## Description
<!-- Please insert your description here and especially provide info
about the "what" this PR is solving -->
当首次启动桌面版，初始化选择 “OpenAI 兼容” provider 的时候，会出现输入了我自己的 base url 和 api key
之后，无论是否勾选允许向第一个模型发送请求来探测可用性，都会提示 找不到可用模型 的情况，但是实际上 apikey 和 base url
都没有问题，而且也正常发送了获取模型列表的 hello 的请求。返回后填写的内容被重置
问题出在 onbording 保存配置的时候，写入写到了 computed 的临时对象上，而且桌面版配置向导的独立窗口
`synced-leader` 为 false
## Linked Issues
<!-- Optional, if you have any -->
看起来暂时没人提
## Additional Context
<!-- e.g. is there anything you'd like reviewers to focus on? -->
AIRI desktop could load Extensions that were already present on disk,
but users could not safely add an Extension folder. This PR completes
Extension Manifest v2 and adds a review-first folder import flow. An
imported Extension remains disabled and unloaded until the user
explicitly enables and loads it.
The design was informed by the incomplete `claude-code-plugin`
experiment and the Agent Activity Extension work tracked in #2507.
## User flow
1. Select an Extension folder in Plugin Host Devtools.
2. Review its identity, version, runtime, entrypoints, permissions, Kit
declarations, file count, and total size.
3. Confirm the import.
4. Enable and load the Extension when it is ready to run.
5. Disable and unload it to stop its runtime session.
## What changed
### Extension Manifest v2
- Add a strict schema for identity, version, AIRI compatibility,
runtimes, entrypoints, permissions, and Kit declarations.
- Reject unknown fields, duplicate runtime or Kit declarations, unsafe
Extension ids, missing entrypoints, and invalid semantic versions.
- Check `engines.airi` and the current runtime before importing an
Extension entrypoint.
- Keep Plugin Host transfer types in the runtime-neutral
`@proj-airi/stage-shared/plugin-host` boundary.
### Folder import
- Add separate prepare and commit steps so package code cannot run
during review.
- Bind the reviewed manifest to a package fingerprint and revalidate the
source before and after copying it.
- Reject symbolic links, absolute entrypoints, entrypoints outside the
package, duplicate Extension ids, and source changes after review.
- Limit packages to 10,000 entries and 512 MiB and manifests to 1 MiB.
Hash and copy file data with streams.
- Copy into `.imports` staging and publish the package with an atomic
rename.
- Record the validated committed entry directly in the registry after a
successful import.
- Retain the macOS security-scoped bookmark from folder selection
through commit.
- Wait for an active import during Host shutdown so no managed-directory
write outlives the Host.
### Desktop controls
- Add Devtools actions for importing an Extension folder.
- Add combined **Enable and load** and **Disable and unload** actions
that model real user behavior.
- Add English and Simplified Chinese strings for the new controls and
import review.
## Scope
This PR defines Kit declarations as manifest data. Extension-hosted Kit
routing, Provider and Consumer lifecycle, revocable clients, and
dependency activation order are isolated in draft PR #2549.
## Verification
- GitHub CI passed: unit tests, type checks, lint, provenance checks,
and all configured builds.
- Focused Plugin SDK core, directory importer, and Electron Plugin Host
tests: 86 passed.
- Stage UI Plugin Host store tests: 8 passed.
- `pnpm typecheck`: 52 workspace tasks passed.
- `pnpm lint`: passed with 646 existing repository warnings and no
errors.
- `sem diff --staged --no-cosmetics -v --file-exts .ts .tsx`: the final
shutdown batch analyzed 113 entities; its JSON report contained no
diagnostics.
- The importer shutdown regression failed before the fix and passed
after it.
## Visual change
| Before | After |
|---|---|
| Extension folder import was unavailable. | 
|
Payment completed and Flux was credited, but returning from Stripe
showed `ERR_FAILED`. Edge reported that the service worker replayed a
redirected response for a navigation request. Cloudflare redirects
`/index.html` to `/`.
Precache the canonical root URL and use it as the navigation fallback.
The new cache key also avoids reusing the old redirected app shell.
Validation: generated a service worker with the installed Workbox
version and verified both its precache entry and navigation handler use
`./`; ESLint passed. Production payment credited 500 Flux, and bypassing
the service worker restored the page. Normal-cache production
verification follows deployment.
## Why
Stripe checkout used Stripe-only tables. This extracts a shared payment
CORE. New checkout writes `payment_order`. Old Stripe tables stay so
in-progress Sessions can still settle.
This PR is [1/2]. [#2368](https://github.com/moeru-ai/airi/pull/2368) is
[2/2]. That PR archives leftover Stripe tables after in-progress
Sessions finish or expire.
## Changes
- Add `payment_order` and `provider_account`.
- Copy `stripe_checkout_session` into `payment_order`.
- Copy `stripe_customer` into `provider_account`.
- Keep `stripe_*` tables and `user_flux.stripe_customer_id`.
- New checkout writes `payment_order` and stores
`metadata.payment_order_id`.
- Webhook resolves new Sessions by `metadata.payment_order_id`.
- Webhook resolves older Sessions by `provider_order_id`, then by a
leftover `stripe_checkout_session` row.
- That leftover-row lookup covers Sessions opened before this deploy,
and rows written while 0023 runs.
[#2368](https://github.com/moeru-ai/airi/pull/2368) deletes it after
those Sessions finish or expire.
## Test plan
- [x] `pnpm exec vitest run
server/apps/api/src/services/domain/payment/tests/payment.test.ts
server/apps/api/src/routes/stripe`
- [x] `pnpm -F @proj-airi/api-server typecheck`
- [x] `git diff --check`
## Visual changes
No user-visible changes.
## Open: settle after account deletion
Account deletion stamps `payment_order.deletedAt`. A Checkout Session
that is still open can still pay after that stamp. This PR keeps `main`
behavior. `settle` loads the row by id, including a soft-deleted row,
then marks it `paid` and credits Flux.
Follow-up policy: if `deletedAt` is set, skip. Do not update the archive
row. Do not credit Flux. Do not insert a live `provider_account`. Stripe
remains the payment record. Skip matches the soft-delete rule: a deleted
row is gone, not write it again.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: RainbowBird <git@luoling.moe>
# Refactor: Move Provider Tests to provider-inference
## Summary
Move azure-openai and openrouter-ai provider tests from `stage-ui` to
`provider-inference` package, placing them closer to their
implementations.
## Changes
- **Moved test files**:
-
`packages/stage-ui/src/libs/providers/providers/azure-openai/index.test.ts`
→
`packages/provider-inference/src/providers/cloud/azure-openai/index.test.ts`
-
`packages/stage-ui/src/libs/providers/providers/openrouter-ai/index.test.ts`
→
`packages/provider-inference/src/providers/cloud/openrouter-ai/index.test.ts`
- **Simplified test imports**: Updated tests to use direct provider
definitions instead of `getDefinedProvider()`, removing unnecessary
lookup logic
- **Added dependency**: `@proj-airi/core-agent` as devDependency for
test utilities
## Benefits
1. Tests are co-located with their implementations
2. Direct imports are simpler and more maintainable
3. Better package organization following module boundaries
## Verification
```bash
# Run tests for provider-inference
pnpm -F @proj-airi/provider-inference exec vitest run
# Typecheck
pnpm -F @proj-airi/provider-inference typecheck
```
## Test Results
All tests pass after the refactoring.
## Summary
- Auth and API origin policy now trusts `*.moeru-ai.workers.dev`.
- The retired `*.kwaa.workers.dev` suffix is removed. Server-dev
stage-web previews on the moeru-ai Cloudflare account can complete OIDC
login.
## Test plan
- [x] `pnpm exec vitest run server/apps/auth/src/tests/auth.test.ts
server/apps/auth/src/tests/origin.test.ts
server/apps/api/src/utils/tests/origin.test.ts`
- [ ] After deploy, sign in from
https://server-dev-moeru-ai-airi.moeru-ai.workers.dev and confirm
`/auth/callback` is accepted.
## Visual changes
No user-visible changes.
Made with [Cursor](https://cursor.com)
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary
The desktop browser suite can mount `InteractiveArea` before its utility
styles settle, then scroll history while the reply composer is still
expanding. A pending Virtua tail scroll can replace the message that the
test selected and make the scrollport assertion fail.
This addresses the pre-existing browser-test failure reported during
#2506 ([CI
failure](https://github.com/moeru-ai/airi/actions/runs/34448585692/job/102804067154)).
- Scan desktop and shared Vue components before the initial test
stylesheet is served. Load the desktop UnoCSS config explicitly so
config discovery does not replace the scan.
- Give each fixture a window-sized host, reset the viewport, and dispose
the component, host, and Pinia after each test.
- Wait for the reply transition and virtual-list measurements to settle
before scrolling. Cover both 200 ms and 1 s transitions, and assert the
requested scroll position throughout the existing message-mount checks.
Only browser tests and their configuration change.
## Validation
The complete desktop browser suite passed with three shuffled seeds: **6
files, 65 tests per run**, with no skipped tests.
```sh
for seed in 2508 2506 2507; do
npm_config_registry=https://registry.npmjs.org/ NODE_OPTIONS=--no-experimental-webstorage \
pnpm exec vitest run --config apps/stage-tamagotchi/vitest.config.ts \
--project browser --sequence.shuffle --sequence.seed="$seed" --bail=1
done
npm_config_registry=https://registry.npmjs.org/ pnpm run typecheck
npm_config_registry=https://registry.npmjs.org/ pnpm run lint
git diff --check
```
Typecheck passed all 52 tasks. Lint passed with existing repository
warnings. ResizeObserver loop warnings remain visible; this change does
not suppress them. Linux CI validation is pending.
RainbowBird