2 Commits

Author	SHA1	Message	Date
Zeren Wang	a58ab484a6	feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443) ... * feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash Implements docs/superpowers/specs/2026-09-12-projects-mvp-phase2-design.md (issue #5160, tracker #5129) in the slice order of the spec's §16. Slices: - A: ProjectsConfig + write-time 422 UTF-8 byte cap; PROJECT_CONTEXT_KEY admission pinning (both server-owned sets + worker hoist); latest-only request-scoped <project> block via DynamicContextMiddleware wrap_model_call/awrap_model_call (idempotent reassembly, reserved ID prefix + marker + provenance, never persisted); journal audit fingerprints; Instructions tab. - B: ProjectDocumentRow + migration 0023; ProjectDocumentRepository with locked check-and-set; hash-qualified immutable shelf storage with Paths helpers; upload/list/content/delete-to-trash routes; project delete trashes the shelf in-transaction; request-scoped bounded <documents> index with honest count/shown + actionable overflow note; list_project_documents/read_project_document tools registered only on pinned runs; PAT allowlist + drift guards; blocking-IO anchors. - C: shared thread-upload ingestion service (uploads router refactored to parity); POST from-thread with provenance; attach-to-thread with lock-staged copy (archived source allowed); read-only thread-files view with per-group truncation reporting. - D: restore (restored/merged/not_found/no_target/content_missing; no file moves), purge (continuous row lock across unlink/delete/commit, retryable on FS errors), retention sweep (lazy + startup, 24h orphan guard, row-side reconciliation never deletes). - E: Documents tab (shelf + conversation-files browser, provenance, archived banner, content-missing rows), /workspace/trash route, sidebar entry, composer attach handoff, i18n (en-US/zh-CN), e2e mocks + specs. Review hardening folded in (10 rounds, all with tests): - force active shelf content (HTML/XML family) to download; nosniff on artifact + content responses; unified unsandboxed-iframe PDF preview (fixes the pre-existing Chromium sandbox blank in the artifact viewer) - scope document trash to the URL project under the document lock - atomic no-overwrite filename reservation for ALL ingestion (seeded claims + os.link commit with suffix retry; same-name re-upload now unique-names instead of replacing); hidden staging only, no visible placeholders; lease cleanup on setup failure - serialize conversion under the document lock with post-lock active revalidation; drain locked filesystem work on cancellation; preserve bytes when an insert's commit state is uncertain (including trashed rows) - original-integrity checks before serving text or cached conversions; content_missing surfaced in list responses (UI reads the flag, no 409-probe); downloads always serve original bytes - bounded streaming document reads with cached char counts; shelf limits declared in middleware release identity - thread-root confinement for from-thread sources; config fallback rejects fractional/infinite values; composer counts staged attachments; pending attachments persist until submission or removal; in-flight instruction/rename edits survive save refetches; shelf and trash pagination; conversation-file and thread-files pages stay subscribed to refetches Docs: README/README_zh, backend API.md/ARCHITECTURE.md, AGENTS.md contracts, config.example.yaml projects block. Review follow-ups (head b4807477 → this revision): - The trash retention sweep is split so repeated lazy triggers stay bounded: the indexed expiry purge still runs on every trigger (GET /api/trash/documents, POST /api/trash/purge) while the O(all rows + all files) reconciliation is throttled to one run per user per 15 minutes (process-local, per-user window). The startup sweep now runs as a background task instead of blocking gateway readiness, and shutdown awaits it (bounded). - The export scrub (stripInternalMarkers) is fence- and indentation-aware like the render path, so a pasted, fenced <project>/<documents> snippet survives markdown export while real injected blocks (never fenced) are still removed. Fence regexes moved to a dependency-free leaf module to avoid the messages↔streamdown import cycle. - The artifact viewer's PDF iframe no longer carries an added title attribute (the upstream e2e contract locates it via :not([title])), and the upstream artifact-preview spec now pins the new contract: PDFs render unsandboxed, images keep sandbox="". * fix(projects): round-2 review — cancel an overrun trash sweep, restore the PDF frame title - Shutdown cancelled only the shield around the background startup sweep, so an all-users reconciliation that outlived the 5s budget kept walking rows and files while the document repo and DB engine were disposed underneath it. The wait now lives in `_shutdown_startup_trash_sweep`, which cancels the task and drains it before worker exit: the shield keeps the wait bounded, the cancel makes it final (CancelledError lands at the sweep's next await, and `_run_startup_trash_sweep` only catches `Exception`, so nothing swallows it). - The browser-preview iframe lost `title={getFileName(filepath)}` in the previous fix round, leaving the PDF frame without an accessible name while its siblings keep theirs. Restore it (WCAG frame titles), assert it in the DOM test, and anchor the e2e on `iframe[title="report.pdf"]` instead of `iframe:not([title])`. * fix(projects): round-3 review — report the sweep's late finish, not a phantom cancel `Task.cancel()` returns False when the sweep already finished inside the window between the deadline firing and the cancel, so the shutdown log claimed a cancellation that never happened. Branch on that outcome: the warning stays for a real cancel, a late finish is logged at info, and both paths still reap the task before worker exit. * fix(projects): round-4 review — make Empty trash delete what it confirms `POST /api/trash/purge` only ran the retention sweep, and the sweep's candidate selection is age-gated, so a freshly trashed document survived "Empty trash" even though the confirmation promises that every listed document is permanently deleted. With one trashed row the route answered `{"purged": 0}` and left it in place; `GET /api/trash/documents` sweeps expired rows before listing, so the visible rows were normally ineligible for the action by construction. Empty trash now drives `purge_all_trashed`: the caller's trashed rows (`list_all_trashed`, no age filter) each go through the same guarded, row-locked `purge` as the single-document delete — bytes first, then the row, in one transaction — so a row restored mid-flight is skipped instead of force-deleted, and an unlink failure rolls that row back and answers 500 with a retryable message. Retention expiry stays where it was: the sweep's `purge_candidates` is now the only age-gated selection, and the lazy retention sweep still runs on the listing and at startup. Tests: the router suite replaces the retention-gated expectation with the reviewer's repro (fresh row purged, bytes unlinked, shelf and other users' trash untouched, a failing unlink stays retryable and 500); a blocking-I/O anchor drives the new entry point through the offload; the mocked e2e covers the action end to end; a new real-backend spec performs it against the real gateway and re-reads `GET /api/trash/documents`. README, API, ARCHITECTURE and the phase-2 design docs (en+zh) state the age-independent contract.	2026-09-16 18:46:18 +08:00
Zeren Wang	5951c89b5b	feat(projects): project workspaces with scoped chats and thread membership (#5265) ... * feat(projects): project workspaces with scoped chats and thread membership Backend: - projects table model and migration; fail-closed ProjectRepository with ownership checks, CRUD/archive/restore/delete router, and atomic thread move between projects - threads_meta.project_id column exposed as reserved deerflow_project_id metadata; project-aware thread create/search with pagination bounds and membership echoed in create responses - first-run admission assigns the project only at genuine first run, seeded at write time and dropped when invalid; serialized against project deletion and thread assignment - branch creation inherits the source thread's project membership (an archived/deleted project degrades the branch to unassigned instead of failing the request) Frontend: - projects data layer, thread move API, and sidebar projects section with flat/grouped modes, archived-project threads, and stable virtual-list offsets - project detail page with project-scoped new chat (/workspace/chats/new?project=) and paginated thread list - move-to-project thread menu, new-project dialog, archived-project gates - project-scoped new chats pre-create the thread with membership before the first submit or /goal set, so runs never proceed outside the project - goal-set preparation is fenced against conversation switches: a stale continuation is dropped instead of saving the goal or launching the abandoned submission on the newly opened conversation - project thread lists join thread lifecycle invalidations (stop, pin) so an open project page never keeps stale titles, recency, or pagination * fix(chats): keep archive undo toast when the sidebar row unmounts The archive success toast was fired from per-mutate callbacks passed to mutation.mutate. React Query drops those handlers when the observer component unmounts before the mutation settles; archiving the open chat removes its sidebar row mid-flight, so the undo toast never appeared and the e2e archive-undo test timed out waiting for it. Move the success/error handlers to the mutation level (useArchiveThread options, same pattern as useMoveThreadToProject) where callbacks are delivered even after the originating row unmounts. * fix(projects): pin project thread listing contract and exclude archived chats GET /api/projects/{id}/threads returned the thread store row verbatim (list[dict], no response_model): user_id/assistant_id leaked, any future ThreadMetaRow column would auto-leak, and the OpenAPI schema was empty. Return