@orion-agents/orion-code 0.3.2 → 0.3.7

package/CHANGELOG.md

@@ -22,6 +22,213 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.7] — CANDIDATE
+
+> **Status: candidate.** This work is isolated on the codex/v0.3.7 worktree (left project
+> rail interaction quality). It is not merged, tagged or published to npm.
+
+### Added
+
+- Session **tags**: up to 8 user-assigned tags per Session (each ≤ 32 chars), persisted on
+  the Session record (`SessionMeta.tags`), projected into `WebSessionSummaryV1.tags`,
+  managed from a new "管理标签…" dialog (chip add via Enter/comma, per-chip remove) and
+  rendered as small badges on rail rows. Host endpoint `POST /sessions/:id/tags`.
+- Session **archive / restore**: soft delete via `SessionMeta.archivedAt` that keeps every
+  file, hides the Session from default listings and counts, and surfaces it under a new
+  "已归档" rail section with a 还原 action (`POST /sessions/:id/archive|restore`;
+  `GET /workspaces/:id/sessions/archived`).
+- Session **delete** from the web workbench: destructive confirmation dialog (explicit
+  "永久删除" guard, 不可恢复 copy) wired to the existing storage `deleteSession` through a
+  new `DELETE /sessions/:id` endpoint; refuse-while-busy checks in the controller.
+- The rail rename affordance becomes a general **overflow menu** (`SessionRowMenu`,
+  keyboard navigable ↑↓/Home/End/Esc with focus restore) hosting 重命名… / 管理标签… /
+  归档 / 删除… so future per-Session actions have a stable home.
+
+### Changed
+
+- Active-workspace session listings (`listProjectSessions`, `listSessions`,
+  `countSessionsByProject`) exclude archived Sessions by default.
+- Rail footer status copy is shortened to 已连接 / 离线 / … with full sentences moved to a
+  tooltip (`connectionTitle`); the collapsed rail dot keeps an accessible short label.
+- Project tag chips, archived-section rows and the two new dialogs ship with their own
+  styles; stale `.session-rename`/`.session-row` rules were removed.
+
+### Fixed
+
+- Rename failures are no longer silent: `RenameDialog` surfaces the server error inline
+  (`field-error`) instead of closing without feedback.
+- Session-row menu hint ids are instance-unique (`useId`) so `aria-describedby` can never
+  point at another row's hint.
+- The archived rail listing is bound to its owning Workspace: switching projects drops stale
+  foreign archive rows immediately and never flashes another project's archive while loading;
+  `session_deleted` also clears the stale runtime projection.
+
+### Tests
+
+- New contract suites: `web-reducer-session-lifecycle` (14, incl. owner-binding + runtime
+  cleanup regression), `web-ui-SessionDialogs` (7), `web-ui-SessionRowMenu` (3),
+  `web-ui-WorkspaceDialog` (6), `session-storage-tags-archive` (5, incl. delete),
+  plus controller-level guards (tags validation / archive-restore / delete-while-busy /
+  foreign-workspace rejection / 404) in `web-workbench-controller.test.ts`; `web-ui-*` now
+  112 cases green. E2E: `web-v037-session-lifecycle.spec.ts` (archive/restore, delete-confirm,
+  tags round-trip) runs in CI.
+
+
+## [0.3.6] — CANDIDATE
+
+> **Status: candidate.** This work is isolated on the codex/v0.3.6 worktree (pure web
+> workbench interaction quality). It is not merged, tagged or published to npm.
+
+### Added
+
+- Component rendering contract layer for the web workbench: six `.test.tsx` suites
+  (89 cases) assert on `react-dom/server.renderToStaticMarkup` output without jsdom —
+  Markdown / StateDot / ShortcutHelp / DiffViewer / ApprovalCard / PanelResize.
+- `StateDot` status indicator that never relies on colour alone (WCAG 1.4.1): every dot
+  carries a shape channel via `data-tone` (square / circle / pulsing ring / hollow ring /
+  triangle) plus a visually-hidden text label for assistive tech; applied to reasoning,
+  research sources, review evidence and the work-panel rail.
+- Single-source keyboard binding table (`shortcuts.ts`) plus a `⌘/` shortcut help dialog
+  rendered from it, so the panel cannot drift from the live bindings; `matchesShortcut`
+  now resolves `Esc` → `Escape` so the help vocabulary matches real key events.
+- Header theme-cycle button (system → light → dark, persisted through the settings
+  document); the `SettingsDialog` entry stays intact.
+- Stacked notification toasts (P1-C): multiple notices queue without overwriting, each
+  non-recoverable non-error notice auto-dismisses after 5s, error / recovery notices stay
+  until acted on, and `aria-live` is graded (alert for errors, status otherwise).
+
+### Changed
+
+- `PanelResizeHandle` is keyboard reachable with full separator semantics: `role=separator`
+  with live `aria-valuenow`/`aria-valuetext`, ←/→ steps of 2% (Shift 10%), Home/End jump,
+  Enter/Space reset to default; stepping logic is extracted as pure functions.
+- Notification region becomes a stacked container (`.workbench-notice-stack`); cards slide
+  in on `opacity`/`transform` only and the whole stack is inert while drawers are open.
+- Icon set gains `sun` / `moon` / `monitor` / `keyboard` glyphs.
+
+### Fixed
+
+- Markdown heading off-by-one: `##` renders as `<h2>` (was `<h3>`), a lone `#` no longer
+  collapses to `<h6>`; >6 hashes stay a plain paragraph per GFM.
+
+
+## [0.3.5] — CANDIDATE
+
+> **Status: candidate.** This work is isolated on the codex/v0.3.5 worktree. It is not
+> merged, tagged or published to npm, and exact-artifact qualification remains a separate gate.
+
+### Added
+
+- Version thread projection digests so v0.3.2/v0.3.3 cutover receipts keep verifying while new
+  projections carry the full diagnostic/compact shape; forged digests fail closed.
+- Session snapshot sync state is decoupled from the Host transport: a Session snapshot failure
+  can no longer flip the live SSE to `replay-required`; Composer and command gates require both
+  transport live and the foreground Session snapshot ready.
+- Host and browser diagnostics counters for Session switches, snapshot cache hits/loads/latency,
+  and Session actor allocation/eviction/closure, so "pure selection allocates no Runtime" is
+  provable from counters instead of prose.
+- Runtime ownership across Workspace Context switches: the Host-level Session registry is created
+  once and preserved; control planes and Session actors borrow per-Workspace shared kernels, and
+  only Host shutdown closes every actor and kernel.
+
+### Changed
+
+- Instant Session switching renders a cached projection immediately, refreshes with a bounded
+  tail snapshot in the background, and prefetches the most recent Sessions after a baseline.
+- Version and release hygiene: package identity moves to 0.3.5, `release:check` recognizes
+  `codex/vX.Y.Z` and `GITHUB_HEAD_REF` release branches, and the Web rail no longer falls back to
+  a hardcoded version string.
+
+### Fixed
+
+- Workspace Context activation no longer shuts down resident Session actors of other Workspaces
+  or requires every actor to be idle before switching the active control plane.
+- A failed Context activation restores the previous control plane without rebuilding the Session
+  registry, so resident actors and their Runtime revisions survive the rollback.
+
+## [0.3.4] — CANDIDATE
+
+> **Status: candidate.** This stabilization work is isolated on the v0.3.4 worktree. It is not
+> merged, tagged or published to npm, and exact-artifact qualification remains a separate gate.
+
+### Changed
+
+- Bind Settings writes to the active Workspace and Context revision in addition to the Settings
+  document revision, so a stale browser tab cannot apply a valid patch to another Workspace.
+- Preserve lexical symbolic-link identity while projecting a contained target as a file or
+  directory, and expose the true changed-file total separately from the bounded Review page.
+- Split exact-tgz qualification into a script-disabled identity stage and a separate lifecycle-
+  enabled consumer/native stage.
+
+### Fixed
+
+- Keep split terminal surrogate pairs intact across delayed PTY callbacks, wait for browser write
+  capacity without animation-frame spin, and drain reconnect data in replay, live-tail, exit order.
+- Reject blank Session renames without changing durable metadata, and keep active-turn state intact
+  when a busy-rejected slash command fails.
+- Isolate concurrent command transcript capture so interleaved output cannot cross Sessions or
+  leave the process-wide console bridge installed.
+- Project cold and resident Composer model, Effort and permission changes from the actor Runtime's
+  canonical Session instead of a pre-actor metadata copy.
+- Detect binary content on every file page, render contained directory symlinks as expandable and
+  label Review truncation against the true repository total.
+
+### Security
+
+- Redact URL userinfo and structured sensitive keys before browser/evidence projection; evaluate
+  file aliases plus canonical targets and block sensitive current or rename-source Git diffs before
+  starting a content process.
+- Require matching, canonical-digest-verified terminal receipts and durable receipt facts before a
+  modern tool result can project success.
+- Fail release qualification for a failed live canary or duplicated runtime run and manifest
+  evidence instead of accepting a structurally complete but non-independent matrix.
+
+## [0.3.3] — CANDIDATE
+
+> **Status: candidate.** The implementation and local qualification remain isolated on the v0.3.3
+> worktree. It is not merged, tagged, published to npm or represented as a completed release receipt.
+
+### Added
+
+- Add the bundled `orion-blocksmith` pixel-workshop style as a closed built-in appearance option,
+  composed with system/light/dark themes and reduced motion without remote assets or executable
+  theme packages.
+- Add a bounded Web Session actor registry with three running slots, four resident actors, FIFO
+  overflow admission, cancellable queued turns, idle LRU eviction and explicit per-Session runtime
+  revisions.
+- Add the v0.3.3 OpenAPI, migration guide and exact-artifact WEB33-P0-01..12 plus
+  WEB33-P0-16..24 qualification contract.
+
+### Changed
+
+- Make foreground Session selection browser-tab-local so a running, approval-waiting or queued
+  Session continues while another Session is viewed or submitted.
+- Route Session commands and Composer mutations through exact Workspace, Context, Session runtime
+  and control revisions; stale operations fail closed instead of following a global active Session.
+- Keep a single Workbench SSE connection while projecting Session-tagged runtime state into bounded
+  per-Session browser caches.
+- Package runtime JavaScript and declarations without generated source-map files, preserving local
+  build maps while keeping the published artifact within the existing unpacked-size budget.
+
+### Fixed
+
+- Remove the global pending barrier from warm same-Workspace Session selection and restore cached
+  content immediately while a guarded snapshot refreshes in the background.
+- Keep the collapsed Work Panel as a right-side full-height 48px rail across desktop and drawer
+  breakpoints without moving it below the conversation or creating horizontal page overflow.
+- Keep the only persistent Settings entry at the lower-left project rail and restore focus after a
+  successful Settings save.
+- Raise Orion Blocksmith light-theme muted text contrast to WCAG AA for small labels and empty-state
+  copy.
+
+### Security
+
+- Serialize same-Workspace mutating Tool steps through a shared arbiter while preserving independent
+  actors for non-conflicting work; stale file baselines are rejected before side effects.
+- Bind queued-turn cancellation, approvals, Goal/Plan controls and structured Context references to
+  the intended Session actor, with zero cross-Session provider, Tool, journal or file effects on
+  revision conflict.
+
 ## [0.3.2] — CANDIDATE
 
 > **Status: candidate.** Source, API and browser qualification are being frozen together. This is

package/README.md

@@ -2,16 +2,26 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.2 candidate — one Orion runtime with a resizable local Web Workbench, a Session-scoped
-> Composer Control Center and the existing TUI/terminal surfaces. Candidate source is not an npm
-> publication or Git tag.
+> v0.3.7 candidate — a left project-rail interaction release on top of the v0.3.6 work:
+> shortened connection copy, a keyboard-reachable per-Session overflow menu
+> (rename / tags / archive / delete with confirmation), persisted Session tags with
+> rail badges, an archived-Session section with restore, and a friendlier
+> "打开或新增项目" workspace dialog. Candidate source is not an npm publication,
+> Git tag, or merge-ready release.
 
 [中文说明](README.zh-CN.md) ·
-[v0.3.2 Workbench plan](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) ·
-[v0.3.2 Web API](docs/architecture/v0.3.2-web-api.yaml) ·
+[v0.3.7 plan](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
+[v0.3.6 plan](docs/plan/v0.3.6-plan.md) ·
+[v0.3.5 plan](docs/plan/v0.3.5-plan.md) ·
+[v0.3.4 stabilization plan](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 contract](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E plan](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 migration](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 plan](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
 [mode/permission contract](docs/architecture/agent-mode-permission-contract.md) ·
-[v0.3.2 E2E plan](docs/test/v0.3.2-web-workbench-e2e-plan.md) ·
-[v0.3.2 migration](docs/migration/v0.3.1-to-v0.3.2.md) ·
+[v0.3.3 E2E plan](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 migration](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web plan](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings plan](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node compatibility](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -20,11 +30,82 @@ Local-first, goal-driven coding agent for the terminal and browser.
 [Settings migration](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [real-state gallery](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## What v0.3.2 includes
-
-- **One runtime, two interactive surfaces.** `orion web` uses the same product bootstrap,
-  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and
-  MCP boundaries as the terminal product; the browser does not run a second agent loop.
+## What v0.3.7 changes
+
+- **Left rail status copy** is shortened (已连接 / 离线 / …) with full sentences on hover.
+- **Per-Session overflow menu** replaces the rename icon — 重命名… / 管理标签… / 归档 /
+  删除…, fully keyboard navigable, deleting requires an explicit confirmation dialog.
+- **Session tags**: up to 8 persisted tags per Session, edited as chips and shown as
+  badges on rows; archive hides a Session (all files kept) into a rail 已归档 section
+  with one-click restore.
+- **Workspace dialog** rework: "打开或新增项目" with suggested workspaces, a collapsible
+  "其他工作区" list and busy/validation feedback.
+
+## What v0.3.6 changes
+
+- **A component-rendering contract layer.** Six `.test.tsx` suites (89 cases) assert the web
+  workbench UI through `renderToStaticMarkup` — no jsdom needed — pinning Markdown tables and
+  headings, status dots, the shortcut help dialog, the diff viewer, the permission card and the
+  resize separator keyboard contract.
+- **Keyboard-reachable resize separators.** Project navigation and work-panel splitters expose
+  full separator semantics (`aria-valuenow`/`aria-valuetext`) and answer ←/→ (±2%, Shift ±10%),
+  Home/End and Enter/Space from the keyboard.
+- **Status without colour alone.** A shared `StateDot` adds a shape channel (`data-tone`) and a
+  screen-reader label to every status dot — reasoning, research sources, review evidence and the
+  work-panel rail.
+- **Single-source shortcut help.** `⌘/` opens a help dialog rendered from the same binding table
+  the live handlers match against.
+- **Theme cycle in the header.** One click walks system → light → dark and persists through the
+  settings document; light tokens stay consolidated in the blocksmith token sheet.
