fischer
/
fischer-agentkit
1
0
Fork 0
Code Issues Pull Requests Actions 85 Packages Projects Releases Wiki Activity
407 Commits 1 Branch 0 Tags 22 MiB
Commit Graph

198 Commits

Author SHA1 Message Date
chiguyong 980919fc95 feat(admin): U5 — LLM config admin endpoints + department quotas 
QuotaService: set/get/list/delete quotas, check_quota (hard reject),
is_model_allowed. JSON-serialized limit_value, upsert with ON CONFLICT.

LlmConfigService: provider CRUD + set_api_key + fallback management.
fcntl.flock file lock prevents concurrent YAML writes. Reuses
settings.py helpers (_read_yaml_config, _write_yaml_config,
_write_env_var, _mask_api_key).

11 new admin endpoints: provider CRUD, api-key, fallback CRUD,
department quotas CRUD. All guarded by _require_admin.

93 new tests (30 quota unit + 32 llm-config unit + 31 integration).
 2026-06-21 15:03:38 +08:00
chiguyong ad65f7a8d7 feat(admin): U1+U2+U4 — schema v3, department service, context filtering 
U1: Bump _SCHEMA_VERSION to 3, add 5 department tables (departments,
user_departments, department_skill_bindings, department_kb_bindings,
department_quotas) + 5 ORM models + helpers.

U2: DepartmentService (12 async methods: CRUD + bind/unbind skill/KB +
count_users). Mount admin_router in app.py. 36 unit + 28 integration tests.

U4: DepartmentContext FastAPI dependency (per-route, admin bypasses
filtering). filter_skills_by_department / filter_kb_sources_by_department
helpers. Applied to GET /skills and GET /kb-management/* routes.
15 integration tests for department isolation.

Also includes brainstorm + plan docs. 108 new tests, all pass.
 2026-06-21 15:03:27 +08:00
chiguyong 6dca9ba4f2 feat(admin): U3 — user CRUD + password reset + multi-department 
Add create_user method to LocalAuthProvider (bcrypt hash + INSERT,
raises ValueError on duplicate username/email).

Add UserService with 9 async methods: create/list/get/update/delete
(soft)/reset_password/assign_department/remove_department/list_user_departments. reset_password revokes all sessions via SessionService.
delete_user is soft (is_active=0, row preserved).

Add 9 user endpoints to routes/admin.py: POST/GET/PATCH/DELETE users,
reset-password, assign/remove department, list departments. All
guarded by _require_admin.

Tests: 40 unit + 37 integration = 77 new tests. Full admin suite
170 tests pass, no regressions.
 2026-06-21 13:45:42 +08:00
chiguyong 54be47d9ba fix(ui): SplashScreen retry button white-on-white in dark mode 
The '重试' button used hardcoded `color: #fff` while its background
was `var(--color-primary)`. In dark mode --color-primary resolves to
#fbfbfa (near-white), making the button text invisible.

Switch to `var(--text-inverse)` (which is #1a1a1a in dark mode and
#ffffff in light mode) so the button text is always readable on the
primary background regardless of the active theme.

SplashScreen was the only file in the codebase with this pattern;
all other primary-colored elements either use Ant Design's automatic
colorTextLightSolid handling or a different token combination.
 2026-06-21 12:27:56 +08:00
chiguyong 67c0d67262 fix(auth,chat): P0 security fixes + stop-generation button + doc sync 
U1: whoami cold-start security — add is_active check (disabled users
now get 401, not 200) and replace create_token_pair with create_access_token
to avoid minting a discarded refresh token (token-amplification risk).

U2: list_active_by_provider now filters expired sessions (expires_at > now)
matching its docstring promise; previously only checked revoked = 0.

U3: Fix asyncio.run() crash in test_revoke_other_user_session_returns_404
(converted to async). Add U1/U2 verification tests (disabled-user whoami,
no-refresh-leak, expired-session filtering, provider filtering) and
strengthen admin route tests (404 boundary, non-admin 403 on /admin/sessions).

U4: Update CLAUDE.md/AGENTS.md Request Flow — CostAwareRouter 3-layer
diagram replaced with actual RequestPreprocessor architecture (@board/@team
prefix intercepts then @skill: prefix then trivial-input regex then default
REACT). ExecutionMode list expanded to all 7 values.