a narrow ProjectThreadResponse (the exact fields ProjectThread declares) with the same metadata secret redaction the surrounding thread endpoints get from _MetadataRedactingResponse. The listing also ran search() without the archived filter, so a retired chat rendered as a normal row on the project page while the sidebar hid it. Search archived=False to mirror the sidebar's archived:false lists; restore stays on the global Archived tab. Both regressions pinned by new router tests: wire-shape allowlist and archived-member exclusion. * docs(migrations): record the 0019/0020 chain against the bootstrap reservation The tree now chains 0018 -> 0019_projects -> 0020_threads_meta_project_id, so migrations/AGENTS.md was stale twice over: the revision index stopped at 0018 and the rolling-forward section still claimed the tree 'deliberately remains at 0018'. Document the new head and record the intentional numeric-prefix reuse of 0019: 0019_projects is in-chain while 0019_thread_incarnations stays the reserved, allowlisted out-of-tree rollout id. The owning rollout revision must re-parent onto this tree's head when it merges so alembic never sees two heads off 0018; bootstrap.py now cross-references that note next to _FORWARD_COMPATIBLE_REVISION. * fix(chats): invalidate project thread lists on archive/restore useArchiveThread refreshed the infinite sidebar cache, threads/search and the per-thread metadata cache but not the project-scoped list ([...PROJECTS_QUERY_KEY, 'threads', id]) this PR adds — the one thread mutation not wired to that key, after usePinThread, useRenameThread, useDeleteThread, useMoveThreadToProject and invalidateStoppedThreadCaches. An archive from a sidebar row while a project page is open therefore left the archived chat rendered as a normal row until remount (and undo left it missing). Invalidate the prefix in the mutation-level success handler. Regression test asserts the project-list prefix is invalidated on success. * fix(projects): fetch project discovery only in grouped sidebar mode RecentChatList mounted two useProjects queries per sidebar render, but knownProjectIds is consumed only by the grouped-mode exclusion filter; in the default flat mode every page load paid two GET /api/projects?status= round trips for data nothing read. Gate both queries on grouped mode — GroupedProjectList fetches the same keys when the toggle is on and TanStack dedupes the observers. Also set retry: false on useProject: a deleted or foreign project 404s deterministically, and the page renders a dedicated not-found state for it, so the default 1s/2s/4s retry backoff kept deep links in 'loading' for ~7s before that state appeared. Matches useThreadMetadata / useThreadTokenUsage. * fix(threads): fail closed on project-scoped create in memory mode MemoryThreadMetaStore.create accepted project_id and silently ignored it, making memory mode the one membership path that fails open: POST /api/threads with a project id returned 200 and the run started unassigned, violating the invariant that a run never proceeds outside the selected project (the SQL store raises ProjectNotAssignableError inside the insert transaction for the same request). Raise ProjectNotAssignableError whenever project_id is present so the router's existing 404 mapping applies, the frontend keeps the composer text for a retry, and memory mode behaves exactly like SQL mode. set_project already reports rejection; create now matches it. Store-level test (raises, nothing persisted, project filter stays empty, unscoped creates still work) plus a router-level test asserting the 404 and that no row is left behind. * fix(projects): window the project page thread list ProjectThreadsSection rendered every loaded page as a plain Link row, so a long-lived project accumulated unbounded DOM on the page's scroll surface: each load-more appended another 100 rows and every formatTimeAgo tick re-rendered the whole list. Reuse VirtualThreadList (now generic over any row shape with a thread_id), pointing its scroll parent at this page's ScrollArea viewport via the shared [data-slot="scroll-area-viewport"] selector used by /workspace/chats; under the 60-row threshold it falls back to the plain render, so small projects are unchanged. * fix(projects): restore row dividers and pin them with a render test The row class template literal concatenated transition-colors directly with the conditional border-b token, so non-final rows rendered the invalid class 'transition-colorsborder-b' and lost both the divider and the transition. Compose the row classes with cn() and a boolean guard instead. The section moved out of page.tsx into a testable component so the row markup finally has coverage: a DOM test asserts every row except the final data row carries border-b (index-based, not last: — correct under virtualization where the last mounted row is not the last data row), and the untitled fallback plus load-more button render for a partial page. * fix(projects): validate forward schemas and fence membership reads	2026-09-08 17:00:26 +08:00