生产者本机足迹查看器 + 逐条排除/撤回/个人脱敏词表#5
Merged
Merged
Conversation
降低被动入库者的「被监视感」，让全队愿意全员开。设计见 docs/PRODUCER_FOOTPRINT.md。
M1 地基 + 只读足迹：
- core/ledger.mjs 结果账本：记每条 session 最终结果(uploaded/skipped+原因/opted_out)
+ 服务端坐标；client/sync.mjs 在 4 条采集路径的终态写账本（不改上传行为）。
- client/viewer.mjs 常驻内嵌的 127.0.0.1 只读查看器（Node 原生 http、本地 token、仅
loopback），用与服务端同款 core 函数本地投影出「脱敏后」正文（与库里一字不差）+ 本机
原文对比；启动时从 .brain-state.json 回填历史。
- web/viewer.{html,js} 前端（默认英文、可切中文；活动日志隐藏空转 tick）。
- brain viewer 命令 + brain status 显示地址。
M2 控制：
- core/optout.mjs 逐条排除：上传前闸门拦截，与 viewer 同进程即时生效。
- server/retract.mjs + POST /retract 撤回：只能撤自己 producer-id，git rm + commit。
- core/userredact.mjs 个人脱敏词表：上传前在内置脱敏后再抹，带本机命中计数。
- 配置可视化编辑 + dry-run 差量。
全套 144 测试通过。
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
之前装机包只打 core/client/mcp/cli，没带 web/ → 真实安装上 viewer 页面会 404。 现补带 web/viewer.html + web/viewer.js（~44K，CSS 已内联、无外链字体）； 明确不带 web/fonts、web/app.*（线上服务端查看器，server-only），装机包不变肥。 客户端依赖仍是 3 个（mcp-sdk/yaml/zod），新代码零新增依赖。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
FakeHank
added a commit
that referenced
this pull request
Jun 25, 2026
#5 合并时漏了升版本号；不升的话已在 0.1.18 的客户端不会触发自动更新、拿不到 本机查看器(brain viewer)。bump 到 0.1.19 让全队 sync 自动拉新客户端。 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
为什么
降低被动入库者的「被监视感」，让全队愿意全员开。把黑盒变成本机可见 + 可控。
设计与决策见
docs/PRODUCER_FOOTPRINT.md。做了什么
M1 · 地基 + 只读足迹（不改上传行为）
core/ledger.mjs结果账本：记每条 session 最终结果（uploaded / skipped+原因 / opted_out）+ 服务端坐标；client/sync.mjs在 4 条采集路径的终态写账本。client/viewer.mjs常驻内嵌的127.0.0.1只读查看器（Node 原生 http、本地 token、仅 loopback）。用与服务端同款 core 函数本地投影出「脱敏后」正文（与库里一字不差）+ 本机原文对比；启动时从.brain-state.json回填历史。web/viewer.{html,js}前端：默认英文、可切中文；活动日志隐藏空转 tick。brain viewer命令 +brain status显示地址。M2 · 控制
core/optout.mjs逐条排除：上传前闸门拦截，与 viewer 同进程即时生效。server/retract.mjs+POST /retract撤回：只能撤自己 producer-id，git rm + commit（默认仅从 HEAD 移除，git 历史仍可考古）。core/userredact.mjs个人脱敏词表：上传前在内置脱敏之后再抹，带本机命中计数。验证
/ingest → /retract全链路、viewer 排除→服务端撤回→文件删除、个人词表命中计数、配置 dry-run、token 401 鉴权。main（含 feat: 文档源连接器多源化——通用镜像引擎 + Notion + Google Docs #3）试合零冲突。备注
.gitignore。🤖 Generated with Claude Code