23 Commits

Author	SHA1	Message	Date
Fischer	8633f60831	feat: complex-task-quality-loop (R1-R12) — 11 P1 blockers fixed (#22) ... Merge feat/complex-task-quality-loop into main. Includes U1-U9/R1-R12 implementation + 11 P1 blocker fixes from ce-code-review. P1 fixes: trace_outcome propagation, portal execute_stream routing, network_block reentrancy, spec review gate wiring, max_reflections threading, phase budgets, plan aggregation, failure status mapping, evolution drain timeout, portal spec_review_reply, spec_review persistence.	2026-07-05 22:31:21 +08:00
chiguyong	7c900ce280	docs: add complex-task-quality-loop plan and requirements documents ... Adds the brainstorm requirements and implementation plan that drove the 9-unit quality-loop feature (R1-R12). Also gitignores local worktree directories.	2026-07-03 22:54:11 +08:00
chiguyong	f8927d1749	docs(bitable-eval): apply ce-doc-review best-judgment fixes (20 gated_auto + 12 manual) ... ce-doc-review（7 reviewers, 39 raw findings → 32 actionable + 3 FYI 经合成管道）， 用户选择"自动用最佳判断处理"路径。本提交应用全部 20 个 gated_auto 修复，并把 12 个 manual findings 追加到 Outstanding Questions 的 From 2026-07-03 review 子节。 主要修复： - 修正 BitableTool 动作清单：实际为 create_table/import_excel/import_database/ collect_api/upsert_records/query_records（原文 4/6 错），消除 R15a 范围误判 - R15a 从 B 线提升至 P0（4 reviewers 独立标记的优先级矛盾——B 线"non-blocking" 与"agent 对等最高优先级子项"自相矛盾） - G23 闭合路径标注（R15c 路径 (a)/(b)） - 默认字段类型未来 user/datetime 标注（Inventory + G6） - R3 后端依赖标注（POST /views schema 扩展） - 视图删除端点补 P0 验收标准（R15a 验收 + 前端 deleteView 方法） - vxe-table 幽灵依赖标注（package.json 未声明，靠主仓 hoisting） - create_field 动作标注为必需（R8 17 新类型需 agent 能批量建字段） - R15 测试映射拆分为 R15a/R15b/R15c 三行 - R8 验收矩阵补 PII/XSS/auto-number 写保护列 + schema V3 迁移成本估算 - R15c 安全要求补 SSRF/认证/凭据加密 + 端点访问控制 - 横切验收标准补 WCAG AA 可访问性 + 空状态要求 - R8 矩阵范围标注（覆盖 P1，非 P0） Open Questions 新增 12 个 manual findings（ce-plan 阶段决策）： - user 字段用户模型 - C 先行优先级策略的实证依据 - 并发编辑 UX 策略 - 加载/错误状态统一模式 - 条件格式规则构建器 UX 形态 - 分组交互细节 - 响应式断点定义 - R2 记录详情抽屉宽度 - vxe-table 容量上限评估 - R13 仪表盘图表库 buy-vs-build - 禁用态视图类型路线图 - schema V3 双向关联回滚策略 文件：docs/brainstorms/2026-07-03-bitable-comparative-evaluation-requirements.md （107 insertions, 31 deletions）	2026-07-03 13:32:07 +08:00
chiguyong	e9821a3b7f	docs(bitable): add comparative evaluation requirements with ce-code-review P1 fixes ... 新增三向对比评估需求文档（agentkit bitable vs Twenty vs 飞书），并应用 ce-code-review 产出的全部 P1 缺口修复（共 9 项）： - P1-1: R8 字段类型计数对齐 16+1=17（KD6 与 R8 同步） - P1-2: 新增 R8 字段类型验收矩阵（17 行表，含 V2->V3 迁移列） - P1-3: KTD7 引用具体文件 formula/parser.py 替代裸引用 - P1-4: R-ID 命名空间冲突，加日期前缀 2026-06-29-R1..R5 - P1-5: created-time 统一为 datetime（通用类型 + 默认字段使用 datetime） - P1-6: 新增 P0 验收标准段落（R1-R5 Given/When/Then） - P1-7: 新增测试策略段落 + 测试文件映射表（R1-R5、R8、R15） - P1-8: R15 拆解为 R15a/R15b/R15c + 新增 Agent 对等评估方法段落 - P1-9: R4 补充后端扩展（group_by/conditional_formatting schema）+ agent 对等说明 同时包含 2 项 gated_auto 修复： - 组件计数 14 -> 15 - 移除文档中的全部 emoji，替换为 [OK] ce-code-review run-id: 20260703-123134-c7c2b2ea	2026-07-03 12:59:41 +08:00
