47f3bfecfc
feat(documents): add document processing capability (U1-U9)
...
Implements end-to-end document generation, template filling, and reading:
- DocumentService: unified business layer for create/query/download
- Renderers: Word (Markdown->docx), Excel (Markdown/JSON->xlsx),
PDF (Markdown->pdf with CJK font), Template (Jinja2 sandbox .docx fill)
- DocumentLoader: read PDF/Word/Excel/Markdown/HTML/text -> Document
- DocumentTool: Agent tool with action=create|read
- REST API: /api/v1/documents (create, upload-template, list, download)
- Frontend: DocumentPanel, DocumentCard, documents Pinia store,
chat store tool_result detection
- Security: path traversal guard (Path.resolve + relative_to),
SSTI guard (SandboxedEnvironment), API key auth, 50MB upload limit
- Bug fixes: template path traversal (400 not 500), TemplateRenderer
lazy-load (no external registration dependency)
- Tests: 168 tests (unit + security + E2E F1/F2/F3 + bug hunt)
- Docs: README section 17, requirements + plan + test-plan docs
Requirements R1-R28 verified, F1-F3 user flows pass.
2026-06-23 15:05:01 +08:00
698a8fafba
fix(review): U7 refresh token hash verification on whoami
...
The whoami route accepted rotated/old refresh tokens for cold-start
because it only checked session revocation status, not the token hash.
Now when token_type == "refresh", the route computes hash_token(token)
and compares it with the session's stored refresh_token_hash using
hmac.compare_digest (constant-time). Mismatch returns 401.
- Add SessionService.get_stored_refresh_hash(session_id) helper
- Add hash verification in whoami route (R9)
- Add TestWhoamiTokenHash with 5 integration tests
2026-06-22 16:55:20 +08:00
abe2a66436
fix(review): CLI field names, Pydantic validation, exception chaining
2026-06-22 15:24:31 +08:00
5e977539c7
test(admin): U10 — E2E + security isolation + quota enforcement tests
...
23 integration tests across 3 files:
- test_e2e_admin_flow: 5 end-to-end lifecycle tests (department, user,
LLM config, skill management, usage dashboard)
- test_security_isolation: 7 department isolation tests + non-admin 403
tests (cross-dept skill/KB access, multi-dept union, admin sees all,
removed user loses access, disabled dept, API key client)
- test_quota_enforcement: 10 quota tests (token/cost/whitelist limits,
multi-dept strictest-wins, real gateway integration, usage recording)
418 admin tests pass, no regressions.
2026-06-21 19:57:49 +08:00
09feca3307
feat(admin): U7 — usage dashboard + quota enforcement
...
UsageRecord extended with user_id + department_id (backward compatible).
UsageStore Protocol extended: record() accepts user_id/department_id,
get_usage() accepts filters, new get_usage_by_user/department methods.
RedisUsageStore uses versioned keys (v2) for new records.
LLMGateway.chat()/chat_stream() accept user_id, department_ids, db_path.
Quota check before provider call: model whitelist + token limit + cost
limit (daily). Multi-department uses strictest-wins (any exceed → reject).
QuotaExceededError → 429 at route layer.
UsageService: summary, timeseries, by-model, top-users, export (CSV/JSON).
5 new admin endpoints under /admin/usage/*.
llm_gateway.py routes pass DepartmentContext + db_path to gateway,
catch QuotaExceededError → 429 (JSON for /chat, SSE error for /stream).
84 new tests. 441 admin+usage tests pass, no regressions.
2026-06-21 17:23:20 +08:00
fd7f6816b8
feat(admin): U6 — Skill & KB management endpoints + department binding
...
SkillService: enable/disable (persisted in skill_states table, schema
v4), import from YAML (with path traversal + name validation), reload
from file, update config. GET /skills now filters disabled skills.
KbService: list/upload/delete documents with department_id binding.
Added department_id field to KnowledgeSource + UploadedDocument.
Department visibility: (bound to user depts) ∪ (global = None).
10 new admin endpoints: skill enable/disable/import/reload/update,
KB documents CRUD, source sync/rebuild. All guarded by _require_admin.
Implemented reload stub in skill_management.py (was no-op).
54 new tests (26 unit + 28 integration). Fixed 4 pre-existing lint
errors. 357 admin tests pass, no regressions.
2026-06-21 16:19:51 +08:00
980919fc95
feat(admin): U5 — LLM config admin endpoints + department quotas
...
QuotaService: set/get/list/delete quotas, check_quota (hard reject),
is_model_allowed. JSON-serialized limit_value, upsert with ON CONFLICT.
LlmConfigService: provider CRUD + set_api_key + fallback management.
fcntl.flock file lock prevents concurrent YAML writes. Reuses
settings.py helpers (_read_yaml_config, _write_yaml_config,
_write_env_var, _mask_api_key).
