From 6895a844091a7287b2930d123bb7dab80038b345 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Mon, 15 Jun 2026 11:08:51 +0200 Subject: [PATCH 1/9] =?UTF-8?q?docs(rebrand):=20Phase=207=20docs=20+=20Pha?= =?UTF-8?q?se=208=20CI/CD=20=E2=80=94=20complete=20StoryCraft=20=E2=86=92?= =?UTF-8?q?=20WorldScript=20rebrand?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Rebranded all forward-facing documentation, issue templates, and workflow comments. - Renamed smoke-test protocol V1.22 → V1.23-REBRAND-SMOKE-TEST.md with rebrand-specific checks. - Updated GitHub Actions CI VRT serve path to /WorldScript-Studio/ and docker.yml pull comment. - Updated .github/best-practices-badge.yml security policy URL and issue template descriptions. - Forward-updated GitHub URLs in docs/history/ sprint handoffs. - Regenerated .mcp/proforge-mcp-server/package-lock.json for @worldscript scope. - Updated metadata.json app name to WorldScript Studio. - Added scripts/rebrand-docs.mjs helper for documentation mass-rebrand. --- .../a11y_audit_overhaul_cb9565d0.plan.md | 2 +- ...t_best-practices_overhaul_f438c5af.plan.md | 6 +- ...torycraft_helper_overhaul_78451cbd.plan.md | 4 +- .github/CI-AUDIT.md | 2 +- .github/CONTRIBUTING.md | 2 +- .github/ISSUE_TEMPLATE/bug_report.yml | 6 +- .github/ISSUE_TEMPLATE/feature_request.yml | 2 +- .github/ISSUE_TEMPLATE/translation_pr.yml | 2 +- .github/SECURITY.md | 2 +- .github/best-practices-badge.yml | 2 +- .github/copilot-instructions.md | 6 +- .github/workflows/ci.yml | 8 +- .github/workflows/docker.yml | 2 +- .github/workflows/mutation.yml | 2 +- .mcp/proforge-mcp-server/README.md | 12 +-- AGENTS.md | 18 ++-- AUDIT.md | 36 +++---- CHANGELOG.md | 45 ++++----- CLAUDE.md | 12 +-- CONTRIBUTING.md | 12 +-- KIMI-INSTRUCT.md | 6 +- README.md | 50 +++++----- ROADMAP.md | 6 +- TODO.md | 10 +- backend/README.md | 2 +- docs/ACCESSIBILITY.md | 2 +- docs/AUDIT-PERFECTION-PLAN-v1.23.md | 6 +- docs/BEST-PRACTICES.md | 2 +- docs/BULK-TRANSLATION.md | 4 +- docs/CI.md | 6 +- docs/CODEANT-REVIEW-LOOP.md | 6 +- docs/CODE_QUALITY.md | 2 +- docs/COPILOT.md | 2 +- docs/DEPLOYMENT.md | 4 +- docs/Design-System.md | 6 +- docs/EDGE_AI_PERFECT_PLAN.md | 2 +- docs/FEATURE-PARITY.md | 6 +- docs/I18N-COLLATION.md | 2 +- docs/I18N-DISPLAYNAMES.md | 2 +- docs/I18N-GLOSSARY-RTL.md | 4 +- docs/I18N-GLOSSARY.md | 6 +- docs/I18N-LISTFORMAT.md | 2 +- docs/I18N-LOCALE.md | 2 +- docs/I18N-NUMBERS.md | 2 +- docs/I18N-PLURALS.md | 2 +- docs/I18N-RELATIVETIME.md | 2 +- docs/IDB-ENCRYPTION.md | 14 +-- docs/LOCAL-AI.md | 4 +- docs/PLOT-BOARD.md | 4 +- docs/PLUGINS-BETA.md | 2 +- docs/PROFORGE-PIPELINE.md | 2 +- docs/PWA-AUDIT.md | 4 +- docs/SECURITY-THREAT-MODEL.md | 2 +- docs/TAURI-CI.md | 18 ++-- docs/TAURI-UPDATER.md | 2 +- docs/TS7-MIGRATION.md | 2 +- docs/UI-MODERNIZATION.md | 4 +- ...KE-TEST.md => V1.23-REBRAND-SMOKE-TEST.md} | 33 +++++-- docs/VOICE_MASTER_PLAN.md | 8 +- docs/adr/0002-local-ai-stack-layering.md | 2 +- docs/adr/0003-workerbus-hybrid-routing.md | 2 +- .../adr/0004-csp-connect-src-byok-tradeoff.md | 4 +- docs/architecture/global-copilot-plan.md | 6 +- .../proforge-mcp-copilot-followups.md | 4 +- docs/codegraph.md | 6 +- docs/dual-graph-setup.md | 4 +- docs/graphify.md | 2 +- .../sprints/SPRINT-HANDOFF-2026-05-23.md | 4 +- ...RINT-HANDOFF-2026-05-30-encryption-a11y.md | 6 +- docs/sprints/local-ai-perfection-PLAN.md | 2 +- docs/sprints/local-ai-perfection-RESUME.md | 2 +- infra/low-end-ci/DAILY-DRIVER.md | 18 ++-- infra/low-end-ci/INSTALL.md | 50 +++++----- infra/low-end-ci/README.md | 4 +- metadata.json | 2 +- scripts/rebrand-docs.mjs | 95 +++++++++++++++++++ 76 files changed, 377 insertions(+), 264 deletions(-) rename docs/{V1.22-SMOKE-TEST.md => V1.23-REBRAND-SMOKE-TEST.md} (79%) create mode 100644 scripts/rebrand-docs.mjs diff --git a/.cursor/plans/a11y_audit_overhaul_cb9565d0.plan.md b/.cursor/plans/a11y_audit_overhaul_cb9565d0.plan.md index c65f087c..7e49a8d5 100644 --- a/.cursor/plans/a11y_audit_overhaul_cb9565d0.plan.md +++ b/.cursor/plans/a11y_audit_overhaul_cb9565d0.plan.md @@ -23,7 +23,7 @@ todos: isProject: false --- -# Accessibility-Audit + Overhaul-Plan (StoryCraft-Studio) +# Accessibility-Audit + Overhaul-Plan (WorldScript-Studio) ## Kurz-Einordnung des Ist-Zustands diff --git a/.cursor/plans/storycraft_best-practices_overhaul_f438c5af.plan.md b/.cursor/plans/storycraft_best-practices_overhaul_f438c5af.plan.md index f0b4bd7b..c5d18518 100644 --- a/.cursor/plans/storycraft_best-practices_overhaul_f438c5af.plan.md +++ b/.cursor/plans/storycraft_best-practices_overhaul_f438c5af.plan.md @@ -1,6 +1,6 @@ --- -name: StoryCraft Best-Practices Overhaul -overview: "Systematisches Qualitäts- und Content-Programm für StoryCraft-Studio: Audit-Matrix aller