U5: Frontend stop-generation button — ChatInput.vue shows a stop button
when isGenerating is true; chat store gains stopGeneration() that sends
{type:"cancel"} over WebSocket (backend portal.py already handles cancel).

Tests: 120 auth tests pass (unit + integration). ruff clean. vue-tsc clean.
 2026-06-21 11:36:58 +08:00
chiguyong aee7362665 feat(auth): U3/U4/U9 logout-others + whoami cold-start + admin UI + integration tests 2026-06-21 09:08:34 +08:00
chiguyong 9328451050 feat(auth): U7-U10 会话管理 UI + admin API + 测试修复 
- U7: 前端 ActiveSessionsPanel + ChangePasswordPanel 组件
- U8: 用户会话管理（查看/撤销/改密）集成到 SettingsView
- U9: 管理员会话管理 API + UserSessionsPanel + AdminApiClient
- U10: 认证中间件支持 sid 会话验证 + legacy client 兼容
- 修复 test_auth.py 测试夹具：注入 SessionService 单例绑定测试 DB
- 修复 wrong-password 断言大小写匹配
- ruff: 清理未使用导入
 2026-06-21 08:48:25 +08:00
chiguyong b418c3dc95 feat(auth): U3 SessionService + validation cache 
Adds the central business-logic layer for ``auth_sessions`` so routes,
the auth middleware, and the admin endpoints can call a single service
instead of touching the table directly.

Server
- session_service.SessionService: CRUD + lifecycle for auth_sessions.
  - create() enforces the per-user cap (default 10): the oldest
    active session is evicted with reason=session_cap_eviction.
  - rotate() swaps a refresh token, adds the old hash to the
    denylist, and raises SessionReuseDetected (revoking all sessions
    for the user) when the old token is replayed.
  - revoke() / revoke_by_refresh_token() / revoke_all_for_user()
    with explicit reasons: user_terminated, admin_revoked,
    password_changed, reuse_detected, session_cap_eviction.
  - touch() bumps last_active_at (called on /auth/whoami).
- session_cache.SessionValidationCache: bounded LRU+TTL wrapper
  (default 30s/1k entries) around SessionService.is_session_valid.
  The middleware hits this on every request carrying a V2 sid claim;
  one SQLite round-trip per 30s per session instead of per request.
- get_session_service() / get_validation_cache() module-level
  singletons overridable in tests via set_session_service() /
  set_validation_cache().

Tests
- tests/unit/auth/test_session_service.py: 15 cases covering
  create/rotate/revoke/list/cap-eviction/reuse-detection/expired
  sessions.

Refs: U3 in docs/plans/2026-06-20-002-feat-centralized-auth-token-persistence-plan.md
 2026-06-21 01:58:30 +08:00
chiguyong 5ba1aceb96 feat(auth): U2 JWT sid/jti claims + refresh-token denylist 
Adds V2 JWT claim schema that closes the kicked-out window and enables
refresh-token rotation with reuse detection.

Server
- jwt_utils.create_token_pair now takes ``session_id`` and ``remember_me``
  kwargs.  When ``session_id`` is provided, both tokens carry a ``sid``
  claim and the access token also carries a ``jti`` claim; the refresh
  token's jti is intentionally absent (rotation uses the token hash).
- New ``REFRESH_TOKEN_TTL_REMEMBER_ME = 30d`` (default 7d) selected by
  the ``remember_me`` flag.
- ``verify_token`` now supports an optional ``expected_type`` filter
  (e.g. ``"access"`` / ``"refresh"``); when omitted, both types pass
  (used by /auth/whoami's cold-start path).
- New ``auth.denylist`` module: ``InMemoryRecentlyRevoked`` (default for
  the Tauri sidecar / dev mode) and ``RedisRecentlyRevoked`` (multi-
  process server).  Bounded LRU with auto-expiry via ``time.monotonic()``.

Backwards-compat
- Tokens issued before U2 (no ``sid``) are still accepted by
  ``verify_token``; validation falls through to the legacy
  ``user_sessions`` table via the U10 shim (next commit).

Tests
- tests/unit/auth/test_jwt_utils.py: 12 cases — V1/V2 claim presence,
  default + remember-me TTL, expected_type filter, expiry, wrong secret.
- tests/unit/auth/test_denylist.py: 6 cases — add/contains, TTL expiry,
  LRU eviction, re-add refresh, clear, hash stability.

Refs: U2 in docs/plans/2026-06-20-002-feat-centralized-auth-token-persistence-plan.md
 2026-06-21 01:53:13 +08:00
chiguyong e39bf56248 feat(frontend): U6 tauri-auth adapter + vitest unit tests 
- src/api/tauri-auth.ts: abstract Keychain (Tauri) / localStorage (Web)
  behind a single async API (set/get/clear refresh token). Falls back
  to localStorage with a console.warn when the Keychain is unavailable
  (KTD-confirmed decision: silent localStorage fallback).
- tests/unit/api/tauri-auth.test.ts: 13 vitest cases covering both
  Tauri and Web code paths plus the failure / fallback behaviour.
- vitest.config.ts + tsconfig.test.json: minimal Vitest setup
  (happy-dom env, @ alias). Adds test:unit, test:unit:watch, and a
  typecheck alias that includes the test tree.

Refs: U6 in docs/plans/2026-06-20-002-feat-centralized-auth-token-persistence-plan.md
 2026-06-21 01:42:50 +08:00
chiguyong 7e7a841f78 feat(tauri): U5 OS Keychain commands (store/load/clear refresh token) 
macOS 的 WebView 把 localStorage 存在明文 SQLite（`~/Library/WebKit/.../LocalStorage/`），
同 UID 任何进程可读。Refresh token 迁到 OS Keychain 加密落盘：
- macOS:   Keychain Access.app
- Windows: Credential Manager
- Linux:   Secret Service (gnome-keyring / kwallet)

变更
- Cargo.toml: 加 keyring = "3" 依赖
- src/auth.rs: 3 个 #[tauri::command] — store_refresh_token / load_refresh_token / clear_refresh_token
- src/lib.rs: mod auth + 注册 3 个 commands

设计要点
- SERVICE = "com.fischer.agentkit"，USERNAME = "refresh_token"，
  单 slot（last-login-wins），匹配 V1 localStorage 行为
- load / clear 都把 keyring::Error::NoEntry 映射为 Ok(None) / Ok(())，
  首次启动 / 重复登出不会触发错误
- 多用户切换器未来需要时把 key 改成 refresh_token::<user_id>

Tauri 2 capabilities 说明
- capabilities/default.json 不需要改：自定义 #[tauri::command] 默认允许，
  capabilities 仅管 plugin 命令（core:*、log:* 等）

验证
- cargo check: 通过
- cargo test --lib: 1 passed (constants_are_stable smoke test)

后续：U6 在前端封装 tauri-auth.ts adapter（keychain / localStorage fallback）
 2026-06-21 01:35:55 +08:00
chiguyong 2f55fc7434 feat(auth): U11 AuthProvider 抽象层 + auth_sessions schema 
为未来对接集团 IdP（OIDC / SAML / LDAP / 飞书 / 钉钉 / 企微）留扩展点，
同时落地 auth_sessions 表（V2 替代 user_sessions）。

变更
- models.py: 新增 auth_sessions + auth_meta 表，V1→V2 数据回填
- providers/base.py: AuthProvider Protocol 接口契约
- providers/local.py: LocalAuthProvider 默认实现（封装 SQLite + bcrypt）
- providers/oidc_stub.py: StubOIDCProvider 占位（NotImplementedError）
- providers/__init__.py: get_auth_provider DI 工厂（lru_cache 单例）
- providers/exceptions.py: AuthProviderError / InvalidCredentials / ProviderNotImplemented
- providers/user.py: Provider-agnostic User 值对象
- tests/unit/auth/: 37 个测试覆盖 Protocol / DI / Local / OIDC 行为

auth_sessions.auth_provider 字段记录登录来源（local / oidc-stub / 未来
oidc-keycloak / saml / ldap），未来切 IdP 时审计可溯源。

测试: 37 passed (providers) + 62 passed (auth 全集) + ruff check clean
 2026-06-21 01:28:14 +08:00
TraeAI d245f2e3d8 fix: UI/UX 修复 + 暗色主题 + async generator 防御 
- App.vue: 重构 bootstrapBackend 流程，新增 retryBootstrap 重试入口
- SplashScreen.vue: 错误状态显示「重试」按钮
- system.py: /system/resources 移除 SYSTEM_CONFIG 权限依赖，避免 dev 模式 401
- react.py + gateway.py: 新增 _ensure_async_iterable helper 防御
  'async for requires aiter, got coroutine'
- theme.ts: Ant Design colorTextLightSolid 映射到 --text-inverse
  修复暗色主题下所有 primary 按钮白底白字
- ChatSidebar.vue: 新建对话按钮兜底深色文字
- SystemMonitorPanel.vue: 服务状态区域间距优化
- chat.ts + portal.py + sqlite_conversation_store.py: 会话标题派生修复
  解决点击对话标题变成"对话"的问题
- app.py: Serve 模式自动创建 default agent
- Tauri src-tauri/: 完整 Tauri 客户端配置 (icons, capabilities, Cargo)
 2026-06-20 23:35:57 +08:00
chiguyong cac9c73dd5 fix(routing): U1-U6 路由优化 + 修复方案 + 代码审查修复 
实现 6 个修复单元（U1-U6）并应用 ce-code-review 发现的 5 项安全修复。

## U1: benchmark 超时阈值
- 按 difficulty 分级超时：easy=45s, medium=60s, hard=90s
- 替换原单一 60s 硬编码

## U2: OpenAICompatibleProvider httpx 超时
- 新增 timeout 参数（默认 120s），替换硬编码 60s
- ProviderConfig.timeout 透传到 Provider
- 新增 2 项单元测试

## U3: 激活 QualityGate skill_match 校验
- BaseAgent._build_skill_context() 构造 skill_context
- 在 base.py / tasks.py / runner.py 三处传入 QualityGate.validate()

## U4: 添加 disambiguation_keywords 字段
- IntentConfig 新增 disambiguation_keywords 字段
- 8 个 skill YAML 补充该字段

## U5: 优化 RequestPreprocessor 路由正则
- 拆分 _FACTUAL_RE 为 CN/EN 双正则（中文无空格）
- 新增 _MATH_RE / _TRANSLATION_RE 纯模式
- _TOOL_CONTEXT_RE 排除需要工具的实时查询
- 多行输入守卫 + 结尾标点支持
- 新增 21 项单元测试（共 40 项全通过）

## U6: 重新基准测试
- 真实 LLM benchmark：准确率 60% -> 93.3%
- 4/5 通过，p50=40.8s，一致性=100%
- 旧基线备份至 baseline_2026-06-17_old_arch.json

## ce-code-review 修复（5 项）
- 修复 \s 字符类匹配换行符的安全隐患
- 添加事实/数学正则的结尾标点支持
- 修复 geo_optimizer.yaml 关键词重复
- 修复 _login_with_retry 不可达 return
- 修复 real_llm_server fixture stderr_fh 资源泄漏

测试：tests/unit/chat/ 63 项全通过，ruff 检查通过。
 2026-06-20 19:31:49 +08:00
chiguyong 2e404cf1a0 test: 全面回测 + 真实 LLM E2E + 能力 benchmark + 问题修复 
## 测试结果

### 后端 E2E（真实 LLM，真实服务器）— 13/13 通过
- tests/e2e/test_real_llm_e2e.py: 认证流程、LLM 网关、Chat API、WebSocket
- 使用百炼 coding plan（qwen3.7-plus）真实 LLM，无 mock
- 修复 SQLite 写锁竞争导致的间歇性 500（_login_with_retry 重试机制）

### 前端 E2E（Playwright + 真实 LLM）— 11/11 通过
- login.spec.ts (4): 登录流程、表单验证、token 存储
- chat.spec.ts (3): 真实 LLM 对话、消息渲染
- terminal.spec.ts (4): 终端面板、白名单管理
- 使用系统 Chrome（channel: 'chrome'）避免浏览器下载

### Benchmark 能力评估（真实 LLM）
- full 模式: 60% 准确率（5 用例 3 通过 2 超时）
- fast 模式: 100% 准确率
- 失败用例: llm-001 (intent_understanding) / llm-004 (code_generation) 均为超时

