weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
281 Commits 10 Branches 15 Tags
d612c1193ed11980131a5d62ce052d5db290dfcb
Commit Graph
281 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weichen d612c1193e fix(web): remove identity simulation and stop sending X-User-ID 
Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.
 2026-09-13 02:50:22 +00:00
weichen 886cbb7913 docs(plan): add production governance plan and Phase 0 authz matrix 2026-09-13 02:50:22 +00:00
weichen 36721f9c08 docs(test): archive P0 remediation test report 2026-09-13 02:50:22 +00:00
weichen 3145550a59 feat(security): complete P0 release blocking remediation 
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor ad2147445c chore(deploy): 三环境 Compose 构建真实 app 镜像并补齐法规库运维 
将 dev/test/main 的 app 服务从占位容器改为 Dockerfile 多阶段构建，增加 healthcheck 与 .regulations 只读挂载；新增法规库备份/恢复脚本并同步 env-service 目录初始化与 gitignore。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor f4e4357ddb fix(agent): Chat Agent 全链路 P0-P5 整改 
封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 21de3bc39e merge: feature/chat-idempotency-task — turn idempotency and task materials 2026-09-13 02:50:22 +00:00
WeiCHEN fcf00e7d1a chore(scripts): fix backfill script import and run projection for ws_intake 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 9d40a91f9d feat(web): sync workflow docs from server and persist task artifact in chat 
Pass doc_id on task runs, merge server deliverable state by task_key,
fetch controlled document content when opening non-template docs, and
map metadata.artifact after refresh.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 68765023a2 feat(api): add workflow document list, content read, and backfill script 
Expose project controlled documents from DocGov, serve authenticated
output.md content by doc_id, and add idempotent backfill for run_1789111889557885000.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 238f1d9346 feat(agent): unify async task FinalizeTaskRun projection to chat and runs 
Extend taskrun executors to return full TaskRunResult, finalize assistant
placeholder content with artifact metadata, and map quality_failed terminal
state instead of metadata-only updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 91b257393e docs(test): add longtask P0 observer and materials test report 
Archive automated regression results for stream materials, observer disconnect,
project asset upload, and ResolveMaterials assembly.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor bbd1218922 feat(web): asset upload, task run observer, and session lineage on tasks 
Upload binary attachments as project assets, subscribe by run_id after refresh,
and pass session_id/project_id through long-task requests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor e139b2b267 feat(api): observer task runs decoupled from SSE lifecycle 
Add POST/GET/POST cancel task run APIs, background worker with event replay,
workspace reconcile, runner child cancel, and chat message metadata updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 908d4bdb2e feat(agent): project asset upload and squad materials assembly 
Register uploads via CAS, resolve project asset pools into task materials
with server-side extraction, and propagate asset_id through the bizdev/squad chain.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 6f3a4d4c80 fix(api): pass materials through task/stage stream handlers 
Stream SSE path now forwards Materials to ExecuteTask/ExecuteStage, and
TestTaskStream_MaterialsInjection targets the real /tasks/run/stream endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 70493a3ed5 feat(web): wire project list and create to server API 
Login syncs projects from GET /api/v1/projects; create project uses POST with server-assigned id while preserving local sessions and templates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 636eb0ccf1 fix(web): align workbench user ids with auth seed 
Unify MOCK_USERS with backend auth (admin id=1), merge session identity on login, and migrate demo seeds/tests to id 2/3/4 for 张工/李/王.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor a8c8cba447 fix(web): keep draft when send preflight fails 
Return accepted/error from handleSendMessage, clear InputArea only on success, and surface thinking/streaming feedback.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor f9c4f9b01b fix(web): add secure-context-safe clientTurnId helper 
Provide RFC 4122 v4 fallback via getRandomValues for LAN HTTP pages where randomUUID is unavailable.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHEN eea28f0be4 feat(task): inject uploaded documents into task materials and enable LAN host access 
- backend: add Materials field to TaskRunRequestDTO and forward to ExecuteTask
- backend: add TestTaskStream_MaterialsInjection test case in taskstream_test.go
- web: serialize materials in buildTaskRequest and add unit test
- web: improve isSameMessage identity comparison in messageIdentity.ts
- web: configure host: '0.0.0.0' in vite.config.ts for LAN collaboration access
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor cc2aa33b10 docs(test): chat turn idempotency automated test report 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 7ab5041c59 refactor(web): stop persisting full message list to localStorage 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor d17fae0a5d feat(web): isolate stream runtime by session and turn 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor f5ead1dcd5 feat(web): send stable client_turn_id and resume turns after disconnect 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor a1cb4aade0 feat(api): gate chat stream on chat_turns with session serial execution 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen eb350d4367 merge: feature/web-chat-ux — SSE chat longtask history workflow and seed data 2026-09-13 02:50:21 +00:00
WeiCHENandCursor c887bc0480 feat(db): add chat_turns idempotency table 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 93ae180159 chore(db): add ten-project chat seed migration and generator script 
Provide SQL migration and Python helper to import review demo sessions
and seed messages from tenProjectsSeed.json into Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 62ab734021 fix(web): guard chat window fetch races on session switch 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor cda534a75d feat(web): improve chat attachments, unread marks, and session UX 
Support richer attachment payloads in input area, local read-id cache for
unread badges, and expand private-shared and chronology test coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 7c830146f5 test(web): cover real temp vs server message identity 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 6f4e8c0933 feat(web): align project templates with official reference skeletons 
Replace ad-hoc markdown stubs with reference-system template baselines,
free-text device type input, and add template quality regression tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor e1a9b302ba fix(web): merge live and history by serverId and clientTurnId 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor a9fe69ac16 fix(workflow): reconcile version conflicts in review mode and UI retry 
Auto-adopt current workflow selection version in review/demo backend
paths, and retry frontend workflow switch after refreshing project version.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor c4ef72506f feat(api): return user_message_id in SSE turn_ack and done 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 0d395f2bf2 fix(ctxmgr): normalize dismissed_unread_ids for Postgres array insert 
Ensure nil dismissed ID slices serialize as empty bigint arrays and
preallocate compressDismissed output to avoid NULL write failures.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 9f7500bb72 fix(web): disable chat stream auto-retry without idempotency 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHEN 222b0c2dd6 feat(doc-preview): 上传文档多格式在线预览 + IndexedDB 持久化恢复 
## 新增功能
- 支持用户上传的 Word(.docx)、PDF、Excel(.xlsx/.csv)、PPT(.pptx)、
  图像(png/jpg/svg/webp等)、纯文本/代码文件的在线高保真预览
- 预览与受控工作流文档严格隔离：上传文档走 FilePreviewPanel，
  工作流/对话入库文档继续走 BlockRenderer，互不干扰

