9 Commits
Author SHA1 Message Date
weichenandCursor c0e7df5abf feat(docgov): expose proposal HTTP and wire frontend decide flow
Add POST /api/v1/docgov/proposal for ProposeModification, harden decide
status mapping, and replace App pendingProposal local mock with real API calls.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:07:52 +00:00
weichenandCursor 7fdbee6c0c test(server): adapt fixtures to IAM dual-gate fail-closed
Boot memory IAM only via explicit test env opt-in; strict auth cases
disable AllowInMemory after startup.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-16 09:42:07 +00:00
weichenandCursor 73ae4b8f5b fix(server): drain taskrun workers before TempDir cleanup
Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-16 09:33:41 +00:00
weichenandCursor 3f42149457 feat(bizdev): snapshot collaborators onto Runtime and Server ports
Composition roots copy Parts once so HTTP/CLI handlers stop calling locator getters on every request.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-15 13:00:33 +00:00
weichen deaec82a7c test(chat): cover readonly summary HTTP path 2026-09-13 04:29:17 +00:00
weichen 3145550a59 feat(security): complete P0 release blocking remediation
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
2026-09-13 02:50:22 +00:00
WeiCHENandCursor f4e4357ddb fix(agent): Chat Agent 全链路 P0-P5 整改
封堵鉴权旁路与导出 IDOR,DocGov 改服务端身份;对话层 PendingAction 接真实 docgov/taskrun;修复流式租约假死与会话级任务流;加固配置/doc_id/NULL;补齐 slog 与测试;前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
WeiCHENandCursor 44ebafd946 test(api): add e2e integration tests for claimed document SSE and docgov RESTful APIs
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:19 +00:00
WeiCHENandCursor 810eb26be3 feat(api): 实现HTTP服务骨架与Server-Sent Events流式交互接口
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:19 +00:00