Why: the adjudicated preview plan needs server-side OG fetching for link
cards, and the proposal's reserved-capability items call for the fs tool
family to exist behind a default-off gate (implemented, not offered).
Evidence: GET /api/url-preview fetches and parses og:title/description/
site_name/image/favicon with a 5s timeout, 256KB body cap, text/html
content check, TTL cache, and SSRF guards enforced at dial time (loopback
/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-
rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 exists for local testing only,
default fail-closed; errors return sanitized cards, never internal
addresses). fs_read_file/fs_write_file/fs_list_dir register as Hidden
tools sandboxed under <root>/<owner>/<conversationId>: traversal,
absolute paths, backslashes, and symlink escape rejected; 1MB/2MB size
caps; writes register an artifact so workspace files stay visible in the
panel. ToolDesc.Hidden gates both model visibility (runctx.Tools) and
/api/tools listing on runtime.fsTools, and registry.Execute re-checks
fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
go test ./... green (fs negative matrix, SSRF negatives, endpoint
fail-closed, cache).
Impact: link previews work end to end once the frontend wires the
fetcher; fs tools are inert until runtime.fsTools is enabled.
Refs: task feature/file-preview-caps; core 4d29301.
Why: govulncheck reported 20 module-level advisories against golang.org/x/crypto v0.37.0 (19 with upstream fixes, GO-2026-5932 unfixed); none were reachable from our code, but the whole batch clears with one routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: golang.org/x/crypto v0.37.0 => v0.56.0 (x/text follows to v0.41.0 as a requirement); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green against the new core types; govulncheck now reports 0 affected, 0 import-level, 1 module-level (the upstream-unfixed GO-2026-5932 — the floor until upstream ships a fix).
Impact: go.mod/go.sum bumps only; no code change; x/crypto is not imported by any of our packages (transitive require).
Refs: Dev-side task fix/followup-hardening (gitlink pin follows after combined verification)
Why: govulncheck flagged two reachable vulnerabilities: GO-2026-5004 (SQL injection via placeholder confusion with dollar-quoted literals in pgx v5.7.6, reached through pgx.Conn.Exec sanitize path on Postgres deployments) and GO-2026-5970 (infinite loop on invalid input in golang.org/x/text v0.24.0, reached through pgx.Connect normalization). Follow-up to the 2026-09-30 dependency CVE inventory task.
Evidence: golang.org/x/text v0.24.0 => v0.39.0 and github.com/jackc/pgx/v5 v5.7.6 => v5.9.2 (both at or past the fixed versions); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green; govulncheck ./... now reports 0 reachable vulnerabilities (was 2).
Impact: go.mod/go.sum dependency bumps only; no code change; the remaining 20 module-level advisories are not called by our code (informational).
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)
Why: Local.Put joined the caller-supplied id straight into the store directory, and store.UpdateArtifactContent feeds the HTTP path parameter into it, so a traversal id (encoded ../ in the artifact path) reaches an arbitrary-path file write; Get/Delete took stored refs unvalidated too. The 2026-09-30 deep security scan flagged the unsanitized join as the one actionable finding after triage.
Evidence: new internal/blobstore tests cover rejection of empty/dot/dotdot/traversal/absolute/backslash/NUL ids with no residue in the store dir, a normal Put/Get/Delete roundtrip, and refusal of out-of-store refs for Get and Delete; go vet ./... and go test -count=1 ./... pass.
Impact: internal/blobstore only; plain-filename ids (the only form produced today via newID and artifact path params) keep working; no schema, API, or caller change.
Refs: Dev-side task fix/blobstore-id-hardening (gitlink pin follows after combined verification)
Why: agents rediscovered Gitea hosts and credential locations from
scratch each session, and the retired git-panel host kept failing with
TLS broken-pipe errors before the right host was recalled.
Evidence: curl git-home...:30319/api/v1/version with token from
~/.secrets/gitea -> {"version":"1.27.3"}; ssh -p 31411 git@git-ssh...
(BatchMode) -> "Hi there, weichen!" with key ~/.ssh/home_gitea (ED25519,
SHA256:GYXaOXIMeloQ1fKSfdJ/ndgPQzs/Ix7Hk62ekfkfQ20). Same section already
merged in Agent-System-Dev (PR #73).
