合并上游 v1.5.14 并保留 CDP 有界解析

Author: yousizaitianqiong

TASK_PROGRESS.md

@@ -56,10 +56,131 @@
   已推送到 `origin/codex/bound-cdp-json-responses`，远端 SHA 已核对一致；
   Draft PR #356 已创建并指向 `main`。GitHub 连接器创建 PR 返回 403，已按
   yeet 技能回退到已登录 `gh` CLI；未合并、未 Ready、未创建 tag/Release。
-- [CI 阻塞] PR #356 的 Actions run `31490204781` 为 `action_required`，
+- [上游同步] 2026-08-13 复核发现 PR 已与最新 `upstream/main@95423d849f74b9824db2ba0c1121cc7a13b56d10`
+  （v1.5.14）冲突。为保留公开分支历史且避免未经授权强推，采用普通 merge；
+  三处文本冲突均同时保留 #280 的 CDP 有界 discovery 与上游新增的 Windows
+  启动结果、外观恢复、本地化及其测试合同。合并提交、推送和新 CI 仍需在
+  完整回归通过后执行。
+- [CI 阻塞] PR #356 的旧 Actions run `31493227103` 为 `action_required`，
   没有 jobs；尝试批准时 GitHub 返回需要仓库 admin 权限。当前用户 token
-  无法替上游维护者批准 fork PR 工作流，因此在 CI 获得批准并通过前不转 Ready。
+  无法替上游维护者批准 fork PR 工作流；同步推送后以新 HEAD 对应的 run
+  为准，在 CI 获得批准并通过前不转 Ready。
+## Issue #352 fix and v1.5.14 release (2026-08-12)
 
