Skip to content

docs(rfc): propose Tauri desktop control center - #1455

Open
knqiufan wants to merge 11 commits into
oceanbase:masterfrom
knqiufan:codex/rfc-desktop-control-center
Open

knqiufan wants to merge 11 commits into
oceanbase:masterfrom
knqiufan:codex/rfc-desktop-control-center

Conversation

@knqiufan

@knqiufan knqiufan commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Which issue or RFC does this PR close?

Refs #1428. This design proposal and delivery plan do not close the issue; closure requires the complete installed-product journey on one qualified platform.

Rationale for this change

PowerContext needs a desktop control center for connections, local setup, context assets, Review and supported Handoff workflows. The desktop must use public Server contracts while keeping the Python Server independent of the desktop lifecycle.

The proposal uses Tauri 2, a bundled React + TypeScript client built by Vite, and a constrained Rust host. It shares suitable presentation resources with the personal Dashboard and keeps a separate client management entry. Source facts are pinned to upstream 62e4c821709c18b832c77363fdd428765bee6a96; release compatibility requires separate qualification.

What changes are included in this PR?

  • Add synchronized English and Chinese RFCs following the repository template. Guide-level examples explain connecting, selecting a Scope, managing context, reviewing proposals, following Handoffs, interpreting notifications, switching connections and recovering safely.
  • Define the architecture and contracts supporting those examples: typed IPC, public API access, identity isolation, compatibility, authorization, independent service ownership, deterministic import, updates and data-preserving removal.
  • Preserve mappings to 52 existing public operation IDs, including typed Profile Review, read-only Topic Memory and conditional tag updates. Complete Memory browsing/history depends on bounded Server queries.
  • Specify bounded background work, truthful incomplete-scan counts and private notifications. Client polling, jitter, retention, timeout and capacity values are selected through implementation and measurement. Existing Server pagination limits remain explicit.
  • Add separate bilingual delivery plans with producer coordination, P0–P6 phases, owners, 26 acceptance criteria, qualification evidence and tuning measurements, linked from the RFCs and development navigation.
  • Make macOS native-service CI compile installed bytecode before the bounded lifecycle startup check. Preserve a short sample of the test service process on startup failure, with regression coverage for retaining that evidence after cleanup. This addresses cold import/compilation observed in the failing LaunchAgent job without increasing the startup timeout or skipping tests.

Are there any user-facing changes?

The product changes are documentation only; runtime behavior, OpenAPI, dependencies and persisted formats are unchanged. CI installation and failure diagnostics also receive the scoped changes described above. The proposed first target is Windows 11 x64 with SQLite. A clearly limited connect-only preview may precede managed installation and durable delivery. Proposed producer interfaces are identified as dependencies, not existing capabilities.

How was this change tested?

All 21 PR checks passed on f890f13115d16dd12972d215b271dd6d702b201a, including native services, the Python matrix, quality and website checks, and SQLite/OceanBase acceptance. The macOS job compiled 8,794 files during installation and completed its lifecycle suite with 5 passed and the existing Windows-only case skipped, without changing the service startup deadline.

Passed locally:

  • pnpm --dir website install --frozen-lockfile and pnpm --dir website lint.
  • MDX/GFM compilation of both RFCs and both delivery plans.
  • Documentation checks for UTF-8/LF, frontmatter, local link targets, navigation, RFC template structure, all 52 operation mappings against OpenAPI, and matching bilingual reference sections, dependency/phase IDs and 26 acceptance IDs.
  • Non-type pre-commit hooks via SKIP=ty-check uv run --locked --no-sync prek run -a.
  • git diff --check and git diff --cached --check.
  • pytest -q tests/test_native_service_diagnostics.py tests/test_workflow_actions.py: 12 passed; changed workflow and tests also pass YAML, Ruff and whitespace hooks.

Local full-check limitations on Windows, not counted as passes:

  • uv run --locked prek run -a: the type hook reports seven existing diagnostics in processing workers/tests (Connection versus PipeConnection, and POSIX-only os.WNOHANG). No runtime files are changed by this PR.
  • pnpm --dir website build: generation completes, but the site-wide link validator fails across existing pages on this Windows checkout. Local link targets in the four affected documents were independently verified; the full website build is not claimed as passing.

AI usage statement

OpenAI Codex assisted with repository and review research, RFC design, English/Chinese documentation, validation and PR preparation.

