v0.3.0-rc.3

⚠️ Breaking Changes

URL Naming Convention Unification

All URL-related configuration fields now use uppercase 'URL' for consistency:

• workerUrl → workerURL
• scenariosUrl → scenariosURL
• serverUrl → serverURL (OAuth2Client, S3Client, PersistenceConfig, AUTH_CONFIG)

This affects:

• createRtcAgent() factory function configuration
• RtcAgent component properties
• OAuth2ClientOptions, S3ClientOptions, PersistenceConfig
• All documentation and examples

🐛 Bug Fixes

Security

• Prevent duplicate OAuth token exchange with reentry guard
• Improve OAuth2 error message security (avoid leaking sensitive details)
• Improve type accuracy, security, and debuggability in FunctionRegistry

Race Conditions & Concurrency

• Fix TOCTOU race in softDeleteSession (wrap check+write in transaction)
• Fix OffsetManager cache rollback on DB failure
• Fix logo setter async race condition (generation counter)
• Fix ResourceScope listener mismatch and OffsetManager rollback gap
• Fix throttle race condition in event binding controller
• Fix lifecycle race conditions and resource leaks in component
• Fix error isolation and dead code in event pipeline

Type Safety

• Correct virtualFSGrep return type to match GrepResult
• Fix UUID schema mismatch (count>1 returns array but schema described string)
• Fix markdown generator oneOf union type rendering
• Eliminate 'any' type assertions in entity-repository
• Unwrap CustomEvent detail in factory DOM callbacks

Other Fixes

• Remove debug markers and fix redundant gap fill check
• Fix memory leaks and improve command extensibility
• Initialize theme in component lifecycle
• Standardize localStorage key naming

🔧 Refactoring

• Unify URL naming convention across all packages (client, persistence, component)
• Remove verbose debug logs across controllers and utilities
• Consolidate register methods in FunctionRegistry
• Simplify auth to AuthProvider-only mode (remove OAuth2 internal flow)
• Translate Chinese comments to English
• Standardize SVG icon formats
• Migrate console.* to scoped logger

📚 Documentation

• Update all documentation for serverURL naming convention
• Add @deprecated to UI-layer Session/Message types
• Fix logger docs and deduplicate scopes
• Improve security documentation

🧪 Testing

• 1002 tests passing
• All pre-commit and pre-push checks passing

📦 Protocol Updates

• Regenerate models from OpenAPI spec
• MessageListRequest.cursor: number → string
• Remove 'reserved' notes from FileAttachment and UserMessageContent.files