Why: downstream parsers are unreachable via extension.Host and the base lacked xlsx/pptx parsers; MS1 needs Excel and PPT ingest (EXT-5 request, documents proposal 2026-10-06-ext-5-host-parse-document).
Evidence: local GOWORK=off go test ./... all 29 packages pass incl. new ooxml_test (hand-built parts), ooxml_python_test (openpyxl/python-pptx round-trip), inproc owner-scope and limit tests, xlsx upload e2e; go vet clean; recorded as SELF on the Dev task card, PR CI to confirm.
Impact: Host gains ParseDocument (pure compute; errors only on ctx cancel or >100MiB input); builtin:xlsx (sheet order via workbook.xml rels, rich-text shared strings, formula cache, 1900/1904 dates, sparse cells) and builtin:pptx (sldIdLst order, titles, group shapes, AlternateContent Choice, tables, notes) added with 200k-cell/64MiB-part caps; legacy doc/xls/ppt get an actionable hint; ParsersDescription gains xlsx/pptx and the missing text ext; surface snapshot now records exported interface methods; docx part reads share the 64MiB cap.
Refs: documents 2026-10-06-ext-5-host-parse-document.md; EXT-1 host.go precedent.
Why: Masks must not be the only copy of a key, and personal instructions, lore hits, and candidate replies have to reach the model without rewriting the system prefix or deleting history.
Evidence: go test ./internal/store ./internal/ctxasm ./internal/settings ./internal/runtime ./internal/server. Migration v16 upgrades and rolls back. Startup snapshots settings before moving raw keys.
Impact: One labeled key is active per service. Excluding a message hides its whole run from the model. Regenerating appends another candidate and rewinds files to the user turn. User slash commands expand to prompt text and do not fire on their own.
Refs: docs/records/2026-10-04-sillytavern-review.md
Why: The embedded tier starts without auth, and nothing checked Origin or Host, so a public bind or a foreign page could call write APIs.
Evidence: go test ./internal/config ./internal/server covering listen policy, origin rejection, and response headers.
Impact: Non-loopback without auth exits before opening the database. HTML artifacts get a sandbox CSP. Reverse proxies must list their public host in allowedHosts.
Refs: feature/sillytavern-review
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A dotted-key PUT was stored beside the nested object and never read, so replacing a key kept the old pool. GET also returned tools.tavily.apiKeys in clear text, and saving settings would write the mask placeholder back over a real key.
Evidence: go test ./...
Impact: Dotted writes take effect on the next read. Startup expands stored dotted keys, and the existing nested value wins when both forms exist. GET masks schema secrets, including apiKeys. Writing the mask placeholder no longer overwrites a stored secret.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: workspace writes had no checkpoint, and a 5xx before any output stopped the turn instead of trying the next configured model.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/runmgr/ ./internal/tools/ ./internal/settings/ ./internal/server/ ./internal/app/
Impact: models.chat.fallbacks defaults to empty, so existing runs keep their model. Rewind restores only tracked writes and appends a system note. Usage records the model that served.
Refs: feature/durable-rewind
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Plan mode has to block writes, confirmations dropped the argument preview, and direct chat did not share its stop gate with squad members.
Evidence: GOWORK=off go test ./internal/store/ ./internal/tools/ ./internal/runmgr/ ./internal/runtime/ ./internal/server/ passed. Default mode still runs write_artifact; plan mode rejects it.
Impact: Empty permission mode keeps the profile allow, deny, and confirm lists. High-risk shell commands now ask. There is no bypass-all mode.
Refs: feature/permission-hooks
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A dropped subscription had no retry hint, and a reconnect had no test that the gap is filled from the cursor.
Evidence: The stream starts with retry: 1000. A live publish is delivered, and Last-Event-ID after an overflow replay skips events the client already has.
Impact: EventSource waits one second before reconnecting. Persisted events are unchanged.
Refs: feature/runstate-shell
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Refreshing or switching back only knew the latest event cursor, so process that had already happened was missing until the run finished.
Evidence: GOWORK=off go test -count=1 -run TestConversationResumeSeq ./internal/server passed. While a hitl run waits, resumeSeq is the run's first seq minus one and is less than lastSeq; after the run completes the two cursors match.
Impact: Conversation detail gains resumeSeq beside lastSeq. No core contract change. Clients that ignore the field keep the old cursor.
Refs: Dev fix/live-run-visibility
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A hard kill left runs in pending, running, or waiting_hitl, a busy send stored a message before the 409, finishRun could mark a run completed without an assistant message, and a full SSE buffer dropped events without closing the stream.
Evidence: GOWORK=off go vet ./... and GOWORK=off go test -count=1 ./... passed, including store, runmgr, bus, and server recovery tests.
Impact: Migration v14 adds runs.instance_id and messages.request_id. Startup reconciliation and shutdown share one seal. Turn and workflow sends claim a slot before writing. Duplicate request ids return the existing message. SettleRun updates the run and appends the assistant message in one transaction. A full subscriber buffer closes the channel so SSE can replay from the cursor.
Refs: Dev feature/pi-durable-borrow
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A hit intent should start the bound workflow, and a command that shares the same id still has to win.
Evidence: go test ./internal/intentgate/ ./internal/runmgr/ ./internal/server/ passed. Recognize keeps slots and the missing-slot question. StartWorkflowRun copies the definition and selects the workflow runner even when mock is on.
Impact: Ordinary turns are unchanged. The workflow runner body is still a stub until the executor lands.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Intent routing needs a registry of workflow definitions, and uninstall was leaving intents and workflows in place.
Evidence: go test ./internal/workflow/ ./internal/plugins/ ./internal/app/ passed. Validation rejects duplicate ids, unknown kinds, denied tools, and both step caps. Unregister clears the registry and the intent gate.
Impact: Script steps must stay inside the plugin directory. The server holds the registry for later routing.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Downstream products must extend the base through a public package and host API instead of editing internal code.
Evidence: go test ./... passed, including plugin v2 assets, sidecar startup, migration v13, pending confirms, HITL timeout, hash embedder, command pairs, and the extension surface snapshot.
Impact: apiVersion 2.0-experimental rejects empty network allowlists for declarative HTTP. Hash embeddings stay opt-in via models.embedding.provider=hash. Plugin secrets resolve per owner at execution time.
Refs: docs/proposals/2026-10-01-plugin-contract-v2.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Generated files kept Word's default theme, US Letter pages,
hand-typed bullets and empty sections. Recipes only showed library
calls, the prompt had no craft standard, and seeded skills could not
be upgraded once written.
Evidence: go test ./... passed. The house-style suite covers three
themes across docx, pptx and xlsx, and rejects a document that repeats
the diagnosed layout failures. lint on the sample minutes exits 1.
Impact: Every run gets a resident quality standard. Office files use
house-style (switchable themes, templates, imitation) and must pass
lint. Skill seeding upgrades untouched builtins and keeps user edits.
Uploads land in inputs/, and the default style is a setting.
Refs: feature/agent-professional-deliverables
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: docx deliverables were plain text saved with a .docx name (no
headings/tables/styles), and the artifact_ref part was marked Process
so the deliverable vanished into the collapsed process section — the
user saw only model-written text like "📄 xxx.docx 工件 ID …" instead
of an openable, formatted document delivered in the conversation.
Evidence:
- new internal/docgen: Markdown -> styled OOXML (Title/Heading1-4,
numbered+bullet lists with numbering.xml, GFM tables with shaded
header, quotes, code blocks, bold/italic/strike, real hyperlinks);
zero third-party deps; tests cover zip structure, XML well-formedness,
numbering refs, hyperlink rels, escaping, plain-text fallback
- ingest round-trip test proves generated docx parses back to blocks
- new write_docx builtin tool (markdown in -> styled .docx artifact);
write_artifact prompt now routes Word docs to it; task.doc-minutes
output contract requires write_docx delivery
- llm.go: artifact refs collected as deliverables and appended as
content parts AFTER the final text (pinned tail, not process); mock
#dogfood path generates a real styled docx; runmgr skips string
indexing for binary office mimes
- go test ./... 19 packages ok (incl. new e2e asserting <w:tbl> and
title text inside the artifact served by the API)
Impact: model-written documents open in Word/WPS with real layout and
preview with formatting (mammoth maps Heading1-4 to h1-h4); every tool
artifact now lands as a visible in-chat card; no behavior change for
text artifacts.
Refs: task feature/deliverable-docx-r1
Why: D48-D51 approved — cross-session inbox so todos are not lost across
conversations.
Evidence: store v12 index + ListProjectCards aggregate (D49 verdict:
project cards any status + per-conversation action_required only);
cardsvc project-stream emit/mirror via project:<id> pseudo-key (helpers
in core PR #11/#12) and ToProject (idempotent via ref, dismisses origin,
refuses flow-bound hitl/cmd cards); runmgr scope=project ownership;
llm.go scope param on submit_card/card_begin; server routes
GET /api/projects/{id}/cards, POST /api/cards/{id}/to_project, events
scope=project; vendored core synced; new tests ToProject/,
TestLLMRunnerCardScopeProject, e2e TestProjectInbox; e2e server now
wires production card emitter (no-op before).
Impact: additive; no change to existing conversation flows.
Refs: documents proposal 2026-09-30-card-stream-artifact-unify-project-inbox.md (D48-D52).
Why: D46/D47 approved — artifact_ref parts left only a name line in model
context (next-turn amnesia on big tool results), and artifacts had no
inbox presence unlike submit_card products.
Evidence: ctxasm ArtifactResolver backfills UTF-8 artifact text with the
card char limit (Truncations + artifact(n) observable; binary keeps
placeholder); runmgr runCtx.Artifact; llm.go auto-creates a result facade
card (summary kv + doc-ref) when a tool result is truncated, suppressed
when the run already submitted an explicit card; mock #doc demos the
facade; new tests TestAssembleInputArtifactBackfill,
TestLLMRunnerArtifactFacadeCard/Suppressed, e2e TestArtifactFacadeCard.
Impact: frontend unchanged — artifact chips and doc-ref already resolve
via docBridge; no wire protocol change.
Refs: documents proposal 2026-09-30-card-stream-artifact-unify-project-inbox.md (D46/D47).
Why: D44/D45 approved — card content streaming lets users watch long
artifacts materialize in the inbox instead of a single submit_card blob.
Evidence: cardsvc Append with 250ms emit throttle (persist-every-append);
runmgr Begin/Append/CommitStreamCard + finishRun fallback marking
uncommitted stream cards done/failed with warn tone; llm.go declares the
three tools under ui.cardflow with hallucination rejection; mock
#cardstream demo; new unit tests (TestLLMRunnerCardStreamTools/Gated,
TestAppendStreamThrottleAndMerge) and e2e TestMockCardflowStreamLoop.
Impact: no change to existing submit_card path or wire protocol;
card.updated payload already carried full cards (projection semantics).
Refs: documents proposal 2026-09-30-card-stream-artifact-unify-project-inbox.md (D44/D45).
Why: the adjudicated preview plan needs server-side OG fetching for link
cards, and the proposal's reserved-capability items call for the fs tool
family to exist behind a default-off gate (implemented, not offered).
Evidence: GET /api/url-preview fetches and parses og:title/description/
site_name/image/favicon with a 5s timeout, 256KB body cap, text/html
content check, TTL cache, and SSRF guards enforced at dial time (loopback
/private/link-local/multicast/reserved/CGNAT rejected per hop, anti DNS-
rebind; AS_URL_PREVIEW_ALLOW_PRIVATE=1 exists for local testing only,
default fail-closed; errors return sanitized cards, never internal
addresses). fs_read_file/fs_write_file/fs_list_dir register as Hidden
tools sandboxed under <root>/<owner>/<conversationId>: traversal,
absolute paths, backslashes, and symlink escape rejected; 1MB/2MB size
caps; writes register an artifact so workspace files stay visible in the
panel. ToolDesc.Hidden gates both model visibility (runctx.Tools) and
/api/tools listing on runtime.fsTools, and registry.Execute re-checks
fail-closed. ToolExecCtx gains OwnerID/WorkspaceRoot/SettingBool.
go test ./... green (fs negative matrix, SSRF negatives, endpoint
fail-closed, cache).
Impact: link previews work end to end once the frontend wires the
fetcher; fs tools are inert until runtime.fsTools is enabled.
