@orion-agents/orion-code 0.3.1 → 0.3.2

package/docs/readme.md

@@ -18,6 +18,17 @@ The repository release history is canonical in [`CHANGELOG.md`](../CHANGELOG.md)
 link into the archive, but historical evidence is not moved back into `plan/` merely to satisfy an
 old relative path.
 
+## v0.3.2 candidate release set
+
+- [Resizable Workbench and Composer Control Center plan](plan/v0.3.2-web-workbench-layout-and-composer-plan.md)
+- [v0.3.2 Web API contract](architecture/v0.3.2-web-api.yaml)
+- [Agent mode and permission contract](architecture/agent-mode-permission-contract.md)
+- [v0.3.2 real Web E2E qualification plan](test/v0.3.2-web-workbench-e2e-plan.md)
+- [v0.3.1 to v0.3.2 migration and rollback](migration/v0.3.1-to-v0.3.2.md)
+
+Candidate plans and contracts describe required behavior; they are not release evidence. A v0.3.2
+GO still requires the source-clean exact-tarball receipts described by the E2E plan.
+
 ## v0.3.1 candidate release set
 
 - [Professional Web Workbench plan](plan/v0.3.1-web-workbench-professional-shell-plan.md)
@@ -25,8 +36,7 @@ old relative path.
 - [v0.3.1 real Web E2E qualification plan](test/v0.3.1-web-workbench-e2e-plan.md)
 - [v0.3.0 to v0.3.1 migration and rollback](migration/v0.3.0-to-v0.3.1.md)
 
-Candidate plans and contracts describe required behavior; they are not release evidence. A v0.3.1
-GO still requires the source-clean exact-tarball receipts described by the E2E plan.
+This remains the v0.3.2 baseline and historical qualification contract.
 
 ## v0.3.0 release set
 

package/docs/test/v0.3.1-web-workbench-e2e-plan.md

@@ -1,7 +1,7 @@
 # Orion Code v0.3.1 Web Workbench E2E 资格计划
 
 - 目标版本：`0.3.1`
-- 状态：合同已冻结，真实 release evidence 待生成
+- 状态：合同已冻结；真实 release evidence 由组装器生成，本文不手工复制易漂移的 run ID
 - 权威场景目录：`src/runtime/release-receipts.ts`
 - 证据组装器：`scripts/e2e/assemble-web-e2e-receipt.ts`
 - 产品方案：[`v0.3.1 Web Workbench 专业工作台计划`](../plan/v0.3.1-web-workbench-professional-shell-plan.md)

