erickkkyt · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -8,6 +8,6 @@ Include the affected route or component, reproduction steps, impact, and any sug
 
 ## Deployment responsibility
 
-BeatDesign is a single-user, local-first application and does not include authentication. The development server binds to localhost and is not designed to be exposed as a hosted multi-user service. Provider and optional storage credentials are encrypted in the local SQLite workspace.
+BeatDesign is a single-user, local-first application and does not include authentication. Supported development and production launchers bind to localhost; production HTTP rejects non-local Host authorities. The workspace is not designed to be exposed as a hosted multi-user service. Provider and optional storage credentials are encrypted in the local SQLite workspace.
 
 The maintainers support the latest released `0.2.x` version. Security fixes are published in the next patch release when possible.
diff --git a/.github/workflows/quality.yaml b/.github/workflows/quality.yaml
@@ -40,4 +40,4 @@ jobs:
         run: pnpm exec playwright install --with-deps chromium
       - if: runner.os == 'Linux'
         run: pnpm test:e2e
-      - run: pnpm audit --prod --audit-level high
+      - run: pnpm audit --audit-level high
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,17 @@
 
 All notable changes to BeatDesign are documented in this file.
 
+## [Unreleased]
+
+- Close dedicated SQLite command connections explicitly after commit/rollback, keeping unrelated reads isolated. Startup and packaged migrations use owned connections, avoiding Windows file locks retained by detached driver transactions.
+
+- Remove the unused shadcn generator CLI and its obsolete dependency tree; full dependency audit reports zero advisories. CI now checks development dependencies as well as production dependencies. Existing UI components and their configuration are unchanged.
+
+- Adapt Issue #29 organization work from JaysonAlbert/BeatDesign PR #16: persistent Canvas groups and arrangement, logical Asset folders, exact-version Elements, text steps, and reusable local workflow templates. UI and MCP share atomic revision-checked commands; eight added tools bring source MCP to 38.
+- Preserve older Canvas documents and pinned Timeline Assets. Template capture stores semantic configuration, not source media identities; insertion never uploads or runs generation.
+- Reject non-local production HTTP Host authorities independently of Origin, and pin source production/WorkBuddy listeners to loopback.
+- Apply packaged schema upgrades and migration receipts atomically while tolerating additive columns/tables already installed by older source/runtime startup.
+
 ## [0.2.5] - 2026-10-22
 
 ### Added

diff --git a/README.ja.md b/README.ja.md
@@ -46,6 +46,8 @@ BeatDesignは、AI画像・動画制作のための独立したオープンソ
 
 [変更履歴](./CHANGELOG.md) · [Project設定](./docs/PROJECT_SETTINGS.md) · [現状とロードマップ](./docs/PRODUCT_PLAN_AND_STATUS.md)
 
+現在のソース（未リリース）は永続 Canvas グループ、素材フォルダー、固定バージョンの Elements、ローカルワークフローテンプレートと 38 の MCP ツールを含みます。v0.2.5 npm パッケージは 30 ツールです。[詳細](./docs/PROJECT_ORGANIZATION.md)。
+
 ## 2つの制作モード、1つのProject
 
 ### 無限Canvas
@@ -104,7 +106,7 @@ pnpm dev
 
 ## AgentからBeatDesignを使う
 
-BeatDesignはSkill、Project、Asset、Canvas、生成、Editor操作をカバーする30個のローカルMCPツールを提供し、内蔵Skillの検出と正式なTimelineからのMP4書き出しにも対応します。Agentによる変更は同じProjectサービスを通り、ブラウザーのワークスペースに表示されます。
+現在のソースはSkill、Project、Asset、Canvas、生成、Editor操作をカバーする38個のローカルMCPツールを提供し（v0.2.5の公開パッケージは30個）、、内蔵Skillの検出と正式なTimelineからのMP4書き出しにも対応します。Agentによる変更は同じProjectサービスを通り、ブラウザーのワークスペースに表示されます。
 
 MCP Hostへ接続した後は、次のように依頼できます。
 

diff --git a/README.md b/README.md
@@ -46,6 +46,8 @@ Already available: tail-frame continuation, Canvas-to-Editor handoff, image over
 
 [Change details](./CHANGELOG.md) · [Project settings](./docs/PROJECT_SETTINGS.md) · [Current scope and roadmap](./docs/PRODUCT_PLAN_AND_STATUS.md)
 
+Current source (unreleased) adds persistent Canvas groups and arrangement, Asset folders, exact-version Elements and reusable local workflow templates, with 38 MCP tools. These changes are not in the v0.2.5 npm package. [Organization guide](./docs/PROJECT_ORGANIZATION.md).
+
 ## Two creative modes, one Project
 
 ### Infinite Canvas
@@ -104,7 +106,7 @@ Add your own [BeatAPI API key](https://beatapi.io/dashboard/apikeys) only when y
 
 ## Use BeatDesign with an Agent
 
-BeatDesign exposes 30 local MCP tools for Skills, Projects, Assets, Canvas, generation, and Editor operations, including built-in Skill discovery and authoritative MP4 timeline rendering. Agent changes use the same project services and become visible in the browser workspace.
+Current source exposes 38 local MCP tools (v0.2.5 packages expose 30) for Skills, Projects, Assets, Canvas, generation, and Editor operations, including built-in Skill discovery and authoritative MP4 timeline rendering. Agent changes use the same project services and become visible in the browser workspace.
 