Refs: task feature/file-preview-caps; core 4d29301.
Why: generated deliverables (e.g. meeting-minutes docx) had no reliable
download path — the content endpoint set no Content-Disposition, so the
filename only survived via the front-end <a download> attribute, and
contentTypeOf returned text/plain for any artifact whose MIME column was
empty, mangling office/pdf uploads.
Evidence: artifactContent now always sets Content-Disposition (inline by
default, attachment with ?download=1) with an RFC 5987 filename* for
non-ASCII names plus an ASCII fallback; contentTypeOf consults an
explicit office-format extension table then mime.TypeByExtension before
the kind fallbacks. New tests cover disposition on both modes, the
encoded Chinese filename, and the extension/mime precedence chain;
go test ./... green.
Impact: front-ends can link direct download URLs and browsers receive
correct file types for docx/xlsx/pptx/pdf/csv/md regardless of the
stored MIME value.
Refs: task feature/chat-order-artifact-files.
Why: conversation transcripts were the only project channel not
readable across sessions (artifacts/knowledge are already shared),
which caused duplicate parallel work; see proposal
2026-09-30-cross-session-reading.
Evidence: runmgr/crossread_test.go covers the full gate matrix
(project gate on/off x outbound flag x private target x cross-project
x cross-tenant x self-read x archived x limit clamping) against a real
store + settings chain; store tests cover migration v11, flag
persistence and tenant isolation; tools/peers_test.go covers args
validation, transcript rendering and the untrusted-content banner;
go test ./... green.
Impact: setting crossSession.read (default off, schema-driven);
conversation columns allow_cross_read (default true) and cross_private
(default false) with PATCH support; builtin tools list_conversations
and read_conversation gated fail-closed in runmgr toolCtx; nested
agent-system-core pin bumped to fd44179 (Core PR #6).
Refs: Agent-System-Documents proposals/2026-09-30-cross-session-reading.md
(Dev task feature/cross-session-reading).
Why: the user ruled out self-registration (2026-09-30): accounts are
created only by admins who set an initial password; first login (and
first login after any admin reset) must force a password change.
Evidence:
- migration v10 auth_accounts (users password/must_change/is_admin +
sessions table; upgrade test walks v1<->v10 both directions).
- argon2id hash/verify with PHC encoding; store tests cover hash
roundtrip, duplicate-owner conflict, must-change lifecycle, session
keep/except semantics.
- e2e TestAdminAccountFlow: static login page reachable without auth,
wrong password 401, login sets HttpOnly cookie + mustChangePassword,
admin creates user (409 on duplicate), non-admin create 403, forced
change clears flag and old password dies, admin reset revokes sessions
and re-arms forced change, API-key channel untouched, 5-fail backoff
429, logout kills session. Full go test ./... green.
Impact: middleware now accepts Bearer key OR session cookie and exempts
static + /api/auth/login (also fixes the latent case where the login
page itself could 401). Embedded no-auth mode unchanged.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (admin-issued
variant, user decision 2026-09-30)
Why: a non-nil Authenticator with Enabled=false is the embedded no-auth
mode; reporting auth=true there made the sidebar account footer show
the wrong identity state (found in the live headless walk).
Evidence: restarted binary now returns {"auth":false,...} in embedded
mode; TestTaskListAndFlags still green.
Impact: response field value only.
Why: the task-centric sidebar (approved option A) needs a cross-project
conversation list, server-authoritative pinned/archived state, and an
identity endpoint for the sidebar account footer.
Evidence:
- migration v8 conversation_flags (sqlite/postgres up+down; the upgrade
test walks v1<->v8 for real); store and e2e tests cover pinned-first
ordering, archived filtering with ?archived=1, tenant-isolation
negatives (cross-owner flag write -> NotFound), and /api/me shape
(owner/name/auth) in embedded mode.
- go vet + full go test ./... pass.
Impact: additive columns/APIs; existing endpoints unchanged (PATCH gains
optional pinned/archived fields; responses keep prior shape).
Refs: core bump deps/agent-system-core -> 1dc08fc (Conversation flags)
Why: prompts lived inline in Go (profile const, subagent string, squad
role one-liners, tool descriptions) - every copy change shipped code,
and task guidance like meeting-minutes quality lived permanently in the
base prompt whether or not the task was at hand.
