fix(taptap-maker): 升级官方 Runtime 并注入插件分发环境 - #94
Conversation
## 改动内容 - 将随插件分发的官方 @taptap/maker Runtime 从 0.0.28 整体升级到 0.0.31，并同步 README、运行时文档与第三方许可证。 - 在 Maker MCP 主入口和 CLI/Proxy 子进程入口注入 TAPTAP_MAKER_DISTRIBUTION=cindy_plugin。 - 同步 maker_status 的 detail/skip_remote_sync 契约与四语言描述，补充真实 Runtime 工具列表和插件托管状态回归测试。 - 将插件版本从 2.1.10 提升到 2.1.11。 ## 影响面 - Maker 动态 Proxy tools 使用官方 0.0.31 版本，插件托管环境不会触发独立 npm Runtime 更新检查。 - 主进程、账号 CLI 和 Proxy 子进程继续使用现有固定入口与 childSpawn 安全边界；未新增 Cindy 网络目标或凭证存储路径。 - 官方包新增 yaml 依赖，已补充 ISC 许可证；npm tarball 与 vendor 内容逐文件一致。 - 已验证 40 项仓库门禁与 Maker 测试、JS/JSON 校验、diff 检查及当前工作树 .cindy 打包约束。 Generated-By: Claude Code <https://claude.ai/code> Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: liangdong <liangdong@xd.com>
|
| Filename | Overview |
|---|---|
| taptap-maker/vendor/taptap-maker/dist/maker.js | 将大型上游 Runtime bundle 升级到 0.0.31，并加入不可重放远端操作处理；属于需要维护者核对来源和生成物的敏感 vendor 变更。 |
| taptap-maker/node/maker-mcp.cjs | 在加载 Runtime 前设置 Cindy 插件分发标记，原有虚拟 stdio、spawn adapter 和 root router 接线保持不变。 |
| taptap-maker/node/maker-child.cjs | 子进程入口在导入 Runtime 前设置相同分发标记，使账号 CLI 和 Runtime 自派生进程无需依赖父进程环境继承。 |
| taptap-maker/main.js | 对 Runtime 状态中的裸 CLI 登录提示进行插件原生化替换，并继续执行路径及敏感信息清理。 |
| taptap-maker/ghost.json | 插件版本递增到 2.1.11，并声明 maker_status 的完整诊断与本地摘要参数语义。 |
| .tests/taptap-maker.test.mjs | 增加 Runtime 版本、分发标记、真实工具列表、托管状态、认证提示及不可重放操作的回归覆盖。 |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
Cindy[Cindy tool call] --> Main[taptap-maker/main.js]
Main --> MCP[node/maker-mcp.cjs]
Main --> Account[node/account.cjs]
Account --> Child[node/maker-child.cjs]
MCP --> Runtime["@taptap/maker 0.0.31"]
Child --> Runtime
MCP -->|TAPTAP_MAKER_DISTRIBUTION=cindy_plugin| Runtime
Child -->|TAPTAP_MAKER_DISTRIBUTION=cindy_plugin| Runtime
Reviews (4): Last reviewed commit: "fix(taptap-maker): prevent voice confirm..." | Re-trigger Greptile
💡 Codex Review当当前项目或账号未获服务端开放某个 Proxy tool，或服务端工具集滚动变化时，这里仍无条件返回内置快照；检查 AGENTS.md reference: AGENTS.md:L19-L23 https://github.com/makecindy/cindy-official-plugins/blob/2407dd5125a4d107fb8f3d3b4ea68e8a03625146/taptap-maker/vendor/taptap-maker/dist/maker.js#L45602 当设置页已有 PAT、但本地 TapTap auth 尚未生成或已丢失时，这个新增分支会把 AGENTS.md reference: AGENTS.md:L19-L23 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
🤖 Cindy 自动审查 / Cindy Automated Review（head 2407dd5） 安全：✅ 设计：✅ 查重：✅ 既有 流程：✅ 历史：✅ 未命中反复摇摆。 问题清单：无阻塞问题。 结论：✅ 建议合并。 完整契约见 .greptile/rules.md；合并决策由维护者做出。 |
💡 Codex Review这里改为无条件返回静态 AGENTS.md reference: AGENTS.md:L19-L23 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
