guarantee that every connected backend or older packaged app has the same capabilities. Settings screens do not themselves supply provider credentials, an MCP server or a running scheduler.
 
-- Chat over one shared `/v2/stream` WebSocket, using JSON by default and opt-in MessagePack negotiation.
-- Streaming messages, reasoning, tools, tasks, budgets, sub-agents, Markdown, syntax highlighting, Mermaid, images, and approval or question dialogs.
-- Session navigation, live account reconciliation, drafts, pending-question restoration, Markdown/PDF export, and a desktop split view with a second interactive chat pane.
-- Responsive desktop and mobile layouts, light/dark/system themes, simple/advanced modes, and a graphics-safe mode for constrained environments.
-- Sixteen settings tabs: General, Providers, MCP, Plugins, Skills, Permissions, Environment, Schedules, Notifications, Masking, Prompts, Workflows, Clusters, Metrics, Jiandu memory, and System.
+## See a project prepared for a task
 
-## Internationalization
+![Lotus Next creates a demo project through Bamboo and selects its workspace for a new task.](docs/demos/project-workspace.gif)
 
-The i18next runtime currently registers six locales: `en-US`, `zh-CN`, `zh-TW`, `fr-FR`, `ja-JP`, and `hi-IN`. Locale resources load on demand, with `en-US` as the fallback.
+[Static image](docs/demos/project-workspace.png) · [Recording and reproduction](docs/demos/README.md)
 
-Translation coverage is not complete: parts of the newer application shell and settings UI still contain hard-coded Chinese strings. The locale list therefore describes the implemented runtime and resources, not complete localization of every screen.
+Real browser recording against a real Bamboo backend at the audited source pins.
+It uses an empty temporary workspace; no model is called and no task completion
+is implied. This is source behavior, not acceptance of the published desktop app.
 
-## Production gates
+## Try it from source
 
-Run the same checks locally that CI runs for pull requests and `main`:
+Requirements: Node.js **22.12+**, npm, and a compatible Bamboo server. Start Bamboo separately using its [setup instructions](https://github.com/bigduu/Bamboo-agent#readme), with the API listening on `127.0.0.1:9562`. Then, in this directory:
 
 ```bash
 npm ci
-npx playwright install chromium
-npm run verify
-npm run test:e2e:built
+npm run dev -- --host 127.0.0.1
 ```
 
-`npm run verify` produces the production artifact after the type, lint, unit,
-architecture, bundle, and package checks. `npm run test:e2e:built` then exercises
-that exact output in Chromium at desktop, tablet, and phone viewports. Use
-`npm run test:e2e` as the standalone convenience command when you need it to
-build first. The browser suite checks standalone, secure remote, and nested
-embedded hosting while enforcing the canonical `/api/v1` and `/v2/stream`
-runtime contract. CI retains its HTML report, trace, screenshot, video, and
-runtime observations when a case fails.
-
-The source-built real-runtime gate is intentionally separate from that
-deterministic matrix. It builds a clean checkout of Bamboo revision
-`f1f1057bdbde33358d769b6a62ff93f2287e3f9f` into an isolated Docker image,
-serves the production Lotus Next artifact from that Bamboo process, and drives
-one complete chat turn through the visible desktop UI and a local deterministic
-OpenAI-compatible provider. It requires the `auth.ws_hello_ack.v1` bootstrap
-capability and records one ordered, bidirectional WebSocket timeline for both
-the initial page and a fresh browser context, proving that exact `hello` is
-acknowledged by exact `welcome` before any subscription is sent. The provider
-shares Bamboo's test-owned network
-namespace and listens only on that namespace's loopback interface; only Bamboo's
-HTTP or in-process rustls TLS listener is published on a random host-loopback
-port. The provider writes redacted observations atomically to a test-owned bind
-mount instead of exposing its own API to the host.
-Both Bamboo data and its Jiandu home stay inside a separate
-test-owned temporary `/data` mount, so the lane never reads the workstation's
-live Bamboo or Jiandu state. To run it locally, provide the absolute path to a
-clean checkout at that exact revision:
+Open **http://127.0.0.1:9563**. On a fresh backend, finish `bamboo init` first; the initial setup gate directs you to backend/desktop configuration. Open **Settings → Provider** to configure a provider if your Bamboo instance does not already have one. Start with a small task in a sample workspace, then follow the tool activity and any approval prompts.
+
+The explicit host option keeps this development server on loopback; the repository's unqualified `npm run dev` listens on the network. Vite proxies `/api` and `/v2` to Bamboo on port `9562`. An unavailable backend cannot execute tasks or provide server-backed settings.
+
+For a production artifact:
 
 ```bash
-BAMBOO_E2E_SOURCE_DIR=/absolute/path/to/bamboo \
-  npm run test:e2e:real-bamboo
+npm run build
+# In a separate shell with Bamboo installed:
+bamboo serve --static-dir /absolute/path/to/lotus-next/dist --port 9562
 ```
 