package/docs/test/v0.3.2-web-workbench-e2e-plan.md

@@ -0,0 +1,100 @@
+# Orion Code v0.3.2 Web Workbench E2E 资格计划
+
+- 目标版本：`0.3.2`
+- 状态：合同冻结；本地开发 run 只用于修复，不是 release evidence
+- 权威场景目录：`src/runtime/release-receipts.ts`
+- required facts：`tests/e2e/scenarios.ts::WEB32_REQUIRED_EVIDENCE_FACTS_V1`
+- 证据组装器：`scripts/e2e/assemble-web-e2e-receipt.ts`
+- 产品方案：[`v0.3.2 Workbench 与 Composer 计划`](../plan/v0.3.2-web-workbench-layout-and-composer-plan.md)
+- API 合同：[`v0.3.2 Local Web API`](../architecture/v0.3.2-web-api.yaml)
+
+## 1. GO 边界
+
+源码 build、单元测试、开发 Host 或历史 0.3.1 receipt 都不是 v0.3.2 发布证明。GO 必须同时满足：
+
+1. source-clean checkout 只构建一次 `@orion-agents/orion-code@0.3.2` tgz；
+2. 三次 fresh primary run 与 Node 22.12.0、24.0.0、26.0.0 runtime run 安装同一
+   `tarballSha256`，且 `installedTargetDigest` 相同；
+3. 使用真实 Chrome、打包后的 `bin/orion`、真实 Host/Runtime/ToolGateway/Thread store；
+4. primary 精确执行既有 E2E/SET/WEB31 加 WEB32-P0-01..12；runtime 精确执行冻结 critical 集；
+5. 无 skip、expected-fail、自动 retry、源码 fallback 或 DOM 注入伪造状态；
+6. console error/warning、page error、HTTP 5xx、secret finding、dropped event、orphan 均为 0；
+7. 每个 WEB32 场景的 structured facts 和 PNG 都通过安全校验并绑定 manifest digest；
+8. runner、Chrome、Node/npm/platform/arch、artifact receipt 与 installed target identity 写入 receipt。
+
+## 2. WEB32 场景
+
+| ID          | 真实旅程                                                                          | 关键权威证据                                      |
+| ----------- | --------------------------------------------------------------------------------- | ------------------------------------------------- |
+| WEB32-P0-01 | 左栏鼠标拖至 240/280/480、双击复位、48px rail、刷新恢复                           | pointer facts、实际 bounding box、PNG             |
+| WEB32-P0-02 | 左右栏同时最大，right concession 后 center 仍 ≥560；视口恢复时桌面偏好恢复        | center/right 实测宽度与 preference                |
+| WEB32-P0-03 | 320/390/760/1024/1180/1440 drawer、互斥、focus return、无水平溢出                 | viewport matrix、focus、overflow=0                |
+| WEB32-P0-04 | BUILD/PLAN/AUTO 下拉、immediate/deferred、AUTO risk；模式与权限独立               | Host snapshot、provider request mode              |
+| WEB32-P0-05 | default/Ask/Allow/Deny、Allow confirm、显式 Deny、真实 ToolGateway                | 文件副作用、durable authorization receipt         |
+| WEB32-P0-06 | 双模型 catalog+Effort、切小窗口真实 compact、失败 rollback                        | provider model/usage、compact receipt、metadata   |
+| WEB32-P0-07 | provider/estimated Context、阈值、capacity reset、自动/手动 compact               | Runtime context projection 与 provider request    |
+| WEB32-P0-08 | file/folder/review/session/skill 引用、stale/forbidden、prompt manifest、secret=0 | Host prompt manifest/digest、negative probes      |
+| WEB32-P0-09 | PLAN 不执行；approve/continue/cancel；refresh/restart；stale digest 409           | durable Thread facts、provider sequence、零副作用 |
+| WEB32-P0-10 | queue edit/move/remove、Steer CAS、Session draft 切换/刷新、无串线                | queue/item revisions、sessionStorage scope        |
+| WEB32-P0-11 | 双 tab CAS、Host restart、replay reset、matching snapshot 前 Composer disabled    | exact 409、SSE frames、snapshot barrier           |
+| WEB32-P0-12 | normal CSP、axe、light/dark/reduced-motion/200% zoom、错误/secret/dropped 全 0    | headers、axe JSON、browser counters、PNG          |
+
+每个 Playwright 标题必须且只能包含一个 scenario ID。完整 fact key、类型与阈值以代码目录为准；
+组装器拒绝缺失、额外、错误类型、错误 PNG、绝对路径、symlink 或不满足阈值的证据。
+
+## 3. Critical 子集
+
+Node 22.12/24/26 使用同一 tgz 执行既有 critical 集并新增：
+
+```text
+WEB32-P0-01, WEB32-P0-04, WEB32-P0-05, WEB32-P0-06,
+WEB32-P0-09, WEB32-P0-11, WEB32-P0-12
+```
+
+它覆盖 packaged layout、模式/权限/模型/Context、durable Plan review、多标签 CAS、恢复屏障与
+normal-CSP accessibility/security。其他 WEB32 场景仍必须在三次 full primary run 中执行。
+
+## 4. 运行规则
+
+- deterministic loopback provider 至少提供大/小两个 context window 和多个 Effort；
+- 权限场景必须进入真实 ToolGateway，以 durable receipt 和文件副作用核验；
+- PLAN 场景必须读取真实 Thread journal；HTTP 202 或 UI 文案不是完成证据；
+- recovery 使用真实同端口 Host restart、EventSource cursor/replay reset 和 matching snapshot；
+- 核心旅程使用 normal CSP；axe 注入不能通过全页 `bypassCSP` 弱化产品约束；
+- Context/文件安全 negative probe 可用 installed Host fetch，避免预期 4xx 变成浏览器 console 噪音；
+- network failure 只能在场景内精确采集 method/path/error 后逐项登记；不得给固定宽限；
+- 截图只裁产品表面，禁止绝对路径、用户名、凭据、真实项目内容、terminal ticket 或外部账号信息。
+
+## 5. 构建与 receipt
+
+等价本地入口如下，实际 tgz 文件名从 artifact receipt 读取：
+
+```bash
+npm run release:artifact -- \
+  --out-dir .release/package \
+  --receipt .release/package/artifact.json
+
+npm run test:web-e2e:primary -- \
+  --tarball .release/package/orion-agents-orion-code-0.3.2.tgz \
+  --receipt .release/package/artifact.json \
+  --chrome /absolute/path/to/google-chrome
+
+npm run test:web-e2e:matrix -- \
+  --tarball .release/package/orion-agents-orion-code-0.3.2.tgz \
+  --receipt .release/package/artifact.json \
+  --chrome /absolute/path/to/google-chrome \
+  --node22 /absolute/path/to/node-22.12.0 \
+  --node24 /absolute/path/to/node-24.0.0 \
+  --node26 /absolute/path/to/node-26.0.0
+```
+
+三个 primary manifests、三个 runtime manifests 和 artifact receipt 交给
+`npm run release:web-e2e-receipt`。最终 release receipt 必须强绑定 Web receipt digest。
+
+## 6. 失败处理
+
+- 任一 ID 缺失/重复/额外、fact/PNG 缺失、artifact identity 不一致：NO_GO；
+- 任一 Node clean install/native dependency/Chrome journey 失败：NO_GO；
+- stale mutation 有副作用、Plan 自动执行、敏感内容泄漏、snapshot 前 Composer 可提交：NO_GO；
+- 修复产品或测试后，从同一 source-clean commit 重建新 tgz，旧 artifact 与旧 run 全部失效；
+- 开发态逐场景 GO 只能证明修复方向，不能复制成正式发布结论。

