@senguoyun/dsh-arkme 0.1.42 → 0.1.43

package/docs/avatar-diagnostics.md

@@ -0,0 +1,36 @@
+# 头像失败诊断日志
+
+诊断标记：`[ArkmeAvatarDiag]`。仅追加失败日志，不修改头像展示、缓存、并发限制或重试策略。
+需要发布包含本改动的插件后才生效；不自动修改本机已安装包。
+
+## 下次复现时
+
+先保留日志、记录发生时间和目标用户，再重启客户端，避免丢失故障现场。
+macOS 生产版日志位于 `~/Library/Application Support/Arkme Harness/`：
+
+- `logs/desktop-startup.log`：Browser 头像加载失败，由桌面壳捕获 renderer console。
+- `logs/harness.log`：Host 资料请求、头像引用和图片读取失败。
+- 账号隔离实例的 Host 日志可能位于 `dsh-containers/<scope>/logs/harness.log`，具体以启动日志中的实例路径为准。
+
+先筛选 `[ArkmeAvatarDiag]`，再按发生时间、`viewerUserId` 和 `targetUserId` / `referenceTargetUserId` 对账。
+例如 1D3E 的目标用户 ID 是 `21698`。批量资料失败的目标位于 `targetUserIds`。
+
+| event | 含义 |
+| --- | --- |
+| `profile_fetch_failed` | 批量资料请求失败，尚未生成头像引用 |
+| `profile_missing` | 成功响应漏掉了请求的用户资料 |
+| `profile_avatar_rejected` | 非空头像值被地址安全校验拒绝 |
+| `private_avatar_seal_failed` | 私聊头像引用生成失败 |
+| `image_read_failed` | Host 最终无法读取用户头像 |
+| `image_load_failed` | Browser 头像共享缓存收到加载失败 |
+
+`trigger=load` 表示普通加载，`revalidate` 表示重验证；不代表新增重试。
+`hasCachedImage=false` 表示这次失败没有旧图片可保留，可能显示默认头像。
+`durationMillis` 包含排队时间。`httpStatus` 是 Host 错误状态，`upstreamStatus`（存在时）是底层服务或图片下载的 HTTP 状态。
+引用中的 `referenceViewerUserId` / `referenceTargetUserId` 只是解析出的诊断提示，不参与授权校验。
+
+日志以单行 JSON 输出，避免桌面桥接把字段变成 `[object Object]`。不记录原始头像引用、签名 URL、图片内容、昵称、token、错误全文或堆栈。
+正常图片加载、未设置头像及合法 phone_avatar 默认头像不记录错误；共享并发读取只记一次，旧账号请求在切换后的预期取消不记 Browser 错误。
+
+已确认的恢复慢机制仍保持原样：首次加载失败后，相同引用的普通渲染不触发重试；周期维护约 10–12 分钟。
+本次日志用于确认真实复现的首次失败阶段，不预先认定为超时或鉴权问题。

package/docs/consumer-plugin-contract.md

@@ -77,6 +77,23 @@ if ((await arkme.capabilities()).features.extensionPreviews === true && userConf
 
 The SDK communicates only with the same-origin Provider route. Consumers must not read OS credential-store entries, SQLite files, state files, or tokens directly.
 
