9 Commits
Author SHA1 Message Date
weichen 3e01f18756 merge: integrate final-artifact-vault into local_dev (authorized exception)
User authorized lifting CURRENT FAV whole-branch merge protection on
2026-09-23. Keep FAV_DEGRADED_READ/FAV_PUBLISHER_ENABLED default false.
Drop duplicate goose 00034 (local_dev already has 00036). Preserve
agentx workspace admin routes and pin-export wiring.
2026-09-23 13:57:08 +00:00
weichen 738bbe1579 feat(agent): add pi-native backend and drop cursor-cli
Keep the container pi-agent backend as the default while the in-process runtime is available beside it, and remove the unused cursor bridge.
2026-09-21 14:52:53 +00:00
weichenandCursor cdbf9cab63 fix(config): layer root .env over configs/.env.{ENV} for KB auth
Stop using a fake default KB password; merge Compose-style env files and
rewrite compose DNS to localhost on the host so go test/E2E authenticate.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 02:03:07 +00:00
weichenandCursor 3478a5a05a feat(config): add FAV vault flags defaulting off
Gate FAV_DEGRADED_READ and FAV_PUBLISHER_ENABLED behind explicit opt-in,
and refuse VAULT_STATE_ROOT colliding with runtime data/{env}.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-16 15:40:10 +00:00
weichenandCursor ad9b67d599 feat(artifactvault): close same-tx staging, recover-apply, and GET zero-write gaps
Approve/commit now write FAV staging in the domain transaction, recover-apply materializes scratch collections, and unpublished or GET paths cannot mutate the registry.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-14 12:52:28 +00:00
weichenandCursor fe0bb3a503 fix(config): layer root and env compose files with expanded overrides
Load agent/cursor env overrides in config loader; pass root .env plus
environment-specific env files in env-service; align compose env_file mounts.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:55:18 +00:00
weichen 171959710d fix(security): add CORS allowlist and enforce principal on chat handlers
Replace wildcard CORS with configured origins and bind chat/task user
identity to the authenticated principal instead of request body fields.
2026-09-13 02:50:22 +00:00
WeiCHENandCursor f4e4357ddb fix(agent): Chat Agent 全链路 P0-P5 整改
封堵鉴权旁路与导出 IDOR,DocGov 改服务端身份;对话层 PendingAction 接真实 docgov/taskrun;修复流式租约假死与会话级任务流;加固配置/doc_id/NULL;补齐 slog 与测试;前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
WeiCHENandCursor 68d58df38f chore(config): initialize go module and configuration loader
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:18 +00:00