- Replace Runtime CLI login instructions in maker_status with plugin-native recovery paths. - Match the combined missing-PAT-and-TapTap-auth state before the narrower auth-only state. - Prefer re-saving PAT in the plugin settings when PAT exists, while retaining maker_login for browser authorization. - Add exact regression coverage for all three authentication states. - Keep the official 0.0.31 vendor bundle unchanged and retain plugin version 2.1.11. Validation: - node --test .tests/plugin-contract.test.mjs .tests/localization.test.mjs .tests/provisioning.test.mjs .tests/publish-workflows.test.mjs .tests/taptap-maker.test.mjs - git diff --check Signed-off-by: liangdong <liangdong@xd.com>
4c70f98 to
0a05682
Compare
💡 Codex Review0.0.31 将 AGENTS.md reference: AGENTS.md:L38-L40 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
🤖 Cindy 自动审查 / Cindy Automated Review（head 0a05682） 安全： 设计： 查重：✅ 既有 流程：✅ 历史：✅ 未命中方向反复摇摆。#28（0.0.27）与 #53（0.0.28）均沿同一路线合并；本次对比旧 0.0.28 与新 0.0.31，网络失败重放逻辑已存在于旧 Runtime，未查到被 revert 或相反方案。因此这不是历史争议，但当前发布包仍需满足本仓三态契约。 问题清单：
结论： 完整契约见 .greptile/rules.md；合并决策由维护者做出。 |
- Treat confirm_character_voice as non-replayable because it can create a permanent ElevenLabs voice and consume a Voice Slot. - Return an execution-unknown result after a post-dispatch connection failure and require manual verification before retry. - Reject the same tool as not executed while the proxy reconnects or when it is found in a pending replay queue. - Disable the outer Maker proxy retry for this tool while keeping retry behavior for other proxy tools unchanged. - Document the unknown-state recovery contract in the bundled tool description and assert the generated Runtime safeguards. Validation: - npm test -- --runInBand src/__tests__/mcpProxyLifecycle.test.ts src/__tests__/makerBuildLocalChanges.test.ts - node --test .tests/plugin-contract.test.mjs .tests/localization.test.mjs .tests/provisioning.test.mjs .tests/publish-workflows.test.mjs .tests/taptap-maker.test.mjs - node --check taptap-maker/vendor/taptap-maker/dist/maker.js - git diff --check Signed-off-by: liangdong <liangdong@xd.com>
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
💡 Codex Review当本地 Proxy 子进程启动或 MCP AGENTS.md reference: AGENTS.md:L38-L41 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
🤖 Cindy 自动审查 / Cindy Automated Review（head e4e5f63） 安全： 设计： 查重：✅ 这是既有 流程：✅ 历史：✅ 未命中反复摇摆。Runtime 升级路线在 #28（0.0.27）与 #53（0.0.28）均已合并；本次延续同一路线，未查到被否决、revert 或后续推翻的相反方案。旧 Codex 关于静态工具清单与 CLI 登录提示的意见已由当前 head 修复；当前 head 的“连接前失败误报 unknown”意见为真问题。未发现 Codex 的虚构 DCO commit 噪音。 问题清单：
结论： 完整契约见 .greptile/rules.md；合并决策由维护者做出。 |
当前合并门禁未通过（head
|
3 participants
改动内容
@taptap/makerRuntime 从0.0.28整体升级到正式版0.0.31。TAPTAP_MAKER_DISTRIBUTION=cindy_plugin。maker_status的detail/skip_remote_sync契约、四语言描述、README、Runtime 文档和第三方许可证。managed_by_plugin行为回归测试。confirm_character_voice加入最小的随附 Runtime 安全补丁：该操作会创建永久 ElevenLabs voice 并消耗 Voice Slot，断线后不再自动重放。P1 修复
影响面
0.0.31Runtime；插件托管模式不会触发独立 npm Runtime 更新检查。0.0.31新增yaml依赖，已补充 ISC 许可证。dist/maker.js中上述不可逆操作的重试保护。验证
dist/maker.js定点安全补丁。mcpProxyLifecycle与makerBuildLocalChanges共184 passed。42 passed, 0 failed。git diff --check和提交后.cindy打包检查通过。这是敏感的 vendor 升级与定点安全补丁，请维护者进行人工 review。