weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
313 Commits 10 Branches 15 Tags
d9f3d404237dc3f8e5eb0c835f298cb2cbe12efb
Commit Graph
313 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weichenandCursor d9f3d40423 feat(abac): enforce stage access on chat, search and SSE streams. 
Tag messages with stage_key metadata, block sends for unauthorized roles, and filter history/search/case results by allowed stages.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 69a3be5463 feat(web): poll stage ready notifications to refresh advance banner. 
Poll project notifications every 15s and reload readiness when stage_ready_to_advance arrives.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 4bfe1cb5ad feat(api): wire document approval hook and project notifications API. 
Register workflow approval callback on server start and expose GET /projects/{id}/notifications.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 32b88beee0 feat(projectinstance): refresh stage readiness after document approval. 
Sync doc task status on approve and evaluate whether to emit stage advance readiness; chain docgov hooks.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 10fa91de61 feat(notification): emit deduplicated stage ready to advance events. 
Write outbox row and creator notification when a stage first becomes advance-ready.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor ff81170f47 feat(db): add outbox, notifications and stage advance request tables. 
Support transactional stage.ready_to_advance events with dedupe by stage instance and config revision.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor ec2ea02e8a feat(abac): restrict workflow document access by active stage duties. 
Resolve stage access from live instance assignments and filter document list/content for non-assigned roles.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor b402426257 test(db): add PG integration test for activation and stage advance. 
Verify migration 00017 and full plan→preview→activate→advance chain against dev Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor e0c39aa38c feat(service): add stage gate readiness and creator-confirmed advance. 
Evaluate required document approvals before stage transition, expose readiness/advance APIs, show StageAdvanceBanner in the UI, and keep legacy workflow switch for explicit initial_workflow_key projects.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 50c5f2ab0d docs(test): add Phase 3 project workflow governance test report. 
Document planning-mode creation, plan/preview/activate unit results, and API regression outcomes for the instance governance MVP.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 1fa6e9aa77 feat(web): add project workflow settings wizard and replace free switcher. 
Topbar shows configure/view workflow actions under governance mode with a multi-step ProjectSettingsModal for plan, duty assignment, and confirmed activation.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor be5cdb1ef6 feat(api): expose project settings endpoints and block legacy workflow switching. 
Add settings/plan/preview/activate routes and reject active-workflow toggles when governance instances or planning projects require configured activation.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor dc629fc4b8 feat(service): implement project workflow plan, preview, and activation flow. 
New projectinstance package validates three-duty separation, issues confirmation tokens, and activates immutable workflow instances; new projects start in planning mode.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 0f5bc426e8 feat(db): add project workflow instance tables for Phase 3 governance. 
Introduce planning/active lifecycle, instance snapshots, duty assignments, and activation confirmation tokens with single-live-instance constraints.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor 654e19a12d docs(test): Phase 2 workflow designer test report and plan 
Archive validator/publish test results and document Phase 2 MVP scope
boundaries ahead of Phase 3 project activation work.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor ebbfc2db18 feat(web): add admin workflows and template library tab 
Admin console can list workflow definitions, validate/publish draft versions,
and view bootstrap template assets from the server API.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor 967dd9becd feat(api): add admin workflow and template management endpoints 
Expose draft/validate/publish/retire workflow APIs and template upload/list
routes wired to workflowdef service with DBCatalog refresh on publish.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor edffe74009 feat(db): add workflow definitions, versions, and template asset tables 
Introduce Phase 2 IAM-adjacent schema for versioned workflow definitions,
template assets/versions, and workflow_defs permissions seed.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen a24b00d393 merge: feature/security-iam — P0 security and IAM Phase 0-1 2026-09-13 02:50:22 +00:00
weichen 21de3bc39e merge: feature/chat-idempotency-task — turn idempotency and task materials 2026-09-13 02:50:22 +00:00
weichenandCursor 016c3a9791 test(docs): Phase 1 completion gates, PG integration tests, and report 
Add disabled-user 401, admin roles/sessions handler tests, optional PG store
integration, cross-project 403 fixture, and update the Phase 1 test report to
reflect completion status.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHEN fcf00e7d1a chore(scripts): fix backfill script import and run projection for ws_intake 2026-09-13 02:50:22 +00:00
weichenandCursor a56d033d3c feat(web): fail-closed capabilities and admin roles from server API 
Stop persisting roles to localStorage as authority; AdminSettingsModal reads
and writes role matrices via /api/v1/admin/roles; hasPermission denies when
capabilities are not loaded from /auth/me.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 9d40a91f9d feat(web): sync workflow docs from server and persist task artifact in chat 
Pass doc_id on task runs, merge server deliverable state by task_key,
fetch controlled document content when opening non-template docs, and
map metadata.artifact after refresh.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor 6219caf690 feat(authz): complete Phase 1 admin roles, sessions, and unified admin gate 
Add roles CRUD backed by system_roles tables, session list/revoke APIs,
capabilities fallback for memory mode, and route all admin checks through
AuthorizationService instead of hardcoded role-admin checks.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 68765023a2 feat(api): add workflow document list, content read, and backfill script 
Expose project controlled documents from DocGov, serve authenticated
output.md content by doc_id, and add idempotent backfill for run_1789111889557885000.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 8cdc839650 test(docs): Phase 1 IAM authz tests and test report 
Extend P0 and auth/me handler tests for members endpoint and capabilities; archive Phase 1 test report under .doc/test-reports/.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 238f1d9346 feat(agent): unify async task FinalizeTaskRun projection to chat and runs 
Extend taskrun executors to return full TaskRunResult, finalize assistant
placeholder content with artifact metadata, and map quality_failed terminal
state instead of metadata-only updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 47b8179824 feat(web): wire project members CRUD to REST API 
Add projectMembers client and role adapter; sync members from server on login and modal open; persist add/update/remove via /api/v1/projects/{id}/members.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 91b257393e docs(test): add longtask P0 observer and materials test report 
Archive automated regression results for stream materials, observer disconnect,
project asset upload, and ResolveMaterials assembly.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 844bfd2803 feat(web): consume server capabilities for RBAC decisions 
Fetch and cache capabilities from /auth/me on login and session restore; hasPermission prefers server capabilities over local role definitions.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor bbd1218922 feat(web): asset upload, task run observer, and session lineage on tasks 
Upload binary attachments as project assets, subscribe by run_id after refresh,
and pass session_id/project_id through long-task requests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 4258d88415 feat(authz): add AuthorizationService, capabilities API, and project members CRUD 
Wire authz service into server, expose capabilities on /auth/me, and add project member management routes with owner/admin gates.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor e139b2b267 feat(api): observer task runs decoupled from SSE lifecycle 
Add POST/GET/POST cancel task run APIs, background worker with event replay,
workspace reconcile, runner child cancel, and chat message metadata updates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen d8c445bfd5 feat(auth): persist sessions and accounts via PostgresAuthStore 
Add PgStore with hashed token sessions, IAM bootstrap, and store factory wiring; remove in-memory token map and allow_dev_switch from login payload.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 908d4bdb2e feat(agent): project asset upload and squad materials assembly 
Register uploads via CAS, resolve project asset pools into task materials
with server-side extraction, and propagate asset_id through the bizdev/squad chain.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 3b72503ec6 feat(db): add IAM core migration for users, sessions, and RBAC 
Introduce goose migration 00015 to extend users with IAM columns and seed system roles/permissions for Phase 1 authorization.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 6f3a4d4c80 fix(api): pass materials through task/stage stream handlers 
Stream SSE path now forwards Materials to ExecuteTask/ExecuteStage, and
TestTaskStream_MaterialsInjection targets the real /tasks/run/stream endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 25ec2a22d8 docs(plan): add Phase 1 IAM and authorization implementation plan 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 70493a3ed5 feat(web): wire project list and create to server API 
Login syncs projects from GET /api/v1/projects; create project uses POST with server-assigned id while preserving local sessions and templates.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen d4988d04e8 test(docs): extend Phase 0 security gates and archive test report 
Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0
security止血 acceptance report with PASS results.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor 636eb0ccf1 fix(web): align workbench user ids with auth seed 
Unify MOCK_USERS with backend auth (admin id=1), merge session identity on login, and migrate demo seeds/tests to id 2/3/4 for 张工/李/王.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen e96ade076a fix(auth): restrict demo seed users to dev/test environments 
Main no longer creates fixed-password demo accounts and legacy anonymous
fallback is limited to explicit dev/test in-memory fixtures.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor a8c8cba447 fix(web): keep draft when send preflight fails 
Return accepted/error from handleSendMessage, clear InputArea only on success, and surface thinking/streaming feedback.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen 171959710d fix(security): add CORS allowlist and enforce principal on chat handlers 
Replace wildcard CORS with configured origins and bind chat/task user
identity to the authenticated principal instead of request body fields.
 2026-09-13 02:50:22 +00:00
WeiCHENandCursor f9c4f9b01b fix(web): add secure-context-safe clientTurnId helper 
Provide RFC 4122 v4 fallback via getRandomValues for LAN HTTP pages where randomUUID is unavailable.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen d612c1193e fix(web): remove identity simulation and stop sending X-User-ID 
Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.
 2026-09-13 02:50:22 +00:00
WeiCHEN eea28f0be4 feat(task): inject uploaded documents into task materials and enable LAN host access 
- backend: add Materials field to TaskRunRequestDTO and forward to ExecuteTask
- backend: add TestTaskStream_MaterialsInjection test case in taskstream_test.go
- web: serialize materials in buildTaskRequest and add unit test
- web: improve isSameMessage identity comparison in messageIdentity.ts
- web: configure host: '0.0.0.0' in vite.config.ts for LAN collaboration access
 2026-09-13 02:50:22 +00:00
weichen 886cbb7913 docs(plan): add production governance plan and Phase 0 authz matrix 2026-09-13 02:50:22 +00:00
WeiCHENandCursor cc2aa33b10 docs(test): chat turn idempotency automated test report 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00