Merge pull request #30 from BeatAPI/codex/review-community-improvements

Integrate community fixes, project settings and workspace hardening

Author: erickkkyt

CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to BeatDesign are documented in this file.
 
 ## Unreleased
 
+### Added
+
+- Project settings from project cards and workspace headers: names, short descriptions, explicit image covers, automatic image/video-poster fallback, and the revision-checked `bdesign_project_update` MCP tool (30 tools total). Community contribution: #28.
+
+### Fixed
+
+- Create a project directly after choosing Canvas or Studio, preserving entry parameters and retrying in the chosen workspace without duplicate clicks (#22).
+- Align Canvas previews and Take selection with the latest usable successful generation, while preserving explicit selections and pinned timeline Assets (#26).
+- Preserve timeline clip gains in MCP audio exports and limit overlapping peaks without makeup gain (#24).
+- Commit project settings and idempotency receipts atomically; retain edits and show errors when header renames conflict.
+- Persist undo/redo back to an intentionally empty Canvas. Extract Windows test portability, Studio empty-state translations, and narrow-screen hero layout improvements from #18 without its branding, Provider, or hosted deployment profile.
+
+### Security
+
+- Isolate BeatAPI adapter construction, readiness checks and input validation with TanStack server-only functions so browser model discovery never imports local configuration or SQLite.
+- Update TanStack Start/Router, the MCP SDK, Vite, Seroval and source-map-js to patched versions; production dependency audit reports no known vulnerabilities.
+
+### Documentation
+
+- Highlight current source updates in English, Chinese and Japanese READMEs, while distinguishing them from the v0.2.4 release and package. Update the MCP catalog and current product status.
+
 ## [0.2.4] - 2026-09-23
 
 ### Added

README.ja.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://design.beatapi.io">ウェブサイト</a> ·
+  <a href="https://beatapi.io/design">ウェブサイト</a> ·
   <a href="#クイックスタート">クイックスタート</a> ·
   <a href="#agentからbeatdesignを使う">MCP</a> ·
   <a href="./docs/PRODUCT_PLAN_AND_STATUS.md">製品ステータス</a>
@@ -30,6 +30,20 @@
 
 BeatDesignは、AI画像・動画制作のための独立したオープンソース、ローカルファーストのワークスペースです。Higgsfieldのような一貫した制作フローを、自分のマシンで実行、確認、拡張したい人に向けて作られています。
 
+## 最近のソース更新 · 2026年10月
+
+以下は`main`の更新です。最新の正式Releaseとnpmパッケージは引き続き **v0.2.4** です。利用するにはソースを更新してください。既存のパッケージへ自動配信されるものではありません。
+
+- **Project設定とカバー：** 名前と説明の編集、画像カバーのアップロード・選択、自動カバーへのリセットに対応。手動カバーは後の読み込みや生成で置き換わりません。Projectカードまたはワークスペース上部の設定アイコンから開きます。
+- **生成バージョンの一致：** CanvasのプレビューとTake選択が最新の成功結果を示します。手動選択とTimelineの固定Assetは保持されます。
+- **Projectへ直接移動：** CanvasまたはStudioを選ぶとProjectを作成して直接開きます。再試行と連打防止にも対応します。
+- **音量を保持した書き出し：** MCPのTimeline書き出しで順番に並ぶClipの音量を保持し、重なる音声にはピーク保護を適用します。
+- **30個のMCPツール：** AgentもUIと同じバージョン確認付きコマンドでProject設定を更新できます。空のCanvasへの取り消し・やり直しの保存、Windowsテスト互換性、狭い画面のレイアウトも改善しました。
+
+末尾フレームからの続き生成、CanvasからEditorへの移行、画像オーバーレイ、スタイル付きSRT字幕、ブラウザーとMCPによるMP4書き出しも利用できます。ブラウザーの書き出しにはシステムFFmpegは不要です。MCPのフレーム抽出には`ffmpeg`、Timeline書き出しにはさらに`ffprobe`が必要です。
+
+[変更履歴](./CHANGELOG.md) · [Project設定](./docs/PROJECT_SETTINGS.md) · [現状とロードマップ](./docs/PRODUCT_PLAN_AND_STATUS.md)
+
 ## 2つの制作モード、1つのProject
 
