weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 7 Actions 3 Packages Projects Releases Wiki Activity

agent-exec transport f3333c654e1ba857d9723b91a38c443f/9addf6d9ab1a

Browse Source
This commit is contained in:
agent-exec-transport
2026-10-22 12:47:52 +00:00
parent 6bec85e1f8
commit a69e8c82bd
11 changed files with 48 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+5 -5
View File
@@ -35,7 +35,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -219,7 +219,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -410,7 +410,7 @@ jobs:
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
export GIT_CONFIG_VALUE_2="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
export GIT_CONFIG_KEY_3="core.hooksPath"
export GIT_CONFIG_VALUE_3="/dev/null"
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
@@ -544,7 +544,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -698,7 +698,7 @@ jobs:
export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
export GIT_CONFIG_VALUE_2="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
export GIT_CONFIG_KEY_3="core.hooksPath"
export GIT_CONFIG_VALUE_3="/dev/null"
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
.gitmodules
+14 -14
View File
@@ -1,42 +1,42 @@
[submodule "modules/core"]
path = modules/core
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Core.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Core.git
[submodule "modules/backend"]
path = modules/backend
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Backend.git
[submodule "modules/frontend"]
path = modules/frontend
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Frontend.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Frontend.git
[submodule "modules/documents"]
path = modules/documents
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Documents.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Documents.git
[submodule "deps/development-guidelines"]
path = deps/development-guidelines
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git
[submodule "deps/agent-native"]
path = deps/agent-native
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Native.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Native.git
[submodule "deps/agent-squad"]
path = deps/agent-squad
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Squad.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Squad.git
[submodule "deps/agent-intent"]
path = deps/agent-intent
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Intent.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Intent.git
[submodule "deps/error-code-system"]
path = deps/error-code-system
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Error-Code-System.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Error-Code-System.git
[submodule "deps/logging-system"]
path = deps/logging-system
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Logging-System.git
[submodule "modules/ui"]
path = modules/ui
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-UI.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-UI.git
[submodule "deps/agent-command"]
path = deps/agent-command
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Command.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Command.git
[submodule "deps/development-manager"]
path = deps/development-manager
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Manager.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Manager.git
[submodule "deps/agent-document-renderer"]
path = deps/agent-document-renderer
url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Document-Renderer.git
url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Document-Renderer.git
policy/delivery.md
+1 -1
View File
@@ -381,7 +381,7 @@ Review 只将阻塞项列为必修；非阻塞意见标明后续建议，不得
解决冲突和重跑最终 CI。本节只安排 Dev `refs/heads/main` 的最终交付顺序；需求、授权、阶段状态和
证据仍在原任务卡，受保护分支的最终准入仍由 Gitea 执行。
- **队列**：Dev main 只用一份[合入队列 #518](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/issues/518)，
- **队列**：Dev main 只用一份[合入队列 #518](https://gitea.naitangbaobao.cn/weichen/Agent-System-Dev/issues/518)，
只记录顺序和当前窗口：任务/PR、owner、依赖、就绪状态、当前 base/head、CI、合入结果。
- **职责**：协调智能体维护顺序和窗口；任务 owner 负责分支内容和必要整改；窗口内的同步、冲突处置、
Review、当前 HEAD CI 核验和所有 PR 合入由智能体执行。
policy/facts.md
+3 -3
View File
@@ -15,9 +15,9 @@
| ID | 事实 | 验证命令 | last_verified | TTL(天) |
|---|---|---|---|---|
| F1 | Gitea Web/API 可达：https://git-home.u1680832.nyat.app:30319（1.27.3） | `curl -fsS -m 10 https://git-home.u1680832.nyat.app:30319/api/v1/version` | 2026-10-14 | 30 |
| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv） | `bash scripts/facts-verify.sh api-token https://git-home.u1680832.nyat.app:30319/api/v1/user` | 2026-10-14 | 30 |
| F3 | Git over SSH 可达：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git HEAD` | 2026-10-14 | 30 |
| F1 | Gitea Web/API 可达：https://gitea.naitangbaobao.cn（1.27.3） | `curl -fsS -m 10 https://gitea.naitangbaobao.cn/api/v1/version` | 2026-10-22 | 30 |
| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv） | `bash scripts/facts-verify.sh api-token https://gitea.naitangbaobao.cn/api/v1/user` | 2026-10-22 | 30 |
| F3 | Git over SSH 可达：ssh://git@gitea.naitangbaobao.cn:52222/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git HEAD` | 2026-10-22 | 30 |
| F4 | 旧端点 git-panel.u1680832.nyat.app:30319 TCP 可连通但 TLS 握手失败（仅 TLS 层握手错误判 PASS） | `bash scripts/facts-verify.sh tls-handshake-fails git-panel.u1680832.nyat.app 30319` | 2026-10-14 | 180 |
| F5 | 基座 users 表存有姓名（name 列，CreateAccount/ListUsersAdmin 读写；EXT-19 目录自 P3 起向授权管理读面下发） | `cd modules/backend && go test ./internal/app/ -run TestInprocHostSearchAccounts -count=1` | 2026-10-14 | 180 |
| F6 | 基座账号无停用位（users 表无 disabled；EXT-19 Valid 恒为存在性）——停用机制未实现，不得当已具备 | `cd modules/backend && ! grep -rn -e disabled -e Disabled internal/store/auth.go pkg/extension/extension.go` | 2026-10-14 | 180 |
scripts/facts-verify.sh
+2 -2
View File
@@ -4,7 +4,7 @@
# 用法：make facts-verify [ARGS=--update] （--update：把 PASS 项 last_verified 刷为当天并写回）
# 表内验证命令约定不含竖线；含 "\|" 转义时按字面还原后执行。
# 登记表引用的探针子命令（单独运行时在 stderr 说明判定，不输出凭据）：
# api-token URL URL 须逐字等于登记端点 https://git-home.u1680832.nyat.app:30319/api/v1/user，
# api-token URL URL 须逐字等于登记端点 https://gitea.naitangbaobao.cn/api/v1/user，
# 校验通过后才进程内读 ~/.secrets/gitea HOME 段 ACCESS_TOKEN 并 GET（不跟随重定向）；
# 0=接受 3=缺失 4=格式不符 5=请求失败/被拒/重定向 6=非登记端点
# tls-handshake-fails HOST PORT 仅当 TCP 已连通且 TLS 层握手报错时 0；
@@ -20,7 +20,7 @@ import sys, urllib.request
sys.path.insert(0, sys.argv[1])
import task_triage
ENDPOINT = "https://git-home.u1680832.nyat.app:30319/api/v1/user"
ENDPOINT = "https://gitea.naitangbaobao.cn/api/v1/user"
if sys.argv[2] != ENDPOINT:
print("api-token: URL 不是 policy/facts.md F2 登记端点，拒绝发送凭据", file=sys.stderr)
sys.exit(6)
scripts/svc.sh
+1 -1
View File
@@ -144,7 +144,7 @@ SRC_DIR="${SVC_SRC_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/agent-system-svc/src}"