Dimensionen, messbare Best-Practices-Spezifikation (besonders App-Inhalte), dann priorisierte Umsetzung in Phasen — ohne bestehende Funktionalität zu brechen und mit realistischen Gates statt unmessbarer „100 %-Perfektion“." +name: WorldScript Best-Practices Overhaul +overview: "Systematisches Qualitäts- und Content-Programm für WorldScript-Studio: Audit-Matrix aller Dimensionen, messbare Best-Practices-Spezifikation (besonders App-Inhalte), dann priorisierte Umsetzung in Phasen — ohne bestehende Funktionalität zu brechen und mit realistischen Gates statt unmessbarer „100 %-Perfektion“." todos: - id: phase1-content-audit content: "Phase 1: Glossar + String-Pass (portal/help/tour/settings/commands) + Community-Templates-Strategie/Schema + Demo-Flow Toast statt alert + FR/ES/IT Qualität" @@ -20,7 +20,7 @@ todos: isProject: false --- -# StoryCraft Studio — Global Audit & Best-Practices-Programm +# WorldScript Studio — Global Audit & Best-Practices-Programm ## Prämisse (messbar statt absolut) diff --git a/.cursor/plans/storycraft_helper_overhaul_78451cbd.plan.md b/.cursor/plans/storycraft_helper_overhaul_78451cbd.plan.md index 8d401dcc..9a168ef8 100644 --- a/.cursor/plans/storycraft_helper_overhaul_78451cbd.plan.md +++ b/.cursor/plans/storycraft_helper_overhaul_78451cbd.plan.md @@ -1,5 +1,5 @@ --- -name: StoryCraft Helper Overhaul +name: WorldScript Helper Overhaul overview: "Schritt-1-Audit und Spezifikation: Feature-Mapping vom Ist-Zustand (Redux/Zustand, monolithische Palette, fehlende Shortcut-UI) zu einem kohärenten „Creative OS“-Layer mit Weltklasse-Command-Palette, durchsuchbarem Settings-Hub, RAG-gestütztem Help und vereinheitlichten sekundären UI-Hilfen – ohne bestehende Kernfunktionen zu brechen." todos: - id: registry-shortcuts @@ -23,7 +23,7 @@ todos: isProject: false --- -# StoryCraft Studio: Helper-Layer & Command-Center (Audit + Spezifikation) +# WorldScript Studio: Helper-Layer & Command-Center (Audit + Spezifikation) ## Kontext aus dem Code (relevant für das Mapping) diff --git a/.github/CI-AUDIT.md b/.github/CI-AUDIT.md index c4524a63..40d06348 100644 --- a/.github/CI-AUDIT.md +++ b/.github/CI-AUDIT.md @@ -1,4 +1,4 @@ -# CI Audit — StoryCraft Studio +# CI Audit — WorldScript Studio **As of:** 2026-05-21; **last updated:** 2026-06-01 · **Workflow files:** `ci.yml`, `tauri-build.yml`, `prune-deployments.yml`, `storybook-debug.yml`, `scorecard.yml`, `codeql.yml`, `docker.yml` diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index da091d17..9304aa3c 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,4 +1,4 @@ -# Contributing to StoryCraft Studio +# Contributing to WorldScript Studio ## Code of Conduct diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 4ca80b3f..34567ff9 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -1,5 +1,5 @@ name: Bug Report -description: Report a bug or unexpected behavior in StoryCraft Studio +description: Report a bug or unexpected behavior in WorldScript Studio title: "[Bug]: " labels: ["bug", "needs-triage"] body: @@ -7,7 +7,7 @@ body: attributes: value: | Thanks for taking the time to report a bug! Please fill in as much detail as possible. - **Do not report security vulnerabilities here** — use [GitHub Private Vulnerability Reporting](https://github.com/qnbs/StoryCraft-Studio/security/advisories/new) instead. + **Do not report security vulnerabilities here** — use [GitHub Private Vulnerability Reporting](https://github.com/qnbs/WorldScript-Studio/security/advisories/new) instead. - type: textarea id: description @@ -59,7 +59,7 @@ body: id: version attributes: label: Version - description: Which version of StoryCraft Studio? (shown in Settings → About or the v badge in README) + description: Which version of WorldScript Studio? (shown in Settings → About or the v badge in README) placeholder: "e.g. v1.19.0" validations: required: true diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index e9d3df6c..cd2343ee 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -1,5 +1,5 @@ name: Feature Request -description: Suggest a new feature or enhancement for StoryCraft Studio +description: Suggest a new feature or enhancement for WorldScript Studio title: "[Feature]: " labels: ["enhancement", "needs-triage"] body: diff --git a/.github/ISSUE_TEMPLATE/translation_pr.yml b/.github/ISSUE_TEMPLATE/translation_pr.yml index 6a9e86ce..31963733 100644 --- a/.github/ISSUE_TEMPLATE/translation_pr.yml +++ b/.github/ISSUE_TEMPLATE/translation_pr.yml @@ -6,7 +6,7 @@ body: - type: markdown attributes: value: | - Thanks for helping translate StoryCraft Studio! + Thanks for helping translate WorldScript Studio! Locale source files live in `locales//*.json` (15 modules per language). Run `pnpm run i18n:check` before submitting to verify key parity across all 5 locales. diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 2eca5ae1..beb17ec1 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -17,7 +17,7 @@ Please do not open public GitHub issues for security vulnerabilities. Use one of these private channels instead: 1. Preferred: GitHub Private Vulnerability Reporting (Security Advisories) - - URL: https://github.com/qnbs/StoryCraft-Studio/security/advisories/new + - URL: https://github.com/qnbs/WorldScript-Studio/security/advisories/new 2. Encrypted email (fallback): maintainers may publish a dedicated address in organization docs; until then, **use GitHub Private Vulnerability Reporting only**. If the email channel is not configured, use GitHub Private Vulnerability Reporting. diff --git a/.github/best-practices-badge.yml b/.github/best-practices-badge.yml index fcd46ab3..b8c7f40e 100644 --- a/.github/best-practices-badge.yml +++ b/.github/best-practices-badge.yml @@ -25,7 +25,7 @@ criteria: # The project MUST have a security policy. have_security_policy: true # The project MUST have a security policy that is publicly available. - security_policy_url: https://github.com/qnbs/StoryCraft-Studio/security/policy + security_policy_url: https://github.com/qnbs/WorldScript-Studio/security/policy # Code code: diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 47ccf47f..9ef4a581 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -1,10 +1,10 @@ -# Copilot Instructions — StoryCraft Studio +# Copilot Instructions — WorldScript Studio ## Project Overview -StoryCraft Studio is an AI-powered creative writing application built as an offline-first PWA. It combines a React 19 SPA with Google Gemini AI integration, IndexedDB persistence, and optional Tauri desktop packaging. +WorldScript Studio is an AI-powered creative writing application built as an offline-first PWA. It combines a React 19 SPA with Google Gemini AI integration, IndexedDB persistence, and optional Tauri desktop packaging. -**Live:** `https://qnbs.github.io/StoryCraft-Studio/` +**Live:** `https://qnbs.github.io/WorldScript-Studio/` **Documentation map:** [`README.md`](../README.md#-documentation-hub) § Documentation Hub lists every maintainer `.md` guide (see also [`AUDIT.md`](../AUDIT.md)). diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7b4caf93..943cb7e8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,5 @@ # ============================================================ -# StoryCraft Studio – CI/CD Pipeline +# WorldScript Studio – CI/CD Pipeline # security → quality (lint, i18n, tsgo, vitest+coverage) → build (+chunk budget, rollup analyze) # ├→ e2e | storybook (parallel) ; lighthouse after build # deploy (main): needs build + e2e → GitHub Pages @@ -460,10 +460,10 @@ jobs: env: CI: true run: | - # QNBS-v3: The GitHub Pages build has base=/StoryCraft-Studio/. Mirror that structure + # QNBS-v3: The GitHub Pages build has base=/WorldScript-Studio/. Mirror that structure # so http-server serves assets at the expected paths matching playwright.config baseURL. - mkdir -p serve_root/StoryCraft-Studio - cp -r dist/. serve_root/StoryCraft-Studio/ + mkdir -p serve_root/WorldScript-Studio + cp -r dist/. serve_root/WorldScript-Studio/ pnpm exec http-server serve_root -p 3000 -s & pnpm exec wait-on http://127.0.0.1:3000 --timeout 30000 pnpm run test:vrt diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index d2d07bef..f0aec71e 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -1,5 +1,5 @@ # Docker image build + push to GitHub Container Registry on every tag. -# Pull with: docker pull ghcr.io/qnbs/storycraft-studio:latest +# Pull with: docker pull ghcr.io/qnbs/worldscript-studio:latest name: Docker diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 068e7f57..81a2fc4b 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -1,5 +1,5 @@ # ============================================================ -# StoryCraft Studio – Mutation Testing (Stryker) — Parallel + Incremental +# WorldScript Studio – Mutation Testing (Stryker) — Parallel + Incremental # QNBS-v3: Matrix-parallel Stryker with per-module incremental caching. # Run manually via workflow_dispatch. Each matrix job targets one module # to keep wall-clock time low (~5–15 min per job vs. 30–45 min single job). diff --git a/.mcp/proforge-mcp-server/README.md b/.mcp/proforge-mcp-server/README.md index fbb47649..cffcc9ed 100644 --- a/.mcp/proforge-mcp-server/README.md +++ b/.mcp/proforge-mcp-server/README.md @@ -1,6 +1,6 @@ # ProForge MCP Server -Exposes the StoryCraft Studio **ProForge** 8-stage agentic editing pipeline to external AI agents +Exposes the WorldScript Studio **ProForge** 8-stage agentic editing pipeline to external AI agents (Claude Desktop, Cline, Cursor, GitHub Copilot, Kimi, …) over the [Model Context Protocol](https://modelcontextprotocol.io). @@ -23,7 +23,7 @@ AI agent ──stdio MCP──> ProForge MCP server (this folder) Node InferenceGateway (@google/genai) · in-process memory bank · file run-history ``` -Because StoryCraft is a backend-less PWA, this server cannot read the browser's live IndexedDB +Because WorldScript is a backend-less PWA, this server cannot read the browser's live IndexedDB project. It operates on a **portable project payload** passed per call (`project` argument) or loaded once at startup (`--project `). See [`examples/sample-project.json`](./examples/sample-project.json). @@ -43,14 +43,14 @@ once at startup (`--project `). See [`examples/sample-project.json`](./exa | Var | Purpose | |-----|---------| -| `GEMINI_API_KEY` (or `STORYCRAFT_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`) | Required only for `proforge_run_stage`. Never logged, never bundled. | +| `GEMINI_API_KEY` (or `WORLDSCRIPT_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`) | Required only for `proforge_run_stage`. Never logged, never bundled. | CLI flags: `--project ` (default payload), `--history ` (run-history JSON store). ## Run This server reuses the repo's TypeScript sources and their dependencies (`zod`, `@google/genai`), -so it must live inside the StoryCraft repo. Only the MCP SDK + `tsx` are installed locally. +so it must live inside the WorldScript repo. Only the MCP SDK + `tsx` are installed locally. ```bash cd .mcp/proforge-mcp-server @@ -71,7 +71,7 @@ GEMINI_API_KEY=… npx tsx src/index.ts --project ./examples/sample-project.json "proforge": { "command": "npx", "args": ["tsx", "src/index.ts", "--project", "./examples/sample-project.json"], - "cwd": "/absolute/path/to/StoryCraft-Studio/.mcp/proforge-mcp-server", + "cwd": "/absolute/path/to/WorldScript-Studio/.mcp/proforge-mcp-server", "env": { "GEMINI_API_KEY": "your-key-here" } } } @@ -85,7 +85,7 @@ GEMINI_API_KEY=… npx tsx src/index.ts --project ./examples/sample-project.json "mcpServers": { "proforge": { "command": "npx", - "args": ["tsx", "/absolute/path/to/StoryCraft-Studio/.mcp/proforge-mcp-server/src/index.ts"], + "args": ["tsx", "/absolute/path/to/WorldScript-Studio/.mcp/proforge-mcp-server/src/index.ts"], "env": { "GEMINI_API_KEY": "your-key-here" } } } diff --git a/AGENTS.md b/AGENTS.md index 573c4ec3..c85b84a7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,14 +1,14 @@ -# StoryCraft Studio — Agent Guide +# WorldScript Studio — Agent Guide --- ## Project Overview -**StoryCraft Studio** is an offline-first, AI-powered creative writing application. It is a React 19 single-page application (SPA) that runs in the browser as a Progressive Web App (PWA) and can also be packaged as a desktop app via Tauri 2. There is no backend server; all project data lives locally (IndexedDB in the browser, filesystem in Tauri). Cloud AI providers are optional and user-triggered only. +**WorldScript Studio** is an offline-first, AI-powered creative writing application. It is a React 19 single-page application (SPA) that runs in the browser as a Progressive Web App (PWA) and can also be packaged as a desktop app via Tauri 2. There is no backend server; all project data lives locally (IndexedDB in the browser, filesystem in Tauri). Cloud AI providers are optional and user-triggered only. -- **Primary deploy target:** Static SPA on GitHub Pages (`/StoryCraft-Studio/` base path) +- **Primary deploy target:** Static SPA on GitHub Pages (`/WorldScript-Studio/` base path) - **Secondary targets:** Vercel (root base) and Cloudflare Pages via edge builds (`pnpm run build:edge`) - **Desktop:** Tauri 2 bundles for Linux (AppImage), macOS (DMG), and Windows (MSI); auto-updater enabled via `latest.json` - **Version:** `1.22.0` @@ -65,7 +65,7 @@ The app supports a multi-provider AI stack (Gemini, OpenAI, Claude, Grok, OpenRo ## Project Structure ```text -StoryCraft-Studio/ +WorldScript-Studio/ ├── app/ # Redux store setup, typed hooks, listener middleware, Zustand transient store ├── components/ # React view components; components/ui/ = design-system primitives │ ├── ui/ # Atoms: Button, Modal, Toast, Input, etc. @@ -275,7 +275,7 @@ Pre-commit hook runs `biome check --write` on staged files via `simple-git-hooks ### E2E Tests (Playwright) - **CI-only by policy:** `CI=true` is required (`pnpm run test:e2e`). CI runs Chromium desktop + Pixel 5 mobile emulation. Locally, Firefox is included; mobile only with `RUN_MOBILE_E2E=1`. -- **Base URL:** `http://127.0.0.1:3000/StoryCraft-Studio` +- **Base URL:** `http://127.0.0.1:3000/WorldScript-Studio` - **Do NOT use `networkidle`** against the Vite dev server (HMR keeps WebSocket open). Use `waitForSpaReady()` from `tests/e2e/helpers.ts`. - **Helpers:** `ensureBlankProject()`, `selectEnglish()`, `sidebar(page)` (scopes to `#sidebar`). - **Accessibility smoke:** `tests/e2e/a11y.spec.ts` runs axe-core on welcome route and Settings → Accessibility. @@ -337,7 +337,7 @@ deploy (main, non-PR) needs: build + e2e ──► GitHub Pages | Target | Build Command | Vite Base | |--------|---------------|-----------| -| GitHub Pages (canonical) | `pnpm run build` | `/StoryCraft-Studio/` | +| GitHub Pages (canonical) | `pnpm run build` | `/WorldScript-Studio/` | | Vercel | `pnpm run build:edge` | `/` | | Cloudflare Pages | `pnpm run build:edge` | `/` | @@ -410,11 +410,11 @@ Edge builds run `scripts/build-edge.mjs` which sets `DEPLOY_TARGET=edge` and pat - `services/ai/index.ts` — canonical entry; exports orchestration layer built on `@ai-sdk/google`, `@ai-sdk/openai`, and the `ai` package. - `providerFactory.ts` — `LanguageModel` factory. -- `storyCraftCompletionFetch.ts` — custom fetch adapter. +- `worldScriptCompletionFetch.ts` — custom fetch adapter. - `aiPolicy.ts` — `assertCloudAiAllowed` gates all cloud AI calls. - `aiRetry.ts` — `withTransientRetry(fn, opts)` wraps provider calls with transient-error retries. - `services/ai/providers/openrouterProvider.ts` — OpenRouter gateway with circuit breaker and free-tier catalog. -- `hooks/useStoryCraftAI.ts` — wraps `useCompletion` from `@ai-sdk/react`. +- `hooks/useWorldScriptAI.ts` — wraps `useCompletion` from `@ai-sdk/react`. ### AI Execution Modes @@ -497,7 +497,7 @@ Central orchestration layer for all background worker tasks. Messages use short ## Desktop (Tauri) -- `src-tauri/tauri.conf.json` configures the window, CSP, updater, deep links (`storycraft://`), and file associations (`.storycraft`, `.scst`). +- `src-tauri/tauri.conf.json` configures the window, CSP, updater, deep links (`worldscript://`), and file associations (`.worldscript`, `.scst`). - `src-tauri/Cargo.toml` defines the Rust crate; `rust-compute` feature optionally includes `candle-core` + `candle-nn` for Rust-side inference. - `vite.config.ts` externalizes all `@tauri-apps/*` modules for web builds. - Tauri plugins: log, fs, http, dialog, shell, updater, window-state, deep-link, single-instance. diff --git a/AUDIT.md b/AUDIT.md index 337d90b9..094585ed 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1,4 +1,4 @@ -# StoryCraft Studio — Codebase Audit Report +# WorldScript Studio — Codebase Audit Report **Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** **Scope:** Full application, repository configuration, CI/CD, documentation, release validation @@ -133,7 +133,7 @@ **Help & Settings content augmentation (2026-06-03):** new Help category **"Advanced & Power Features"** (`helpCatalog.ts`) — 8 articles (Languages/RTL, LoRA fine-tuning, ProForge, Voice, At-rest encryption, Cloud Sync, Plugins, Adaptive AI/GPU/Eco) translated in en/de/fr/es/it (ar/he English fallback). Offline help-RAG (`helpDocRetrieval.ts`) grown 13 → **16 chunks** (`languages-rtl`, `privacy-local-ai`, `advanced-editing`). In-app **Settings Guide** (`SettingsGuideSection.tsx`) completed — the previously-undocumented live categories **Fine-Tuning (LoRA)**, **Community**, and **Plugins** now appear with title/desc + search hints in all 7 locales. +23 keys (help) +6 keys (settings) → **2259 keys × 7 locales**. Tests green (`helpCatalogIntegrity`, `helpDocRetrieval`, `helpSearchIndex`, `SettingsGuideSection`). -**SW i18n-staleness fix (2026-06-03):** returning users kept **stale translations** after a content-only i18n update (symptom: switching to ar/he flipped layout to RTL but text stayed English until a hard reload / cache clear). Root cause: `public/sw.js` cached `/locales/**/bundle.json` with **stale-while-revalidate** against `storycraft-dynamic-v${APP_VERSION}`; `APP_VERSION` is synced from `package.json` and doesn't bump on i18n-only changes, so the old (stub) bundle was served first and only revalidated in the background. Fix: locale handler switched to **network-first with cache fallback** — fresh strings whenever online, offline still served from cache. Regression guard: `tests/unit/swLocaleStrategy.test.ts` (asserts network-first ordering, no stale-first return). Changing `sw.js` also triggers a new SW install → `controllerchange` auto-reload (`register-sw.ts`) for existing clients. +**SW i18n-staleness fix (2026-06-03):** returning users kept **stale translations** after a content-only i18n update (symptom: switching to ar/he flipped layout to RTL but text stayed English until a hard reload / cache clear). Root cause: `public/sw.js` cached `/locales/**/bundle.json` with **stale-while-revalidate** against `worldscript-dynamic-v${APP_VERSION}`; `APP_VERSION` is synced from `package.json` and doesn't bump on i18n-only changes, so the old (stub) bundle was served first and only revalidated in the background. Fix: locale handler switched to **network-first with cache fallback** — fresh strings whenever online, offline still served from cache. Regression guard: `tests/unit/swLocaleStrategy.test.ts` (asserts network-first ordering, no stale-first return). Changing `sw.js` also triggers a new SW install → `controllerchange` auto-reload (`register-sw.ts`) for existing clients. **Quality gate (2026-06-02):** lint ✅ · i18n:check ✅ (2236 keys × 5 locales; `lora` + `common.next/back` un-orphaned) · typecheck ✅ · tests ✅ · feature-parity 0 criticals · LoRA view routed (Phase 2.2) + Phase 3 coverage tests (33) · Stryker now manual-only · Coverage/E2E: CI-only @@ -166,7 +166,7 @@ **Scope:** Complete the WorkerBus v2 Rust half (TODO.md line 26) and verify it natively. Branch `feat/workerbus-v2-phase3-rust` (PR #70). -**Phase 3 delivered:** `src-tauri/src/commands/task_supervisor.rs` + `commands/mod.rs` — `storycraft_task_supervisor_ping` (version) + `storycraft_task_supervisor_submit` (taskType dispatcher; unknown/bad-payload → `{success:false,error}`, never a hard `Err`, matching the `RustTaskResultEvent` honest-failure contract). First native task `text.analyze` (word/char/sentence/syllable + Flesch Reading Ease, pure Rust, 8 `#[cfg(test)]` tests). TS front-end `services/rustTaskSupervisor.ts` `analyzeTextViaRust()` probes `isRustComputeAvailable()` before routing (Rust-only task never hits the web pool; null → JS fallback), 5 unit tests. Verified locally: biome + tsc + 5 TS tests ✅. +**Phase 3 delivered:** `src-tauri/src/commands/task_supervisor.rs` + `commands/mod.rs` — `worldscript_task_supervisor_ping` (version) + `worldscript_task_supervisor_submit` (taskType dispatcher; unknown/bad-payload → `{success:false,error}`, never a hard `Err`, matching the `RustTaskResultEvent` honest-failure contract). First native task `text.analyze` (word/char/sentence/syllable + Flesch Reading Ease, pure Rust, 8 `#[cfg(test)]` tests). TS front-end `services/rustTaskSupervisor.ts` `analyzeTextViaRust()` probes `isRustComputeAvailable()` before routing (Rust-only task never hits the web pool; null → JS fallback), 5 unit tests. Verified locally: biome + tsc + 5 TS tests ✅. **Verification method — Rust has no PR-CI gate.** `tauri-build.yml` runs only on `workflow_dispatch` / `v*` tags, and the crate cannot be compiled on the dev host. Verified by dispatching `tauri-build.yml` on the branch: the crate now **compiles clean** (`Finished release` in ~4m18s) and bundles **`.deb` / `.rpm` / `.AppImage`** on ubuntu. @@ -383,7 +383,7 @@ The P0/P1 tables above were authored against the pre-Phase-2.1 tree. A line-by-l ### Settings: New Danger Zone features - **Factory Reset** (`services/factoryResetService.ts`): wipes all IDB databases, localStorage, SW caches -- **Repeat Onboarding**: dispatches `storycraft:openPortal` event; `useApp.ts` listener re-opens WelcomePortal +- **Repeat Onboarding**: dispatches `worldscript:openPortal` event; `useApp.ts` listener re-opens WelcomePortal ### CI: Stabilization - `deploy-cloudflare-pages.yml` paused (manual trigger only) — eliminates phantom 0-job failures on branch pushes @@ -401,7 +401,7 @@ Three security findings identified and fixed in the same session: | ID | Severity | Finding | Fix | |----|----------|---------|-----| -| C1-F1 | **High** | PBKDF2 iterations = 100,000 — below OWASP 2024 minimum (600k for SHA-256); StoryCraft's own code uses 310k | Raised to 600,000 across all 5 KDF sites (`collab-transport/crypto.js`, `collaborationService.ts`, `storageEncryptionService.ts`, `cloudSyncEncryption.ts`, `libraryBackupService.ts`) | +| C1-F1 | **High** | PBKDF2 iterations = 100,000 — below OWASP 2024 minimum (600k for SHA-256); WorldScript's own code uses 310k | Raised to 600,000 across all 5 KDF sites (`collab-transport/crypto.js`, `collaborationService.ts`, `storageEncryptionService.ts`, `cloudSyncEncryption.ts`, `libraryBackupService.ts`) | | C1-F2 | **High** | `extractable: true` on the derived `CryptoKey` — violates SEC-RULE-5; allows key export via `crypto.subtle.exportKey()` | Changed to `extractable: false` | | C1-F3 | **Medium** | `promise.reject(...)