## 核心 Bug 修复
- 修复页面刷新后上传文件无法预览/下载的根本问题
  - 根因：File 对象无法 JSON 序列化，刷新后内存引用丢失
  - 方案：新增 fileStore.ts，使用 IndexedDB 持久化文件二进制内容
  - App 启动时自动 restoreFileRawToDeliverables() 从 IndexedDB 恢复 fileRaw
  - 上传时 saveFile() 同步写入 IndexedDB（fire-and-forget）

## 下载按钮修复
- 优先从内存 File 对象动态创建 blob URL，避免依赖已 revoke 的旧 URL
- 文件内容不可用时按钮禁用并显示 tooltip 说明

## 存储层改进
- saveDeliverables() 序列化前剔除 fileRaw（不可持久化）和 blob: URL
  避免 localStorage 保存损坏的空对象

## 新增文件
- web/src/data/fileStore.ts — IndexedDB 封装（saveFile/getFile/restore）
- web/src/components/doc/preview/FilePreviewPanel.tsx — 预览面板主组件
- web/src/components/doc/preview/renderers/DocxViewer.tsx — Word 预览
- web/src/components/doc/preview/renderers/PdfViewer.tsx  — PDF 预览
- web/src/components/doc/preview/renderers/ExcelViewer.tsx — Excel 预览
- web/src/components/doc/preview/renderers/PptViewer.tsx  — PPT 预览
- web/src/components/doc/preview/renderers/ImageViewer.tsx — 图像预览
- web/src/components/doc/preview/renderers/TextViewer.tsx  — 文本预览
- web/src/tests/file-preview.test.ts — 预览功能单元测试
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor b69cb617a0 docs(spec): chat turn idempotency and session isolation 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 24478ec383 feat(intent): Phase 5 V2 shadow gray flags and IntentPlan execution 
Add env-based feature flags (intent_v2_shadow/decision, multi_intent,
workflow_intents), V1/V2 shadow diff reporting, expectation_plus_new plan
building, ranked-frame L2 conflict gate, and coordinator sequential query
plan execution with confirm-step deferral.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 9cb129d3e8 feat(intent): Phase 4 run control, subtypes, and limited IntentPlan 
Add RUN_STATUS_QUERY/RUN_RESUME/RUN_RESTART with matcher and coordinator
handlers; write QUERY_PROGRESS/SUPPLEMENT_INFO subtypes to V2 frame; support
safe query+query multi-intent plans via IntentPlan dual-write.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor dda6a06e4a feat(intent): Phase 3 workflow/help intents and coordinator handlers 
Add SWITCH/TRIGGER/QUERY workflow, doc status, help and unsupported intents
with ActionSpec registry entries, NL matchers, L2 handlers with creator-only
switch gate, router routes, and capability-aware AvailableActions.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 3db56b4166 feat(intent): add V2 frame, ActionSpec registry, and legacy dual-write 
Introduce IntentFrameV2 with goal/object/relation/evidence, register all 21
legacy intents in ActionSpec registry, and dual-write intent_frame_v2 alongside
TopIntent without changing Router/Coordinator routing.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 868238137c fix(intent): Phase 0+1 P0 safety gates for recognition and coordination 
Add golden-v1 hard-negative suite, shadow observability fields, query/command
negation gates for high-risk writes, AllowAffirmative enforcement, candidate
conflict clarification, and coordinator clarify-before-ambiguous ordering.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:21 +00:00
WeiCHEN 60d4df4319 fix(chat): resolve intent recognition, workflow auth, and message ordering 2026-09-13 02:50:21 +00:00
WeiCHEN 917740f26d feat(project): implement modal-based project creation, creator-led member assignment, and exited-member read-only retention 2026-09-13 02:50:21 +00:00
WeiCHEN eda2a2b32b refactor(dialogue): implement task dispatch notifications and consecutive assistant messages with confirmation cards 2026-09-13 02:50:21 +00:00
WeiCHEN 0df8b065c2 refactor(dialogue): naturalize multi-role conversations, close chat sessions with assistant response, and set URS to project shared 2026-09-13 02:50:21 +00:00
WeiCHEN 76e538a47f fix(doc): resolve URS viewing and private-to-shared workflow in document pane for 10 review projects 2026-09-13 02:50:21 +00:00