 ### 無限Canvas
@@ -88,7 +102,7 @@ pnpm dev
 
 ## AgentからBeatDesignを使う
 
-BeatDesignはSkill、Project、Asset、Canvas、生成、Editor操作をカバーする29個のローカルMCPツールを提供し、内蔵Skillの検出と正式なTimelineからのMP4書き出しにも対応します。Agentによる変更は同じProjectサービスを通り、ブラウザーのワークスペースに表示されます。
+BeatDesignはSkill、Project、Asset、Canvas、生成、Editor操作をカバーする30個のローカルMCPツールを提供し、内蔵Skillの検出と正式なTimelineからのMP4書き出しにも対応します。Agentによる変更は同じProjectサービスを通り、ブラウザーのワークスペースに表示されます。
 
 MCP Hostへ接続した後は、次のように依頼できます。
 

README.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://design.beatapi.io">Website</a> ·
+  <a href="https://beatapi.io/design">Website</a> ·
   <a href="#quick-start">Quick start</a> ·
   <a href="#use-beatdesign-with-an-agent">MCP</a> ·
   <a href="./docs/PRODUCT_PLAN_AND_STATUS.md">Product status</a>
@@ -30,6 +30,20 @@
 
 BeatDesign is an independent, open-source, local-first workspace for AI image and video creation. It is built for people who want the connected creative flow of tools such as Higgsfield, with a workspace they can run, inspect, and extend on their own machine.
 
+## Latest source updates — October 2026
+
+Available on `main`; the latest tagged release and npm package remain **v0.2.4**. Pull the source to use these updates; existing packaged installations do not receive them automatically.
+
+- **Project settings:** edit names and descriptions, upload or select a cover, and reset to an automatic image or local video poster. A manual cover stays selected after later imports and generations. Open the settings icon on a project card or workspace header.
+- **Consistent generation versions:** Canvas previews and Take selection agree on the latest successful output; manual selections and concrete timeline Assets are preserved.
+- **Faster project entry:** choosing Canvas or Studio creates one project and opens it directly, with retry protection.
+- **Reliable audio export:** MCP timeline rendering preserves clip gain across sequential shots, with peak protection for overlapping audio.
+- **30 MCP tools:** Agents can update project settings through the same revision-checked command path as the UI. Canvas undo/redo can save an intentionally empty canvas; Windows test portability and narrow-screen layout are improved.
+
+Already available: tail-frame continuation, Canvas-to-Editor handoff, image overlays, styled SRT captions, browser-native MP4 export, and MCP timeline rendering. Browser export needs no system FFmpeg; MCP frame extraction needs `ffmpeg`, and MCP timeline rendering also needs `ffprobe`.
+
+[Change details](./CHANGELOG.md) · [Project settings](./docs/PROJECT_SETTINGS.md) · [Current scope and roadmap](./docs/PRODUCT_PLAN_AND_STATUS.md)
+
 ## Two creative modes, one Project
 
 ### Infinite Canvas
@@ -88,7 +102,7 @@ Add your own [BeatAPI API key](https://beatapi.io/dashboard/apikeys) only when y
 
 ## Use BeatDesign with an Agent
 
-BeatDesign exposes 29 local MCP tools for Skills, Projects, Assets, Canvas, generation, and Editor operations, including built-in Skill discovery and authoritative MP4 timeline rendering. Agent changes use the same project services and become visible in the browser workspace.
+BeatDesign exposes 30 local MCP tools for Skills, Projects, Assets, Canvas, generation, and Editor operations, including built-in Skill discovery and authoritative MP4 timeline rendering. Agent changes use the same project services and become visible in the browser workspace.
 
 After connecting your MCP host, you can ask:
 

README.zh-CN.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://design.beatapi.io">网站</a> ·
+  <a href="https://beatapi.io/design">网站</a> ·
   <a href="#快速开始">快速开始</a> ·
   <a href="#让-agent-操作-beatdesign">MCP</a> ·
   <a href="./docs/PRODUCT_PLAN_AND_STATUS.md">产品状态</a>
@@ -30,6 +30,20 @@
 
 BeatDesign 是一个独立、开源、本地优先的 AI 图片与视频创作工作台。它适合喜欢 Higgsfield 这类连贯创作流程，同时希望在自己的电脑上运行、检查和扩展工作空间的人。
 