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@orion-agents/orion-code",
-      "version": "0.3.1",
+      "version": "0.3.2",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^0.7.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Orion Code - local-first goal-driven coding agent for terminal and Web.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,15 +18,20 @@
     "docs/migration/v0.2.2-to-v0.3.0.md",
     "docs/migration/v0.2.2-to-v0.3.0-settings.md",
     "docs/migration/v0.3.0-to-v0.3.1.md",
+    "docs/migration/v0.3.1-to-v0.3.2.md",
     "docs/plan/v0.2.0-dsh-harness-redesign-plan.md",
     "docs/plan/v0.2.0-release-checklist.md",
     "docs/plan/v0.3.0-web-workbench-plan.md",
     "docs/plan/v0.3.0-settings-integration-plan.md",
     "docs/plan/v0.3.0-node-runtime-compatibility-plan.md",
     "docs/plan/v0.3.1-web-workbench-professional-shell-plan.md",
+    "docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md",
     "docs/test/v0.3.1-web-workbench-e2e-plan.md",
+    "docs/test/v0.3.2-web-workbench-e2e-plan.md",
     "docs/architecture/v0.3.0-web-api.yaml",
     "docs/architecture/v0.3.1-web-api.yaml",
+    "docs/architecture/v0.3.2-web-api.yaml",
+    "docs/architecture/agent-mode-permission-contract.md",
     "LICENSE",
     "README.md",
     "README.zh-CN.md",