-Docker and Chromium are required. The runner rejects a different or dirty
-Bamboo checkout and never accepts a live Bamboo URL. Normal completion, setup
-failure, `SIGINT`, and `SIGTERM` share one exact-resource teardown for the two
-containers, private network, temporary image, observation mount, and data root
-it created. CI runs this single desktop lane once on Node 22; it does not repeat
-it across the mock suite's viewport/runtime matrix.
-
-The published-artifact acceptance is a second real-runtime lane. It downloads
-`@bigduu/lotus-next@2026.9.14` from the public npm registry into a fresh cache
-with lifecycle scripts disabled, then requires the committed SHA-1, SHA-512
-integrity, manifest SHA-256, resource-set digest, 34-resource inventory, and
-source revision `ae17b50574ccd86395cbc226b50c9fb2f0f51e0f`. It refuses any
-different artifact before launching Bamboo. The same verified bytes are tested
-first through native loopback HTTP and then through Bamboo's own HTTPS/WSS
-listener using an ephemeral one-day certificate for `remote.lotus.test`.
-Desktop, tablet, and phone viewports must keep the shell, settings, and composer
-usable while every application request remains same-origin on canonical
-`/api/v1` and the single `/v2/stream` WebSocket.
-
-Run the immutable public-artifact lane with the same clean Bamboo checkout:
+Open **http://127.0.0.1:9562** when Bamboo is ready. This uses the frontend you just built. The published npm package contains frontend assets, not a standalone agent or CLI.
+
+## Source, npm package and desktop release
+
+Lotus Next is the canonical UI used by current Bamboo/Bodhi source consumers. The old Lotus frontend is retained as an explicit rollback path in those consumers, rather than the default production frontend.
+
+Checked on 2026-10-03:
+
+| Layer | Verified identity |
+|---|---|
+| Zenith pin and upstream `main` observed then | `1131c275cb441694a41f996228d9f91473d920f5` |
+| npm `latest` | `@bigduu/lotus-next@2026.9.22`, source `a480e2bb94f5dd08fe4b01b2f8844a2c9ed03245` |
+| Latest public Bodhi installer | `app-v2026.9.20`, locking Lotus Next `2026.9.16` |
+
+The source has changes after the npm artifact, including actor-stream/continuity and workflow-selection work. Those source changes are **not** asserted to be in `2026.9.22` or the desktop installer. Source `package.json` intentionally keeps `0.0.0`; publishing and consumer adoption are separate steps. See the [version audit](docs/readme-audit.md) for evidence.
+
+## Runtime and localization
+
+The UI uses canonical `/api/v1` REST calls and one shared `/v2/stream` WebSocket (JSON by default, opt-in MessagePack). Browser builds and the Tauri runtime adapter choose the backend endpoint; serving static files alone does not replace Bamboo.
+
+`VITE_BACKEND_BASE_URL` and new browser endpoint overrides accept a bare HTTP(S) origin or exact `/api/v1`. Do not use the legacy `/v1` alias. Keep credentials out of public `VITE_*` build variables. Prefer serving the production UI from Bamboo's origin; remote hosting requires the appropriate backend authentication and secure transport setup.
+
+The i18next runtime registers `en-US`, `zh-CN`, `zh-TW`, `fr-FR`, `ja-JP` and `hi-IN`, loaded on demand with `en-US` fallback. Some newer screens still contain hard-coded Chinese text; this is not a claim of complete localization.
+
+## Develop and verify
 
 ```bash
-BAMBOO_E2E_SOURCE_DIR=/absolute/path/to/bamboo \
-  npm run test:e2e:published-bamboo
+npm run type-check
+npm run test:run
+npm run verify
+npx playwright install chromium
+npm run test:e2e:built
 ```
 