@knqiufan

knqiufan commented Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

rfc 内容总结:
desktop 的目的是:一个用来安装、连接、查看和管理 PowerContext 的桌面控制台。
用户可以通过它了解本地服务是否正常、Agent 是否接入正确范围,浏览记忆和其他资产,审核候选内容,导入文本,并逐步获得本地安装升级和交接收件箱能力。
技术上计划使用 Tauri 2 + React + TypeScript + Vite。

功能点包括:

功能点 RFC 中的情况 实际含义与限制
查看服务与使用情况总览 已纳入 集中展示当前连接、身份、服务健康、可用功能、待办和恢复入口
检查 Server 是否安装、启动 已纳入 区分未安装、未运行、端口占用、配置过期、服务异常等状态
一键安装本地 Server 已纳入,依赖安装器 目标是在没有预装 Python 的电脑上完成安装;安装器未完成时,只提供连接已有服务的预览
一键启动、停止、重启 Server 已纳入,依赖服务接口 只管理确认归属的本地服务;当前服务层尚缺正式的 start/stop/restart 接口
设置登录后自动启动 已纳入 桌面应用和 Server 的登录启动分别设置
关闭桌面后 Server 继续工作 已纳入 Server 独立运行,关闭或退出桌面不会中断 Agent 使用 Server
本地 Server 在线升级 已纳入,依赖安装器 下载并校验版本、升级、验证健康;可能需要暂停服务,不承诺无中断升级
桌面应用自身升级 已纳入 与 Python Server 升级分别处理;应用退出安装前要保存必要的恢复状态
升级失败恢复与数据迁移 已纳入,依赖相关接口 记录各组件状态,支持恢复;数据格式已变化时,不能简单退回不兼容的旧程序
一键 setup 不同 Agent 插件 已纳入,依赖安装与分发接口 用户选择受支持的 Agent,由对应适配器安装和合并配置;不是任意插件市场,也不承诺所有 Agent
检查 Agent 是否安装、加载、可用 已纳入 分别检查安装、宿主加载、连接及实际保存/召回情况;未验证的状态明确显示未验证
检查 Agent 是否使用正确 Scope 已纳入 检查已知集成绑定和实际解析结果;不自动发现所有运行中的 Agent
浏览、选择 Scope 已纳入 查看有权限的范围及组织关系;切换浏览范围不会自动修改 Agent 的保存位置
创建、修改 Scope 和 Agent 绑定 已纳入 通过公开接口创建/修改 Scope、设置/清除受支持绑定;遵守权限和版本检查
添加、保存、切换 Server 连接 已纳入 保存多个地址、名称和凭据引用;每个窗口只有一个活动连接
连接 HTTP/HTTPS Server 已纳入,有范围限制 本机回环地址允许 HTTP;远程首版仅支持 HTTPS,不支持远程明文 HTTP
自定义 CA 与连接证书校验 已纳入 可以显式配置连接所信任的 CA;不提供“忽略证书错误”作为替代方案
可视化修改 Server 地址、端口并重启 部分纳入,细节待补 本地配置应用和重启已有方向,但具体可编辑字段、端口变更和重连流程尚未完整列出
同时创建和管理多个本地 Server 实例 首版未纳入 首版复用唯一用户级本地服务;多个连接配置不等于多个受管服务实例
可视化添加、修改 PowerContext 配置 部分纳入,配置清单待补 有校验、应用和恢复机制,但尚未明确哪些模型、Embedding、存储及处理参数必须提供表单
凭据保存、更换与认证状态查看 已纳入 使用系统凭据库,支持配置和轮换 token;切换服务地址时不会自动沿用旧凭据
企业 SSO、浏览器登录、代理连接 首版未纳入 首版以直连 HTTPS 和受支持的 Bearer 凭据为主
Memory 浏览、搜索、详情 已纳入 查看记忆正文和精确引用;完整大规模目录需要先补服务端分页
手动保存、修改、退役 Memory 已纳入 可通过界面管理记忆;修改时处理版本冲突,避免覆盖别人刚完成的修改
Memory 历史与变更查看 已纳入,依赖分页接口 历史查询能够限制返回量后才开放,不能把一次返回全部数据伪装成分页
Experience 浏览与来源核对 已纳入 查看经验、适用情境、依据及关联材料
Skill 浏览、生命周期管理、下载与发布 已纳入 使用公开接口管理,发布仅面向受支持目标;下载 Skill 不会自动执行它
Profile 查看与审核 已纳入 按 Profile 的实际结构展示和审核,不能当成普通 Skill 处理
Topic Memory 浏览、搜索与详情 已纳入,只读 查看主题记忆和版本;首版不提供手工通用写入或强制处理操作
标签查看与修改 已纳入 管理受支持资产及记忆条目的标签,保留并发检查
待审核列表与在线审核 已纳入 支持 Experience、Skill、Profile 的查看、批准、拒绝和修订;拒绝需要理由
Handoff 记录与报告查看 已纳入 查看工作目标、进展、下一步和精确版本;首版不提供 Handoff 编辑器
查看获授权的共享内容 已纳入 查看当前身份有权访问的具体资源;能访问某条交接不代表能浏览整个 Scope
查看 Handoff 接收目标和投递收件箱 已纳入,依赖投递接口 “发到哪里”指交给哪个已关联接收目标,以及对应投递记录;不是查看文件保存位置
Handoff 接收确认与结果记录 已纳入,依赖接收流程 只有具备实际接收方信息和权限的流程才允许操作;打开页面不等于确认接手
粘贴文本、导入文本文件 已纳入 首版支持文本和 UTF-8 文件,有大小限制及明确的重复导入规则;不自动同步整个目录
Source 浏览及处理状态说明 已纳入 查看输入材料和受支持状态;导入成功不代表后续记忆提取已经完成
连接器管理 仅部分纳入 可以展示已支持的事实;启动、重试等管理操作需要额外接口,首版没有连接器市场
用量统计 已纳入,页面对齐待细化 可以展示公开统计;现有 Dashboard 的每日图表和明细尚未逐项列为必须对齐的验收要求
Prompt 查看 部分纳入 允许安全且受支持的元数据/详情,但没有明确完整覆盖 Dashboard 现有的提示词配置查看页
Prompt 编辑、Dream 管理 首版明确排除 不提供专门的提示词编辑和 Dream 管理界面
完整覆盖现有 Dashboard 功能 尚未完整承诺 核心阅读能力大多覆盖,但缺少逐页对齐清单,尤其是 Prompt 查看和详细统计展示
系统通知与托盘 已纳入 提醒当前连接、当前精确 Scope 内的审核事项,以及后续投递待办;退出桌面后停止通知
网络断开与离线处理 已纳入受限行为 提示断连,恢复后重新核验;不建立持久离线写入队列,不承诺离线查看远程内容
诊断与问题导出 已纳入 展示安全的状态和错误信息,允许预览并导出脱敏诊断
卸载桌面或本地服务 已纳入 分开处理,默认保留业务数据和仍被其他组件使用的环境,不误删用户配置
中英文、主题与无障碍 已纳入 支持语言/主题切换、键盘操作、屏幕阅读器、高对比度及缩放
多操作系统支持 分阶段纳入 建议先验收 Windows 11 x64 + SQLite,macOS/Linux 后续分别验收
团队成员、角色管理 首版明确排除 桌面遵守 Server 权限,但不提供完整成员与角色管理后台