package/dist/web-client/assets/FilesPanel-BkoLmgjR.js

@@ -1,2 +0,0 @@
-import{r as l,j as e,I as k,s as H,W as J}from"./index-BkIDl_xk.js";function se({workspaceId:t,refreshEpoch:c,actions:a}){const[i,d]=l.useState({}),[p,x]=l.useState(new Set(["workspace-root"])),[o,f]=l.useState(null),[m,y]=l.useState(""),[L,S]=l.useState(null),[P,$]=l.useState(!1),[E,R]=l.useState(""),[T,N]=l.useState(""),[F,Q]=l.useState(""),[B,V]=l.useState(!1),[z,q]=l.useState("1"),D=l.useRef(null),u=l.useRef(0),g=l.useRef(0),C=async(s,r=!1,b=u.current)=>{if(b!==u.current)return;const h=i[s],v=r?h?.nextCursor:void 0;if(!(r&&!v)){d(n=>({...n,[s]:{items:h?.items??[],nextCursor:h?.nextCursor??null,revision:h?.revision??"",loading:!0}}));try{const n=await a.listFiles(s,v??void 0);if(b!==u.current)return;d(j=>({...j,[s]:{items:r?X(j[s]?.items??[],n.items):n.items,nextCursor:n.nextCursor,revision:n.revision,loading:!1}}))}catch(n){if(b!==u.current)return;if(r&&K(n)){N("目录已变化，已重新载入第一页。"),C(s,!1,b);return}d(j=>({...j,[s]:{items:j[s]?.items??[],nextCursor:j[s]?.nextCursor??null,revision:j[s]?.revision??"",loading:!1,error:_(n)}}))}}};l.useEffect(()=>{const s=u.current+1;u.current=s,g.current+=1,d({}),x(new Set(["workspace-root"])),f(null),y(""),S(null),$(!1),R(""),N(""),t&&C("workspace-root",!1,s)},[c,t]);const w=async(s,r=!1,b=!1,h=u.current,v=g.current+1)=>{if(h===u.current&&!(!s.readable||s.sensitive||s.kind==="directory")){g.current=v,f(s),R(""),r||(y(""),S(null),$(!1)),b||N("");try{const n=await a.readFileContent(s.id,r?L??void 0:void 0);if(h!==u.current||v!==g.current)return;$(n.binary),y(j=>r?`${j}${n.content??""}`:n.content??""),S(n.nextCursor),b&&N("文件已变化，已从第一页重新载入。")}catch(n){if(h!==u.current||v!==g.current)return;if(r&&K(n)){await w(s,!1,!0,h,v);return}R(_(n))}}},M=s=>{const r=new Set(p);r.has(s)?r.delete(s):(r.add(s),i[s]||C(s)),x(r)},G=l.useMemo(()=>Object.values(i).flatMap(s=>s.items),[i]),W=F.trim()?G.filter(s=>s.name.toLocaleLowerCase().includes(F.toLocaleLowerCase())):null;return e.jsxs("div",{className:"work-resource-panel files-panel",children:[e.jsxs("div",{className:"resource-toolbar",children:[e.jsxs("label",{className:"resource-search",children:[e.jsx("span",{className:"sr-only",children:"搜索已加载文件"}),e.jsx(k,{name:"search",size:14}),e.jsx("input",{type:"search",value:F,onChange:s=>Q(s.target.value),placeholder:"搜索已加载文件"})]}),e.jsx("button",{type:"button",className:"icon-button","aria-label":"刷新文件树",onClick:()=>{C("workspace-root")},children:e.jsx(k,{name:"refresh",size:15})})]}),e.jsxs("div",{className:"files-layout",children:[e.jsx("section",{className:"file-tree","aria-label":"工作区文件",children:W?e.jsxs(e.Fragment,{children:[e.jsx("p",{className:"resource-hint",children:"搜索仅覆盖已加载的目录和文件。"}),e.jsx("ul",{role:"list",className:"file-node-list search-results",children:W.map(s=>e.jsx(O,{node:s,depth:0,expanded:!1,selected:o?.id===s.id,onToggle:M,onSelect:r=>{w(r)}},s.id))})]}):e.jsx(A,{parentId:"workspace-root",depth:0,directories:i,expanded:p,selectedId:o?.id,onToggle:M,onSelect:s=>{w(s)},onLoadMore:s=>{C(s,!0)}})}),e.jsxs("section",{className:"file-preview","aria-label":"文件预览",children:[T?e.jsx("p",{className:"resource-notice",role:"status",children:T}):null,o?e.jsxs(e.Fragment,{children:[e.jsxs("header",{children:[e.jsx("strong",{children:o.name}),e.jsx("span",{children:Y(o.sizeBytes??0)})]}),E?e.jsx("p",{className:"resource-error",role:"alert",children:E}):P?e.jsxs("div",{className:"resource-empty",children:[e.jsx(k,{name:"code"}),e.jsx("strong",{children:"二进制文件"}),e.jsx("p",{children:"出于安全和性能考虑，只显示元数据。"