 After connecting your MCP host, you can ask:
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -46,6 +46,8 @@ BeatDesign 是一个独立、开源、本地优先的 AI 图片与视频创作
 
 [更新详情](./CHANGELOG.md) · [项目设置说明](./docs/PROJECT_SETTINGS.md) · [当前能力与后续规划](./docs/PRODUCT_PLAN_AND_STATUS.md)
 
+当前源码（尚未正式发版）新增持久画布分组与排列、素材文件夹、固定版本 Elements 和本机工作流模板，MCP 共 38 个工具；v0.2.5 npm 包仍为 30 个。[功能说明](./docs/PROJECT_ORGANIZATION.md)。
+
 ## 两种核心创作模式，一个 Project
 
 ### 无限 Canvas
@@ -104,7 +106,7 @@ pnpm dev
 
 ## 让 Agent 操作 BeatDesign
 
-BeatDesign 提供 30 个本地 MCP 工具，覆盖 Skill、Project、Asset、Canvas、生成和 Editor 操作，包括发现内置 Skill 目录以及从权威时间线导出 MP4。Agent 修改会经过同一套项目服务，并显示在浏览器工作空间中。
+当前源码提供 38 个本地 MCP 工具（v0.2.5 发布包为 30 个），覆盖 Skill、Project、Asset、Canvas、生成和 Editor 操作，包括发现内置 Skill 目录以及从权威时间线导出 MP4。Agent 修改会经过同一套项目服务，并显示在浏览器工作空间中。
 
 连接 MCP Host 后，可以直接提出这样的要求。
 

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -36,8 +36,28 @@ Provider and optional R2/S3 credentials are encrypted in the local `config` tabl
 
 Upload storage is a separate adapter boundary. File selection remains browser-local. A successful generation precheck creates a short-lived, one-time SQLite intent that binds the project, model, exact upload count, uploaded URLs, and final generation submission. Required references are promoted only after that point and immediately before task submission; they become project assets only after the provider accepts the task. The default path uploads supported references to BeatAPI Files. Users may instead configure a public R2/S3-compatible bucket; those credentials remain local and are used only for confirmed generation inputs.
 
+Production browser requests accept only localhost, IPv4 loopback and IPv6 loopback
+authorities, independently of Origin. `pnpm start` and the WorkBuddy launcher pin
+the listener to IPv4 loopback; ambient hosting variables cannot widen it. Packaged
+DDL and migration receipts commit atomically and tolerate prior additive startup
+upgrades without rewriting user records.
+
 ## Command boundary
 