chiguyong	96f459c27d	docs: add brainstorm/plan decision artifacts + plan progress update ... Add ce-brainstorm requirements doc and ce-plan plan doc for private board restrictions and scheme B bubbles (decision artifacts). Update 2026-07-02-002 plan with U6/U7 progress table. Add .compound-engineering/config.local.example.yaml from ce-setup. gitignore tmp_*.html and delete_old_cluster.sh.	2026-07-02 21:27:20 +08:00
chiguyong	f872a3fac6	feat: UI/UE enhancement — streaming, sticky header, hover actions, calendar tokens ... U1 ThinkingBlock: streaming cursor + auto-collapse to summary bar U2 StickyModeHeader: new component replacing ExpertTeamView + BoardStatusView U3 Backend _phase_executor: execute_stream() with token/thinking/final_answer forwarding U4 Frontend chatStream: expert_result_chunk/team_synthesis_chunk token accumulation U5 AssistantText: routing tag hover fade-in U6 UserBubble: hover actions (copy/delete/refill) U7 CalendarGrid: token-based color redesign Review fixes (ce-code-review): - P0: _VALID_TEAM_EVENT_TYPES whitelist adds 3 new streaming event types - P0: final_answer no longer double-accumulates token content - P2: exception handling expanded to except Exception for LLMProviderError etc. Simplification (ce-simplify-code): - _synthesizer.py: O(n²) concat -> list+join, _concat_results extraction - config_driven.py: 4 duplicate _handle_*_stream -> _wrap_sync_as_stream - chatStream.ts: 5x [...messages].reverse().find() -> findLastMessage helper Tests: pytest 13/13, vitest 126/127 (1 baseline), typecheck pass, ruff clean	2026-07-01 12:51:45 +08:00
chiguyong	2747bb4e64	chore(prior): malformed tool call handling, auth whitelist, dev scripts, wave1 plan	2026-06-29 20:25:03 +08:00
chiguyong	a6e1bf5884	feat(bitable): 多维表格文件层 + 默认字段 + 表内字段操作 + ce-code-review 修复 (Stage 1) ... 实现多维表格 UI 完整性 Stage 1（U1-U6），补齐飞书/twenty 对齐缺失的文件层、 默认字段与表内字段操作能力，并修复 ce-code-review 走查发现的 P0/P1 级问题。 后端（U1-U2）: - 新增 BitableFile 实体（models/db/repository/service/routes），三级层级：文件→数据表→字段/记录 - Schema V2 迁移：bitable_files 表 + tables.file_id 列，幂等（IF NOT EXISTS），保留 V1 孤儿表 - 新建数据表自动创建 5 个默认字段（标题/状态/日期/创建人/创建时间） - agent-owned 字段在 create_record 时自动填充（按 type+owner 匹配，传 actor_user_id） - 7 个文件 REST 端点 + IDOR ownership 检查（404-before-403，internal token 旁路） 前端（U3-U5）: - 文件列表页（FileCard 网格 + 新建/重命名/删除）+ 文件详情页（侧栏表格列表 + vxe-table 网格） - Vue Router 嵌套路由 /bitable → /bitable/:fileId → /bitable/:fileId/:tableId - 列头菜单（编辑/隐藏/删除字段）+ 末尾 + 列新增字段 - select/multiselect 字段自定义单元格编辑器 + Tag 展示 - Pinia store 扩展 file 状态与动作，深链直访回退 getFile，fileId 切换 watch 测试（U6）: - 文件 CRUD（12 例）+ 默认字段（10 例）单元测试 - 3 个 E2E spec（视图加载、文件流、字段操作），后端不可用时优雅跳过 ce-code-review 修复（P0/P1）: - P0 路由冲突：GET /files/{file_id} 遮蔽下载端点 → 下载改 /uploads/{filename} - P0 IDOR：update/delete field/record/view 五端点补 ownership 检查 - P1 is_initialized property 缺失致二次初始化崩溃 - P1 直接 URL 导航失效（files 数组为空）→ selectFile 回退 getFile - P1 fileId 切换不重载 → 增加 watch - P1 轮询丢弃最终公式值（wasCalculating 守卫）+ 复用视图 filters - P1 测试断言 200→201；test_db 无 URL 用例解除 postgres 标记得以执行 - P2 _check_table_ownership 403→404；输入长度校验；upload field-table 一致性校验 - P2 multiselect 浅比较 → 深比较；E2E bitable-view 补 waitForServer 守卫 验证：ruff check 通过；pytest 91 passed/116 skipped；vue-tsc --noEmit 通过。	2026-06-29 04:07:45 +08:00
chiguyong	bbbf9cd40a	feat(bitable): add bitable companion service with full P0-P2 fixes ... Bitable is a multi-dimensional table companion service that runs alongside the main AgentKit server. It provides structured data storage with formula fields, views, and ingestion pipelines. Major components: - Domain models (Pydantic v2): Table, Field, Record, View, RecalcTask - SQLAlchemy 2 async ORM with independent bitable PostgreSQL schema - Formula engine: AST parser, DAG, Kahn topological sort, safe eval - RecalcWorker: atomic task claiming (FOR UPDATE SKIP LOCKED), topo-order processing, stale-threshold reaper for crash recovery - REST API (/api/v1/bitable): tables, fields, records, views, files - BitableTool: agent-facing tool with batch chunking (500/batch) - CLI: agentkit bitable subcommands (create, list, import-excel, etc.) - Frontend: Vue 3 + vxe-table grid with field management, views, filters - Ingestion: Excel (openpyxl), database reflection, API collector Security fixes (ce-code-review P0 + ce-debug P1): - SQL injection prevention (field_id validation, parameterized queries) - IDOR protection (_check_table_ownership on all table-level endpoints) - SSRF prevention (URL scheme + private IP validation in parse_excel_url) - OOM prevention (streaming file upload, batch delete, batch insert) - Atomic recalc task claiming (FOR UPDATE SKIP LOCKED) - Formula engine cache invalidation on field changes - Composite cursor pagination for non-id sort orders - Batch upsert (eliminates N+1 queries) - Sync I/O offloaded to thread pool in async contexts - Internal token auth (X-Internal-Token, hmac.compare_digest) - PK unique index enforcement Test coverage: 88 unit tests (95 skipped without Docker)	2026-06-25 01:09:59 +08:00
chiguyong	574db8458f	fix(experts): PM 协同代码审查全量修复 ... P0: 跨阶段契约状态同步 — _notify_collaborators 更新接收方契约状态为 received P0: 4 个 PM 事件加入 _VALID_TEAM_EVENT_TYPES 白名单 P1: 验收 fail-open 改标注降级原因 P1: 返工失败抛 RuntimeError 而非返回 dict P1: 验收 prompt injection 防护 — 专家输出用 XML 标签包裹 P1: 契约字段校验 _EXPERT_NAME_RE P1: bool("false") 修复 — 显式比较避免字符串真值陷阱 P1: _parse_risk_flags(None) 防御 P2: _notify_collaborators 移到验收通过后 P2: SharedWorkspace 写入移到验收通过后 P2: 验收贪婪正则修复 P2: 风险标记数量上限 MAX_RISK_FLAGS=10 P2: 返工 feedback 截断 P2: 前端会话隔离 — 切换会话时清除/恢复 collaborationState P2: 前端契约状态更新 — collaboration_notice 时标记 delivered P2: CLI 死代码标注 + 异常改 debug 日志 P2: 模块级 _RISK_FLAG_RE 预编译	2026-06-24 18:56:27 +08:00
chiguyong	fbe08cb1e2	feat(experts): add debate phase executor to TeamOrchestrator (U2) ... Implement _execute_debate_phase() with Lead-facilitated structured debate: - Lead opens with divergence point + dependency context - Experts argue in parallel per round (asyncio.gather) - Lead summarizes each round, then adjudicates final verdict - Verdict produces decision (adopt/compromise/shelve/inconclusive) + conclusion - Conclusion written to SharedWorkspace for downstream phases Escape hatches: - debate_config.skip=true short-circuits with template text - MAX_DEBATE_ROUNDS=4 hard cap on rounds - User /stop intervention ends debate early (U4-compatible via getattr fallback) - LLM unavailable falls back to template verdict, no crash New events: debate_started, expert_argument, debate_round_summary, debate_resolved (plus existing phase_completed for consistency). Phase dispatcher (_execute_phase) routes by phase_type: EXECUTION to _execute_execution_phase, DEBATE to _execute_debate_phase. 36 new tests in test_orchestrator_debate.py covering happy path (2 rounds, 2 experts), max_rounds=1 boundary, empty participants, user stop, skip escape hatch, LLM unavailable, SharedWorkspace integration, event broadcasting, intervention channel compatibility, and helper methods. All 377 expert tests pass. Also includes planning artifacts (brainstorm requirements + implementation plan with 6 units U1-U6).	2026-06-24 10:54:51 +08:00
chiguyong	d1250cf32b	docs(calendar): mark plan as completed — all 12 units implemented	2026-06-24 05:04:39 +08:00
chiguyong	47f3bfecfc	feat(documents): add document processing capability (U1-U9) ... Implements end-to-end document generation, template filling, and reading: - DocumentService: unified business layer for create/query/download - Renderers: Word (Markdown->docx), Excel (Markdown/JSON->xlsx), PDF (Markdown->pdf with CJK font), Template (Jinja2 sandbox .docx fill) - DocumentLoader: read PDF/Word/Excel/Markdown/HTML/text -> Document - DocumentTool: Agent tool with action=create|read - REST API: /api/v1/documents (create, upload-template, list, download) - Frontend: DocumentPanel, DocumentCard, documents Pinia store, chat store tool_result detection - Security: path traversal guard (Path.resolve + relative_to), SSTI guard (SandboxedEnvironment), API key auth, 50MB upload limit - Bug fixes: template path traversal (400 not 500), TemplateRenderer lazy-load (no external registration dependency) - Tests: 168 tests (unit + security + E2E F1/F2/F3 + bug hunt) - Docs: README section 17, requirements + plan + test-plan docs Requirements R1-R28 verified, F1-F3 user flows pass.	2026-06-23 15:05:01 +08:00
chiguyong	ad65f7a8d7	feat(admin): U1+U2+U4 — schema v3, department service, context filtering ... U1: Bump _SCHEMA_VERSION to 3, add 5 department tables (departments, user_departments, department_skill_bindings, department_kb_bindings, department_quotas) + 5 ORM models + helpers. U2: DepartmentService (12 async methods: CRUD + bind/unbind skill/KB + count_users). Mount admin_router in app.py. 36 unit + 28 integration tests. U4: DepartmentContext FastAPI dependency (per-route, admin bypasses filtering). filter_skills_by_department / filter_kb_sources_by_department helpers. Applied to GET /skills and GET /kb-management/* routes. 15 integration tests for department isolation. Also includes brainstorm + plan docs. 108 new tests, all pass.	2026-06-21 15:03:27 +08:00
chiguyong	54955aab50	plan: 计划审查修订 + AuthProvider 抽象层设计 ... - 修复 U1 (Schema): 澄清不使用 Alembic，采用 _SCHEMA_SQL + init_auth_db()， 新增 user_sessions → auth_sessions 一次性数据回填 - 修复 U4 (Routes): whoami 端点添加到中间件白名单并实现自主认证， 明确 get_current_session / load_user / user_to_response 等函数定义 - 新增 AuthProvider 抽象层：Protocol 接口、LocalAuthProvider、StubOIDCProvider 及依赖注入工厂，支持未来对接集团 IdP - 新增 AE-10 (Provider 切换) + AE-11 (审计字段) 验收用例 - 更新 Component Map，添加 AuthProvider 相关组件	2026-06-21 00:21:52 +08:00
TraeAI	df8a995ec4	docs: 集中鉴权与 Token 持久化需求文档 ... 覆盖 A+B+C 一次到位方案： - A 当前实现加固（refresh 轮换、记住我、预刷新、启动三态） - B Tauri OS Keychain 集成（keyring crate 跨 macOS/Win/Linux） - C 服务端 Session 表（滑动过期、踢出、改密码强踢、reuse 检测） Out of scope: 企业 IdP / SSO / 2FA / 多租户（后续单独 brainstorm）	2026-06-20 23:42:34 +08:00
chiguyong	91f56ca663	feat: 企业级客户端-服务端架构 + 代码审查修复 ... ## 主要变更 ### 新增功能 - 企业级客户端-服务端架构（JWT 认证 + RBAC 权限 + 终端安全） - Tauri 桌面客户端与服务端配置同步 - 远程 LLM 网关（RemoteLLMProvider，支持 401 token 刷新重试） - 服务端终端 WebSocket（带管理员审批流程） - 终端白名单六层防御（黑名单 → shell 操作符检测 → 内置安全 → 全局/用户/会话白名单 → 危险检测） ### 代码审查修复（P0/P1/P2） - P0: 危险二进制（rm/docker 等）不再加入白名单，compute_whitelist_entry 返回 None - P1: 终端审批所有权追踪（_approval_owners dict）+ 会话清理防泄漏 - P1: 本地终端 WebSocket URL 补齐 JWT token - P1: 审计日志支持 terminal_mode 过滤 - P1: /system/resources 端点强制 SYSTEM_CONFIG 权限 - P1: RemoteLLMProvider 增加 401 token 刷新重试机制 - P1: auth/models.py 使用 Mapping[str, object] 替代 Any 类型 - P2: 终端授权依赖检查 is_active 账户状态 - 修复 app.py 未使用的 APIKeyAuthMiddleware 导入 ### 文档更新 - README.md: 新增第 16 章「企业级客户端-服务端架构」 - AGENTS.md / CLAUDE.md: 同步模块映射、路由表、前端页面 - 计划文档标记为 completed Closes: docs/plans/2026-06-19-003-feat-enterprise-client-server-evolution-plan.md	2026-06-20 06:48:18 +08:00
chiguyong	dddcbd24e3	feat: 私董会讨论模式 + 回测集成 + WS持久化修复 ... 私董会讨论模式 (Board Meeting Mode): - BoardRouter: @board 前缀路由, 专家名验证, 模板回退 - BoardTeam: 讨论容器, 状态机 (FORMING->DISCUSSING->CONCLUDING->COMPLETED) - BoardOrchestrator: 多轮自主循环讨论引擎, 主持人小结, 停止命令检测 - 9个预设名人专家 YAML (马斯克/贝佐斯/张小龙/芒格等) - 前端 BoardStatusView 群聊式 UI + WebSocket 事件处理 - 后端 chat.py 集成 @board 路由到主聊天流程 回测集成: - benchmark.py: 新增 board_meeting 维度 (18 tasks, 6 categories) - benchmark_dataset.py: 新增 BOARD_BENCHMARKS (11 E2E cases) - test_board_backtest.py: 66 个回测测试 (9 test classes) Bug 修复: - resolve_expert_configs: deep-copy 防止 is_lead 修改污染共享模板 - 所有专家名无效时回退到默认模板 - board_router: 非匹配路径 topic 未 strip - benchmark_dataset: board-name-invalid-001 输入修正 WebSocket 持久化修复: - chat.py: 三层防御机制确保任务结果不丢失 - chat store: 断线恢复逻辑 部署配置: - Gitea Actions CI/CD workflow - docker-compose.deploy.yaml 部署编排 - scripts/deploy.sh 自动化部署脚本 测试结果: 120 单元测试通过, 71 benchmark 测试 100% 通过, ruff 全部通过	2026-06-17 23:52:53 +08:00
chiguyong	64d62a2b60	feat: autonomous task execution - connect PlanExecEngine + TeamOrchestrator ... U1: TeamOrchestrator._execute_phase real execution (Expert.agent.execute) U2: LLM-based merge strategies (BEST/VOTE/FUSION) with fallback U3: ReActStepExecutor replacing _LLMStepAgent for tool-enabled steps U4: SharedWorkspace integration for cross-phase/cross-execution state U5: GoalPlanner prompt tuning with few-shot and verb pattern matching U6: Replan-before-fallback in TeamOrchestrator U7: End-to-end validation tests for multi-step research tasks U8: WebSocket progress events (step_event_callback + new event types) Code review fixes: P0 response.strip fix, P1 competitor status check, milestone real impl, VOTE self-bias fix, confirmation_handler wiring, ExpertTeam public API, DRY _build_result_summaries, replan tests Also: geo_server.py refactor (ServerConfig.from_yaml), delete llm_config.yaml	2026-06-15 12:41:32 +08:00
chiguyong	7384ecb03e	feat: Expert Team Mode — plan-execute collaboration with conversation UI ... Implements B+C hybrid Expert Team Mode with ExpertConfig, CollaborationPlan, TeamOrchestrator, ExpertTeamRouter, HandoffTransport, SharedWorkspace, and Expert wrapper. Frontend includes ExpertTeamView, ExpertMessage, PlanVisualization, team store, and WS event handlers. Code review fixes: sentinel-based close, per-phase retry, name validation, Vue component integration, teamState dedup, Redis reset, plan reassign, event_type validation, hmac timing-safe compare, message dedup, reactive updatePhases, O(1) phase lookup, iterative DFS, bounded Queue. 232 unit tests passing.	2026-06-14 22:20:14 +08:00
chiguyong	94c4c8b887	feat: accumulated frontend enhancements, docs, and static assets ... - Frontend view updates (ChatView, EvolutionView, SkillsView, etc.) - Updated portal routes and chat store - New frontend components (FilePreview, ToolCallCard, IconNav) - Updated static build assets - New test files (merged router, parallel tools, ReWOO fallback) - Documentation and brainstorm files - Codegraph and understand-anything artifacts	2026-06-14 16:35:01 +08:00
chiguyong	09698d7a06	feat: frontend productization with code review fixes ... - Workflow: visual canvas, undo/redo, drag-and-drop, real-time execution WebSocket - Evolution: dashboard, ECharts metrics, experience timeline, pitfall warnings, usage panel - KB: source CRUD, document upload, search test - Terminal: interactive PTY WebSocket, whitelist security - Security: hmac.compare_digest, API key auth on all endpoints, whitelist bypass fix - Fixes: ECharts async init, WebSocket intentional disconnect, TOCTOU race, Pydantic models	2026-06-13 01:29:58 +08:00
chiguyong	f87b790c0f	feat(agentkit): v2 Phase 1 - ReAct/LLM Gateway/Skill/Server + review fixes ... 535 unit + 52 integration tests passing. README added.	2026-06-05 23:32:16 +08:00