-This command additionally requires `openssl`. It creates no public tunnel: the
-named remote topology resolves only to `127.0.0.1`, and the self-signed
-certificate is trusted only by the ephemeral test processes. It proves the
-browser contract and responsive viewports, not a physical-device or
-public-network path. HTML reports and Playwright artifacts are written to the
-`playwright-report-real-bamboo-{local,remote}` and
-`test-results-real-bamboo-{local,remote}` directories; runtime identity and
-redacted observations remain under `test-results-real-bamboo/{local,remote}`.
-CI uploads all three evidence roots even when a lane fails.
-
-`npm run pack:check` rebuilds the app, asks npm for the exact dry-run tarball
-manifest, and rejects anything outside `dist/` plus npm's required package
-metadata. Every build also writes `dist/lotus-next-manifest.json`. That
-versioned universal-web manifest binds the package name/version, exact source
-revision and dirty state, relative `index.html` entrypoint, and every other
-regular `dist/` resource by portable path, byte size, and SHA-256. Its combined
-digest is deterministic for one resource set. Consumers must verify this file
-before serving or staging an artifact; a dirty source manifest is never a
-release artifact.
-
-The committed package version remains the `0.0.0` source placeholder. The
-manual publication workflow accepts one explicit SemVer, verifies the complete
-Node 22/24 and real-Bamboo gates from a clean `main` commit, packs without a
-second build, verifies the tarball, publishes with npm provenance, then
-downloads and verifies the registry copy. Publishing does not switch any
-Bamboo, Bodhi, or Zenith consumer.
-
-The initial bundle-size baseline is recorded in [`docs/bundle-baseline.md`](docs/bundle-baseline.md). It is an observation gate, not a size-budget change.
+`verify` checks types, lint, unit tests, architecture, the build and package contents. The browser suite exercises that output at desktop, tablet and phone viewports. Its deterministic fixtures are separate from the real-Bamboo acceptance lanes; neither is a claim of physical-device or public-network testing.
+
+See [verification and packaging](docs/verification.md) for isolated real-runtime tests, immutable published-artifact checks and manifest verification, and [bundle baseline](docs/bundle-baseline.md) for measured build context. These are contributor checks, not prerequisites for installing Bodhi.
+
+## License
+
+Project-owned code and documentation are licensed under the [MIT License](./LICENSE).
+Third-party components retain their respective licenses and copyright notices.