+- [fix merged] PR #360 (`e3787857953998a1916c39b10942ac6c15978a25`) passed exact-head CI run `31558654733`: Static, macOS repository regressions plus universal DMG, Windows PowerShell 7, and Windows PowerShell 5.1 plus Setup.exe. It was squash-merged with the authorized same-owner review bypass at `2026-08-12T03:06:37Z` as `main@69a5a2e4b68174b1c0c70a2fa62adf1aca1eff2a`.
+- [release branch] This isolated worktree is `codex/release-v1.5.14` from that exact merge commit. Only the six version sources, two version-bound macOS assertions, both platform changelogs, and this durable progress record are in scope. All six version sources equal `1.5.14`.
+- [local gate] Portable Node regressions pass 103/103; runtime asset sync, macOS/Windows payload checks, Node/Bash syntax, version consistency, and `git diff --check` pass. `CODEX_DREAM_SKIN_SKIP_DOCTOR=1 bash macos/tests/run-tests.sh` passes with only the documented full-Xcode XCTest and installed signed Codex Doctor branches skipped.
+- [next] Commit and push the version branch, open a Ready PR, require exact-head CI, merge it, then verify the sole Release workflow creates `v1.5.14` from the exact main merge and publishes non-empty DMG, Setup.exe, and `SHA256SUMS.txt`. Only after public asset/checksum verification will #352 receive the customer reply; keep it open pending field confirmation.
+
+## Issue #352 Windows one-click cold-session baseline (2026-08-12)
+
+- [root cause] The reporter's exact `One-click apply requires an existing
+  verified Dream Skin session.` failure is the cold-session guard introduced
+  by PR #245 (`c44b434`, merged as `71f30f0`), not PR #357. The guard conflicts
+  with the documented one-click start/restart path by rejecting before that
+  path can run. Upstream Issue #235 remains a separate limitation: current
+  Store Codex may still fail to expose a verified CDP endpoint after startup.
+- [local implementation] Isolated worktree
+  `/private/tmp/dreamskin-issue352-baseline`, branch
+  `codex/fix-352-one-click-baseline`, starts from exact public v1.5.13
+  `main@6ae42e645c15f6ac91f5fa54a9c37dbc57af646c`. The Windows community apply
+  path now classifies only a missing session as bootstrap-eligible, releases
+  the operation lock while invoking the existing start-and-verify child, then
+  reacquires the lock and revalidates the complete old-theme baseline and its
+  fingerprint. All other baseline failures remain fail-closed.
+- [safety/order] User confirmation still precedes startup. Old-theme baseline
+  establishment and visible verification precede temporary work-root creation,
+  ZIP download, import, snapshot, or active-theme write. The transaction keeps
+  its second baseline check to reject a concurrent pause/theme/session change.
+  A baseline failure therefore performs zero candidate download/import/write,
+  and no longer claims that nonexistent download files were cleaned up.
+- [tests] Before the final orchestration assertion, focused PowerShell suites passed for community apply, both appearance
+  recovery paths, renderer readiness, verified-skin preservation, config
+  rollback, and the structured start-result contract. All 11 Windows scripts
+  parse; Windows Node tests pass 27/27, tools Node tests 2/2, and the focused
+  macOS ZIP validator passes. The final portable Node set passes 103/103,
+  runtime asset sync, dual payload checks, Node syntax, and `git diff --check`
+  pass. The portable macOS set previously passed 73/74 in one
+  parallel run with only a host subprocess exit 141, and that exact ZIP case
+  passed alone. Full Windows wrapper and one ZIP guard remain native-Windows CI
+  gates because macOS lacks `Get-AuthenticodeSignature` and resolves `/var`
+  through a symlink. This shell no longer has `pwsh` installed, so the final
+  test-only orchestration ordering assertion has not been executed locally and
+  remains an explicit exact-head Windows CI gate.
+- [independent review] Final read-only review found no P0/P1. It confirmed
+  lock release before child startup, bounded lock reacquisition, exact
+  fingerprint revalidation, download-before-baseline prevention, accurate
+  cleanup messaging, and PowerShell 5.1-compatible syntax. Residual evidence
+  required before merge is exact-head Windows PowerShell 5.1/7 CI plus Setup.
+- [current truth] Six implementation/test/documentation/progress files are modified and
+  uncommitted. No push, PR, merge, version bump, tag, Release, or Issue reply
+  exists for this fix yet. Next: rerun the corrected focused/static gates,
+  review the final diff, commit/push, open a Ready PR, and require all four
+  exact-head CI jobs before merge. Then prepare v1.5.14 through the sole Release
+  workflow, verify tag/assets/checksums/public status, and reply to #352 without
+  closing it until the reporter confirms the field fix.
+
+## Issue #354 Windows failed-start appearance recovery (2026-08-12)
+
+- [current local implementation] All prior independent-audit findings are
+  addressed. Startup appearance uses a strict, 64 KiB durable
+  `preparing -> committed` journal before marker/config writes. Recovery is
+  three-way per managed key and marker, preserves a newer post-crash user
+  `system -> light` edit, rejects a journal whose declared changes do not match
+  its snapshots without mutating config/marker/evidence, and normalizes CRLF
+  snapshot line endings before serialization. One-click child completion gets
+  lock timeout plus 300000 ms independent grace, never force-kills a live child,
+  and keeps candidate files coherent for timeout/invalid/blocked/
+  `preserved-rendered` states. A rendered-but-unverified result-token child
+  closes its exact new CDP session and restores appearance before returning
+  `restored`.
+- [focused verification 2026-08-12] Seven PowerShell 7.6.4 suites pass together:
+  `config-startup-rollback`, `start-result-contract`, CDP-failure recovery,
+  post-launch recovery, renderer readiness, verified-skin preservation, and
+  `community-theme-link`. Executable coverage includes marker/config hard-stop
+  windows, tampered journals, CRLF quoted keys and dollar-bearing values,
+  post-crash user edits, 480000 ms parent wait, no force-kill/result cleanup
+  while the child remains live, preserved-rendered file coherence, and the full
+  outer child catch/writer/reader category path.
+- [complete local gate 2026-08-12] Portable Node passes 103/103 (macOS 74,
+  Windows 27, tools 2). All 23 PowerShell files parse and satisfy the PS5.1
+  non-ASCII UTF-8 BOM policy; all Node and Bash syntax checks, both platform
+  payload checks, runtime asset sync, and `git diff --check` pass. The full
+  `CODEX_DREAM_SKIN_SKIP_DOCTOR=1 bash macos/tests/run-tests.sh` wrapper exits
+  0, including signed-runtime switch and runtime-state integration. Native
+  SwiftPM/XCTest is skipped because this host lacks a matching full Xcode
+  platform, and Doctor is explicitly skipped because no installed signed Codex
+  app is available. Native Windows PowerShell 5.1/7 and Setup remain CI gates.
+- [independent final audit] Read-only review of the complete local diff found no
+  remaining P0/P1. The prior parent hard-kill and `preserved-rendered` mixed-state
+  blockers are closed by executable production-helper/result-path coverage.
+  Non-blocking P2 residuals are documented: same-user coherent rewriting of the
+  entire local journal is outside corruption detection; the explicitly invoked
+  test/debug-only `-ForegroundInjector` mode has a narrow pre-injector committed
+  window and no production caller; and a concurrent manual action choosing
+  byte-identical theme content is indistinguishable from no superseding change.
+- [remote state] PR #351 is squash-merged as
+  `main@9e6798700c0e35be0713135ebd9b3a6f01583499`; exact-head run
+  `31522162828` and post-merge run `31523222468` passed all four client CI
+  jobs. Draft PR #357 targets that `main` from
+  `codex/fix-354-appearance-rollback@fa3e53822a4158d56dc1ae10efa8f288b2d73a88`.
+  Exact-head run `31531028135` passed Static, macOS/DMG, Windows PowerShell 7,
+  and Windows PowerShell 5.1/Setup.
+- [pushed checkpoint] The 15 implementation, test, and Windows documentation
+  files are committed as `54933c3678034333a4e00c0a93c9d4da5d2ded6d`; the
+  first verification checkpoint is `8ad35f2`. Both were pushed to
+  `codex/fix-354-appearance-rollback` for Draft PR #357. Run `31531028135`
+  remains historical evidence for older head `fa3e538`, not the new changes.
+- [scope] The PR fixes only caught Windows failed-start partial appearance,
+  rollback ownership/concurrency, and bounded one-click diagnostics. It does
+  not claim that official Store Codex `26.803.5235.0` restored a supported CDP
+  endpoint. User authorization covers scoped commit, push, PR merge, and issue
+  handling, but not a version, tag, Release, deployment, or external config.
+- [remaining] Push this progress-only checkpoint and update the PR body. Require
+  all four CI jobs green on the resulting exact head before marking #357 Ready
+  and squash-merging with head protection. Verify post-merge `main` CI, then
+  update only #235, #352, and #354. Native Windows 5.1/7 and Setup are CI-only
+  evidence on this macOS host.
 ## Client release v1.5.12 (2026-08-08)
 
 - [scope] Reviewed and merged 10 pending community/self PRs that had accumulated