})]}):e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"file-preview-actions",children:[e.jsxs("label",{children:[e.jsx("span",{className:"sr-only",children:"跳到行"}),e.jsx("input",{type:"number",min:"1",value:z,"aria-label":"跳到行",onChange:s=>q(s.target.value)})]}),e.jsx("button",{type:"button",className:"text-button",onClick:()=>Z(D.current,z),children:"跳转"}),e.jsx("button",{type:"button",className:"text-button",onClick:()=>{I(m,N)},children:"复制"}),e.jsx("button",{type:"button",className:"text-button","aria-pressed":B,onClick:()=>V(s=>!s),children:"自动换行"})]}),e.jsx("pre",{ref:D,tabIndex:0,className:`file-code-view ${B?"wrap":""}`,"aria-label":`文件内容 ${o.name}`,children:H(m).split(`
-`).map((s,r)=>e.jsxs("span",{className:"file-code-line","data-line":r+1,children:[e.jsx("span",{className:"file-line-number","aria-hidden":"true",children:r+1}),e.jsx("span",{className:"file-line-content",children:s||" "})]},r))})]}),L?e.jsx("button",{type:"button",className:"secondary-button",onClick:()=>{w(o,!0)},children:"加载更多内容"}):null]}):e.jsxs("div",{className:"resource-empty",children:[e.jsx(k,{name:"workspace"}),e.jsx("strong",{children:"选择文件预览"}),e.jsx("p",{children:"敏感文件、工作区外链接和二进制正文不会返回浏览器。"})]})]})]})]})}function A({parentId:t,depth:c,directories:a,expanded:i,selectedId:d,onToggle:p,onSelect:x,onLoadMore:o}){const f=a[t];return f?f.error?e.jsx("p",{className:"resource-error",role:"alert",children:f.error}):e.jsxs("ul",{role:"list",className:"file-node-list",children:[f.items.map(m=>{const y=i.has(m.id);return e.jsxs("li",{children:[e.jsx(O,{node:m,depth:c,expanded:y,selected:d===m.id,onToggle:p,onSelect:x}),m.kind==="directory"&&y?e.jsx(A,{parentId:m.id,depth:c+1,directories:a,expanded:i,selectedId:d,onToggle:p,onSelect:x,onLoadMore:o}):null]},m.id)}),f.loading?e.jsx("li",{className:"resource-loading",children:"正在读取…"}):null,f.nextCursor?e.jsx("li",{children:e.jsx("button",{type:"button",className:"text-button",onClick:()=>o(t),children:"加载更多"})}):null]}):e.jsx("p",{className:"resource-loading",children:"正在读取…"})}function O({node:t,depth:c,expanded:a,selected:i,onToggle:d,onSelect:p}){const x=t.sensitive||!t.readable;return e.jsxs("button",{type:"button",className:`file-node ${i?"selected":""} ${x?"blocked":""}`,style:{paddingInlineStart:`${8+c*15}px`},"aria-expanded":t.kind==="directory"?a:void 0,"aria-label":`${U(t.kind)} ${t.name}${x?"，不可读取":""}`,onClick:()=>t.kind==="directory"?d(t.id):p(t),disabled:x,children:[e.jsx(k,{name:t.kind==="directory"?"workspace":"code",size:14}),e.jsx("span",{children:t.name}),t.kind==="symlink"?e.jsx("small",{children:"链接"}):null,t.sensitive?e.jsx("small",{children:"敏感"}):null]})}function U(t){return t==="directory"?"目录":t==="symlink"?"符号链接":"文件"}function X(t,c){const a=new Map(t.map(i=>[i.id,i]));for(const i of c)a.set(i.id,i);return[...a.values()]}function Y(t){return t<1024?`${t} B`:t<1048576?`${(t/1024).toFixed(1)} KB`:`${(t/1048576).toFixed(1)} MB`}function K(t){return t instanceof J&&t.code==="file_revision_conflict"}function Z(t,c){const a=Number(c);!t||!Number.isSafeInteger(a)||a<1||(t.querySelector(`[data-line="${a}"]`)?.scrollIntoView({block:"center"}),t.focus())}async function I(t,c){try{await navigator.clipboard.writeText(t),c("已复制当前加载的文件内容。")}catch{c("浏览器未允许复制，请手动选择文本。")}}function _(t){return t instanceof Error?t.message:"文件请求失败。"}export{se as FilesPanel};