Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Pass doc_id on task runs, merge server deliverable state by task_key,
fetch controlled document content when opening non-template docs, and
map metadata.artifact after refresh.
Co-authored-by: Cursor <cursoragent@cursor.com>
Upload binary attachments as project assets, subscribe by run_id after refresh,
and pass session_id/project_id through long-task requests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Login syncs projects from GET /api/v1/projects; create project uses POST with server-assigned id while preserving local sessions and templates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify MOCK_USERS with backend auth (admin id=1), merge session identity on login, and migrate demo seeds/tests to id 2/3/4 for 张工/李/王.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return accepted/error from handleSendMessage, clear InputArea only on success, and surface thinking/streaming feedback.
Co-authored-by: Cursor <cursoragent@cursor.com>
- backend: add Materials field to TaskRunRequestDTO and forward to ExecuteTask
- backend: add TestTaskStream_MaterialsInjection test case in taskstream_test.go
- web: serialize materials in buildTaskRequest and add unit test
- web: improve isSameMessage identity comparison in messageIdentity.ts
- web: configure host: '0.0.0.0' in vite.config.ts for LAN collaboration access
Support richer attachment payloads in input area, local read-id cache for
unread badges, and expand private-shared and chronology test coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Auto-adopt current workflow selection version in review/demo backend
paths, and retry frontend workflow switch after refreshing project version.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent self-XSS when chat bubbles render user/LLM markdown via
dangerouslySetInnerHTML by escaping raw HTML after math/code
extraction and sanitizing link href schemes.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Rebased App.tsx on the last clean Task-4 parent (5aa8129) and re-applied
only Task-5's SSE plumbing: streamAbortRef, isStreamingActive,
buildNetworkErrorInfo, runStreamAttempt, handleErrorAction,
handleStopStreaming, and the InputArea/MessageStream wiring.
- Removed the unscoped WIP that had been folded into b2cf863 (NeuroPulse
demo data/session-privacy/docgov-lease/cardActionPolicy imports that do
not exist in git, causing b2cf863 to fail to build in isolation).
- Real-backend path now appends the pending placeholder and calls
runStreamAttempt immediately; the artificial setTimeout(600) is only
used for the mock keyword-shortcut demo branches (unchanged from 5aa8129),
gated by precomputed predicates so it never wraps the SSE call.
- Preserved 5aa8129's mock keyword shortcuts (生成文档/驳回/修改/通过等) verbatim.
- No silent success-template fallback re-introduced.
- P1 error actions remain filtered to retry-only; auto-retry transient
attempts stay capped at 2 with 1s/2s backoff via AbortController.
- Bloated WIP App.tsx backed up to .superpowers/sdd/App.tsx.wip-backup
for later use by whichever task owns NeuroPulse/session-privacy/docgov
lease work.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen