# 2026-07-07 M4C-EDC-03

## 用户目标

处理 MEXP15 fresh-machine sidebar bootstrap blocker 的 m4c/sidebar 侧问题：Mindraw App 未手动启动时，Codex sidebar 显示 `MINDRAW_PREVIEW_SOURCE_REQUIRED` / `MINDRAW_OPEN_PACKAGE_API_REQUIRED`，点击 Edit 不能启动 Mindraw App。范围限定 m4c Codex plugin/sidebar，不改 Mindraw App source、Tauri config、signing、packaging、release metadata，也不实现任意 target-link entry。

## 已完成事项

- 确认 m4c 侧根因：`/api/open-edit` 只依赖 `mindraw.app.open_package` capability；fresh machine 上 runtime capability file 不存在时直接返回 `MINDRAW_OPEN_PACKAGE_API_REQUIRED`，没有对已有 latest-created `.mindraw` package 做启动 fallback。
- 在 canonical source `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin` 做最小修复：
  - `openCanvasInMindraw` 优先走 `mindraw.app.open_package`。
  - 当 capability file、`openPackage` capability、health 或 runtime transport 不可用时，在 macOS 上对同一个 latest-created package 尝试 LaunchServices fallback：bundle id `com.mindraw.desktop`，app name `Mindraw`，package association。
  - preview fail-closed 行为保持不变。
- 增加 HTTP smoke 回归用例：已有 latest-created `.mindraw` + missing capability file + `/api/open-edit` 返回 `opened=true`、`fallbackUsed=true`、method `macos.open.bundle`。
- manifest cachebuster 从 `0.1.0+codex.20260704090518` 提升到 `0.1.1+codex.20260707231339`。
- 同步 installed cache：`/Users/ar/.codex/plugins/cache/personal/mindraw/0.1.1+codex.20260707231339`。
- 生成 MEXP15 plugin candidate：
  `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839/`
- 回写过程报告、JSON 摘要、review request、P2 INDEX、P2 CODEGRAPH、根 INDEX、统一台账 Progress Log 和 PMO_INBOX。

## 核心事实 / 变更快照

- 变更对象：Mindraw Codex plugin sidebar edit/open handoff。
- 变更前：Edit / double-click 需要 `mindraw.app.open_package` capability；runtime capability file 不存在时返回 `MINDRAW_OPEN_PACKAGE_API_REQUIRED`。
- 变更后：Edit / double-click 仍优先使用 `mindraw.app.open_package`；capability/API 不可用时在 macOS 对同一 latest-created `.mindraw` package 走 LaunchServices fallback。
- 范围边界：latest-created project canvas only；不创建 canvas package fallback；不写 `.mindraw` internals；不实现 `mindraw://...documentId...elementId...` target-link entry。
- Review Gate：`crg-eda4493ea1b8` pending review。
- Candidate tarball SHA256：`9c196fdea953f316619ee321897e1ac4d2c4b030ef017737fc3597acd226d3ee`。
- Source / packaged relative tree list SHA256：`270cf4df0ceb80ff988db9e83956b6898003d2081a0f0e3b69cb52f941733a03`。

## 文件变更

- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/lib/project-canvas.mjs`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/README.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/skills/mindraw-open-canvas/SKILL.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/.codex-plugin/plugin.json`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-sidebar-bootstrap-fallback-check-20260707.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-sidebar-bootstrap-fallback-check-20260707.json`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/02-P/MEXP15-SignedNotarizedDMG/m4c-edc-03-review-request-crg-eda4493ea1b8.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/CODEGRAPH.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/INDEX.md`
- `/Users/ar/Projects/Mindraw/INDEX.md`
- `/Users/ar/Projects/Mindraw/02-P/plan-progress.markdown`
- `/Users/ar/Projects/Mindraw/02-P/PMO_INBOX.md`
- `/Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C2.builds/MEXP15-SignedNotarizedDMG/mindraw-plugin-0.1.1+codex.20260707231339-M4C-EDC-03-20260707231839/`

## 验证证据

- Source / installed / packaged validator passed。
- Source / installed / packaged `npm run check` passed。
- Source / installed / packaged smoke、HTTP smoke、lifecycle smoke、MCP smoke、Playwright sidebar smoke 均 `ok=true`。
- HTTP smoke 覆盖 missing capability file + `/api/open-edit` fallback。
- Tarball list / extract / validator / `npm run check` passed。
- Skill directory SkillSpector：`SAFE`，score `0`。
- Plugin root SkillSpector：`CAUTION`，score `21`，TM1 at `scripts/mindraw-canvas-service.mjs:4`，需 review gate 接受。
- Sensitive scan：private-key / GitHub / AWS / OpenAI-style key pattern 无匹配。

## 可复用命令 / Runbook

用途：复跑 M4C-EDC-03 source / installed / packaged fallback 验证。

前置条件：已安装 Codex runtime node modules；Playwright headless shell 如缺失，可用 `playwright install chromium` 一次性安装到本机缓存。

```bash
npm run --prefix /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin check
node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-http --report /tmp/m4c-edc-03-source-http.json
PLAYWRIGHT_NODE_MODULES=/Users/ar/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/node_modules node /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin/scripts/mindraw-canvas-service.mjs smoke-sidebar --report /tmp/m4c-edc-03-source-sidebar.json --out /tmp/m4c-edc-03-source-sidebar
codex plugin add mindraw@personal --json
diff -qr /Users/ar/Projects/Mindraw/P2.mindrawforcodex/03-O/C1.source/mindraw-plugin /Users/ar/.codex/plugins/cache/personal/mindraw/0.1.1+codex.20260707231339
```

清理 / 恢复：如需回到 personal source-backed plugin，执行：

```bash
codex plugin add mindraw@personal
codex plugin list
```

搜索关键词：`M4C-EDC-03`、`MINDRAW_OPEN_PACKAGE_API_REQUIRED`、`macos.open.bundle`、`0.1.1+codex.20260707231339`、`crg-eda4493ea1b8`。

## 未决问题

- `crg-eda4493ea1b8` 需要代码审核员回写 PASS / CHANGES_REQUESTED / BLOCKED。
- Owner fresh-machine 还未用新 plugin version 复测。
- 如果 LaunchServices 三种方式都失败，sidebar 仍会返回 `MINDRAW_OPEN_PACKAGE_API_REQUIRED`。
- 如果没有 latest-created `.mindraw` package 且 App capability 不可用，m4c 仍不能创建 package。