+## Team capability
+
+`capabilities().features.teamDirectory`, `teamMembers`, and `teamGovernance` advertise the complete Team contract. Consumers call `listTeams()` or `resolveTeams()` to obtain an opaque, account-scoped `teamRef`, then pass that reference unchanged to `listTeamMembers()`. A display name or public Jotmo ID must never be substituted for `teamRef`; member `userRef` and Team `teamRef` are distinct reference types and are not interchangeable.
+
+`createTeams()` requires one stable idempotency key per item. `joinTeamsByJotmoID()` accepts only the exact public Team Jotmo ID and reports whether the current account is the owner, was already a member, or joined now. Both mutations must originate from a current same-origin human UI action. Consumers must not receive, persist, or reconstruct the managed OpenAPI credential, backend numeric IDs, owner request IDs, or internal cursors.
+
+Member identity is an enrichment owned outside Team membership. `identityState=unavailable` or `incomplete` keeps the authoritative membership row visible while telling the Consumer not to invent a display identity. A member may include a Host-resolved `avatarRef` or `avatarFallback`; avatar enrichment failure never removes the authoritative membership row. Consumers discard Team pages and cursors on account change, propagate `AbortSignal`, and retry from a fresh list after an authorization or lifecycle error.
+
+| Capability | Built-in UI | Browser SDK | DSH model Tool | Shared owner |
+| --- | --- | --- | --- | --- |
+| List/resolve my Teams | Contacts → Team directory | `listTeams()`, `resolveTeams()` | `list_my_teams`, `resolve_my_teams` | OpenAPI Team capability registry → Team query owner |
+| List Team members | Team detail with loading, partial identity, pagination and retry states | `listTeamMembers()` | `list_team_members` | OpenAPI Team capability registry → Team membership owner + public identity batch reader |
+| Create Team | No built-in entry | `createTeams()` from a confirmed same-origin UI | `create_teams` after explicit user intent | OpenAPI Team capability registry → existing Team create command |
+| Join by public ID | No built-in entry | `joinTeamsByJotmoID()` from a confirmed same-origin UI | `join_teams_by_jotmo_id` after explicit user intent | OpenAPI Team capability registry → existing Team join command |
+
+The built-in UI and Browser SDK enter through the same injected `TeamServicePort`; model Tools use the OpenAPI MCP projection of the same capability definitions. REST and MCP therefore share one authorization, validation, idempotency, cursor, error, and result contract without routing model traffic through the browser Host.
+
 `capabilities().features.myExtensions` advertises the current-account extension inventory. `myExtensions()` merges only Host-approved live Cordis, Profile-resolved and cloud-owned facts; consumers must use its states and `publish` result without rescanning Profile files or inferring ownership from names. Every publishable item carries one Host-derived route: `dynamic-cordis-v2` means `artifactContractVersion=2` and `artifactKind=dsh-bundle-tgz` for a live current-session Dynamic Cordis Package; `profile-native-v3` means `artifactContractVersion=3` and `artifactKind=dsh-native-package-tgz` for an installed or Profile-local DSH Bundle. Callers pass `ownedRef` unchanged and never choose a mode themselves. A GitHub repository URL is optional provenance metadata, not a third upload route, publication credential or cloud clone/build request. A third-party registry/Git dependency appears only when its actually resolved package declares `dsh.bundle.patch`; it is a V3 publication candidate rather than an assertion that the current account authored the upstream code. `publisher_role` is server-owned: explicit values win, while historical rows without a role resolve to importer only when they have GitHub provenance. Consumers never submit this role. `ownedRef` is short-lived and account-bound. `publishMyExtension()` requires a current explicit human request and can publish only the exact Cordis Package, resolved Bundle directory or local Bundle tgz behind that ref; consumers must refresh the list after expiry or account switch. Profile paths, Agent IDs, source archives, artifact upload requests and signing material never enter this contract.
 