可能需要讨论确定的事项:

  • 先完成支持哪个系统、哪个 Agent?rfc 中优先 windows
  • 需要和现有 Dashboard 共用界面吗?rfc 中桌面界面独立实现,server 资源共享
  • 第一版做到什么程度?rfc 中建议先支持连接已有 Server,后续再补安装和投递等
  • 兼容 Server 版本要怎么做?感觉需要明确升级、恢复、克隆后如何识别同一个服务

@PsiACE PsiACE left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep the RFC focused on the user model and architectural contracts, following the existing RFC example.

P2 expansion. Include empty/multi-page, model-free/configured cases. D7 owns the published budget; there is no current
performance claim. Transport/notification operating caps do not replace measurements.

## 17. Delivery phases

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please follow the structure in our existing RFC example, especially the Guide-level and Reference-level explanations. Explain the user model through examples, then define the architecture and contracts supporting those examples.

RFC
+-- Guide:     connect -> choose Scope -> manage context
`-- Reference: UI -> typed IPC -> Rust -> public API -> Server

#1428 / delivery plan
`-- Implementation phases, task owners, acceptance matrix and evidence

Keep observable guarantees in the RFC, such as the Server continuing to run after the desktop closes. Move the full implementation and acceptance plan out so it can evolve independently.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the guidance. Updated in d2734e3, with both language versions following the RFC template.

The Guide-level section now walks through connecting, choosing a Scope, managing context, reviewing a proposal, interpreting incomplete notification scans, and switching/recovering connections. The Reference-level section connects those examples to the UI → typed IPC → Rust → public API → Server boundary and its contracts.

The implementation phases, owner assignments, acceptance matrix and qualification evidence now live in a separate delivery plan, linked from the RFC and tracked under #1428. Observable guarantees, including the Server continuing after the desktop exits, remain in the RFC.

I would appreciate another look when convenient.

Comment on lines +372 to +375
Initial Review limits: one request at a time, at most 100 Candidates/page, five page requests/minute, 60-second polling
with up to 20% jitter. Continue bounded paging without treating its cursor as an event cursor. Discard a traversal that
cannot finish within five minutes, refresh and report partial coverage. Complete global counts/history need another
Server contract; this background limit does not prevent explicit paged Review navigation.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please avoid committing to implementation details too early. Define the required behavior and tradeoffs first, then establish tuning values through implementation and measurement.

RFC:            bounded polling, accurate counts, private notifications
Implementation: polling interval, page size, jitter, retention settings
Validation:     behavior tests, regression tests, measurements

For example, explain how incomplete scans affect displayed counts without fixing a 60-second interval or 20% jitter yet. Keep a specific value in the RFC only when it is essential to the contract.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you; agreed that the RFC should establish behavior and tradeoffs before tuning values. Addressed in d2734e3 in both languages.

Removed the fixed polling interval, jitter, request rate, scan expiry, backoff and notification retention/capacity values. The delivery plan now records the implementation measurements needed to select them. The RFC retains bounded work, truthful coverage/counts, deduplication and private notifications.

The incomplete-scan example explicitly labels counts as observed and never treats unread pages as zero. It also explains that finishing a traversal does not establish an exact current total without a Server snapshot/count contract. The existing API limit of 100 Candidates per page remains documented as a Server constraint, not a chosen desktop page size.

The four documents pass MDX/GFM compilation and targeted documentation checks. The PR description records the existing Windows type-check and site-wide link-validation limitations separately.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants