weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
274 Commits 10 Branches 15 Tags
77d3da116fbfe876ddd2182d033f8fef31c9f7ce
Commit Graph
274 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weichen 77d3da116f docs: add Phase 1 IAM and authorization implementation plan 
Define the database, PostgresAuthStore, AuthorizationService, and frontend
capabilities workstream after Phase 0 security止血 is complete.
 2026-09-12 01:01:20 +00:00
weichen 8341168271 test(docs): extend Phase 0 security gates and archive test report 
Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0
security止血 acceptance report with PASS results.
 2026-09-12 01:00:58 +00:00
weichen b600c9d518 fix(auth): restrict demo seed users to dev/test environments 
Main no longer creates fixed-password demo accounts and legacy anonymous
fallback is limited to explicit dev/test in-memory fixtures.
 2026-09-12 01:00:58 +00:00
weichen 00ec89a6b3 fix(security): add CORS allowlist and enforce principal on chat handlers 
Replace wildcard CORS with configured origins and bind chat/task user
identity to the authenticated principal instead of request body fields.
 2026-09-12 01:00:58 +00:00
weichen 867f55f1e9 fix(web): remove identity simulation and stop sending X-User-ID 
Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.
 2026-09-12 01:00:58 +00:00
weichen e82b6242c7 docs: add production governance plan and Phase 0 authz matrix 
Freeze terminology and document the API resource-action matrix before
security止血 changes land in application code.
 2026-09-12 01:00:58 +00:00
weichen 82917799e8 docs(test): archive P0 remediation test report 2026-09-11 16:04:56 +00:00
weichen 2772c9e526 feat(security): complete P0 release blocking remediation 
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
 2026-09-11 16:04:53 +00:00
WeiCHENandCursor 8abf190e75 chore(deploy): 三环境 Compose 构建真实 app 镜像并补齐法规库运维 
将 dev/test/main 的 app 服务从占位容器改为 Dockerfile 多阶段构建，增加 healthcheck 与 .regulations 只读挂载；新增法规库备份/恢复脚本并同步 env-service 目录初始化与 gitignore。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 19:53:24 +08:00
WeiCHENandCursor 28faa4932d fix(agent): Chat Agent 全链路 P0-P5 整改 
封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 18:22:45 +08:00
WeiCHENandCursor ba249a56c8 chore: fix backfill script import and run projection for ws_intake 
Remove unused import so backfill can repair run_1789111889557885000
chat message and workflow_runs for project 56 intake workspace.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 16:53:21 +08:00
WeiCHENandCursor 60433f2a6b feat(web): sync workflow docs from server and persist task artifact in chat 
Pass doc_id on task runs, merge server deliverable state by task_key,
fetch controlled document content when opening non-template docs, and
map metadata.artifact after refresh.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 16:46:53 +08:00
WeiCHENandCursor bcfb9f415b feat(api): add workflow document list, content read, and backfill script 
Expose project controlled documents from DocGov, serve authenticated
output.md content by doc_id, and add idempotent backfill for run_1789111889557885000.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 16:46:53 +08:00
WeiCHENandCursor 6e489733ec feat(agent): unify async task FinalizeTaskRun projection to chat and runs 
Extend taskrun executors to return full TaskRunResult, finalize assistant
placeholder content with artifact metadata, and map quality_failed terminal
state instead of metadata-only updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 16:46:49 +08:00
WeiCHENandCursor edb6aa9e96 docs(test): add longtask P0 observer and materials test report 
Archive automated regression results for stream materials, observer disconnect,
project asset upload, and ResolveMaterials assembly.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 15:15:17 +08:00
WeiCHENandCursor 8e966db056 feat(web): asset upload, task run observer, and session lineage on tasks 
Upload binary attachments as project assets, subscribe by run_id after refresh,
and pass session_id/project_id through long-task requests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 15:15:16 +08:00
WeiCHENandCursor 63cc8ab1da feat(api): observer task runs decoupled from SSE lifecycle 
Add POST/GET/POST cancel task run APIs, background worker with event replay,
workspace reconcile, runner child cancel, and chat message metadata updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 15:15:15 +08:00
WeiCHENandCursor 463f7d5ea5 feat(agent): project asset upload and squad materials assembly 
