Repository navigation
fix(tiler): Complete task safety repairs / 完成任务安全与体验修复 - #3
Merged
Merged
Conversation
…固任务执行与预览安全 English: - Hardened task retries, transactional persistence, output handling, and compression progress. - Restricted task file paths, managed GeoJSON access, tile source URLs, and preview responses. - Improved frontend task rendering, polling, validation, and regression coverage for safer downloads. 中文: - 加固了任务重试、事务持久化、输出处理和压缩进度。 - 限制了任务文件路径、受管 GeoJSON 访问、地图源地址和预览响应。 - 改进了前端任务渲染、轮询、输入校验和下载回归测试。 Validation: - node .\scripts\release_preflight.mjs passed: Go tests, JavaScript checks, UI smoke, sensitive-value scan, and generated-file scan. - git diff --cached --check passed. - go test -race ./... was intentionally skipped because the local environment has no C compiler for cgo.
English: - Store worker outputs and staged ZIP files under task and run IDs, and publish artifact metadata in one transaction. - Preserve the previous published download when a later run or its publication fails. - Delete child runs and metadata with a retryable cleanup manifest, shared-file checks, and symlink containment checks. Remaining retry and queue changes follow in separate batches. 中文: - 按任务及运行 ID 隔离输出与临时 ZIP，并在同一事务中发布产物元数据。 - 后续运行或发布失败时保留上一份已发布产物的下载入口。 - 通过可重试清理清单、共享引用及符号链接检查删除子任务文件和元数据；重试及队列修复将在后续批次完成。 Validation: - go test ./...: passed from apps/admin-region-tiler. - node --check static/script.js: passed from apps/admin-region-tiler. - go test -run 'TestManagedPathRejectsSymlinkEscape|TestPublicationFailurePreservesPreviousArtifact' -v: passed, including Windows symlink rejection. - Before repair, TestSameNameArchivesNeverOverwrite and TestPurgeGroupRemovesChildOutput failed; both now pass. - Browser lifecycle and Linux race tests are deferred to the final integration batch.
English: - Track only newly generated area files for rollback, and create polygon files exclusively with write and close error handling. - Keep existing transactional task creation and name validation, with API regression coverage for second-child failure and readable legacy names. - Restrict rendered downloads to the current task endpoint and escape region labels; preserve complete task names in title attributes. 中文: - 仅清理当前请求新建的区域文件，独占创建多边形文件并检查写入和关闭错误。 - 保留已有任务组事务及名称校验，增加第二子任务失败和历史长名称的接口回归。 - 下载链接仅接受当前任务的受管接口，转义区域标签并通过标题属性保留完整名称。 Validation: - go test ./...: passed from apps/admin-region-tiler. - node --check static/script.js: passed. - node scripts/security_ui_test.mjs: passed; the same check against e2cfcdb rejects its script download URL. - TestFailedCreationPreservesReferencedArea failed before repair and now passes. - Browser viewport checks remain scheduled for the UI batch.
English: - Copy and verify existing outputs before retrying failures, keeping ZIP and MBTiles artifacts isolated per run and recording cumulative coverage. - Deduplicate unresolved failures while retaining historical resolution records; publish completion and failure resolution transactionally with restart recovery. - Add explicit local reconciliation and task recreation, reject missing baselines, reserve disk headroom, and prevent interrupted downloads from restarting automatically. Bounded enumeration and persistent queues follow in the next batch. 中文: - 重试前复制并核对已有输出，按运行隔离 ZIP 和 MBTiles，记录累计完整度。 - 对未解决失败去重并保留历史解决信息，通过可恢复事务关联产物发布、完成状态和失败解决状态。 - 增加显式本地核对及重新创建入口，拒绝缺失基线、预留磁盘空间，并阻止服务重启后自动重新下载；有界枚举与持久队列将在下一批完成。 Validation: - go test ./...: passed, including independent worker subprocesses against a local HTTP tile fixture and temporary SQLite. - TestRetryPublishesCompleteCumulativeArtifact: ZIP and MBTiles each retain all four expected coordinates while retry requests exactly one missing tile. - TestPublicationRecoveryDoesNotRedownload, TestDuplicateFailuresAndMissingBaseline, and TestCancelledRunDoesNotPublish: passed. - node --check static/script.js and node scripts/security_ui_test.mjs: passed. - Full browser, Linux race, and release checks remain for final integration.
English: - Enforce a configurable parent tile budget and three active child slots with persistent ordering for immediate, scheduled, and retry work. - Build bbox descriptions without tile arrays, deduplicate enumerations on temporary SQLite, stream retry batches, and persist failure events without accumulating worker failure arrays. - Default to three workers, respect source concurrency caps and minimum delays, expose effective settings, and add Linux race and vet CI checks. Full lifecycle and responsive checks remain in the final batches. 中文: - 为立即、定时和失败重试任务统一执行父任务瓦片预算与最多三个子任务并发的持久排队。 - bbox 构建仅保留范围描述，通过临时 SQLite 去重、分批读取重试记录并流式保存失败事件，避免大任务数组。 - 默认三线程并遵守来源并发上限和最低间隔，展示实际参数，增加 Linux race 与 vet 检查；完整生命周期和响应式验收继续在后续批次执行。 Validation: - go test ./...: passed, including TestFourthTaskQueuesAndSurvivesRestart, TestLargeBBoxBuildStoresDescriptionsOnly, and worker/source limit combinations. - node --check static/script.js and node scripts/security_ui_test.mjs: passed. - node scripts/release_preflight.mjs: passed, including browser creation smoke and sensitive/generated-file scans. - go test -race ./...: configured for Linux CI; unavailable locally because Windows has no C compiler/CGO runtime.
English: - Return preview expiry and full area collections with level selection; renew credentials early and allow one recovery attempt after invalidation. - Isolate task overlays from creation selections, cancel stale previews, stop polling on logout, and coalesce concurrent task refreshes. - Support 390, 768, and 1440 pixel layouts, expose complete legacy names, and restore delegated task menu actions blocked by inline propagation handlers. 中文: - 返回预览有效期及完整区域集合并支持层级切换，提前续期凭证且失效后仅补注册一次。 - 隔离任务覆盖层与创建选区，取消过期预览，退出后停止轮询并合并并发刷新。 - 适配 390、768、1440 像素布局，提供历史长名称详情，修复被内联事件拦截的任务菜单操作。 Validation: - node scripts/release_preflight.mjs: passed, including Go tests, syntax checks, browser checks, and sensitive/generated-file scans. - Browser regression: three viewport widths, task menus, multi-region geometry, reverse response order, 16-minute time advance, credential reset, and refresh coalescing passed. - Desktop and mobile screenshots inspected locally under ignored tmp/repair-ui. - git diff --check: passed. - Full API lifecycle and final main-branch CI verification remain in the delivery batch.
English: - Exercise real HTTP APIs, SQLite, the application binary and ordinary worker processes against local fixture tiles, including scheduling, pause, resume, cancellation, retries, deletion and restart. - Fix pooled SQLite busy handling, premature completion, partial parent status, cumulative integrity, cancellable preparation, all-failed baselines and cancellation at publication. - Preserve historical events and artifacts; verify repeated migration on a legacy database copy and bounded geometry cancellation. Production deployment and production data repair are outside this delivery. 中文: - 使用真实 HTTP、SQLite、应用二进制和正常工作进程测试本地模拟瓦片，覆盖排队、暂停、恢复、取消、重试、删除和重启。 - 修复连接池数据库锁、提前显示完成、父任务部分失败状态、累计完整度、准备阶段取消、全失败基线和发布时取消。 - 保留历史失败与产物，验证旧库副本重复迁移和几何枚举取消；本批不包含生产部署或生产数据修复。 Validation: - go test ./...: passed, including TestAPILifecycle and recovery_edges_test.go. - git diff --check: passed. - Initial API regression runs reproduced partial parent aggregation, pooled SQLite lock failures and completion before artifact availability; all passed after fixes. - Windows local race testing unavailable without a C compiler; Linux CI runs go test -race ./... and go vet ./.... - Browser checks deferred to the final frontend validation batch; no frontend script changed here.
English: - Protect files inside surviving legacy output trees, serialize creation with deletion, and refresh parent status after child cleanup. - Preserve cancellation during publication recovery and reconciled historical gaps; verify retry after an entirely failed first run and complete metadata deletion. - Exercise real browser re-login after 401, single polling and logout cache cleanup. Existing artifacts and shared files remain protected; no production deployment is included. 中文: - 保护其他旧任务输出目录内的共享文件，让创建和删除共用互斥锁，并在删除子任务后刷新父任务状态。 - 保留发布恢复中的取消状态及历史缺口，验证首次全失败后的重试和全部关联元数据删除。 - 增加浏览器 401 后真实重新登录、单轮询器及退出缓存清理测试；保护历史产物和共享文件，不包含生产部署。 Validation: - go test -run TestPurgeProtectsFileInsideSurvivingLegacyTree .: reproduced deletion of a surviving shared file before the fix. - node scripts/release_preflight.mjs: passed, including Go, browser, syntax, sensitive-value and generated-file checks. - go vet ./...: passed. - Previous batch Linux CI passed go test -race ./...; updated commit will run the same required CI checks.