11 new admin endpoints: provider CRUD, api-key, fallback CRUD,
department quotas CRUD. All guarded by _require_admin.
93 new tests (30 quota unit + 32 llm-config unit + 31 integration).
2026-06-21 15:03:38 +08:00
ad65f7a8d7
feat(admin): U1+U2+U4 — schema v3, department service, context filtering
...
U1: Bump _SCHEMA_VERSION to 3, add 5 department tables (departments,
user_departments, department_skill_bindings, department_kb_bindings,
department_quotas) + 5 ORM models + helpers.
U2: DepartmentService (12 async methods: CRUD + bind/unbind skill/KB +
count_users). Mount admin_router in app.py. 36 unit + 28 integration tests.
U4: DepartmentContext FastAPI dependency (per-route, admin bypasses
filtering). filter_skills_by_department / filter_kb_sources_by_department
helpers. Applied to GET /skills and GET /kb-management/* routes.
15 integration tests for department isolation.
Also includes brainstorm + plan docs. 108 new tests, all pass.
2026-06-21 15:03:27 +08:00
6dca9ba4f2
feat(admin): U3 — user CRUD + password reset + multi-department
...
Add create_user method to LocalAuthProvider (bcrypt hash + INSERT,
raises ValueError on duplicate username/email).
Add UserService with 9 async methods: create/list/get/update/delete
(soft)/reset_password/assign_department/remove_department/list_user_departments. reset_password revokes all sessions via SessionService.
delete_user is soft (is_active=0, row preserved).
Add 9 user endpoints to routes/admin.py: POST/GET/PATCH/DELETE users,
reset-password, assign/remove department, list departments. All
guarded by _require_admin.
Tests: 40 unit + 37 integration = 77 new tests. Full admin suite
170 tests pass, no regressions.
2026-06-21 13:45:42 +08:00
67c0d67262
fix(auth,chat): P0 security fixes + stop-generation button + doc sync
...
U1: whoami cold-start security — add is_active check (disabled users
now get 401, not 200) and replace create_token_pair with create_access_token
to avoid minting a discarded refresh token (token-amplification risk).
U2: list_active_by_provider now filters expired sessions (expires_at > now)
matching its docstring promise; previously only checked revoked = 0.
U3: Fix asyncio.run() crash in test_revoke_other_user_session_returns_404
(converted to async). Add U1/U2 verification tests (disabled-user whoami,
no-refresh-leak, expired-session filtering, provider filtering) and
strengthen admin route tests (404 boundary, non-admin 403 on /admin/sessions).
U4: Update CLAUDE.md/AGENTS.md Request Flow — CostAwareRouter 3-layer
diagram replaced with actual RequestPreprocessor architecture (@board/@team
prefix intercepts then @skill: prefix then trivial-input regex then default
REACT). ExecutionMode list expanded to all 7 values.
U5: Frontend stop-generation button — ChatInput.vue shows a stop button
when isGenerating is true; chat store gains stopGeneration() that sends
{type:"cancel"} over WebSocket (backend portal.py already handles cancel).
Tests: 120 auth tests pass (unit + integration). ruff clean. vue-tsc clean.
2026-06-21 11:36:58 +08:00
aee7362665
feat(auth): U3/U4/U9 logout-others + whoami cold-start + admin UI + integration tests
2026-06-21 09:08:34 +08:00
871e20876f
test(integration): U9 重写集成测试覆盖流水线模式
...
- 33 个测试覆盖 F1-F16 全部场景
- F1: 手动团队组建 (@team:expert1,expert2)
- F2: 默认团队模板 (@team:dev_team)
- F3: 流水线串行执行 (3阶段 A→B→C)
- F4: 并行阶段执行 (无依赖)
- F5: 阶段失败和依赖失败传播
- F6: SharedWorkspace 数据传递
- F7: 上下文隔离 (独立 ConfigDrivenAgent)
- F8: 事件序列验证 (team_formed → plan_update → phase_started → phase_completed → team_synthesis)
- F9: TeamStatus.PLANNING 状态流转
- F10: 循环依赖检测
- F11: 无效专家引用 fallback
- F12: LLM 分解失败 fallback
- F13-F16: 去中心化协作、用户干预、团队解散、动态专家管理
2026-06-18 02:26:59 +08:00
28ca5b6001
fix(experts):修复 ExpertTeamRouter 模板引用 bug + 修复损坏的集成测试
...
U1: resolve_expert_configs 中使用 copy.deepcopy(template.config) 替代直接引用，
防止 is_lead 赋值污染共享模板（与 BoardRouter 的 P1 修复保持一致）。
U2: 移除 test_expert_team.py 中对已移除类的导入（CollaborationPlan, MergeStrategy,
ParallelType, PhaseStatus, PlanPhase），删除使用这些类的测试。保留不依赖已移除类
的 8 个测试。U9 将重写为流水线模式测试。
2026-06-18 01:23:25 +08:00
7384ecb03e
feat: Expert Team Mode — plan-execute collaboration with conversation UI
...
Implements B+C hybrid Expert Team Mode with ExpertConfig, CollaborationPlan,
TeamOrchestrator, ExpertTeamRouter, HandoffTransport, SharedWorkspace, and
Expert wrapper. Frontend includes ExpertTeamView, ExpertMessage,
PlanVisualization, team store, and WS event handlers.
Code review fixes: sentinel-based close, per-phase retry, name validation,
Vue component integration, teamState dedup, Redis reset, plan reassign,
event_type validation, hmac timing-safe compare, message dedup,
reactive updatePhases, O(1) phase lookup, iterative DFS, bounded Queue.
232 unit tests passing.
2026-06-14 22:20:14 +08:00
94c4c8b887
feat: accumulated frontend enhancements, docs, and static assets
...
- Frontend view updates (ChatView, EvolutionView, SkillsView, etc.)
- Updated portal routes and chat store
- New frontend components (FilePreview, ToolCallCard, IconNav)
- Updated static build assets
- New test files (merged router, parallel tools, ReWOO fallback)
- Documentation and brainstorm files
- Codegraph and understand-anything artifacts
2026-06-14 16:35:01 +08:00
6e0e081f23
feat: gap closure sprint — dark theme, @-mention, LocalComputerUse, tests
...
P0: U4 UsageStore + U5 CascadeStateStore independent test files (57 tests)
P1: Dark theme — tokens.css [data-theme="dark"] + theme.ts Pinia store
+ TopNav toggle button + App.vue dynamic Ant Design theme
P1: @-mention — MentionDropdown.vue + /skills/mention-suggest API
+ ChatInput integration with @ detection
P2: LocalComputerUseSession — pyautogui + screencapture (replaces Docker stub)
P2: Integration tests for gap closure (12 tests)
Fix: create_cascade_state_store() now passes session_ttl to InMemory fallback
2026-06-14 16:16:50 +08:00
0ccef7be5c
feat: P0 production hardening — LLM cache, semantic routing, state persistence
...
U1: LLM Cache Core (exact + semantic match, InMemory + Redis backends)
U2: Cache integration into LLMGateway with CacheConfig
U3: Semantic Router as Layer 1.5 in CostAwareRouter
U4: UsageStore persistence (Redis Hash + InMemory fallback)
U5: CascadeStateStore persistence (Redis INCR + InMemory TTL)
U6: EvolutionStore interface unification (Protocol + PostgreSQL backend)
U7: Configuration integration + E2E tests
Code review fixes:
- P0: date iteration bug (day>=28), semantic router index never built,
Redis connection leak (per-call → persistent pool)
- P1: cache degradation recovery, semantic_search degradation,
double miss counting, asyncio.Lock for PG init, LIMIT on queries,
__import__ anti-pattern → _utcnow()
- P2: InMemory TTL cleanup, embedding preservation on put(),
data TTL = max(exact_ttl, semantic_ttl)
2026-06-14 15:16:00 +08:00
5ef08a3b30
fix(review): comprehensive P0-P2 code review fixes
2026-06-12 22:18:25 +08:00
ddc735b078
test(pipeline): add coding harness integration tests
...
5 passing tests covering:
- Pipeline config loading and validation
- Review stage adversarial config verification
- Stage dependencies validation
- Code reviewer skill config and output schema
3 skipped tests (complex mock sequencing covered by unit tests)
2026-06-12 09:42:21 +08:00
d47f279887
fix: resolve code review issues from deferred improvements
...
1. InMemoryMessageBus.request(): fix param name (timeout→timeout_seconds) to match ABC
2. InMemoryMessageBus: track consumer tasks, cancel on unsubscribe
3. InMemoryMessageBus: _try_resolve_pending() in queue consumer path
4. evolve_soul(): use "default" category when patterns is empty
5. quick_classify(): use delimiter-based prompt to mitigate injection risk
6. Use asyncio.get_running_loop() instead of deprecated get_event_loop()
2026-06-11 13:49:02 +08:00
bba394be38
fix(marketplace): address code review findings
...
- Fix str.format() crash when user input contains curly braces
- Fix Layer 2 passing str to find_best_agent (expects list[str])
- Fix AlignmentGuard fail-open on LLM audit failure (now fail-closed)
- Fix _config_reload_lock not initialized in create_app()
- Fix evolve_soul redundant reflector.reflect() call (reuse existing reflection)
- Fix test mocks using AsyncMock for sync find_best_agent method
- Remove unused _COMPLEXITY_CLASSIFY_PROMPT constant
2026-06-10 19:21:40 +08:00
8713636d50
feat(marketplace): add Phase B/C - CostAwareRouter, OrganizationContext, AlignmentGuard, Soul Evolution, Auction, Server Integration
...
Phase B:
- U1: CostAwareRouter with 3-layer routing (rule/LLM/capability matching)
- U6: OrganizationContext with agent profiles and capability-based discovery
- U7: AlignmentGuard with constraint injection and cascade detection
Phase C:
- U8: Soul dynamic evolution with version tracking and reflection-triggered updates
- U9: Auction mechanism as optional advanced routing mode
- U10: Server integration + end-to-end integration tests
250 new tests passing across all units.
2026-06-10 19:09:02 +08:00
7874e875af
merge: integrate feat/agentkit-phase8-chat-adaptive (chat/gui commands + GUI mode)
...
Restores agentkit chat, agentkit gui CLI commands, onboarding wizard,
and GUI mode (AGENTKIT_GUI_MODE) with static file serving.
Resolves merge conflicts in orchestrator.py, app.py, tools/__init__.py, shell.py.
2026-06-10 07:44:06 +08:00
9e9f1314f6
fix(security): resolve all P0/P1 findings from code review
2026-06-10 07:12:41 +08:00
b34f74f598
feat(phase6): implement end-to-end enterprise scenario validation (U15)
...
- Add goal-driven agent skill config and pipeline config
- Add 9 E2E integration tests covering all 7 capabilities:
- SC1: Goal-driven SEO analysis (GoalPlanner→PlanExecutor→PlanChecker→ExperienceStore)
- SC2: Knowledge Q&A with system operation (MultiSourceRAG)
- SC3: Workflow with approval (WorkflowStore + approval node)
- SC4: Self-evolution experience accumulation (ExperienceStore→PitfallDetector→PathOptimizer)
- SC5: Parallel execution efficiency verification
- SC6: Skill registry integration (capabilities, versions, health)
- Cross-capability: Plan+Experience+Pitfall, Review+Experience, RAG+Workflow
- All 2472 tests passing (9 integration + 2463 unit)
2026-06-10 01:38:28 +08:00
9874a4aac0
test: add Phase 8 integration tests for Chat + Adaptive + Multi-Agent (U8)
...
End-to-end integration tests covering session lifecycle, adaptive pipeline,
multi-agent communication via MessageBus, and config serialization.
2026-06-08 01:17:04 +08:00
b34b06724d
fix(agentkit): resolve all P0/P1/P2/P3 issues from code review
2026-06-07 22:05:18 +08:00
bad66445ff
feat(compression): U6 GEO Pipeline compression integration tests and config
...
Add GEO Pipeline end-to-end compression integration tests with
MockHeadroomCompressor. Add compression configuration section to
llm_config.yaml with headroom and summary mode examples.
2026-06-07 18:20:41 +08:00
2e547e345a
feat(geo): U4 GEO skill tool binding with BaiduSearch and E2E tests
...
Add BaiduSearchTool (API mode + scraping fallback), bind tools to
GEO skill YAML configs (baidu_search, web_crawl, schema_extract,
schema_generate), extend geo_full_pipeline with generate_content
and deai steps, add 36 E2E integration tests.
2026-06-07 17:25:37 +08:00
468dfd71e8
fix(test): adapt health check assertion to Phase 4 status value change
2026-06-06 21:56:30 +08:00
f87b790c0f
feat(agentkit): v2 Phase 1 - ReAct/LLM Gateway/Skill/Server + review fixes
...
535 unit + 52 integration tests passing. README added.
2026-06-05 23:32:16 +08:00
9a6d6fee4e
feat: initial fischer-agentkit package with unified agent architecture
...
- BaseAgent with handle_task() pattern (execute template moved up)
- Protocol: TaskMessage, TaskResult, HandoffMessage, EvolutionEvent
- Tool system: FunctionTool, AgentTool, ToolRegistry with versioning
- Memory system: WorkingMemory (Redis), EpisodicMemory (pgvector), SemanticMemory (RAG adapter), MemoryRetriever (hybrid)
- Evolution engine: Reflector, PromptOptimizer (DSPy-style), StrategyTuner, ABTester, EvolutionStore
- Orchestrator: PipelineEngine (parallel DAG), PipelineLoader (YAML), HandoffManager, DynamicPipeline
- MCP: Server (FastAPI), Client (httpx), MCPTool
- Prompts: PromptTemplate, PromptSection
- Exceptions: full hierarchy including Tool, Schema, Handoff, Evolution errors
- Tests: unit tests for core, tools, protocol, evolution, pipeline
2026-06-04 22:24:06 +08:00
chiguyong