# 独立 RDM 源仓（下游组合仓 Agent-System-RDM 的干净克隆；SVC_RDM_SRC_DIR 覆盖路径，
# SVC_RDM_ORIGIN 覆盖克隆来源）。rdm 源的解析/列举/物化全部基于它，语义与 SRC_DIR 一致。
RDM_SRC_DIR="${SVC_RDM_SRC_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/agent-system-svc/rdm-src}"
RDM_ORIGIN_DEFAULT="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-RDM.git"
RDM_ORIGIN_DEFAULT="ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-RDM.git"
# 提示信息走 stderr：stdout 只留给数据（提交表/服务表/DSN），便于 $( ) 捕获组合。
c_info() { [ "${CLI_QUIET:-0}" = 1 ] && return 0; printf '\033[1;34m[svc]\033[0m %s\n' "$*" >&2; }
scripts/task.sh
+3 -3
View File
@@ -813,7 +813,7 @@ card_merge_squash() { # $1=branch $2=ref → squash/rebase 落地没有 merge
# 仅查最近 5 页（250 条）：card_merge 的 merge 提交路径仍是主路径，此兜底面向新近任务卡。
local token="${GITEA_TOKEN:-}" web_base url repo owner api payload pg found sha
[ -n "$token" ] || return 1
web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}"
web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}"
url=$(git remote get-url origin 2>/dev/null) || return 1
url="${url%.git}"
repo=$(basename "$url"); owner=$(basename "$(dirname "$url")")
@@ -951,7 +951,7 @@ cmd_close_self() {
esac
pr="$nums"
fi
web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}"
web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}"
url=$(git remote get-url origin); url="${url%.git}"
repo=$(basename "$url"); owner=$(basename "$(dirname "$url")")
link="${web_base}/${owner}/${repo}/pulls/${pr}"
@@ -981,7 +981,7 @@ cmd_close() {
fetch_target
# 默认值取远端通告的 Web 面（git push 输出的 PR 建议链接）；可用 TASK_CARD_WEB_BASE 覆盖。
# git-panel 前缀已失效（TLS 握手失败），默认值改为实测可用的 git-home（AGENTS.md 访问事实节）。
local web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}"
local web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}"
local url owner repo
url=$(git remote get-url origin); url="${url%.git}"
repo=$(basename "$url"); owner=$(basename "$(dirname "$url")")
scripts/task_triage.py
+1 -1
View File
@@ -29,7 +29,7 @@ import urllib.parse
import urllib.request
SCHEMA = "agent-system/task-triage/v1"
DEFAULT_API = "https://git-home.u1680832.nyat.app:30319/api/v1"
DEFAULT_API = "https://gitea.naitangbaobao.cn/api/v1"
DEFAULT_TARGET = "main"
DEFAULT_MAX_AGE = 14400
PAGE_LIMIT = 50
tests/test_ci_credentials.py
+2 -2
View File
@@ -11,8 +11,8 @@ from urllib.parse import urlsplit
WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/ci.yaml"
SERVER = "https://git-home.u1680832.nyat.app:30319"
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SERVER = "https://gitea.naitangbaobao.cn"
SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
ROOT_TOKEN = "synthetic-root-token-not-a-real-secret"
SUB_TOKEN = "synthetic-component-token-not-a-real-secret"
tests/test_facts_verify.py
+15 -15
View File
@@ -256,7 +256,7 @@ class FactsVerifyTests(unittest.TestCase):
self.assert_status(result.stdout, "F2", "PASS")
requests = self.stub_events("http")
self.assertEqual(len(requests), 1, requests)
self.assertEqual(requests[0]["url"], "https://git-home.u1680832.nyat.app:30319/api/v1/user")
self.assertEqual(requests[0]["url"], "https://gitea.naitangbaobao.cn/api/v1/user")
self.assertEqual(requests[0]["authorization"], "token " + HOME_TOKEN)
self.assertEqual(self.dates(), {"F2": self.today, "F8": self.today, "F9": OLD_DATE})
self.assertTrue(receipt.exists(), result.stderr)
@@ -285,7 +285,7 @@ class FactsVerifyTests(unittest.TestCase):
self.assert_status(result.stdout, "F2", "FAIL")
self.assertEqual(self.stub_events("http"), [], "no request without a valid HOME token")