package/README.zh-CN.md

@@ -0,0 +1,91 @@
+# Lotus Next
+
+[English](README.md) · [简体中文](README.zh-CN.md)
+
+![Lotus Next 品牌插画：水边一朵发光的莲花，象征清澈与美。](docs/assets/lotus-next-nature-hero.png)
+
+*品牌插画，不是软件截图。莲花象征清澈与美。*
+
+**在浏览器或 Bodhi 桌面应用里跟进 agent 的工作。** Lotus Next 是 [Bamboo](https://github.com/bigduu/Bamboo-agent) 的 React 界面，Bamboo 是 [Zenith](https://github.com/bigduu/Zenith) 本地 AI agent 套件的核心。它把会话、工具活动、权限请求和运行时设置放在同一个地方。
+
+如果你已经在运行 Bamboo，可以直接用浏览器界面；也可以安装 [Bodhi](https://github.com/bigduu/Bodhi-AI/releases/latest)，用桌面外壳来管理引擎。Lotus Next 只提供界面；agent 由 Bamboo 运行，并连接你配置的模型 provider 和工具。
+
+## 你可以做什么
+
+- **实时跟进任务**：查看流式回复、推理过程和工具活动，并回应权限确认或提问对话框。
+- **让项目会话井井有条**：切换会话、保留草稿，把会话导出为 Markdown 或 PDF。桌面分栏视图支持第二个可交互的对话窗格。
+- **配置会话背后的工具**：打开 provider、MCP 服务、插件、技能和权限的设置，以及工作流、定时任务等运行时功能（取决于所连接的 Bamboo 版本是否支持）。
+- **适配不同屏幕尺寸**：响应式的桌面/移动布局，浅色/深色/跟随系统主题，以及适合受限环境的图形安全模式。
+
+以上描述的是当前源码，不保证所有连接的后端或较旧的打包应用都具备相同能力。设置界面本身不提供 provider 凭据、MCP 服务或正在运行的调度器。
+
+## 看一个为任务准备好的项目
+
+![Lotus Next 通过 Bamboo 创建一个演示项目，并为新任务选择工作区。](docs/demos/project-workspace.gif)
+
+[静态图片](docs/demos/project-workspace.png) · [录制与复现说明](docs/demos/README.md)
+
+在审计时的源码 pin 上，连接真实 Bamboo 后端录制的真实浏览器画面。使用的是空的临时工作区；没有调用模型，也不代表任务已完成。这是源码行为，不代表已发布桌面应用的验收结果。
+
+## 从源码试用
+
+要求：Node.js **22.12+**、npm，以及兼容的 Bamboo 服务。按照 Bamboo 的[安装说明](https://github.com/bigduu/Bamboo-agent#readme)单独启动 Bamboo，让 API 监听 `127.0.0.1:9562`。然后在本目录中运行：
+
+```bash
+npm ci
+npm run dev -- --host 127.0.0.1
+```
+
+打开 **http://127.0.0.1:9563**。如果是全新的后端，请先完成 `bamboo init`；初始设置页会引导你完成后端/桌面配置。如果你的 Bamboo 实例还没有 provider，打开 **设置 → 提供方** 进行配置。先在示例工作区里做一个小任务，然后跟进工具活动和权限确认。
+
+显式指定 host 参数会让开发服务器只监听回环地址；仓库里不带参数的 `npm run dev` 会监听网络。Vite 会把 `/api` 和 `/v2` 代理到 9562 端口的 Bamboo。后端不可用时，无法执行任务，也无法提供依赖服务端的设置。
+
+构建生产制品：
+
+```bash
+npm run build
+# 在另一个已安装 Bamboo 的终端中：
+bamboo serve --static-dir /absolute/path/to/lotus-next/dist --port 9562
+```
+
+Bamboo 就绪后打开 **http://127.0.0.1:9562**。这样使用的就是你刚构建的前端。发布到 npm 的包只包含前端资源，不是独立的 agent 或 CLI。
+
+## 源码、npm 包与桌面版本
+
+Lotus Next 是当前 Bamboo/Bodhi 源码使用的标准界面。旧的 Lotus 前端在这些项目中只保留为显式的回滚路径，而不是默认的生产前端。
+
+2026-10-03 核对结果：
+
+| 层次 | 核实的标识 |
+|---|---|
+| Zenith pin 和当时观察到的上游 `main` | `1131c275cb441694a41f996228d9f91473d920f5` |
+| npm `latest` | `@bigduu/lotus-next@2026.9.22`，源码 `a480e2bb94f5dd08fe4b01b2f8844a2c9ed03245` |
+| 最新公开的 Bodhi 安装包 | `app-v2026.9.20`，锁定 Lotus Next `2026.9.16` |
+
+源码在这个 npm 制品之后还有改动，包括 actor-stream/continuity 和工作流选择相关的工作。这些源码改动**不**代表已包含在 `2026.9.22` 或桌面安装包中。源码 `package.json` 有意保留 `0.0.0`；发布和下游采用是独立的步骤。证据见[版本审计](docs/readme-audit.md)。
+
+## 运行时与本地化
+
+界面使用标准的 `/api/v1` REST 调用，以及一个共享的 `/v2/stream` WebSocket（默认 JSON，可选 MessagePack）。浏览器构建和 Tauri 运行时适配器负责选择后端地址；只提供静态文件并不能替代 Bamboo。
+
+`VITE_BACKEND_BASE_URL` 以及新的浏览器端地址覆盖，接受纯 HTTP(S) origin 或精确的 `/api/v1`。不要使用旧的 `/v1` 别名。不要把凭据放进公开的 `VITE_*` 构建变量。推荐从 Bamboo 的 origin 提供生产界面；远程托管需要相应的后端认证和安全传输配置。
+
+i18next 运行时注册了 `en-US`、`zh-CN`、`zh-TW`、`fr-FR`、`ja-JP` 和 `hi-IN`，按需加载，缺失时回退到 `en-US`。部分较新的界面仍有硬编码的中文文字；这并不表示本地化已经完整。
+
+## 开发与验证
+
+```bash
+npm run type-check
+npm run test:run
+npm run verify
+npx playwright install chromium
+npm run test:e2e:built
+```
+
+`verify` 会检查类型、lint、单元测试、架构、构建和包内容。浏览器测试套件在桌面、平板和手机视口下测试构建产物。它的确定性测试数据与连接真实 Bamboo 的验收流程是分开的；两者都不代表做过实体设备或公网测试。
+
+隔离的真实运行时测试、不可变的已发布制品检查和清单验证，见[验证与打包](docs/verification.md)；构建体积的实测背景见[包体积基线](docs/bundle-baseline.md)。这些是给贡献者的检查，不是安装 Bodhi 的前提条件。
+
+## 许可证
+
+项目自有代码和文档采用 [MIT 许可证](./LICENSE)。第三方组件保留各自的许可证和版权声明。