+- **Stacked notifications.** Toasts queue instead of overwriting, auto-dismiss after 5s unless
+  error/recovery, and grade `aria-live` by severity.
+
+## What v0.3.5 changes
+
+- **Session snapshot state is its own machine.** A failed HTTP snapshot marks only the foreground
+  Session `failed` and never flips the live SSE into `replay-required`; Composer and command gates
+  require both a live transport and a ready foreground Session snapshot.
+- **Instant Session switching.** A cached projection renders synchronously, a bounded tail snapshot
+  refreshes it in the background, the most recent Sessions are prefetched after a baseline, and stale
+  responses can never overwrite the browser-local foreground.
+- **Runtime ownership across Workspaces.** The Host-level Session actor registry is created once per
+  Host. A Workspace Context switch swaps only the active control plane; Session actors of other
+  Workspaces keep running on the Workspace kernel they were created with, and only Host shutdown
+  closes every actor and kernel. Failed switches roll back without rebuilding the registry.
+- **Provable runtime ownership.** Host and browser diagnostics count Session snapshot requests,
+  latency and failures, Session switches and cache hits, and actor allocation/eviction/closure — so a
+  pure selection provably allocates zero Session Runtimes.
+- **Release hygiene.** Version identity moves to 0.3.5; `release:check` understands `codex/vX.Y.Z`
+  and `GITHUB_HEAD_REF`; the Web rail no longer hardcodes a fallback version.
+
+This branch also carries the merged [v0.3.4 stabilization](#what-v034-stabilizes) below.
+
+## What v0.3.4 stabilizes
+
+- **Context-bound writes.** Settings mutations now carry the active Workspace and Context revision;
+  stale tabs fail with no write or Runtime apply. Blank Session renames and busy slash commands also
+  fail without corrupting durable or active-turn state.
+- **One sensitive-data boundary.** Structured credentials, URL userinfo, canonical file targets,
+  Git diff paths, tool artifacts and concurrent command output are checked and redacted before they
+  reach browser or evidence surfaces.
+- **Deterministic Terminal transport.** Split surrogate pairs, browser write backpressure and
+  reconnect races preserve complete Unicode and the required replay, live-tail, exit and close
+  order.
+- **Honest durable/read projections.** Tool receipt and journal facts must validate as a pair;
+  symbolic links expose an effective target kind without losing lexical identity, and Review
+  distinguishes total changed files from its bounded visible page.
+- **Fail-closed release proof.** Failed live canaries, duplicate runtime evidence and lifecycle
+  scripts hidden inside a supposedly safe package-install stage are release blockers.
+
+## What v0.3.3 includes
+
+- **One execution spine, bounded Web Session actors.** Web Sessions use the same product bootstrap,
+  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and MCP
+  boundaries as the terminal product. Up to three Session turns may run concurrently with four
+  resident actors; the TUI and terminal surfaces keep their single-active-Session contract.
+- **Orion Blocksmith.** A bundled pixel-workshop style combines with system/light/dark themes without
+  remote assets, dynamic theme code or a second settings source. Classic remains available as an
+  explicit built-in style.
 - **Recoverable Web workbench.** The React workbench includes workspace/session navigation,
   transcript and tool activity, BUILD/PLAN/AUTO, follow-ups, interrupt, approvals, Goal/Plan,
   model/effort settings, Skills/MCP and diagnostics. Snapshots plus cursor replay repair refreshes
@@ -88,10 +169,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-After the immutable `0.3.2` npm receipt exists:
+After the immutable `0.3.5` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.2
+npm install -g @orion-agents/orion-code@0.3.7
 orion --version
 orion doctor
 ```
@@ -278,10 +359,13 @@ npm run test:web-e2e -- --grep @settings
 
 Release qualification additionally builds one exact tarball and installs that unchanged hash on
 Node 22/24/26 for package identity, native SQLite, TUI, terminal, print, Web, Goal, subagent, Skill,
-MCP, Compact, and resume journeys. WEB32-P0-01..12 additionally qualify the resizable project rail,
-Composer controls, Context, durable Plan review, queue/drafts and recovery/accessibility contract.
-See the [`v0.3.2 Workbench plan`](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) and
-[`v0.3.2 E2E qualification plan`](docs/test/v0.3.2-web-workbench-e2e-plan.md).
+MCP, Compact, and resume journeys. WEB33-P0-01..12 qualify the built-in appearance contract, while
+WEB33-P0-16..24 qualify parallel Session actors, foreground-local switching, bounded queues, the
+right rail and the single Settings entry. See the [`v0.3.3 plan`](docs/plan/v0.3.3-plan.md) and
+[`v0.3.3 E2E qualification plan`](docs/test/v0.3.3-web-workbench-e2e-plan.md). The security and
+stabilization delta is defined by the
+[`v0.3.4 test plan`](docs/test/v0.3.4-stabilization-e2e-plan.md), which does not treat source gates
+as release evidence.
 
 ## Security
 

package/README.zh-CN.md

@@ -2,15 +2,23 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.2 候选版本：一套 Orion Runtime，同时提供可调宽本地 Web Workbench、Session 级
-> Composer Control Center 与既有 TUI/terminal。Candidate 源码不代表已创建 npm 发布或 Git tag。
+> v0.3.7 候选版本：左侧项目栏交互发布（基于 v0.3.6 之上）—— 状态文案精简、会话行键盘可达
+> 操作菜单（重命名 / 标签 / 归档 / 删除含确认）、可持久化会话标签与行内徽章、已归档会话区一键还原、
+> 以及更友好的「打开或新增项目」工作区对话框。Candidate 源码不代表已创建 npm 发布、Git tag 或达到
+> 可合并状态。
 
 [English](README.md) ·
-[v0.3.2 Workbench 方案](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) ·
-[v0.3.2 Web API](docs/architecture/v0.3.2-web-api.yaml) ·
+[v0.3.7 方案](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
+[v0.3.6 方案](docs/plan/v0.3.6-plan.md) ·
+[v0.3.4 稳定化方案](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 合同](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E 方案](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 迁移](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 方案](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
 [模式/权限合同](docs/architecture/agent-mode-permission-contract.md) ·
-[v0.3.2 E2E 方案](docs/test/v0.3.2-web-workbench-e2e-plan.md) ·
-[v0.3.2 迁移](docs/migration/v0.3.1-to-v0.3.2.md) ·
+[v0.3.3 E2E 方案](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 迁移](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web 方案](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings 方案](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node 兼容方案](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -19,11 +27,26 @@
 [Settings 迁移](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [真实状态图册](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## v0.3.2 包含什么
-
-- **一个 Runtime、两个交互界面。** `orion web` 与终端产品共用 product bootstrap、
-  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP；浏览器不另起
-  一套 agent loop。
+## v0.3.4 稳定了什么
+
+- **Context 绑定写入。** Settings mutation 现在同时携带活动 Workspace 与 Context revision；陈旧页面
+  不会写入或应用到另一个 Runtime。空 Session 名称和 busy slash command 也会保持持久态与活动回合不变。
+- **统一敏感数据边界。** 结构化凭据、URL userinfo、canonical 文件目标、Git diff 路径、tool artifact
+  和并发命令输出在进入浏览器或证据前统一检查与脱敏。
+- **确定的 Terminal 传输。** PTY 代理对分片、浏览器写入背压与重连竞态都保持完整 Unicode，以及
+  replay、live tail、exit、close 的严格顺序。
+- **诚实的 durable/read 投影。** Tool receipt 与 journal fact 必须成对校验；symlink 在保留 lexical
+  类型的同时投影有效目标类型；Review 将仓库真实总数与有界可见页分开显示。
+- **Fail-closed 发布证据。** live canary 失败、重复 Runtime 证据，或混入“安全安装阶段”的生命周期
+  script 都会阻止发布。
+
+## v0.3.3 包含什么
+
+- **一条执行主干、有界 Web Session actors。** Web Session 与终端产品共用 product bootstrap、
+  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP。Web 最多允许
+  3 个 Session turn 并行、4 个 actor 常驻；TUI/terminal 继续保持单活动 Session 合同。
+- **Orion 方块工坊。** 内置像素工坊风格可与 system/light/dark 组合，不加载远程资产、动态主题代码或
+  第二份 Settings 真相；classic 继续作为显式内置风格提供。
 - **可恢复的 Web 工作台。** React 界面覆盖工作区/会话、对话与工具活动、BUILD/PLAN/AUTO、follow-up、
   interrupt、审批、Goal/Plan、模型/effort、Skills/MCP 和诊断。快照与 cursor replay 负责刷新和 SSE
   重连恢复。
@@ -76,10 +99,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-当 npm 已存在不可变的 `0.3.2` 发布凭据后：
+当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.2
+npm install -g @orion-agents/orion-code@0.3.7
 orion --version
 orion doctor
 ```
@@ -251,9 +274,10 @@ npm run test:web-e2e -- --grep @settings
 
