weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,524 Commits 10 Branches 15 Tags
dev
Commit Graph
10 Commits
Author SHA1 Message Date
weichen 6a3a0dc201 fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1) 
- FIND-SEC-01: GetUserContext requires session ownership (handler 403 +
  SQL/memory owner filter); in-memory HTTP + isolated-PG regressions
- FIND-ARCH-01: archtest fails closed on untracked table writes (+noise
  exemption) and registers 50 existing writer tables in table_owners
- FIND-SEC-02: Authorizer without pool denies by default; explicit
  NewInMemoryAuthorizer seam opt-in via ALLOW_IN_MEMORY at composition
- FIND-SEC-03: swboot commands run argv-exec (no sh -c) with exact
  basename allowlist match; prefix-spoof and no-shell-eval tests
- FIND-FLOW-01: confirm rejects validated_only plans; ExecuteClaimed
  hard-refuses validated_only steps (new error codes + HTTP mapping)
- FIND-QUAL-01: intentflow.ValidateFlagConsistency fail-fast at Assemble
 2026-09-26 02:00:14 +00:00
weichen 61d728f905 fix(intentflow): pass slots/summary into confirm-time Authorize 
DocGov (and other summary-keyed adapters) resolve doc_id from step slots
or safe_summary; authorizeDecision omitted both, so U11 confirm failed
closed with PLAN_ACTION_FORBIDDEN despite a bound resource version.
 2026-09-23 15:47:44 +00:00
weichen dbae19e80d fix(intentflow): bind resource versions for U10/U11 at plan create 
Mutate/docgov live Authorize requires ExpectedResourceVersion; populate it
(and frame slots) when HandleTurn drafts confirm-class steps so confirm
no longer fails closed with PLAN_ACTION_VERSION_CONFLICT.
 2026-09-23 15:44:48 +00:00
weichen c07d4020d0 feat(intentflow): I2 shadow tier, project allowlist, and rollout metrics 
Persist validated_only shadow plans without executing, gate elevated tiers
behind INTENT_PLAN_PROJECT_ALLOWLIST, and keep legacy chat routing for shadow.
 2026-09-23 15:10:26 +00:00
WeiCHEN d019388f37 feat(intent): wire production QueryOwner and confirm dispatcher 
Replace FakeActionOwner with QueryOwner+QueryGuard at the composition
root; DispatchEligible reuses claim/execute/recover so confirm stays
zero-write before dispatch and default tier remains legacy.
 2026-09-22 21:44:56 +08:00
weichenandCursor 2e99ee3661 feat(intentflow): route confirmed generate steps through a task adapter 
Persist ComboNeedsConfirm plans at confirm tier without executing writes, then run task.run via OwnerMux and a stable idempotency key.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 02:24:23 +00:00
weichenandCursor 702cf6f949 feat(intentflow): execute auto_read query plans from HandleTurn 
Default legacy stays a no-op; QueryGuard refuses generate keys until U8.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 01:40:07 +00:00
weichenandCursor 08aa56b16c feat(intentflow): re-authorize steps before confirm and execute 
Confirmation stays a command receipt; FakeActionOwner now fail-closes on revoke and resource version drift.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 01:01:39 +00:00
weichenandCursor c36d891b05 feat(intentflow): emit plan facts onto Track E outbox 
Append awaiting/step/completed envelopes in the command UoW and project them without changing dispatcher leases.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 00:46:09 +00:00
weichenandCursor da0b3d812b feat(intentflow): persist plans with CAS lease and fencing 
Own plan/step/decision writes behind UoW so two workers cannot both execute the same step.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-15 23:43:46 +00:00