- Overview: kind tabs, five groups with server counts, card/list views,
slot badges, progress (unknown total = "?"), filters in URL, batch actions
- Detail /console/subscriptions/🆔 season tabs, episode x version-target
matrix with cell sheet (manual fill, plan link), drag slot order,
auto-fill switch and fill budget, refresh coverage
- Create/edit dialog (basic/advanced): work picker via global search,
season/range/total, sites, rule groups, include/exclude, templates,
upgrade strategy, downloader/save path; 409 links to existing subscription
Co-Authored-By: Claude Opus 5.5 <[email protected]>
下载详情"整理"按内容路径(经下载器路径映射)换算成登记目录后打开向导;整理记录详情加"重新整理";
整理记录页"手动整理"转到文件管理;删除旧的 downloads/organize-dialog。
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Sidebar becomes 5 groups (overview / resources / subscriptions / organize /
system). Pending items move to a top-bar inbox with badge and grouped
dropdown. Engine panel, schedules and identity pages redirect to the task
page, its plan tab and media overview views; the download plan becomes a
second tab of the download panel. nav.test and smoke cover the new routes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Status page reads /system/health and history: level banner, process table,
event-loop lag and SSE charts (monochrome recharts), database, engine,
schedules, disks with thresholds and mount roots. Home now shows in-progress
tasks, items needing attention, media overview, a plan strip with quick
toggles, recent finished/failed tasks, cache and retention, source health
with site account status, and a run-status summary.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Tasks page merges engine runs (with W9-I business fields) into one stream:
all / active / failed / plan tabs, filters for source, business kind, status
and time; detail drawer with business summary, timeline, collapsed engine
steps, cancel/retry and related audit links. The schedule board moves into
the plan tab; card history jumps to the stream filtered by schedule key.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- site.list / site.health_check / site.refresh_login / site.user_data capabilities
over the W9-A site center services; outputs whitelisted (no secret refs,
cookies, passwords, login names); execute kinds need automation grant.
IDs use snake_case (CapabilityId regex); registry count 17 -> 21.
- settings.organize.minSizeBytes (default 50 MiB); file-manager identify /
organize and planImport take request > setting > port default.
- tests and runbook notes (sites, files).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- POST /files/suggest-name renders the effective template (entity > root >
global) with the same variables as organize: file name segment for files,
work/season dir segment for directories; identity_uncertain when no entity
- planImport plan.naming.templateSource/templateVersion now come from
effectiveNaming + the registered template version (fixes the leftover
DEFAULT_TEMPLATES reference after the naming chain landed)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- GET /naming/variables, POST /naming/preview (builtin/fileName/sourceRelease/asset samples,
line:col errors, warnings, binding-aware), GET/PUT /naming/templates,
PUT /library-roots/{id}/naming, PUT /media-entities/{id}/naming-override
- planImport picks templates entity > library root > global, registers the template
version for new path bindings; naming vars include en title, external ids, season/
episode metadata, slot and root names; optional lock of file-name template for bound works
- runbook: docs/runbook/naming.md
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- process_heartbeat / process_heartbeat_sample (0034): api / worker / worker:agent / all
upsert every 15s (event loop lag last/max, concurrency, running runs, SSE connections, memory)
- GET /system/health (admin): processes with 45s stale flag, SSE, DB latency/size/connections,
disks (DATA_DIR / library roots / download dirs, cache thresholds), mount sentinel checks
with IO timeout, engine pending/oldest/24h failure rate, schedules
- GET /system/health/history?hours=: bucketed lag / running / SSE series
- /engine/runs and /engine/runs/{id}: business {kind, refId, title, triggeredBy} joined from
run input / task / agent_run / tasks_run_meta / outbox; businessKind / businessRefId filters
- docs/runbook/ops.md: field meanings and alert thresholds
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Found in v0.2 visual QA (docs/plan/09-visual-qa.md):
- actor strings (admin_session:<uuid>, user:<uuid>, system) -> 管理员/系统/API Key
in policy revisions, subscriptions, inbox, trash, business tasks, organize detail
- cache volume without key shows the downloader name instead of instance:<uuid>
- download timeline/plan: task and organize statuses, plan purpose, priority and
status reason localized; audit gets labels for capability/files/site/feed actions
- organize record reason uses conflict detail (没有可入库的主视频) instead of
blocked:no_main_video; slot/candidate reasons drop inflight:<uuid>
- identity decision summary no longer shows no_viable_candidate
- upstream test: 'Connection error.' classified as network, with a Chinese hint
- new policy draft prefills key default (placeholder looked like a value)
- dialog/sheet close sr-only text in Chinese
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- manual organize: Execute is disabled when the preview has no organize plan or
has blocking conflicts (it used to create a failed record); plan preview shows
Chinese labels for operation/file action/kind and known failure reasons
- feed table: name column narrower below sm so health and actions fit 390px
Co-Authored-By: Claude Opus 5.5 <[email protected]>
POST /auth/password and /auth/totp answer 401 for a wrong password/code; the
global 401 handler treated that as an expired session and redirected to /login.
Both mutations now pass noAuthRedirect so the form shows the field error.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PUT /sites/{id}/credentials by kind (moved from auth-settings, legacy body
accepted), POST refresh-login (async task or wait), POST health-check,
GET user-data history, DELETE /sites/{id} (soft delete, releases kept),
DELETE /site-accounts/{id}, GET /sites?include=accounts; refreshSiteAccount
task with login-failure decisions and auto re-login on auth_expired;
scheduled jobs sites.user_data (6h) and sites.health_check (1h);
settings.sites defaults for rate limit, snapshot interval, UA and proxy.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Slot units and movie assets recorded pri from slot soft.tiers only, so a rule
group ladder would either never upgrade (pri 100) or re-upgrade forever. The
current pri is now re-evaluated from the asset's source release with the same
chain (fallback: pri recorded in the plan evaluation).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- G1 createEntityFromTmdbCandidate (sources-identity service): entity + accepted
manual external identity + season/episode units, idempotent per TMDB id;
POST /files/entity-from-candidate and organize items with `external`
- G2 minSizeBytes for organize (excluded below_min_size) and identify
(skipped + excludedBySize)
- G3 onExisting passed to planImport; dryRun marks each file
(same/skip/replace/conflict); replace = explicit grant
- G4 naming template|keep; planImport namingMode/namingSource, frozen
plan.naming {mode, templateSource, templateVersion}; targetSegments
- G5 identify prior-record hints, GET /files/record-sources, organize
refreshMetadata, POST /files/scrape-batch (dedupe by entity)
- G8 GET /files/tree (parent, subdirs hasChildren, video/registered counts)
- G9 POST /files/suggest-name returns 501 until the naming engine lands
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- GET /search?q=&scope=all|media|releases|actions&limit=: local works (title_alias
exact/prefix/trgm + name prefix, slot status summary), TMDB candidates (cached,
localEntityId), cross-site releases, page/action jump list; tookMs per group
- cross-site: enabled sites via shared per-site limiter, 15s AbortSignal timeout,
site concurrency cap 4, same-query coalescing, 30s cache; partial + failedSites;
results upserted to source_release; inventory overlay via GET /inventory
- GET /search/releases: site/resolution/source/size/free/H&R filters, sort, cursor,
facets; shares the cache
- POST /search/releases/{siteId}/{siteReleaseId}/plan: forwards in-process to
POST /acquisition-plans (same auth, validation, audit, rejections)
- contracts/search.ts, runbook, tests (partial/timeout, coalesce, cache, overlay,
filters/sort, plan)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
settingsPath() now builds /console/settings#section[/anchor] directly.
Smoke covers the old ?tab= redirects and every settings section hash
(hash-only URLs load from about:blank first). Agent report download
links go to /console/downloads/:id without the /tasks 404 probe.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
When children are still running, agent.await records the wait, closes
the session (the tool call stays pending in the JSONL) and drive returns
suspended. runAgent waits with waitForFact for the children to settle,
the deadline, or cancellation, then reopens the session; agent.await is
replay-safe, so resume replays it and the model gets the real result.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
pi.provider / baseUrl / model / thinkingLevel / apiKeySecretRef are now
DEPRECATED_SETTINGS_FIELDS: kept in the schema for stored JSON, dropped
from PATCH /settings and from the settings sections, never read by the
server. runAgent fails with a clear message when no upstream is set.
The agent demo gate checks the default upstream provider; e2e seeds a
fake upstream as default. OpenAPI summaries say Agent upstream.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
no_match resources (and lookup failures after auto-review gives up) now
open a decision in the inbox with options to set a TMDB ID, pick a local
work, or dismiss; ambiguous decisions get the same manual options.