Register uploads via CAS, resolve project asset pools into task materials
with server-side extraction, and propagate asset_id through the bizdev/squad chain.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 15:15:15 +08:00
WeiCHENandCursor 7d2f86bdc4 fix(api): pass materials through task/stage stream handlers 
Stream SSE path now forwards Materials to ExecuteTask/ExecuteStage, and
TestTaskStream_MaterialsInjection targets the real /tasks/run/stream endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 15:15:11 +08:00
WeiCHENandCursor 0c9c0928ec feat(web): wire project list and create to server API 
Login syncs projects from GET /api/v1/projects; create project uses POST with server-assigned id while preserving local sessions and templates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 14:28:01 +08:00
WeiCHENandCursor 4473115273 fix(web): align workbench user ids with auth seed 
Unify MOCK_USERS with backend auth (admin id=1), merge session identity on login, and migrate demo seeds/tests to id 2/3/4 for 张工/李/王.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 14:23:31 +08:00
WeiCHENandCursor 0fc16af9a3 fix(web): keep draft when send preflight fails 
Return accepted/error from handleSendMessage, clear InputArea only on success, and surface thinking/streaming feedback.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 14:23:28 +08:00
WeiCHENandCursor 78ad01b2da fix(web): add secure-context-safe clientTurnId helper 
Provide RFC 4122 v4 fallback via getRandomValues for LAN HTTP pages where randomUUID is unavailable.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 14:23:25 +08:00
WeiCHEN d084056638 feat(task): inject uploaded documents into task materials and enable LAN host access 
- backend: add Materials field to TaskRunRequestDTO and forward to ExecuteTask
- backend: add TestTaskStream_MaterialsInjection test case in taskstream_test.go
- web: serialize materials in buildTaskRequest and add unit test
- web: improve isSameMessage identity comparison in messageIdentity.ts
- web: configure host: '0.0.0.0' in vite.config.ts for LAN collaboration access
 2026-09-11 13:22:02 +08:00
WeiCHENandCursor 78b340fd35 docs(test): chat turn idempotency automated test report 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:20:13 +08:00
WeiCHENandCursor 2c98839b91 refactor(web): stop persisting full message list to localStorage 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:20:13 +08:00
WeiCHENandCursor 29cbd5a6ad feat(web): isolate stream runtime by session and turn 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:20:13 +08:00
WeiCHENandCursor 0dbfc32603 feat(web): send stable client_turn_id and resume turns after disconnect 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:20:13 +08:00
WeiCHENandCursor 1438af18f7 feat(api): gate chat stream on chat_turns with session serial execution 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:18:16 +08:00
WeiCHENandCursor 9202ca7bf3 feat(db): add chat_turns idempotency table 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:18:16 +08:00
WeiCHENandCursor 636e2c0cb4 fix(web): guard chat window fetch races on session switch 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:17:00 +08:00
WeiCHENandCursor 35aafa288d test(web): cover real temp vs server message identity 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:16:42 +08:00
WeiCHENandCursor f431414e29 fix(web): merge live and history by serverId and clientTurnId 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:16:42 +08:00
WeiCHENandCursor 69d8f2f50d feat(api): return user_message_id in SSE turn_ack and done 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:16:42 +08:00
WeiCHENandCursor d0e0b05bc8 fix(web): disable chat stream auto-retry without idempotency 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:15:25 +08:00
WeiCHENandCursor f4da2f179f docs(spec): chat turn idempotency and session isolation 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:15:07 +08:00
WeiCHENandCursor 8c8fa4721a chore(db): add ten-project chat seed migration and generator script 
Provide SQL migration and Python helper to import review demo sessions
and seed messages from tenProjectsSeed.json into Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:00:35 +08:00
WeiCHENandCursor 13e58814d7 feat(web): improve chat attachments, unread marks, and session UX 
Support richer attachment payloads in input area, local read-id cache for
unread badges, and expand private-shared and chronology test coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:00:34 +08:00
WeiCHENandCursor 79f86e2671 feat(web): align project templates with official reference skeletons 
Replace ad-hoc markdown stubs with reference-system template baselines,
free-text device type input, and add template quality regression tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:00:34 +08:00
WeiCHENandCursor 2c58e2d17c fix(workflow): reconcile version conflicts in review mode and UI retry 
Auto-adopt current workflow selection version in review/demo backend
paths, and retry frontend workflow switch after refreshing project version.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:00:33 +08:00
WeiCHENandCursor a865b68e36 fix(ctxmgr): normalize dismissed_unread_ids for Postgres array insert 
Ensure nil dismissed ID slices serialize as empty bigint arrays and
preallocate compressDismissed output to avoid NULL write failures.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 13:00:31 +08:00
WeiCHEN acedc2b0ba feat(doc-preview): 上传文档多格式在线预览 + IndexedDB 持久化恢复 
## 新增功能
- 支持用户上传的 Word(.docx)、PDF、Excel(.xlsx/.csv)、PPT(.pptx)、
  图像(png/jpg/svg/webp等)、纯文本/代码文件的在线高保真预览
- 预览与受控工作流文档严格隔离：上传文档走 FilePreviewPanel，
  工作流/对话入库文档继续走 BlockRenderer，互不干扰

## 核心 Bug 修复
- 修复页面刷新后上传文件无法预览/下载的根本问题
  - 根因：File 对象无法 JSON 序列化，刷新后内存引用丢失
  - 方案：新增 fileStore.ts，使用 IndexedDB 持久化文件二进制内容
  - App 启动时自动 restoreFileRawToDeliverables() 从 IndexedDB 恢复 fileRaw
  - 上传时 saveFile() 同步写入 IndexedDB（fire-and-forget）

## 下载按钮修复
- 优先从内存 File 对象动态创建 blob URL，避免依赖已 revoke 的旧 URL
- 文件内容不可用时按钮禁用并显示 tooltip 说明

## 存储层改进
- saveDeliverables() 序列化前剔除 fileRaw（不可持久化）和 blob: URL
  避免 localStorage 保存损坏的空对象

## 新增文件
- web/src/data/fileStore.ts — IndexedDB 封装（saveFile/getFile/restore）
- web/src/components/doc/preview/FilePreviewPanel.tsx — 预览面板主组件
- web/src/components/doc/preview/renderers/DocxViewer.tsx — Word 预览
- web/src/components/doc/preview/renderers/PdfViewer.tsx  — PDF 预览
- web/src/components/doc/preview/renderers/ExcelViewer.tsx — Excel 预览
- web/src/components/doc/preview/renderers/PptViewer.tsx  — PPT 预览
- web/src/components/doc/preview/renderers/ImageViewer.tsx — 图像预览
- web/src/components/doc/preview/renderers/TextViewer.tsx  — 文本预览
- web/src/tests/file-preview.test.ts — 预览功能单元测试
 2026-09-11 12:58:50 +08:00
WeiCHENandCursor 5ec5fca070 feat(intent): Phase 5 V2 shadow gray flags and IntentPlan execution 
Add env-based feature flags (intent_v2_shadow/decision, multi_intent,
workflow_intents), V1/V2 shadow diff reporting, expectation_plus_new plan
building, ranked-frame L2 conflict gate, and coordinator sequential query
plan execution with confirm-step deferral.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 11:59:16 +08:00
WeiCHENandCursor 7ae8d5f22c feat(intent): Phase 4 run control, subtypes, and limited IntentPlan 
Add RUN_STATUS_QUERY/RUN_RESUME/RUN_RESTART with matcher and coordinator
handlers; write QUERY_PROGRESS/SUPPLEMENT_INFO subtypes to V2 frame; support
safe query+query multi-intent plans via IntentPlan dual-write.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 11:56:24 +08:00
WeiCHENandCursor e3c62fbc57 feat(intent): Phase 3 workflow/help intents and coordinator handlers 
Add SWITCH/TRIGGER/QUERY workflow, doc status, help and unsupported intents
with ActionSpec registry entries, NL matchers, L2 handlers with creator-only
switch gate, router routes, and capability-aware AvailableActions.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 11:54:24 +08:00
WeiCHENandCursor cbe9f8c43a feat(intent): add V2 frame, ActionSpec registry, and legacy dual-write 
Introduce IntentFrameV2 with goal/object/relation/evidence, register all 21
legacy intents in ActionSpec registry, and dual-write intent_frame_v2 alongside
TopIntent without changing Router/Coordinator routing.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 11:50:56 +08:00
WeiCHENandCursor 7efe0ba5bd fix(intent): Phase 0+1 P0 safety gates for recognition and coordination 
Add golden-v1 hard-negative suite, shadow observability fields, query/command
negation gates for high-risk writes, AllowAffirmative enforcement, candidate
conflict clarification, and coordinator clarify-before-ambiguous ordering.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-11 11:49:20 +08:00
WeiCHEN 8f08a8dbe1 fix(chat): resolve intent recognition, workflow auth, and message ordering 2026-09-11 10:34:47 +08:00
WeiCHEN c72bcc8ab0 feat(project): implement modal-based project creation, creator-led member assignment, and exited-member read-only retention 2026-09-11 10:10:33 +08:00
WeiCHEN af003a3bb9 refactor(dialogue): implement task dispatch notifications and consecutive assistant messages with confirmation cards 2026-09-11 09:52:11 +08:00