English: - Add portable contracts runnable unchanged against the pre-repair baseline and the current app. - Prove eight backend baseline failures, unsafe script downloads and 1080px mobile overflow; make rendering safety part of release preflight. - Keep baseline archives and browser screenshots ignored. Tests use temporary databases and loopback tile fixtures without production access. 中文: - 增加可原样运行于修复前版本和当前版本的契约测试。 - 复现八项后端旧版失败、脚本下载链接和手机 1080px 溢出，并把渲染安全加入发布预检。 - 旧版临时归档和浏览器截图保持忽略，测试只用临时数据库及本地模拟服务，不访问生产。 Validation: - go test -run TestRepairContract -v .: eight current-version contracts passed. - Identical contract file in archived e2cfcdb: all eight tests failed on their intended assertions. - node scripts/security_ui_test.mjs e2cfcdb: expected failure for accepted javascript download URL. - TILER_REPAIR_BASELINE=e2cfcdb node scripts/release_preflight.mjs: passed current checks and reproduced the old 390px viewport / 1080px document mismatch. - node --check apps/admin-region-tiler/scripts/release_preflight.mjs and node --check apps/admin-region-tiler/scripts/repair_ui_checks.mjs: passed from repository root. - git diff --check: passed. Linux CI supplies race checks unavailable on local Windows.
English: - Remove child deletion manifests together with a parent task in the same SQLite transaction. - A previously interrupted child cleanup must not leave orphan metadata after parent deletion. - No change to protected shared-file behavior or production data. 中文: - 在同一 SQLite 事务中随父任务删除子任务的清理记录。 - 防止子任务清理曾经中断时，父任务删除后遗留孤立元数据。 - 共享文件保护规则不变，不操作生产数据。 Validation: - go test -run TestGroupPurgeRemovesChildCleanupManifests .: failed before the fix with one orphan task_deletions record. - go test ./...: passed after the fix, including the regression and real API lifecycle. - No frontend change; browser checks passed in the preceding release preflight.
English: - Document the ten defects, reproducible baseline failures, repaired contracts, real API coverage and migration/rollback boundaries. - Update both user manuals, environment examples, project map, validation chain, merge guidance and handoff memory for the delivered behavior. - Clarify cumulative versus per-run progress, missing-baseline recreation, resource defaults and production exclusions so future operators can verify rather than infer compatibility. 中文: - 记录十类缺陷、可复现的旧版失败、修复后契约、真实 API 覆盖和迁移边界。 - 更新中英文手册、环境示例、项目地图、验证链、合并说明及交接记录。 - 说明累计完整度与本次进度、缺失基线时重新创建、资源默认值和生产范围，便于后续维护者核实兼容性。 Validation: - node scripts/release_preflight.mjs from apps/admin-region-tiler: passed after staging all documents, including Go integration, JavaScript, browser, secret and generated-file checks. - go vet ./...: passed. - python C:/Users/32674/.codex/skills/deep-execution-upgrade/scripts/validate_handoff_contract.py --path docs/long-term-memory.md --format text: valid, no missing sections. - python C:/Users/32674/.codex/skills/deep-execution-upgrade/scripts/audit_environment.py --mode workspace --workspace . --format text: no high-signal drift. - git diff --cached --check: passed; source paths and API/config names checked against code. - Production deployment and production database repair were intentionally not run, as excluded by the authorized scope.
Joe5027
changed the title
Joe5027
marked this pull request as ready for review
September 11, 2026 05:05
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修复结果
修复产物覆盖、页面注入、失败重试丢失累计结果、删除残留、创建失败清理错误、资源无上限、强制线程、预览过期、区域切换及移动布局十类问题。默认父任务所有图层合计 100 万瓦片，最多同时运行 3 个子任务，默认 3 线程并受来源上限约束。
产物按任务和运行隔离，失败或取消保留旧下载入口；重试从旧成功结果补齐完整 ZIP/MBTiles。历史记录保留并显式核对，缺失基线返回 409，重新创建需用户操作。统一持久排队和父子删除，保留密码、会话及响应限制加固。
Verification
No production deployment or production data repair is included. Merge preserves all bilingual batch commits and branch protection; remove the repair branch only after the resulting main CI succeeds.