+## 最近更新 · 2026 年 10 月
+
+以下更新位于 `main` 源码；最新正式 Release 和 npm 包仍为 **v0.2.4**。拉取源码后即可使用，现有安装包不会自动获得这些更新。
+
+- **项目设置与稳定封面：** 修改项目名称和简介，上传或选择封面，或恢复自动封面。手动封面不会被后续导入、生成的素材替换。入口在项目卡片和工作区顶栏的设置图标。
+- **生成版本保持一致：** 画布预览和 Take 选择默认指向最新成功结果，同时保留手动选择和时间线锁定的具体素材。
+- **创建项目一步直达：** 选择画布或创作台后直接进入新项目，支持失败重试和重复点击保护。
+- **修复导出音量：** MCP 时间线导出保留顺序片段的音量，叠加音频增加峰值保护。
+- **30 个 MCP 工具：** Agent 可通过与 UI 相同、带版本校验的命令修改项目设置。同时改进画布撤销／重做到空白状态的保存、Windows 测试兼容性和窄屏布局。
+
+此前已支持尾帧续写、画布到剪辑的连续流程、图片叠层、带样式的 SRT 字幕、浏览器 MP4 导出和 MCP 时间线导出。浏览器导出不依赖系统 FFmpeg；MCP 抽帧需要 `ffmpeg`，MCP 时间线导出还需要 `ffprobe`。
+
+[更新详情](./CHANGELOG.md) · [项目设置说明](./docs/PROJECT_SETTINGS.md) · [当前能力与后续规划](./docs/PRODUCT_PLAN_AND_STATUS.md)
+
 ## 两种核心创作模式，一个 Project
 
 ### 无限 Canvas
@@ -88,7 +102,7 @@ pnpm dev
 
 ## 让 Agent 操作 BeatDesign
 
-BeatDesign 提供 29 个本地 MCP 工具，覆盖 Skill、Project、Asset、Canvas、生成和 Editor 操作，包括发现内置 Skill 目录以及从权威时间线导出 MP4。Agent 修改会经过同一套项目服务，并显示在浏览器工作空间中。
+BeatDesign 提供 30 个本地 MCP 工具，覆盖 Skill、Project、Asset、Canvas、生成和 Editor 操作，包括发现内置 Skill 目录以及从权威时间线导出 MP4。Agent 修改会经过同一套项目服务，并显示在浏览器工作空间中。
 
 连接 MCP Host 后，可以直接提出这样的要求。
 

docs/ARCHITECTURE.md

@@ -32,7 +32,7 @@ The browser calls local `/api` routes. Server routes validate input and resolve
 
 BeatDesign does not implement account concurrency policy. Projects may submit generations independently, and the active Generation Provider is the sole authority for account-level admission. The local submission lock protects SQLite intent/history consistency only; it does not reserve a long-running generation slot or reject a different Project because another task is active.
 
-Provider and optional R2/S3 credentials are encrypted in the local `config` table. Browser components never receive raw credentials.
+Provider and optional R2/S3 credentials are encrypted in the local `config` table. Browser components never receive raw credentials. Shared model metadata may read Provider bindings, but Provider adapter construction, configuration checks and input validation are wrapped in TanStack `createServerOnlyFn`; the browser dependency graph must not import local configuration or SQLite.
 
 Upload storage is a separate adapter boundary. File selection remains browser-local. A successful generation precheck creates a short-lived, one-time SQLite intent that binds the project, model, exact upload count, uploaded URLs, and final generation submission. Required references are promoted only after that point and immediately before task submission; they become project assets only after the provider accepts the task. The default path uploads supported references to BeatAPI Files. Users may instead configure a public R2/S3-compatible bucket; those credentials remain local and are used only for confirmed generation inputs.
 

docs/MCP.md

@@ -104,12 +104,14 @@ installation shapes.
 
 ## Tool groups
 
-There are **29** tools:
+There are **30** tools:
 
 - Skill (2): list the bundled official Skill catalog and read one complete
   versioned Skill definition.
-- Project (5): list, get, create, target the current MCP session, and open a
-  workspace review surface.
+- Project (6): list, get, update settings, create, target the current MCP
+  session, and open a workspace review surface. `bdesign_project_update` requires
+  the latest `settingsRevision` from `bdesign_project_get`; settings changes and
+  idempotency receipts commit atomically.
 - Asset (4): list, get by project membership, import a local file, and extract a
   video frame.
 - Canvas (5): get, browser view/focus, search, incremental apply, and