Evidence: new prompts package tests (library integrity, default
assembly, skill triggering incl. attachment gate and command bypass,
priority supersession, override chain drift, command match, frontmatter
parse); composite make test green; runtime check on a live server
(40 modules across 7 layers, override round-trip, /minutes starts a
run instead of hitting the command bus).
Impact: 40 builtin modules as embed data (5 base + 1 env + 12 task
skills + 10 agent roles + 7 tool descriptions + 3 aux templates + 2
styles); migration v8 adds prompt_modules for user overrides with
basedOnVersion drift markers; ctxasm assembles multi-segment system
messages with per-module observability; subagent/squad/tool copy now
resolve from the library with inline fallbacks; skill commands surface
in the / menu and route to runs; default profile SystemPrompt empties
onto the library base; pins deps/agent-system-core to the contract
commit.
Refs: feature/prompt-library task card; design guide in Documents.
Why: T4 workspaces are declared by plugins via provides.workspaces (Core PluginWorkspace is the authoritative type); the host must surface the merged overlay for the frontend to render in OverlayHost.
Evidence: go test green - plugins suite new TestWorkspacesOverlay (manifest + workspaces/main.json loads, ListWorkspaces returns the declaration with shortcut and body); full internal sweep unchanged.
Impact: plugins host loads workspaces/*.json assets and exposes ListWorkspaces; server adds GET /api/workspaces passthrough; no behavior change without the manifest key.
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T4; task card feature/workspaces-r1
Why: T3 of the interaction foundation - unify button/card/slash/chat entries onto one command bus (D27) composing the Agent-Command library (D30), with danger=high commands gated behind inline confirm cards and every dispatch leaving the same audit envelope.
Evidence: go test green - cmdbus suite (four-entrance audit symmetry, high-danger confirm lifecycle incl. cancel/expiry/handler-reject, audit-unavailable yields unknown, plugin spec fail-closed, schema scalar validation) and server e2e (danger command via POST /api/commands -> confirm card -> card action confirm -> committed receipt -> audit query ordered accepted->committed); legacy /help,/new,/mock,/model,/profile contract preserved through the bus; store migration v7 command_audit (both dialects) with roundtrip test updated.
Impact: new internal/cmdbus (L1 package per D33), server routes POST /api/commands/{id} + GET /api/commands/audit + registry-driven GET /api/commands, postMessage chat-entrance dispatch when the intent gate matches a registered command, plugins host OnCommands overlay, module cards policy/modules/{cmdbus,cardsvc}.md; pending confirm state is process-local (documented limitation).
Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T3; task card feature/command-bus-r1
Why: The frontend appends the confirmation receipt locally so it appears
immediately; returning the server-persisted message (with its id) keeps the
authoritative reconcile duplicate-free.
Evidence: go build green; covered by combo test in Dev.
Impact: response shape gains receipt field (additive).
Refs: proposal 2026-09-30-ui-inbox-command-workspace
Why: T2 of the interaction foundation — activity cards as first-class state
objects behind the right-rail inbox (proposal D25): upload ingest cards
(SR-A5 failures explicit, artifact retrievable), HITL projection cards
(double-presence, ref-linked two-way sync), squad orchestration cards and
the mock #upload demo of the full card lifecycle.
Evidence: go test ./... green across 14 packages incl. new cardsvc suite
(lifecycle, action labels and idempotency, pin/dismiss, owner isolation,
resolve-by-ref idempotency) and updated migration test (v6 activity_cards,
both dialects); events flow through the session event buffer (persist, seq,
replay); receipts appended to the conversation timeline on card actions.
Impact: additive; cards disabled (SetCards nil) degenerates to the T0
baseline; upload cards persist at project level per the v1 inbox boundary
(conversation-scoped inbox; project-level aggregation is follow-up).
Refs: modules/documents docs/proposals/2026-09-30-ui-inbox-command-workspace.md
Details (original message):
Add the vector RAG pipeline: paragraph chunker, OpenAI-compatible embeddings and rerank clients, dual-tier vector store with cosine search, and RRF hybrid retrieval
weichen