` in decrypt() not `return`ed — error is swallowed, decrypt continues with garbage IV/ciphertext | Added `return` before the rejection | @@ -421,7 +421,7 @@ Three security findings identified and fixed in the same session: **B-2:** `services/voice/wasmSttEngine.ts` + `sileroVadEngine.ts` — Whisper tiny.en Q8 + Silero VAD scaffold via @xenova/transformers. Feature-flagged (`enableVoiceWasm`). -**B-3:** `packages/collab-transport` workspace package — vendor fork of y-webrtc 10.3.0 with StoryCraft RTCDataChannel E2E encryption patch baked in. Removes `patchedDependencies` re-apply burden. Biome alias + tsconfig paths wired. +**B-3:** `packages/collab-transport` workspace package — vendor fork of y-webrtc 10.3.0 with WorldScript RTCDataChannel E2E encryption patch baked in. Removes `patchedDependencies` re-apply burden. Biome alias + tsconfig paths wired. **B-4:** `tests/e2e/a11y-axe.spec.ts` — Playwright axe-core gate across 8 views. WCAG 2.2 AA. @@ -736,7 +736,7 @@ Three security findings identified and fixed in the same session: ### Sprint: v2.0 Phase 2 Completion (2026-05-23) -**LORA-1 complete:** LoRA adapter inference foundation — `services/loraAdapterService.ts` (IDB: `storycraft-lora-db`, stores `lora-meta` + `lora-blobs`); `components/settings/LoraAdapterSection.tsx` (file upload, adapter list, delete); `services/localAiFacade.ts` extended with `loraAdapterId` parameter; `enableLoraAdapters` feature flag. Full QNBS-v3 comment coverage. +**LORA-1 complete:** LoRA adapter inference foundation — `services/loraAdapterService.ts` (IDB: `worldscript-lora-db`, stores `lora-meta` + `lora-blobs`); `components/settings/LoraAdapterSection.tsx` (file upload, adapter list, delete); `services/localAiFacade.ts` extended with `loraAdapterId` parameter; `enableLoraAdapters` feature flag. Full QNBS-v3 comment coverage. **PLUGIN-1 complete:** Plugin system v0.1 — `PluginSandboxedApi` interface + `PluginPermission` typed union (`storage.read/write`, `ai.invoke`, `project.read/write`, `scene.read/write`); `pluginRegistry.execute()` builds permission-checking proxy before calling plugin callback; `components/settings/PluginsSection.tsx` (type badges, permission chips, uninstall); `enablePluginSystem` feature flag. Tests: `tests/unit/pluginRegistry.test.ts` extended with 8 `execute()` tests (deny/allow, error, log). @@ -864,7 +864,7 @@ Delivered: WorkerBus v2 (priority preemption, backpressure, transferables), GPU ### Released: v1.6.1 (2026-05-19, commit aa9f21c) -**AI model catalogue (Gemini 3.x):** Default model `gemini-2.5-flash` → `gemini-3.5-flash`. Added Gemini 3.1 Pro Preview, 3.1 Flash, 3.1 Flash-Lite. Removed legacy `gemini-2.0-flash`. All fallback IDs updated across `geminiService.ts`, `storyCraftCompletionFetch.ts`, `dbService.ts` migration, `AiSections.tsx`, `settingsSlice.ts`. +**AI model catalogue (Gemini 3.x):** Default model `gemini-2.5-flash` → `gemini-3.5-flash`. Added Gemini 3.1 Pro Preview, 3.1 Flash, 3.1 Flash-Lite. Removed legacy `gemini-2.0-flash`. All fallback IDs updated across `geminiService.ts`, `worldScriptCompletionFetch.ts`, `dbService.ts` migration, `AiSections.tsx`, `settingsSlice.ts`. **Docker:** Multi-stage `Dockerfile` (builder → nginx:1.27-alpine). `.dockerignore`. `docker.yml` GitHub Actions workflow (GHCR push on `v*` tags and `workflow_dispatch`). @@ -1145,8 +1145,8 @@ Aligned with the current toolchain and UX: **README** Documentation Hub lists ev ### Storage and integrity - Refactored IndexedDB backend into **dual DB topology**: - - `storycraft-state-db` for app/snapshot state - - `storycraft-data-db` for images, codex, rag vectors + - `worldscript-state-db` for app/snapshot state + - `worldscript-data-db` for images, codex, rag vectors - Added `visibilitychange` persistence flush in `index.tsx` to reduce hidden-tab data loss windows. ### AI, sync, and security @@ -1172,7 +1172,7 @@ Aligned with the current toolchain and UX: **README** Documentation Hub lists ev - **Socket.dev false positive — `json-schema@0.4.0` (2026-06-10):** Socket flagged this package as "90% likely obfuscated". Manual inspection confirms this is a **false positive**: the package ships two fully readable, well-commented files (`lib/validate.js` 271 lines, `lib/links.js` 64 lines) under AFL-2.1/BSD-3-Clause. It is a legitimate JSON Schema validator published in 2012 by Kris Zyp (Dojo Foundation), weekly downloads in the millions. `0.4.0` is the latest and only stable version (published 2021-11-09); `@ai-sdk/provider@3.0.10` (also latest) is the sole depender. No upgrade path exists. **Accepted as false positive.