Resolve accepts identity {tmdb | mediaEntityId} and assigns with a manual
lock. The inbox option dialog collects the TMDB type/ID or searches local
works; the identity pool links each pending item to its inbox filter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pi token refresh (10 min) and auth session cleanup (1 h) no longer run
their own setInterval; both register in the maintain group of the
schedules registry with the same default intervals.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- /console/settings#<section>[/<anchor>]; legacy ?tab= redirected in clientLoader
- SETTINGS_SECTIONS in contracts with field-ownership test
- Agent section: upstream list, create wizard (provider -> credentials/model -> login/test/default),
edit drawer with OAuth browser/device login, test, set default, delete
- sites section with site registration, snapshot/rate-limit drawer and account credentials
- path mappings moved into downloader / media-server drawers; metadata and account sections
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- agent_run gains depth / spawn_reason (0029); agent_run_event types
subagent_spawned / subagent_event / subagent_completed
- agent.spawn (propose, medium, replay never): allowlist ⊆ parent, mode not
above parent, budget carved from parent's remainder, idempotent per run+input;
settings.pi.subagents {enabled, maxConcurrent, maxDepth} (subagentsEnabled kept as alias)
- child runs claim a concurrency slot under an advisory lock (waitForFact while
queued); agent.await polls business tables without calling the model
- parent abort cascades to all descendants; parent runtime budget counts
descendant usage; child events mirrored into the parent stream by parent seq
- authorize caps every child call by all ancestors' allowlists/kinds
- session page shows parent link, inherited info and the subagent tree
- e2e E11; runbook section on subagents
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pool detail keeps 重新识别 only; rows with an open identity decision show
已进待处理 and link to /console/inbox?kind=identity_ambiguous.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- 站点工作台: 登记站点 dialog (built-in site definitions or custom).
- Site detail tabs: 整理视图 / 原站视图 / 快照与 Feed / 账号 (account list +
credential form).
- 来源健康 (was 来源/Feed/快照): cross-site health table + all feeds; site
names deep-link to the site's 快照与 Feed tab. Feed table extracted to
components/workbench/feed-table.tsx.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- cards grouped by collect / download / organize / maintain / agent checks: switch,
in-place interval or cron edit, last result and duration, next-run countdown,
failure reason, run now, skip next, reset to default, history drawer
- top stats (enabled / failed / running / total) and a scheduler-offline notice;
refreshed by the schedule.changed SSE event with a 30s fallback
- agent check cards show goal template, trigger, budget and allowlist size; create /
edit dialog (read-only capabilities, budget, trigger, interval, report to inbox)
- nav entry in the system group, route and smoke route
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- modules/schedules: registerScheduledJob({key, defaults, run}) registry; defaults are
synced into scheduled_job without overriding user-changed enabled/schedule
- scheduler runs only on the io worker, one instance via pg_try_advisory_lock held on a
dedicated connection; due = enabled and next_run_at reached, or run requested;
jobs run in parallel, never re-entrant; interval next = finish + period, cron next match;
run-now does not move next_run_at and merges duplicate requests; skip advances one period;
history trimmed to the last 50 runs; interrupted runs marked failed on takeover
- agent_check jobs: trigger condition checked first, goal template rendered, runAgent
enqueued via startRun(trigger=schedule) with allowlist and budget, one run per time slot;
allowRecover uses the autoInvestigate grant check; results harvested back into the run
history and optionally reported as an info decision; 3 built-in checks, off by default
- sources-identity (feeds.poll, sites.snapshot, identity.review), acquisition-organize
(downloads.sync, cache.threshold, downloads.orchestrate, slots.reevaluate,
subscriptions.search, subscriptions.metadata, library.reconcile) and file-manager
(trash.purge) register jobs instead of running their own setInterval; default
intervals unchanged; backup registered as an unconfigured placeholder
- endpoints under /schedules (admin, console session only)
TODO: pi refreshPiTokens and auth-settings session cleanup still own their timers.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- /pi/providers, /pi/upstreams CRUD, test (auth-only by default, no cost), models
- subscription login via pi models.login with a suspended interaction: browser mode
waits for the pasted redirect URL, device mode polls server-side; per-provider
login lock, readable callback-port-in-use errors
