fischer
/
fischer-agentkit
1
0
Fork 0
Code Issues Pull Requests Actions 87 Packages Projects Releases Wiki Activity
300 Commits 1 Branch 0 Tags 20 MiB
Commit Graph

12 Commits

Author SHA1 Message Date
chiguyong d27681a93c fix(portal-auth): 修复 dev mode JWT 验证误激活 + README 文档同步 
## Portal 401 根因修复

问题：AGENTKIT_JWT_SECRET 未设置时，jwt_utils 生成 ephemeral 非空 secret，
该 secret 被传给 AuthMiddleware 后 _is_dev_mode() 返回 False（not "" = False），
导致无 JWT/API key 的请求被拒为 401（17 个 portal 测试失败）。

修复：分离 explicit_jwt_secret 与 jwt_secret —
- explicit_jwt_secret = get_jwt_secret()  # None when env unset
- jwt_secret = explicit_jwt_secret or get_or_create_jwt_secret()  # for signing
- AuthMiddleware(jwt_secret=explicit_jwt_secret or "")  # only explicit activates JWT verify

ephemeral secret 仅供 token 签名 routes，不激活 middleware 的 JWT 验证。
生产环境（AGENTKIT_JWT_SECRET 已设置）行为不变。

验证：
- _is_dev_mode(): False → True
- GET /api/v1/portal/conversations: 401 → 200
- 27 个 portal 测试全部通过（之前 17 失败）
- 232 个测试通过 (portal + auth + calendar)，0 失败

## README 文档同步

代码中 CostAwareRouter / RegexRules / HeuristicClassifier / SemanticRouter / LLMClassifier
类已完全删除，仅 RequestPreprocessor 存在。README.md 6 处过时引用同步：

- 第 4 节"意图路由"改为引用 RequestPreprocessor（详见第 7 节）
- 第 7 节重写为"请求预处理（RequestPreprocessor）"，按 AGENTS.md 架构描述
- 第 8 节"语义路由"删除（合并入第 7 节历史说明）
- 架构图 CostAwareRouter → RequestPreprocessor，22→28 路由模块
- 模块详解 chat/skill_routing + chat/semantic_router 合并为 chat/request_preprocessor
- 模块详解 router/intent 描述更新为"未接入 chat 流程"
- 目录注释 CostAwareRouter → RequestPreprocessor
- 章节重新编号 1-16 连续（原 1-17 跳过 9）
 2026-06-28 15:26:42 +08:00
chiguyong c9ce15fa4b fix(code-review): 修复走查发现的 13 High + Medium 安全/可靠性问题 
代码修复（8 High + 9 Medium）：
- portal.py — C1 IDOR 文档 / C2 类型修复 / C3 WS 连接上限 16 / C4 ws_user_id 早初始化 / M silent swallow 日志化
- auth/middleware.py — C5 WS sid 补齐
- calendar_tool.py — C6 偏移量 ±43200 双向校验 + reminder_channels 类型/白名单校验
- sqlite_conversation_store.py — C7 DELETE 事务回滚
- chat.ts (Pinia) — C8 deleteConversation 清理 pending 缓存
- app.py — M except: pass → logger.debug(exc_info=True)
- Scene6Error.vue — M onUnmounted 清理 setTimeout
- DocumentsTab.vue — M Invalid Date 守卫
- ChatSidebar/RightPanel/TopNav.vue — M aria-label 无障碍标签
- SystemMonitorPanel.vue — M v-else 兜底 + active 边框色 + tablist 键盘导航
- CalendarDrawer.vue — M overflow-y: auto
- CalendarGrid.vue — M ResizeObserver 反馈循环防护
- SkillsTab.vue — M onMounted 始终 fetchSkills