+Project organization uses this same boundary. Canvas v4 stores canonical groups,
+fixed reference bindings and frozen template instances alongside unchanged cards
+and absolute frames. Display projections never replace raw references or historical
+input snapshots. Per-project folders and Elements live in
+`project_organization_state`; installation-wide definitions live in `workflow_template`.
+New semantic writes require explicit revisions and stable IDs. An asynchronous
+transaction context keeps service reads, CAS updates and request-fingerprinted
+receipts on the same SQLite transaction, including legacy snapshot save paths.
+Each transaction owns a dedicated client, commits or rolls back explicitly, then
+closes it in `finally`; unrelated readers keep their separate connection. This
+avoids detached native handles remaining open until garbage collection.
+Canvas generation intents additionally pin the reviewed source card/configuration
+digest. See [Project organization](PROJECT_ORGANIZATION.md).
+
 UI actions and the local MCP server call the same Command Kernel. The kernel owns validation and pure document operations for Canvas and Editor. Persistence boundaries remain responsible for revision checks, durable writes, and returning the authoritative document.
 
 ```text

diff --git a/docs/MCP.md b/docs/MCP.md
@@ -104,7 +104,7 @@ installation shapes.
 
 ## Tool groups
 
-There are **30** tools:
+The current source exposes **38** tools (the published v0.2.5 package has 30):
 
 - Skill (2): list the bundled official Skill catalog and read one complete
   versioned Skill definition.
@@ -121,6 +121,15 @@ There are **30** tools:
 - Editor (8): get, incremental edit, SRT import, authoritative MP4 render,
   semantic snapshot, diagnostics, deep-link view, and command history.
 
+Organization adds eight tools: `bdesign_organization_get`,
+`bdesign_organization_apply`, `bdesign_asset_query`,
+`bdesign_workflow_template_list`, `bdesign_workflow_template_get`,
+`bdesign_workflow_template_preview`, `bdesign_workflow_template_apply`, and
+`bdesign_timeline_usage`. New writes require explicit command IDs, idempotency
+keys and the revision for the command domain. Preview before capturing templates
+or changing exact Element bindings; instantiation never submits generation.
+See [Project organization](PROJECT_ORGANIZATION.md).
+
 The same bundled Skill catalog is also available through the read-only MCP
 Resource `beatdesign://skills`. Individual Skill instructions use the resource
 template `beatdesign://skills/{skillId}`. The two Skill tools are compatibility

diff --git a/docs/PRODUCT_PLAN_AND_STATUS.md b/docs/PRODUCT_PLAN_AND_STATUS.md
@@ -12,7 +12,7 @@
 - `bdesign_project_update` 将 MCP 目录扩展为 30 个工具；项目设置更新与幂等回执在同一 SQLite 事务提交，回执失败时回滚设置，保留旧项目封面。
 - 浏览器/MCP 检查使用生产构建；画布完成编辑器与项目初始化后才开放工具栏和快捷键，延迟加载回归检查确认首次创建动作可保存。
 - 从 PR #18 提取 Windows 测试兼容、Studio 首屏翻译、空画布撤销／重做保存及窄屏布局修复；第三方品牌、Provider 和托管部署配置未纳入上游。
-- v0.2.5 补齐跨平台安装脚本、Linux/Windows CI、接入包版本和项目设置 Skill 指引；README 列出 v0.2.5 功能、正式发布入口与源码升级步骤。官方 Skill 目录仍为空，Issue #29 的持久分组、素材文件夹和复用模板仍待实现。
+- v0.2.5 补齐跨平台安装脚本、Linux/Windows CI、接入包版本和项目设置 Skill 指引；README 列出 v0.2.5 功能、正式发布入口与源码升级步骤。官方 Skill 目录仍为空；后续源码改进另见下方，未包含在 v0.2.5 发布包。
 
 ### v0.2.4 已发布改进
 
@@ -23,6 +23,18 @@
 - Studio / Canvas / Editor redo 与 MCP 共用 asset-first 服务端预检及提交；浏览器接口使用逻辑 model ID，Provider 状态同步集中到服务端。
 - 本地 SQLite 启用 WAL 和 busy timeout；MCP 版本读取根 package 元数据。浏览器与 MCP 联动测试使用独立临时数据库，不调用付费 Provider。
 