 正式准出还会只构建一次 exact tarball，并在 Node 22/24/26 安装同一个 hash，验证 package identity、
 native SQLite、TUI、terminal、print、Web、Goal、subagent、Skill、MCP、Compact 与 resume；
-WEB32-P0-01..12 还会验证可调项目栏、Composer 控制、Context、durable Plan review、队列/草稿、恢复与
-无障碍合同。详见 [`v0.3.2 Workbench 方案`](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md)与
-[`v0.3.2 E2E 资格计划`](docs/test/v0.3.2-web-workbench-e2e-plan.md)。
+WEB33-P0-01..12 验证内置外观合同，WEB33-P0-16..24 验证并行 Session actors、标签页本地前台切换、
+有界队列、右侧 rail 与唯一 Settings 入口。详见 [`v0.3.3 方案`](docs/plan/v0.3.3-plan.md)与
+[`v0.3.3 E2E 资格计划`](docs/test/v0.3.3-web-workbench-e2e-plan.md)。v0.3.4 的安全与稳定化增量见
+[`v0.3.4 测试计划`](docs/test/v0.3.4-stabilization-e2e-plan.md)；它不会把 source gate 当成发布凭据。
 
 ## 安全
 

package/dist/commands/context-tool-command-handlers.js

@@ -206,11 +206,7 @@ async function showHarness(ctx, args = '') {
         },
     };
     const result = () => ({ success: true, output: lines.join('\n') });
-    const tokens = args
-        .trim()
-        .toLowerCase()
-        .split(/\s+/u)
-        .filter(Boolean);
+    const tokens = args.trim().toLowerCase().split(/\s+/u).filter(Boolean);
     const explain = tokens[0] === 'explain';
     const json = tokens.includes('--json');
     if (tokens.some(token => token !== 'explain' && token !== '--json')) {

package/dist/commands/registry.js

@@ -448,10 +448,7 @@ function registerBuiltinCommands(definitions) {
         if (ids.has(command.id))
             throw new Error(`Duplicate command id: ${command.id}`);
         ids.add(command.id);
-        for (const value of [
-            command.name,
-            ...(command.aliases ?? []),
-        ]) {
+        for (const value of [command.name, ...(command.aliases ?? [])]) {
             const normalized = value.toLowerCase();
             const owner = names.get(normalized);
             if (owner)

package/dist/harness/intent.js

@@ -38,14 +38,24 @@ function extractTools(input) {
     return known.filter(tool => lower.includes(tool.toLowerCase()));
 }
 function extractConstraints(input) {
-    const lines = input.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+    const lines = input
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .filter(Boolean);
     const constraintPattern = /(必须|要求|确保|保持|不要|不能|不准|避免|只|仅|must|should|required|ensure|keep|avoid|without|do not|don't|never|only)/i;
-    return [...new Set(lines.filter(line => constraintPattern.test(line)).map(line => truncate(line, 180)))].slice(0, 10);
+    return [
+        ...new Set(lines.filter(line => constraintPattern.test(line)).map(line => truncate(line, 180))),
+    ].slice(0, 10);
 }
 function extractNonGoals(input) {
-    const lines = input.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+    const lines = input
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .filter(Boolean);
     const nonGoalPattern = /(不要|不能|不准|避免|不引入|不新增|禁止|do not|don't|never|avoid|without)/i;
-    return [...new Set(lines.filter(line => nonGoalPattern.test(line)).map(line => truncate(line, 180)))].slice(0, 8);
+    return [
+        ...new Set(lines.filter(line => nonGoalPattern.test(line)).map(line => truncate(line, 180))),
+    ].slice(0, 8);
 }
 function extractQuestions(input) {
     return input
@@ -75,45 +85,86 @@ function classifyKind(input, state) {
         return { kind: 'casual_or_feedback', confidence: 0.5, reason: 'empty input' };
     }
     if (isGenericContinue(text)) {
-        return { kind: 'continue_current_task', confidence: 0.78, reason: 'generic continuation request' };
+        return {
+            kind: 'continue_current_task',
+            confidence: 0.78,
+            reason: 'generic continuation request',
+        };
     }
     if (isShortFeedback(text)) {
-        return { kind: 'casual_or_feedback', confidence: 0.72, reason: 'short feedback should not replace the root objective' };
+        return {
+            kind: 'casual_or_feedback',
+            confidence: 0.72,
+            reason: 'short feedback should not replace the root objective',
+        };
     }
-    if (matches(lower, /\b(verify|test|run tests?|check|lint|typecheck|build)\b/) || matches(text, /(验证|测试|检查|跑一下|运行测试|构建|编译)/)) {
+    if (matches(lower, /\b(verify|test|run tests?|check|lint|typecheck|build)\b/) ||
+        matches(text, /(验证|测试|检查|跑一下|运行测试|构建|编译)/)) {
         return { kind: 'verify_or_test', confidence: 0.82, reason: 'verification-oriented wording' };
     }
     if (hasRoot && isVersionScopedRefinement(text)) {
-        return { kind: 'refine_current_task', confidence: 0.78, reason: 'version-scoped refinement within the active task' };
+        return {
+            kind: 'refine_current_task',
+            confidence: 0.78,
+            reason: 'version-scoped refinement within the active task',
+        };
     }
     if (matches(lower, /\b(harness|mcp|session|resume|compact|config|configuration|ui|npm|publish|push|pull request|pr)\b/) ||
         matches(text, /(配置|会话|恢复|压缩|版本|分支|发布|新ui|界面|工具|权限|确认|配置文件)/)) {
         if (matches(text, /(基于当前|切\s*v|切到|这个版本|新版本|开始按|完整开发|实现这个方案)/) ||
             matches(lower, /\b(please implement|implement this plan|start implementing|new version)\b/)) {
-            return { kind: 'new_task', confidence: 0.88, reason: 'explicit versioned implementation task' };