文档修复（5 High + 6 Medium）：
- portal-platform-security-reliability-fixes.md — D2 测试路径 / D3 Root Cause+Impact 章节 / D4 severity: mixed / 标题中文化 / 12 处绝对路径转相对 / P2 #12 数字口径
- AGENTS.md — D5 路由表 22→28 / 专家模板 5→15 / LiteLLM U15 迁移 / 配置查找 fallback
- README.md — 8 处端口 8000→8001

新增测试：
- tests/unit/calendar/test_calendar_tool.py — ponytail 自检断言

验证：
- ruff check (5 文件) — All checks passed
- vue-tsc --noEmit — exit 0
- git stash baseline 验证 — portal 17 个 401 失败为预存在问题

已知限制（预存在）：
- 17 个 portal 测试 401 失败 — 需另起 ce-debug 调查
- README.md 7 处 CostAwareRouter 引用过时 — 文档同步另起任务
 2026-06-28 15:06:41 +08:00
chiguyong bbbf9cd40a feat(bitable): add bitable companion service with full P0-P2 fixes 
Bitable is a multi-dimensional table companion service that runs alongside
the main AgentKit server. It provides structured data storage with formula
fields, views, and ingestion pipelines.

Major components:
- Domain models (Pydantic v2): Table, Field, Record, View, RecalcTask
- SQLAlchemy 2 async ORM with independent bitable PostgreSQL schema
- Formula engine: AST parser, DAG, Kahn topological sort, safe eval
- RecalcWorker: atomic task claiming (FOR UPDATE SKIP LOCKED), topo-order
  processing, stale-threshold reaper for crash recovery
- REST API (/api/v1/bitable): tables, fields, records, views, files
- BitableTool: agent-facing tool with batch chunking (500/batch)
- CLI: agentkit bitable subcommands (create, list, import-excel, etc.)
- Frontend: Vue 3 + vxe-table grid with field management, views, filters
- Ingestion: Excel (openpyxl), database reflection, API collector

Security fixes (ce-code-review P0 + ce-debug P1):
- SQL injection prevention (field_id validation, parameterized queries)
- IDOR protection (_check_table_ownership on all table-level endpoints)
- SSRF prevention (URL scheme + private IP validation in parse_excel_url)
- OOM prevention (streaming file upload, batch delete, batch insert)
- Atomic recalc task claiming (FOR UPDATE SKIP LOCKED)
- Formula engine cache invalidation on field changes
- Composite cursor pagination for non-id sort orders
- Batch upsert (eliminates N+1 queries)
- Sync I/O offloaded to thread pool in async contexts
- Internal token auth (X-Internal-Token, hmac.compare_digest)
- PK unique index enforcement

Test coverage: 88 unit tests (95 skipped without Docker)
 2026-06-25 01:09:59 +08:00
chiguyong 47f3bfecfc feat(documents): add document processing capability (U1-U9) 
Implements end-to-end document generation, template filling, and reading:

- DocumentService: unified business layer for create/query/download
- Renderers: Word (Markdown->docx), Excel (Markdown/JSON->xlsx),
  PDF (Markdown->pdf with CJK font), Template (Jinja2 sandbox .docx fill)
- DocumentLoader: read PDF/Word/Excel/Markdown/HTML/text -> Document
- DocumentTool: Agent tool with action=create|read
- REST API: /api/v1/documents (create, upload-template, list, download)
- Frontend: DocumentPanel, DocumentCard, documents Pinia store,
  chat store tool_result detection
- Security: path traversal guard (Path.resolve + relative_to),
  SSTI guard (SandboxedEnvironment), API key auth, 50MB upload limit
- Bug fixes: template path traversal (400 not 500), TemplateRenderer
  lazy-load (no external registration dependency)
- Tests: 168 tests (unit + security + E2E F1/F2/F3 + bug hunt)
- Docs: README section 17, requirements + plan + test-plan docs

Requirements R1-R28 verified, F1-F3 user flows pass.
 2026-06-23 15:05:01 +08:00
chiguyong 91f56ca663 feat: 企业级客户端-服务端架构 + 代码审查修复 
## 主要变更