+### 后续源码改进（未正式发版）
+
+从 JaysonAlbert 的 Fork PR #16 中提取 Issue #29 的持久命名分组、折叠和自动排列、
+逻辑素材文件夹、固定版本 Elements、可复用本机工作流模板与文字步骤。
+保留现有项目及 BeatAPI Provider；未引入 Fork 的其他 Provider 或 Series/Scenes 架构。
+UI/MCP 共用事务命令、revision、幂等回执；整理和模板插入不创建生成任务、不上传。
+新增 8 个 MCP 工具，当前源码共 38 个；v0.2.5 发布包仍为 30 个。
+
+补充生产 HTTP Host 校验、`pnpm start`/WorkBuddy 回环绑定，以及兼容旧数据库的
+原子安装迁移；移除未使用的 shadcn 生成器 CLI 及其过期依赖，完整依赖审计为 0 条告警，CI 同时检查开发依赖。功能边界见 [PROJECT_ORGANIZATION.md](PROJECT_ORGANIZATION.md)。
+源码、自动检查、浏览器/MCP 验证、合并和正式发版分别记录；这里不代表 npm 已更新。
+
 ## 1. BeatDesign 是什么
 
 BeatDesign 是一个免费、开源、本地优先的 AI 图片/视频创作工作台。它把 Studio、节点 Canvas、项目 Assets、本地视频 Editor、生成历史和 BeatAPI 连接放在同一个 Project 中。
@@ -173,7 +185,7 @@ Codex / Claude Code / Other Agent
 - `AssetFirstGenerationRequest` v2 不保存通用首帧或尾帧角色；大多数模型仍由明确的 `@ImageN` Prompt 指令表达首尾帧语义。MiniMax H3 Max / Max Turbo 按其公开契约使用专用双槽位，并将附件顺序映射为首帧、尾帧。Adapter 负责翻译 Provider 字段和校验模型硬限制。
 - UI 命令入口不再接受客户端 `origin`；服务端固定写入 `ui`，MCP 入口在内核边界固定写入 `mcp`。
 - Provider Contract 已将逻辑模型目录与 BeatAPI effectId、上传路径和上游模型名拆开；当前同步 GPT Image 2.5 Flare/Sunburst、Wan 3.0/Prime、HappyHorse 1.0/1.1、MiniMax H3 Max/Max Turbo 的请求契约和 SVG 品牌标志。BeatAPI 是默认实现，Fork 可在源码扩展点注册其他 Provider。
-- 本地 stdio MCP Server 提供 30 个工具（Skill / Project / Asset / Canvas / Generation / Editor），模型和参数通过 capability discovery 暴露；Canvas / Editor 增量操作使用完整 JSON Schema，Agent 可直接发现操作类型和参数。MCP 生成直接调用当前 Provider，本地产品不重复实现 API Key、余额、计费或限流策略，只透传 Provider 的结果与错误。`bdesign_skill_list` / `bdesign_skill_get` 是不显示 MCP Resources 的宿主兼容入口；`bdesign_project_target` 绑定当前会话项目，Project/Canvas/Editor view 工具返回 Codex Browser handoff；`bdesign_asset_import` 把本地文件导入项目 Asset 库；`bdesign_asset_extract_frame` 与 `bdesign_canvas_continue_from_tail` 负责抽帧续写；Editor MCP 可导入 SRT、放置和替换任意项目图片 Overlay、调整叠层与单条字幕参数，并通过 `bdesign_editor_render` 将权威时间线导出为项目内 MP4 Asset。
+- 本地 stdio MCP Server 当前源码提供 38 个工具（Skill / Project / Asset / Canvas / Generation / Editor），模型和参数通过 capability discovery 暴露；Canvas / Editor 增量操作使用完整 JSON Schema，Agent 可直接发现操作类型和参数。MCP 生成直接调用当前 Provider，本地产品不重复实现 API Key、余额、计费或限流策略，只透传 Provider 的结果与错误。`bdesign_skill_list` / `bdesign_skill_get` 是不显示 MCP Resources 的宿主兼容入口；`bdesign_project_target` 绑定当前会话项目，Project/Canvas/Editor view 工具返回 Codex Browser handoff；`bdesign_asset_import` 把本地文件导入项目 Asset 库；`bdesign_asset_extract_frame` 与 `bdesign_canvas_continue_from_tail` 负责抽帧续写；Editor MCP 可导入 SRT、放置和替换任意项目图片 Overlay、调整叠层与单条字幕参数，并通过 `bdesign_editor_render` 将权威时间线导出为项目内 MP4 Asset。
 - Codex、Claude Code 与 WorkBuddy 接入包内含 `beatdesign-workspace` Skill，负责项目选择、字幕/续写工具编排、付费生成停点和可视化复核；三者共用同一 MCP 与本地 Project 数据，其中 Claude Code 和 WorkBuddy 使用本机 HTTP MCP。
 
 ## 6. v0.2 Phase 1 本地已实现
@@ -188,7 +200,7 @@ Codex / Claude Code / Other Agent
 - Canvas -> Timeline Node -> Editor 连续工作流。
 - Editor 自动保存接入命令入口，并补齐冲突三方合并、重复操作保护和稳定播放头时间。
 - 图片 Clip、时间线拖拽调整持续时间与图片/视频统一视觉轨。
-- 本地 MCP Server 提供 30 个 Skill、Project、Asset、Canvas、Generation、Editor 工具；支持内置 Skill 目录发现、会话项目绑定、Canvas/Editor 可视化交接、从绝对路径导入本地素材、抽取尾帧续写、导入和精调 SRT 字幕、放置/替换/调整图片 Overlay，以及权威时间线 MP4 导出。
+- 本地 MCP Server 当前源码提供 38 个 Skill、Project、Asset、Canvas、Generation、Editor 工具；支持内置 Skill 目录发现、会话项目绑定、Canvas/Editor 可视化交接、从绝对路径导入本地素材、抽取尾帧续写、导入和精调 SRT 字幕、放置/替换/调整图片 Overlay，以及权威时间线 MP4 导出。
 - 已加入只读 `beatdesign://skills` MCP Resource、单 Skill Resource Template、schema v1 清单校验和宿主兼容工具；当前官方创作 Skill 目录有意保持为空，待具体 Skill 完成提示词评测和可见工作流联调后再加入，并在那时开放 Showcase 入口。
 - MCP 增量 Canvas/Editor 命令在短暂 revision 竞争时会基于最新权威文档限次自动重放；持续冲突返回最新 revision 和明确重试提示。
 - Canvas 与 Editor 每 2 秒并在页面重新聚焦时检查 MCP 写入的新 revision。