** To suppress on future PRs, use the Socket dashboard to set triage state to "acceptable risk" for `npm/json-schema@0.4.0`. - Local AI layers currently include placeholder fallback behavior; full WebLLM + Transformers runtime path should be completed in a dedicated performance validation cycle. -- ~~Dual-DB migration from legacy `storycraft-db`~~ **Resolved (2026-05-08):** idempotent migration `migrateLegacyStorycraftDbIfNeeded` in [`services/dbMigration.ts`](services/dbMigration.ts) runs from [`services/dbService.ts`](services/dbService.ts) `initDB()`; Vitest fixtures in [`tests/unit/dbMigration.test.ts`](tests/unit/dbMigration.test.ts) (`fake-indexeddb`) copy legacy stores (`app-data-store`, `snapshots-store`, `images-store`, `rag-vectors-store`, `codex-store`) into `storycraft-state-db` / `storycraft-data-db` when the legacy DB exists and dual DBs are empty. +- ~~Dual-DB migration from legacy `worldscript-db`~~ **Resolved (2026-05-08):** idempotent migration `migrateLegacyWorldscriptDbIfNeeded` in [`services/dbMigration.ts`](services/dbMigration.ts) runs from [`services/dbService.ts`](services/dbService.ts) `initDB()`; Vitest fixtures in [`tests/unit/dbMigration.test.ts`](tests/unit/dbMigration.test.ts) (`fake-indexeddb`) copy legacy stores (`app-data-store`, `snapshots-store`, `images-store`, `rag-vectors-store`, `codex-store`) into `worldscript-state-db` / `worldscript-data-db` when the legacy DB exists and dual DBs are empty. - CI mutation stage runs [`stryker.conf.json`](stryker.conf.json) against focused targets (`services/codexService.ts`, `services/dbMigration.ts`); tune thresholds as coverage grows. - **Automated accessibility:** Playwright + `@axe-core/playwright` smoke test ([`tests/e2e/a11y.spec.ts`](tests/e2e/a11y.spec.ts)) gates serious/critical axe violations on load (color-contrast disabled in CI for theme-variable variance); manual WCAG/sr verification remains recommended for releases. @@ -1239,7 +1239,7 @@ The bullet list below described **pre-v1.2** gaps between `fileSystemService.ts` ## Executive Summary -StoryCraft Studio is a well-architected React 19 + Redux Toolkit PWA with strong TypeScript enforcement, excellent i18n, and sophisticated offline-first data management. The codebase demonstrates mature React patterns and thoughtful accessibility support. Main improvement areas are **test coverage**, **AI request lifecycle management**, and **desktop (Tauri) security hardening**. +WorldScript Studio is a well-architected React 19 + Redux Toolkit PWA with strong TypeScript enforcement, excellent i18n, and sophisticated offline-first data management. The codebase demonstrates mature React patterns and thoughtful accessibility support. Main improvement areas are **test coverage**, **AI request lifecycle management**, and **desktop (Tauri) security hardening**. ### Scorecard @@ -1272,7 +1272,7 @@ StoryCraft Studio is a well-architected React 19 + Redux Toolkit PWA with strong **File:** `src-tauri/tauri.conf.json` **Issue:** `"security": { "csp": null }` — the desktop app has no Content Security Policy. -**Resolution:** Set comprehensive CSP string including `connect-src` for Gemini API + WebRTC signaling. Identifier fixed to `com.storycraft.studio`, version synced to `1.0.0`. Capabilities narrowed to granular permissions. +**Resolution:** Set comprehensive CSP string including `connect-src` for Gemini API + WebRTC signaling. Identifier fixed to `com.worldscript.studio`, version synced to `1.0.0`. Capabilities narrowed to granular permissions. ### 3. ~~No Request Cancellation for AI Thunks~~ ✅ FIXED @@ -1336,8 +1336,8 @@ StoryCraft Studio is a well-architected React 19 + Redux Toolkit PWA with strong ### 13. ~~Version Mismatch: Tauri vs npm~~ ✅ FIXED **Files:** `src-tauri/tauri.conf.json`, `package.json` -**Issue:** Tauri had version `1.0.0`, package.json `1.1.1`. `frontendDist` pointed to `../build` instead of `../dist` (Vite default output). Window title was lowercase `storycraft-studio`. -**Resolution:** Aligned version to `1.1.1`, fixed `frontendDist` to `../dist`, set proper product name and window title to `StoryCraft Studio`, improved window defaults (1280×800, centered, min size constraints). Narrowed CSP `connect-src` by removing overly broad `https://*.googleapis.com` wildcard. +**Issue:** Tauri had version `1.0.0`, package.json `1.1.1`. `frontendDist` pointed to `../build` instead of `../dist` (Vite default output). Window title was lowercase `worldscript-studio`. +**Resolution:** Aligned version to `1.1.1`, fixed `frontendDist` to `../dist`, set proper product name and window title to `WorldScript Studio`, improved window defaults (1280×800, centered, min size constraints). Narrowed CSP `connect-src` by removing overly broad `https://*.googleapis.com` wildcard. **Effort:** Low | **Priority:** Low ### 15. ~~No Performance Budgets~~ ✅ FIXED @@ -1375,8 +1375,8 @@ StoryCraft Studio is a well-architected React 19 + Redux Toolkit PWA with strong ### 20. FOUC Theme Initialization ✅ FIXED (v1.1.2) **File:** `features/settings/settingsSlice.ts`, `index.html` -**Issue:** `applyInitialTheme()` read `localStorage.getItem('storycraft-state')` — a key never written in production (only in tests). `JSON.parse` had no try/catch. Result: flash of wrong theme on every page load. -**Resolution:** Added inline `