### 单元测试
- 174 个新测试通过
- 28 个预存失败（非本次架构变更引入）

## 代码修复

### chat.ts: 消除 any 类型 TODO（line 406）
- handleWsMessage 参数从 Record<string, any> 改为 WsServerMessage 联合类型
- 使用判别联合窄化，每个 case 分支直接访问类型化字段
- 移除通用 payload 变量，移除未使用的类型导入
- vue-tsc --noEmit 零错误

### 基础设施修复
- playwright.config.ts: 修复 PROJECT_ROOT 路径（4 级而非 2 级）
- playwright.config.ts: 用 uvicorn.run() 替代 agentkit serve（避免非 tty 交互提示）
- helpers.ts: API_BASE 改为绝对 URL（Node.js fetch 不支持相对 URL）
- helpers.ts: clearAuth 修复 page.evaluate 上下文问题（Node 常量传入浏览器）
- helpers.ts: loginViaApi 添加 429 限流重试 + token 缓存
- login.spec.ts / terminal.spec.ts: 修复 Ant Design Vue autoInsertSpace 导致的选择器不匹配
- chat.spec.ts: .first() 改 .last() 避免拾取历史消息
- setup-test-user.py: .local 邮箱改为 .com（EmailStr 拒绝 .local TLD）
- .gitignore: Playwright 产物路径限定到 frontend 目录

### 依赖
- pyproject.toml: 补充 pyjwt, bcrypt, aiosqlite 依赖
- package.json: 添加 @playwright/test 依赖

## 未完成计划清单（核对结果）

### 计划 001（聊天主区 VI 重梳）— active
- U7: SkillsTab/SystemTab/KnowledgeTab 三子组件未实现
- U8: Preview 样例场景精修未完成
- U9: BoardMeetingModal VI 适配收尾未完成
- U10: 质量门与后端回归测试未完成

### 计划 002（企业级 C/S 架构）— 方案评审中
- 8 个待决策问题未明确（卖给谁/部署位置/终端形态等）
- P2/P3/P4 模块延后

### 计划 003（企业级 C/S 演进）— completed
- 7 项 Deferred（Web 管理台/技能市场/SSO/代码索引/多租户等）

### 代码 stub
- DockerComputerUseSession: start/stop/screenshot/execute_action 4 个方法为 stub
  （需真实 Docker + VNC + Anthropic Computer Use API，属未来功能）
 2026-06-20 18:22:10 +08:00
chiguyong 91f56ca663 feat: 企业级客户端-服务端架构 + 代码审查修复 
## 主要变更

### 新增功能
- 企业级客户端-服务端架构（JWT 认证 + RBAC 权限 + 终端安全）
- Tauri 桌面客户端与服务端配置同步
- 远程 LLM 网关（RemoteLLMProvider，支持 401 token 刷新重试）
- 服务端终端 WebSocket（带管理员审批流程）
- 终端白名单六层防御（黑名单 → shell 操作符检测 → 内置安全 → 全局/用户/会话白名单 → 危险检测）

### 代码审查修复（P0/P1/P2）
- P0: 危险二进制（rm/docker 等）不再加入白名单，compute_whitelist_entry 返回 None
- P1: 终端审批所有权追踪（_approval_owners dict）+ 会话清理防泄漏
- P1: 本地终端 WebSocket URL 补齐 JWT token
- P1: 审计日志支持 terminal_mode 过滤
- P1: /system/resources 端点强制 SYSTEM_CONFIG 权限
- P1: RemoteLLMProvider 增加 401 token 刷新重试机制
- P1: auth/models.py 使用 Mapping[str, object] 替代 Any 类型
- P2: 终端授权依赖检查 is_active 账户状态
- 修复 app.py 未使用的 APIKeyAuthMiddleware 导入

### 文档更新
- README.md: 新增第 16 章「企业级客户端-服务端架构」
- AGENTS.md / CLAUDE.md: 同步模块映射、路由表、前端页面
- 计划文档标记为 completed

Closes: docs/plans/2026-06-19-003-feat-enterprise-client-server-evolution-plan.md
 2026-06-20 06:48:18 +08:00
chiguyong 848126203e feat(chat): U3 TeamPlanCard 视觉升级 
- 增加蓝色顶条、Lead 头像、阶段时间线状态图标
- 增加底部进度条与当前阶段提示
- 使用 --radius-card、--shadow-card、--font-mono 等设计令牌
- Scene3 预览场景补充 Lead 示例数据
 2026-06-19 01:35:02 +08:00
chiguyong ff22946655 fix(chat): U2 消息模型与分发器对齐后端事件 
- board_started 现在保存为结构化消息并渲染 BoardBannerCard
- board_concluded 现在追加 board_conclusion 结构化消息
- 扩展 IChatMessage.status 包含 error
- 移除 chat.ts 中的 any 类型（保留 handleWsMessage 遗留 TODO）
- BoardBannerCard v-for key 使用 name-index 组合避免重复
 2026-06-19 01:29:25 +08:00
chiguyong b4ba65b9ca fix(gui): 修复启动报错和对话列表不正确的两个关键Bug 
Bug1: 'async for' requires __aiter__ method, got coroutine
- EventQueue.subscribe() 在 _closed=True 时直接 return，
  Python 将其视为协程而非异步生成器
- 修复: 添加不可达的 yield 语句，确保函数始终为异步生成器

Bug2: 启动时对话列表全显示"对话"，无法识别之前的对话
- list_conversations() 不加载消息，_derive_conversation_title
  遍历空 messages 列表导致标题全为"对话"
- 修复: list_conversations 从 SQLite 加载首条用户消息用于标题推导

Bug2b: WebSocket 不响应前端对话切换
- conv 变量只在首条消息时设置，之后忽略 conversation_id
- 修复: 每条消息都检查 conversation_id，切换时更新 conv
 2026-06-18 16:26:02 +08:00
chiguyong 771756814f fix(review): 修复代码审查发现的 P0/P1/P2 问题 
P0 (Critical):
- orchestrator: plan_update 事件 key 从 phases 改为 plan_phases 匹配前端契约
- orchestrator: team_formed 事件 payload 从 string[] 改为 IExpertInfo[] + plan_phases:[]

P1 (High):
- orchestrator: 新增 phase_failed 事件广播 (3处: gather 失败/_execute_phase 异常/_mark_dependents_failed 级联)
- orchestrator: 新增 team_dissolved 事件广播 (3处: 正常完成/ValueError/Exception)
- orchestrator: _mark_dependents_failed 改为 async 以支持事件广播
- orchestrator: gather 结果检查增加 asyncio.CancelledError (Python 3.11+ BaseException)
- plan: PhaseStatus.RUNNING 值从 running 改为 in_progress 匹配前端联合类型
- team.ts: updatePhaseStatus 增加 plan_phases undefined 防御守卫
- chat.py: 增加 asyncio.CancelledError 处理 + team.dissolve() 移入 finally 块

P2 (Medium):
- orchestrator: _get_isolated_agent 返回类型 Any 改为 ConfigDrivenAgent
- orchestrator: _get_llm_gateway 返回类型 Any 改为 LLMGateway | None
- orchestrator: 依赖输出从 SharedWorkspace 读取改为内存 dep_phase.result (减少冗余 I/O)
- plan: PlanPhase.to_dict() result 序列化为 string 匹配前端 ITeamPlanPhase.result 类型
- types.ts: expert_step.step 类型从 number 改为 string (后端发送 phase ID)

Tests: 377 passed (experts + chat_team + expert_team)
 2026-06-18 13:00:59 +08:00
chiguyong a72bc012d5 feat(frontend): U8 适配前端类型支持流水线阶段事件 
- types.ts: WsServerMessage 新增 phase_started/phase_completed/phase_failed 三个事件类型

- types.ts: ITeamPlanPhase 新增 task_description/depends_on/result 字段，parallel_type 和 milestone 改为可选

- chat.ts: handleWsMessage 新增 3 个 phase 事件 case 分支，调用 teamStore.updatePhaseStatus 更新阶段状态

- team.ts: 新增 updatePhaseStatus(phaseId, status, result?) 方法并导出

- ExpertTeamView.vue: 增强 phase 渲染展示 task_description 和 result，补充 --pending/--failed CSS 样式

- PlanVisualization.vue: 修复 parallel_type 可选后的类型检查错误
 2026-06-18 02:19:40 +08:00
chiguyong 1e818b507d feat(server): U6 新增 _execute_team_collab 集成 @team 流水线到 WebSocket 2026-06-18 02:08:29 +08:00
chiguyong dddcbd24e3 feat: 私董会讨论模式 + 回测集成 + WS持久化修复 
私董会讨论模式 (Board Meeting Mode):
- BoardRouter: @board 前缀路由, 专家名验证, 模板回退
- BoardTeam: 讨论容器, 状态机 (FORMING->DISCUSSING->CONCLUDING->COMPLETED)
- BoardOrchestrator: 多轮自主循环讨论引擎, 主持人小结, 停止命令检测
- 9个预设名人专家 YAML (马斯克/贝佐斯/张小龙/芒格等)
- 前端 BoardStatusView 群聊式 UI + WebSocket 事件处理
- 后端 chat.py 集成 @board 路由到主聊天流程

回测集成:
- benchmark.py: 新增 board_meeting 维度 (18 tasks, 6 categories)
- benchmark_dataset.py: 新增 BOARD_BENCHMARKS (11 E2E cases)
- test_board_backtest.py: 66 个回测测试 (9 test classes)

Bug 修复:
- resolve_expert_configs: deep-copy 防止 is_lead 修改污染共享模板
- 所有专家名无效时回退到默认模板
- board_router: 非匹配路径 topic 未 strip
- benchmark_dataset: board-name-invalid-001 输入修正

WebSocket 持久化修复:
- chat.py: 三层防御机制确保任务结果不丢失
- chat store: 断线恢复逻辑

部署配置:
- Gitea Actions CI/CD workflow
- docker-compose.deploy.yaml 部署编排
- scripts/deploy.sh 自动化部署脚本

测试结果: 120 单元测试通过, 71 benchmark 测试 100% 通过, ruff 全部通过
 2026-06-17 23:52:53 +08:00
chiguyong 5b5291c7e5 fix: WebSocket task persistence three-layer defense with security hardening 
Fix chat history empty content and task stops on refresh. Implements: result persistence on disconnect, task backgrounding via asyncio + EventQueue, frontend reconnection recovery. Security: fail-closed conversation_id ownership, asyncio.shield on CancelledError cleanup, async TaskStore shim, EventQueue subscriber limit, connection error resilience. 23 tests added.
 2026-06-17 22:11:51 +08:00
chiguyong ecf87391a5 feat: integrate SQ/EQ into portal WebSocket and CLI (Phase 4) 
- app.py: initialize EventQueue + SubmissionQueue in app.state, close on shutdown
- portal.py: emit unified events (task.created/started/completed/failed,
  turn.thinking/tool_call/tool_result/final_answer) to EQ alongside WebSocket messages
- cli/chat.py: optional --event-queue flag for event emission
- EQ is bypass-only: emit failures never affect WebSocket or CLI main flow
- WebSocket message format unchanged (backward compatible)

Tests: 650 passed, 0 failed, 4 skipped
 2026-06-17 11:05:04 +08:00
chiguyong 773a62ead2 refactor: remove IntentRouter from tasks.py, delete legacy ConversationStore 
- tasks.py: replace IntentRouter.route() with default agent fallback (REACT mode)
- app.py: remove IntentRouter import and initialization
- portal.py: delete legacy in-memory ConversationStore class (~120 lines),
  SqliteConversationStore is the sole implementation now
- Remove unused SessionManager import from portal.py

Tests: 622 passed, 0 failed
 2026-06-17 10:50:41 +08:00
chiguyong 200174c5c7 feat: SQLite persistence, verification loop, spec-driven execution 
Phase 2 of architecture optimization (U5/U6/U9):

- U5: SqliteConversationStore with WAL mode + LRU cache (1000 convs)
  Replaces in-memory ConversationStore in portal.py
  Data survives server restarts (ref: Codex Thread persistence)
- U6: VerificationLoop with verify/verify_and_retry
  Default commands: pytest + ruff check
  ReActEngine integration via verification_enabled flag
  New run_tests tool for LLM to invoke verification
- U9: SpecManager for plan-as-contract (ref: Qoder Quest Mode)
  Plans persisted to .agentkit/specs/{spec_id}.yaml
  API: GET/PUT /api/v1/specs, POST /api/v1/specs/{id}/confirm
  PlanExecEngine emits spec_created event after plan generation