 Plugin update discovery and acknowledgement are lifecycle concerns owned by the bundled Arkme UI. They are intentionally absent from the public Browser SDK, Host `arkmeData` service and model tool catalog. Consumers must not invoke raw `plugin.update.*` operations or attempt to mutate a DSH profile.
@@ -129,7 +146,7 @@ Interaction flow:
 点击微信 -> 显示 Flutter AppBridge OAuth 缺失说明，不发起伪请求
 ```
 
-`readImage(avatarRef)` resolves an opaque image reference returned by `profile()` or `listSources()`. Private chats expose one optional `avatarRef`. Groups expose the preferred additive `groupAvatar` presentation plus legacy `avatarRefs`: `groupAvatar.slots` preserves the server-selected order for up to five members, including safe phone-default or generic fallbacks when a real image is absent, while legacy `avatarRefs` contains only resolvable real images. `memberCount`, `strategy`, and `computedAtMillis` describe the snapshot without exposing member or session identities. The Provider refreshes an authorized public profile image before downloading it and returns bounded PNG/JPEG/WebP/GIF base64 bytes; signed URLs, STS credentials and bearer tokens never enter the browser contract. Consumers must use `imageDataUrl()` (or decode the payload themselves) instead of concatenating OSS URLs or fetching an avatar reference directly.
+`readImage(avatarRef)` resolves an opaque image reference returned by `profile()`, `listSources()` or `listTeamMembers()`. Private chats and Team members expose one optional `avatarRef`. Groups expose the preferred additive `groupAvatar` presentation plus legacy `avatarRefs`: `groupAvatar.slots` preserves the server-selected order for up to five members, including safe phone-default or generic fallbacks when a real image is absent, while legacy `avatarRefs` contains only resolvable real images. `memberCount`, `strategy`, and `computedAtMillis` describe the snapshot without exposing member or session identities. The Provider refreshes an authorized public profile image before downloading it and returns bounded PNG/JPEG/WebP/GIF base64 bytes; signed URLs, STS credentials and bearer tokens never enter the browser contract. Consumers must use `imageDataUrl()` (or decode the payload themselves) instead of concatenating OSS URLs or fetching an avatar reference directly.
 
 `capabilities().features.worldFeed === true` advertises the additive World read contract. `worldFeed()` returns account-bound opaque `recordRef`, `avatarRef`, and `imageRefs` values; it never exposes stable record IDs, bearer tokens, `file_asset://` references, or signed OSS URLs. File-asset avatars are batch-resolved by the Provider. Resolution failure is best-effort and must keep the feed readable with its declared fallback avatar.
 

package/docs/resizable-composer-verification.md

@@ -0,0 +1,45 @@
+# Resizable chat composer verification
+
+- Base: official `origin/dev`, `4b8b40346be695774900997da4d6ce2f5a05e970`.
+- Branch: `codex/c20260904-resizable-composer`.
+- Scope: shared Arkme chat composer, client presentation only. No changes to DSH, plugin version, authentication or message sending.
+- Behavior: 6px top drag target, vertical resize cursor, 1px green border while hovered/dragged/focused, local browser height preference, double-click/Enter reset, arrow/Home/End keyboard controls, viewport height limit, pointer capture and cursor cleanup.
+
+## Capability coverage
+
+| Surface | Result |
+| --- | --- |
+| UI | Implemented and exercised in the installed plugin on Windows. |
+| Tools | N/A: visual browser layout preference; no new business operation. |
+| SDK | N/A: no Host API or shared business capability introduced. |
+| Host | N/A: no Host storage or routes; localStorage contains only an editor height. |
+
+## Verification
+
+- Relevant pre-change composer tests: 8 passed.
+- Composer presentation/draft tests after integration: 18 passed.
+- Resize, auth ownership and retained-surface tests after SSR fix: 15 passed.
+- TypeScript check and diff whitespace check passed.
+- Full suite: 3106 passed, 26 failed, 4 skipped; 16 failed suites and one additional suite-load failure within those suites. Not an all-green result. Remaining failures include Windows ACL command/module errors, fixture/source newline checksums, packaging/workflow expectations and timeouts. They have not all been independently reproduced on a clean baseline.
+- Standard build passed after temporarily normalizing the credential helper's six checksum inputs to LF. Original checkout line endings were restored afterward; no helper source changes are part of this patch.
+- Generated npm tarball, verified its client bundle hash matches the build, and installed it through official DSH `0.1.1-rc.1` into a fresh isolated profile. No link-based installation or DSH source edits.
+- Actual browser: upward drag changed editor height from 38px to 191px; green rounded border visible; reload and reopening conversation restored 191px; double-click reset to 38px. No test message sent.
+- Windows verified. macOS/Linux not exercised; this change adds no native/platform-specific code.
+
+The earlier sidebar-width PR is separate and is not included in this branch's dev baseline. No production deployment or replacement of the user's running instance is included.
+
+## Follow-up: message viewport anchoring
+
+- Confirmed missing behavior: a shrinking message viewport did not preserve its previous bottom distance, leaving latest messages below the visible region.
+- Added a viewport ResizeObserver: when previously within 80px of the bottom, keep the latest message visible; while reading history, preserve scrollTop. Handles resize-generated scroll events arriving before the observer, reset/expansion, short lists and observer disposal.
+- Composer bounds now use the actual chat area's available height; observers reconnect when the composer appears or the conversation changes. Switching conversation clears active drag/hover/focus state. Keyboard focus and pointer hover are tracked independently.
+- Relevant resize/auth/retained-surface tests: 18 passed. Typecheck and standard build passed (same temporary LF build normalization described above).
+- Full follow-up suite: 3108 passed, 27 failed, 4 skipped. Includes a recording-service timeout under the full parallel run; not an all-green result.
+- Installed a new immutable tarball into a separate official DSH profile; preserved the previous preview instance.