- credential store locks the pi_upstream row (select for update) so api and worker
refreshes never double-write a rotated refresh token
- refreshPiTokens task: refresh before expiry; failure marks expired and opens a
relogin decision, closed again after a successful login
- runAgent picks upstreamId > agent_run.upstream_id > default upstream > legacy
settings; credentials injected by the server, never logged
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Bottom-right FAB (56px, prism ring) with active-run count, pulse and latest
status summary; turns into "collapse" beside the open drawer; hidden on the
Agent page and while the mini dock shows; lifts above bottom floating bars
- Ctrl/Cmd+J toggles the drawer, Esc closes; input is focused on open
- Emphasized Agent entry at the top of the sidebar (expanded and collapsed)
with active-run count; header button kept only below xl
- Drawer first screen offers 3 page-aware quick goals that fill the input
- Respects reduced motion; AgentShortcutsHelp exported for the settings page
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- POST /files/probe writes media_asset.media_info, so scope organize.read -> organize.execute
- e2e e6-w4a-endpoints -> e10-w4a-endpoints (number clashed with e6-auto-recover)
- trash: reusing a consumed approval / retired planId is rejected and the file stays
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- invoke-limits: sharedInvokeLimiter() (one semaphore set per process); agent
capability routes default to it
- /files/identify: catalog.lookup with includeRemote runs under the shared
TMDB semaphore + 15s timeout; at most 20 distinct remote queries per
request, further items fall back to local recall with a warning
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Account popover (cookie sessions) gets a "二次验证" item showing the current
state; the dialog wires GET/POST /auth/totp: begin shows the one-time base32
secret (grouped) and otpauth URI for manual entry, enable confirms with a
6-digit code, disable takes current password + code. No QR image (would need
a new dependency); session query is invalidated so the state label updates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
S-1 (/files/move, /files/organize action=move):
- organize-guard: authorizeMoveEntities checks every source's media entities
(declared entity plus entities of registered assets under the source);
one-time approval still covers the whole request; any source that cannot
be attributed to an entity only passes with an approval; denial lists every
unauthorized item; optional non-consuming pre-check
- transfer: entities per source (directory = registered assets beneath it)
- organize: all move groups pre-checked before any group executes; any
denial -> whole request 403 approval_required
S-2:
- api.ts: GET /files/download and POST /files/trash/purge marked
auth:"session"; files routes attach requireAdminSession from the registry
annotation; handler-side purge check removed, download keeps a same-rule
defense check; permanent delete uses isAdminSession
- DEV key rule written down: equals an admin-scope key for session-only
endpoints, still admin for Move/delete approval bypass (as authorizeMove)
- api-registry.test: session list updated; new reverse assertion that no
non-session endpoint answers 403 to an admin-scope bearer
S-5 (trash restore):
- restore-to requires a writable managed library root (isWritableTarget)
- in-place restore rebuilds missing parents level by level without
following symlinks (mkdirWithin), realpath-checked per level
- cross-volume restore capped by FILES_TRASH_CROSS_MAX_BYTES; cross-volume
copies (trash in / restore out) go through fsproxy
Tests: multi-entity move 403 + listing, unattributed source, organize foreign
asset 403, download/purge 403 for DEV and admin-scope keys, restore target
not writable, symlinked parent, rebuild parents, cross-volume cap.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- downloads.ts observe: re-read download_task FOR UPDATE inside the tx and merge
from the locked row; qB sync could overwrite imported back to importing when
verifyAndImport committed between the sync read and write (E8 flake).
- agent finalize: accept summaryPrefix so the recovery verdict is written with
the terminal status in one update (E6 read a budget_exceeded run before the
"未恢复:…" annotation landed); recover-summary step kept, now idempotent no-op.
- organize.ts: drop local slotComplete and the once-subscription completion
write; completion/history are decided only by applySlotEvent(verify_passed)
(W5-C follow-up, removes double write). Manual slot organize uses the shared
subscriptions.slotComplete.
- vitest: server split into unit (parallel) and pg (file-serial, groupOrder 1)
projects; packages/tasks file-serial; explicit worker concurrency in e2e.
- docs: W6 stabilization record in 04-v0.1-acceptance.md.
Test expectations unchanged. Full `deno task ci` x3 green: 369s / 341s / 337s.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