self.assertEqual(self.dates()["F2"], OLD_DATE)
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user")
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user")
self.assertNotEqual(direct.returncode, 0)
self.assertIn("ACCESS_TOKEN", direct.stderr)
self.assert_no_secrets(result.stdout, result.stderr, direct.stdout, direct.stderr,
@@ -299,7 +299,7 @@ class FactsVerifyTests(unittest.TestCase):
result = self.run_script("--update", http=http)
self.assert_status(result.stdout, "F2", "FAIL")
self.assertEqual(self.dates(), {"F2": OLD_DATE, "F8": self.today, "F9": OLD_DATE})
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user",
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user",
http=http)
self.assertNotEqual(direct.returncode, 0)
self.assertNotIn("Authorization", direct.stderr)
@@ -307,17 +307,17 @@ class FactsVerifyTests(unittest.TestCase):
def test_f2_rejects_unregistered_destination_before_reading_credentials(self):
bad_urls = [
"http://git-home.u1680832.nyat.app:30319/api/v1/user",
"http://gitea.naitangbaobao.cn/api/v1/user",
"https://evil.invalid/api/v1/user",
"https://git-home.u1680832.nyat.app:30320/api/v1/user",
"https://git-home.u1680832.nyat.app/api/v1/user",
"https://user:pw@git-home.u1680832.nyat.app:30319/api/v1/user",
"https://git-home.u1680832.nyat.app:30319@evil.invalid/api/v1/user",
"https://git-home.u1680832.nyat.app:30319/api/v1/user#frag",
"https://git-home.u1680832.nyat.app:30319/api/v1/user?next=https://evil.invalid",
"https://git-home.u1680832.nyat.app:30319/api/v1/users",
"https://git-home.u1680832.nyat.app:30319/api/v1/user/../admin",
"https://git-home.u1680832.nyat.app:30319/api/v1/user ",
"https://gitea.naitangbaobao.cn:30320/api/v1/user",
"https://gitea.naitangbaobao.cn:443/api/v1/user",
"https://user:pw@gitea.naitangbaobao.cn/api/v1/user",
"https://gitea.naitangbaobao.cn@evil.invalid/api/v1/user",
"https://gitea.naitangbaobao.cn/api/v1/user#frag",
"https://gitea.naitangbaobao.cn/api/v1/user?next=https://evil.invalid",
"https://gitea.naitangbaobao.cn/api/v1/users",
"https://gitea.naitangbaobao.cn/api/v1/user/../admin",
"https://gitea.naitangbaobao.cn/api/v1/user ",
]
for secrets_present in (True, False):
if not secrets_present:
@@ -337,12 +337,12 @@ class FactsVerifyTests(unittest.TestCase):
for code in ("301", "302", "303", "307", "308"):
with self.subTest(code):
self.stub_log.unlink(missing_ok=True)
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user",
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user",
http=code)
self.assertEqual(direct.returncode, 5, direct.stderr)
requests = self.stub_events("http")
self.assertEqual([r["url"] for r in requests],
["https://git-home.u1680832.nyat.app:30319/api/v1/user"], "no follow-up request")
["https://gitea.naitangbaobao.cn/api/v1/user"], "no follow-up request")
self.assertNotIn("redirect-target", direct.stdout + direct.stderr)
self.assert_no_secrets(direct.stdout, direct.stderr)
tests/test_svc_realcombo.py
+1 -1
View File
@@ -56,7 +56,7 @@ def ci_git_env():
"GIT_CONFIG_KEY_1": "http.%s/.extraheader" % CI_SERVER,
"GIT_CONFIG_VALUE_1": "AUTHORIZATION: token " + CI_TOKEN,
"GIT_CONFIG_KEY_2": "url.%s/weichen/.insteadOf" % CI_SERVER,
"GIT_CONFIG_VALUE_2": "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/",
"GIT_CONFIG_VALUE_2": "ssh://git@gitea.naitangbaobao.cn:52222/weichen/",
"GIT_CONFIG_KEY_3": "core.hooksPath",
"GIT_CONFIG_VALUE_3": "/dev/null",
}