+- Browser verified: composer grew from 96px to 284px and the latest message moved upward by the same 188px, keeping the gap above the input. While reading older messages, increasing input height by 200px retained the same messages at the same top positions instead of jumping to the latest message.
+
+## Pre-PR review
+
+- Reviewed the complete integration, pointer lifecycle, optional storage, observer cleanup, history anchoring, scope changes and height bounds. No new blocking finding identified.
+- Re-fetched official dev; base remains unchanged with no integration conflict.
+- Re-ran seven targeted suites: 36 tests passed. The separate recording-service rerun from the follow-up passed; full-suite failures above remain disclosed rather than presumed resolved.

package/docs/resizable-note-detail-verification.md

@@ -0,0 +1,41 @@
+# Resizable note detail
+
+- Base: official dev `4b8b40346be695774900997da4d6ce2f5a05e970`.
+- Branch: `codex/c20260904-resizable-detail`.
+- Scope: shared right-edge overlay for normal/forwarded quick notes and interwoven details. Does not change message sending, underlying conversation layout, versions, root README or DSH sources.
+- Left-edge 10px pointer target, 3px green highlight, ew-resize cursor; pointer capture, cancellation/unmount cleanup, keyboard support, double-click reset and optional localStorage width memory.
+- Requested parity: default/minimum width 405px, maximum max(405px, 60% of available width). Containers narrower than 405px cap both bounds to the available width to prevent overflow. Previously saved preferences are clamped to the new bounds.
+
+## Coverage
+
+| Surface | Evidence |
+| --- | --- |
+| UI | Shared resize hook integrated into both detail owners; unit and drawer tests. |
+| Tools | N/A: no business capability, browser layout preference only. |
+| SDK | N/A: no public service/API changes. |
+| Host | N/A: no Host routes or persistence changes. |
+
+- Before change: 17 drawer tests passed. Final targeted coverage: 22 tests passed across identity, resize and drawer suites.
+- Typecheck passed. Standard build passed after temporary LF normalization of the existing credential-helper checksum inputs; original line endings restored, no helper source diff.
+- Latest full-suite run: 3102 passed, 30 failed, 4 skipped. One documentation identity failure was subsequently corrected and the identity suite passed in the targeted rerun. Remaining failures include Windows ACL/module issues, fixture checksums and other areas; not all were independently reproduced on an untouched baseline. Full-suite status is not green.
+- Packaged tarball installed via official DSH 0.1.1-rc.1 into a new isolated profile; existing preview instances preserved. No link installation or production deployment.
+- Windows is the exercised platform; macOS/Linux not verified.
+- Installed-package browser verification: final bounds verified at 405px minimum/default and approximately 554px maximum for a 924px container (60%). Green full-height divider confirmed. Earlier persistence verification confirmed the dragged width survived closing/reopening the detail. No messages sent or note data changed.
+- Scope review: no blocking issue identified in the resize change. Emoji rendering is untouched; the preview base does not include the separate sidebar emoji asset fix. This PR intentionally does not merge that work.
+
+## Updated dev integration (2026-09-04)
+
+- The earlier preview above is superseded. Merged official dev `4f093d0cff3ae98588ee8d9fc85c7bcf5d247696` without conflicts. The remote fetch configuration tracked only master, so fetching dev alone had left the old origin/dev reference unchanged; this run explicitly refreshed that reference.
+- Sidebar preview rendering now inherits dev's `ArkmeRichText` with 20px application emoji assets and matches master `8fea757ff81170311393036240a0c292afd3737a` in the emoji implementation. No separate emoji feature patch or version bump was authored; package metadata is inherited from dev.
+- Reviewed the complete five-file diff against updated dev, including the automatically merged detail shell. The resize scope remains client-only; Tools/SDK/Host remain N/A.
+- Targeted resize/drawer/sidebar/identity suites: 28 tests passed. Typecheck and build passed. The existing credential-helper source files were temporarily normalized to LF for build verification and restored byte-for-byte afterward.
+- Full suite: 3549 passed, 55 failed, 4 skipped (22 failed suites). This is not an all-green result and the failures are not all proven pre-existing. No unrelated test fixes are included.
+- A fresh isolated official DSH 0.1.1-rc.1 profile installed the immutable tarball. Installed client SHA256 matches the build. Windows browser verified detail width 405px -> 495px by pointer drag and back to 405px on Enter; targeted 28 tests passed again after review. Sidebar renderer and emoji assets are unchanged from current master. No messages sent or note content changed.
+
+## Review follow-up: regression coverage and baseline comparison
+
+- Added five tests covering parent resize/recovery and observer cleanup, pointer cancellation, lost pointer capture, unavailable storage, all resize keys and the window-resize fallback without ResizeObserver.
+- Compared full suites against an untouched worktree at dev `4f093d0cff3ae98588ee8d9fc85c7bcf5d247696`. This identified two PR-specific outdated assertions still requiring 372px in interwoven and forwarded details. Updated both to the intended 405px default, container cap and accessible resize separator; retained their other content and authorization assertions.
+- Expanded relevant suites: 88 passed. Typecheck and diff check passed. Review found no remaining confirmed resize implementation defect. No runtime code, emoji assets, metadata or version changes in this follow-up; the existing installed client remains byte-identical to the build.
+- Clean dev full run: 3546 passed, 56 failed, 4 skipped. Final PR full run: 3552 passed, 57 failed, 4 skipped. All 56 baseline failing test identities also fail in the PR. The one additional recording-service timeout passes when rerun alone, and its implementation/test files are identical to dev. The suite-load failure is `spawnSync pnpm ENOENT` on both revisions. This comparison does not claim the whole repository is green or repair unrelated baseline issues.
+- Remaining platform evidence limitation: macOS/Linux were not exercised. Windows pointer interaction evidence from the unchanged runtime above remains applicable.