Impact: AGENTS.md only; records hosts and credential locations, no
secret values (baseline hard boundary 2).
Refs: Agent-System-Dev PR #73
Why: tool-produced artifact_ref parts were appended without Process,
unlike the tool_call/tool_result parts of the same turn, so on final
reconcile the artifact chip stayed in the reply area instead of folding
into the process summary.
Evidence: llm.go now sets Process: true on PartArtifactRef next to its
tool parts; new TestLLMRunnerArtifactPartIsProcess drives a tool turn
that produces an artifact and asserts the part exists, is marked, and
carries the artifact ref. go test ./... all packages ok.
Impact: persisted assistant messages fold artifact references into the
collapsed process area, consistent with other tool-turn output.
Refs: code review of feature/chat-process-split-r1 (2026-09-30)
Why: generated deliverables (e.g. meeting-minutes docx) had no reliable
download path — the content endpoint set no Content-Disposition, so the
filename only survived via the front-end <a download> attribute, and
contentTypeOf returned text/plain for any artifact whose MIME column was
empty, mangling office/pdf uploads.
Evidence: artifactContent now always sets Content-Disposition (inline by
default, attachment with ?download=1) with an RFC 5987 filename* for
non-ASCII names plus an ASCII fallback; contentTypeOf consults an
explicit office-format extension table then mime.TypeByExtension before
the kind fallbacks. New tests cover disposition on both modes, the
encoded Chinese filename, and the extension/mime precedence chain;
go test ./... green.
Impact: front-ends can link direct download URLs and browsers receive
correct file types for docx/xlsx/pptx/pdf/csv/md regardless of the
stored MIME value.
Refs: task feature/chat-order-artifact-files.
Why: conversation transcripts were the only project channel not
readable across sessions (artifacts/knowledge are already shared),
which caused duplicate parallel work; see proposal
2026-09-30-cross-session-reading.
Evidence: runmgr/crossread_test.go covers the full gate matrix
(project gate on/off x outbound flag x private target x cross-project
x cross-tenant x self-read x archived x limit clamping) against a real
store + settings chain; store tests cover migration v11, flag
persistence and tenant isolation; tools/peers_test.go covers args
validation, transcript rendering and the untrusted-content banner;
go test ./... green.
Impact: setting crossSession.read (default off, schema-driven);
conversation columns allow_cross_read (default true) and cross_private
(default false) with PATCH support; builtin tools list_conversations
and read_conversation gated fail-closed in runmgr toolCtx; nested
agent-system-core pin bumped to fd44179 (Core PR #6).
Refs: Agent-System-Documents proposals/2026-09-30-cross-session-reading.md
(Dev task feature/cross-session-reading).
Why: the user ruled out self-registration (2026-09-30): accounts are
created only by admins who set an initial password; first login (and
first login after any admin reset) must force a password change.
Evidence:
- migration v10 auth_accounts (users password/must_change/is_admin +
sessions table; upgrade test walks v1<->v10 both directions).
- argon2id hash/verify with PHC encoding; store tests cover hash
roundtrip, duplicate-owner conflict, must-change lifecycle, session
keep/except semantics.
- e2e TestAdminAccountFlow: static login page reachable without auth,
wrong password 401, login sets HttpOnly cookie + mustChangePassword,
admin creates user (409 on duplicate), non-admin create 403, forced
change clears flag and old password dies, admin reset revokes sessions
and re-arms forced change, API-key channel untouched, 5-fail backoff
429, logout kills session. Full go test ./... green.
Impact: middleware now accepts Bearer key OR session cookie and exempts
static + /api/auth/login (also fixes the latent case where the login
page itself could 401). Embedded no-auth mode unchanged.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (admin-issued
variant, user decision 2026-09-30)
Why: Agent-Native ships a Tavily integration (key-pool rotation,
markdown output, fallback copy) that the backend never registered, so
the catalog's WebSearch prompt had no carrier; wiring the tool gives it
one and gives the agent live-web reach.
Evidence: 4 new tool tests (registration, markdown formatting, empty
query, failure fallback carried inside the error to match registry
replay semantics); go test ./... 16 packages ok; live boot check - no
keys means not registered, two keys log registration with both tools
in /api/tools and 46 library modules in /api/prompts.
Impact: tools.tavily.apiKeys/endpoint settings (restart effect; empty
pool means the tool is absent, no silent degradation); tool.tavily_search
and tool.web_search prompt modules inject citation discipline (cite
sources, keep inference separate, fall back to workspace materials on
failure); library floor raised to 46.
Refs: feature/tavily-search-tool task card; guide disposition table in
Documents.
Why: the porting filter excluded templates without a named roadmap slot,
but the user's bar was anything portable; wizard, memory extraction,
session memory and in-place doc updates all have carriers (delegation
today, memory/doc-editing slots later).
Evidence: go test ./... 16 packages ok with the library floor raised to
44; module format checks unchanged.
Impact: +agent.docs-wizard, +agent.memory-extractor, +aux.session-memory,
+aux.magic-docs; no wiring change.
Refs: feature/prompt-catalog-coverage task card; guide section 9 in
Documents lists the full disposition.
Why: upstream merged prompt_modules as migration v8; the version
namespace is linear so the rebased task-sidebar work moves to v9.
Evidence: go vet + full go test ./... green; migration upgrade test now
walks v1<->v9 (up and down paths exercised for real).
Impact: fresh databases apply v8 (prompts) then v9 (conversation flags);
no released v8 conversation_flags ever existed, so no deployed database
can hold the old numbering.
Why: a non-nil Authenticator with Enabled=false is the embedded no-auth
mode; reporting auth=true there made the sidebar account footer show
the wrong identity state (found in the live headless walk).
Evidence: restarted binary now returns {"auth":false,...} in embedded
mode; TestTaskListAndFlags still green.
Impact: response field value only.
Why: the task-centric sidebar (approved option A) needs a cross-project
conversation list, server-authoritative pinned/archived state, and an
identity endpoint for the sidebar account footer.
Evidence:
- migration v8 conversation_flags (sqlite/postgres up+down; the upgrade
test walks v1<->v8 for real); store and e2e tests cover pinned-first
ordering, archived filtering with ?archived=1, tenant-isolation
negatives (cross-owner flag write -> NotFound), and /api/me shape
(owner/name/auth) in embedded mode.
- go vet + full go test ./... pass.
Impact: additive columns/APIs; existing endpoints unchanged (PATCH gains
optional pinned/archived fields; responses keep prior shape).
Refs: core bump deps/agent-system-core -> 1dc08fc (Conversation flags)
Why: prompts lived inline in Go (profile const, subagent string, squad
role one-liners, tool descriptions) - every copy change shipped code,
and task guidance like meeting-minutes quality lived permanently in the
base prompt whether or not the task was at hand.
Evidence: new prompts package tests (library integrity, default
assembly, skill triggering incl. attachment gate and command bypass,
priority supersession, override chain drift, command match, frontmatter
parse); composite make test green; runtime check on a live server
(40 modules across 7 layers, override round-trip, /minutes starts a
run instead of hitting the command bus).
Impact: 40 builtin modules as embed data (5 base + 1 env + 12 task
skills + 10 agent roles + 7 tool descriptions + 3 aux templates + 2
styles); migration v8 adds prompt_modules for user overrides with
basedOnVersion drift markers; ctxasm assembles multi-segment system
messages with per-module observability; subagent/squad/tool copy now
resolve from the library with inline fallbacks; skill commands surface
in the / menu and route to runs; default profile SystemPrompt empties
onto the library base; pins deps/agent-system-core to the contract
commit.
Refs: feature/prompt-library task card; design guide in Documents.
Why: attachments were hard-truncated at 16k chars (most of a meeting
transcript silently dropped), injection carried no task guidance, the
builtin profile prompt was one generic line, subagents were capped at
300 chars, and docx tables were appended after all paragraphs losing
document order - together these produced sparse meeting minutes.
Evidence: go test ./... 16 packages ok incl. new ctxasm limit tests and
docx order assertions (heading->para->table->para); composite make test
green over the pinned combo.
Impact: attachment ceiling is 48k chars (settings
context.maxAttachmentChars), truncated on rune boundaries and observable
in the context report; the builtin prompt demands full-coverage
structured markdown for document tasks and upgrades stale builtin rows
on boot; budget.maxTokens now reaches the provider; subagents may write
full-length results; docx tables stay in place.
Refs: feature/chat-live-quality task card.
Why: T4 workspaces are declared by plugins via provides.workspaces (Core PluginWorkspace is the authoritative type); the host must surface the merged overlay for the frontend to render in OverlayHost.
Evidence: go test green - plugins suite new TestWorkspacesOverlay (manifest + workspaces/main.json loads, ListWorkspaces returns the declaration with shortcut and body); full internal sweep unchanged.
Impact: plugins host loads workspaces/*.json assets and exposes ListWorkspaces; server adds GET /api/workspaces passthrough; no behavior change without the manifest key.
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T4; task card feature/workspaces-r1
Why: T3 of the interaction foundation - unify button/card/slash/chat entries onto one command bus (D27) composing the Agent-Command library (D30), with danger=high commands gated behind inline confirm cards and every dispatch leaving the same audit envelope.
Evidence: go test green - cmdbus suite (four-entrance audit symmetry, high-danger confirm lifecycle incl. cancel/expiry/handler-reject, audit-unavailable yields unknown, plugin spec fail-closed, schema scalar validation) and server e2e (danger command via POST /api/commands -> confirm card -> card action confirm -> committed receipt -> audit query ordered accepted->committed); legacy /help,/new,/mock,/model,/profile contract preserved through the bus; store migration v7 command_audit (both dialects) with roundtrip test updated.
Impact: new internal/cmdbus (L1 package per D33), server routes POST /api/commands/{id} + GET /api/commands/audit + registry-driven GET /api/commands, postMessage chat-entrance dispatch when the intent gate matches a registered command, plugins host OnCommands overlay, module cards policy/modules/{cmdbus,cardsvc}.md; pending confirm state is process-local (documented limitation).
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T3; task card feature/command-bus-r1
Why: The frontend appends the confirmation receipt locally so it appears
immediately; returning the server-persisted message (with its id) keeps the
authoritative reconcile duplicate-free.
Evidence: go build green; covered by combo test in Dev.
Impact: response shape gains receipt field (additive).
Refs: proposal 2026-09-30-ui-inbox-command-workspace
Why: T2 of the interaction foundation — activity cards as first-class state
objects behind the right-rail inbox (proposal D25): upload ingest cards
(SR-A5 failures explicit, artifact retrievable), HITL projection cards
(double-presence, ref-linked two-way sync), squad orchestration cards and
the mock #upload demo of the full card lifecycle.
Evidence: go test ./... green across 14 packages incl. new cardsvc suite
(lifecycle, action labels and idempotency, pin/dismiss, owner isolation,
resolve-by-ref idempotency) and updated migration test (v6 activity_cards,
both dialects); events flow through the session event buffer (persist, seq,
replay); receipts appended to the conversation timeline on card actions.
Impact: additive; cards disabled (SetCards nil) degenerates to the T0
baseline; upload cards persist at project level per the v1 inbox boundary
(conversation-scoped inbox; project-level aggregation is follow-up).
Refs: modules/documents docs/proposals/2026-09-30-ui-inbox-command-workspace.md
Why: Consumer adaptation step of the cross-repo five-step — Core gained the
activity-card/UI-vocabulary contracts (its PR#2) and Agent-Command reached
v0 (its PR#2); this module's replace-based build must consume those mains so
cmdbus (T3) builds against the real contracts.
Evidence: nested gitlinks now at core a2050d8 and agent-command cc1ad77 (both
merged mains); go build/vet/test green at this state (combo run in Dev).
Impact: Pins only; no code change.
Refs: modules/documents docs/records/2026-09-30-t1-core-cards-commands-verification.md
Why: The command bus work (proposal D30) needs the Agent-Command ecosystem
library available to this module before internal/cmdbus lands in T3; wiring
now keeps that task provider-ready.
Evidence: submodule pinned at Agent-Command main 50f99d9 (skeleton + guidelines
pin, merged via its PR #1); go.mod gains only the replace directive — build,
vet and full go test pass with no other change (go mod tidy churn deliberately
excluded).
Impact: No import yet; zero behavior change. Recursive init materializes
guidelines inside agent-command (development-only).
Refs: Agent-System-Documents proposal 2026-09-30-ui-inbox-command-workspace (D30)
weichen
weichen