### 新增功能
- 企业级客户端-服务端架构（JWT 认证 + RBAC 权限 + 终端安全）
- Tauri 桌面客户端与服务端配置同步
- 远程 LLM 网关（RemoteLLMProvider，支持 401 token 刷新重试）
- 服务端终端 WebSocket（带管理员审批流程）
- 终端白名单六层防御（黑名单 → shell 操作符检测 → 内置安全 → 全局/用户/会话白名单 → 危险检测）

### 代码审查修复（P0/P1/P2）
- P0: 危险二进制（rm/docker 等）不再加入白名单，compute_whitelist_entry 返回 None
- P1: 终端审批所有权追踪（_approval_owners dict）+ 会话清理防泄漏
- P1: 本地终端 WebSocket URL 补齐 JWT token
- P1: 审计日志支持 terminal_mode 过滤
- P1: /system/resources 端点强制 SYSTEM_CONFIG 权限
- P1: RemoteLLMProvider 增加 401 token 刷新重试机制
- P1: auth/models.py 使用 Mapping[str, object] 替代 Any 类型
- P2: 终端授权依赖检查 is_active 账户状态
- 修复 app.py 未使用的 APIKeyAuthMiddleware 导入

### 文档更新
- README.md: 新增第 16 章「企业级客户端-服务端架构」
- AGENTS.md / CLAUDE.md: 同步模块映射、路由表、前端页面
- 计划文档标记为 completed

Closes: docs/plans/2026-06-19-003-feat-enterprise-client-server-evolution-plan.md
 2026-06-20 06:48:18 +08:00
chiguyong 99fe4c99f7 fix: comprehensive code review fixes + WS test stability 2026-06-15 08:17:34 +08:00
chiguyong baaa7089cd docs: update README and knowledge graph for gap closure features 
- README: add dark theme, LLM cache, semantic router, cascade detection, ComputerUseTool, @-mention
- build_kg.py: add 30+ module summaries for new modules
- knowledge-graph.json: rebuild (2496 nodes, 3328 edges)
- fingerprints.json: recalculate 524 file fingerprints
- meta.json: update gitCommitHash and analyzedAt
 2026-06-14 16:54:12 +08:00
chiguyong 94c4c8b887 feat: accumulated frontend enhancements, docs, and static assets 
- Frontend view updates (ChatView, EvolutionView, SkillsView, etc.)
- Updated portal routes and chat store
- New frontend components (FilePreview, ToolCallCard, IconNav)
- Updated static build assets
- New test files (merged router, parallel tools, ReWOO fallback)
- Documentation and brainstorm files
- Codegraph and understand-anything artifacts
 2026-06-14 16:35:01 +08:00
chiguyong 5ef08a3b30 fix(review): comprehensive P0-P2 code review fixes 2026-06-12 22:18:25 +08:00
chiguyong 74e2223153 feat(cli): pair command + doctor rename + client config priority 
- health → doctor (better naming)
- agentkit pair --name <client> generates ak_live_ API key
- agentkit pair --list / --revoke for client management
- ClientConfig class: client config > init defaults > hardcoded
- README updated with pair usage + business system pairing guide
- 38 CLI tests passing
 2026-06-06 13:08:14 +08:00
chiguyong 3cd6a73d86 feat(cli): Docker deployment + README CLI section 
U5: docker-compose.yaml (agentkit + redis + postgres) + Dockerfile ENTRYPOINT
U6: README updated with CLI quick start + Docker deployment guide

31 CLI tests passing, no regression.
 2026-06-06 12:47:47 +08:00
chiguyong f87b790c0f feat(agentkit): v2 Phase 1 - ReAct/LLM Gateway/Skill/Server + review fixes 
535 unit + 52 integration tests passing. README added.
 2026-06-05 23:32:16 +08:00