+            return {
+                kind: 'new_task',
+                confidence: 0.88,
+                reason: 'explicit versioned implementation task',
+            };
         }
-        return { kind: 'meta_configuration', confidence: 0.75, reason: 'configuration or CLI meta request' };
+        return {
+            kind: 'meta_configuration',
+            confidence: 0.75,
+            reason: 'configuration or CLI meta request',
+        };
     }
     if (matches(text, /(不对|不是|错了|改成|改为|换成|重新|重做|不要.+而是|应该.+而不是)/) ||
         matches(lower, /\b(instead|replace|switch to|redo|wrong)\b/)) {
-        return { kind: 'interrupt_and_replace_current_step', confidence: 0.8, reason: 'correction or replacement wording' };
+        return {
+            kind: 'interrupt_and_replace_current_step',
+            confidence: 0.8,
+            reason: 'correction or replacement wording',
+        };
     }
     if (matches(text, /(基于|切到|这个版本|新版本|开始|实现|开发|生成|创建|写文档|完成本次|按这个计划|完整支持|帮我完成)/) ||
         matches(lower, /\b(generate|create|implement|build|start|complete this|write a|please implement)\b/)) {
-        return { kind: 'new_task', confidence: hasRoot ? 0.76 : 0.86, reason: 'explicit task creation wording' };
+        return {
+            kind: 'new_task',
+            confidence: hasRoot ? 0.76 : 0.86,
+            reason: 'explicit task creation wording',
+        };
     }
     // Clarification: user is asking for explanation or asking about meaning
     // Must be checked BEFORE refinement since clarification phrases may contain "这个"
     if (matches(text, /(什么意思|解释一下|解释说明|clarify|explain to me|what does.*mean|what is.*for|can you explain|meaning of)/) ||
         matches(lower, /^(what|why|how|explain|clarify|could you explain|can you explain)\b/)) {
-        return { kind: 'clarification', confidence: 0.7, reason: 'clarification or explanation request' };
+        return {
+            kind: 'clarification',
+            confidence: 0.7,
+            reason: 'clarification or explanation request',
+        };
     }
     if (matches(text, /(补充|另外|同时|还有|希望|可以|顺便|完善|优化|灰色|填充|这个|这里|如图|也|继续)/) ||
         matches(lower, /\b(also|additionally|please also|refine|improve|continue)\b/)) {
-        return { kind: 'refine_current_task', confidence: hasRoot ? 0.76 : 0.58, reason: 'refinement or addition wording' };
+        return {
+            kind: 'refine_current_task',
+            confidence: hasRoot ? 0.76 : 0.58,
+            reason: 'refinement or addition wording',
+        };
     }
     return hasRoot
-        ? { kind: 'refine_current_task', confidence: 0.55, reason: 'existing task makes ambiguous input a refinement' }
+        ? {
+            kind: 'refine_current_task',
+            confidence: 0.55,
+            reason: 'existing task makes ambiguous input a refinement',
+        }
         : { kind: 'new_task', confidence: 0.62, reason: 'first meaningful user task' };
 }
 function classifyIntent(input, state) {
@@ -121,7 +172,9 @@ function classifyIntent(input, state) {
     const baseEpoch = state?.taskEpoch ?? (state?.contract ? 1 : 0);
     const classified = classifyKind(input, state);
     const rootObjectiveChanged = classified.kind === 'new_task' || !state?.contract;
-    const taskEpoch = rootObjectiveChanged ? Math.max(1, baseEpoch + (state?.contract ? 1 : 0)) : Math.max(1, baseEpoch || 1);
+    const taskEpoch = rootObjectiveChanged
+        ? Math.max(1, baseEpoch + (state?.contract ? 1 : 0))
+        : Math.max(1, baseEpoch || 1);
     const summary = truncate(input || 'Continue the current task');
     return {
         id: (0, crypto_1.randomUUID)(),

package/dist/harness/turn-summary.js

@@ -12,7 +12,9 @@ function unique(items) {
 function parseJsonObject(text) {
     try {
         const parsed = JSON.parse(text);
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
     }
     catch {
         return null;