Also fixes: portal skill_name routing, app.py SessionManager guard,
test_telemetry CostAwareRouter removal, test_compression_config fixture
 2026-06-17 10:45:20 +08:00
chiguyong 5374bc8501 refactor: eliminate routing layer, align with industry best practices 
Phase 1 of architecture optimization (U1/U2/U4/U8):

- U1: Rename SimpleRouter to RequestPreprocessor, route() to preprocess()
  Eliminates misleading routing concept; LLM decides autonomously
  in REACT agent loop (matches Codex/Claude Code/Trae pattern)
- U2: Delete CostAwareRouter, HeuristicClassifier, SemanticRouter
  (~700 lines removed). skill_routing.py: 1688 to 220 lines
- U4: PlanExecEngine defaults to ReActStepExecutor, delete _LLMStepExecutor
  (pure LLM calls without tools = no execution capability)
- U8: ReActEngine defaults to ContextCompressor(keep_recent=10)

Supersedes plans 2026-06-15-002/003/004.
New plan: 2026-06-16-006-refactor-architecture-optimization-evolution-plan.md
 2026-06-17 10:44:40 +08:00
chiguyong b54213b3c6 fix(review): resolve all P0/P1/P2 findings from code review 2026-06-16 09:08:03 +08:00
chiguyong 2c5e90104d feat: message persistence, traceability and empty response auto-retry 2026-06-16 08:13:22 +08:00
chiguyong 16ac592855 feat(gateway): empty response auto-retry with fallback model chain 2026-06-16 08:07:21 +08:00
chiguyong 9caf332e9e fix: ensure agent never returns empty result to user 2026-06-16 08:01:43 +08:00
chiguyong 87c59bb3e2 feat(tools): add SkillSearchTool and improve skill_install workflow 
Add skill_search tool so agent can search for skills before installing.
Update skill_install description to guide LLM to search first.
Update system prompt to use skill_search -> skill_install flow.
This fixes the issue where agent returns empty when asked to find a skill.
 2026-06-16 07:52:04 +08:00
chiguyong c4257591d4 refactor(router): replace CostAwareRouter with SimpleRouter and prompt-based tool calling 2026-06-16 03:31:05 +08:00
chiguyong a27eed3714 fix(config): unify config loading chain and protect ${VAR} references 
- Settings API: reverse-resolve env vars to preserve ${VAR} refs in yaml,
  write new API keys to .env instead of agentkit.yaml, extract env_key
  from existing ${VAR} reference when updating providers
- Onboarding: merge-update instead of overwrite when config exists,
  use config_arg to determine output path, .env merge instead of overwrite
- Unified templates: bailian-coding provider name, full model_aliases,
  docker-compose with postgres, expanded .env.example
- Optional ruamel.yaml for comment/format preservation in Settings API
- clients.yaml: add _deep_resolve for ${VAR} env var references
- All CLI commands use load_config_with_dotenv() consistently
- Tests: mock find_config_path and CWD auto-discovery to avoid env leaks
 2026-06-16 00:26:54 +08:00
chiguyong 64d62a2b60 feat: autonomous task execution - connect PlanExecEngine + TeamOrchestrator 
U1: TeamOrchestrator._execute_phase real execution (Expert.agent.execute)
U2: LLM-based merge strategies (BEST/VOTE/FUSION) with fallback
U3: ReActStepExecutor replacing _LLMStepAgent for tool-enabled steps
U4: SharedWorkspace integration for cross-phase/cross-execution state
U5: GoalPlanner prompt tuning with few-shot and verb pattern matching
U6: Replan-before-fallback in TeamOrchestrator
U7: End-to-end validation tests for multi-step research tasks
U8: WebSocket progress events (step_event_callback + new event types)

Code review fixes: P0 response.strip fix, P1 competitor status check,
milestone real impl, VOTE self-bias fix, confirmation_handler wiring,
ExpertTeam public API, DRY _build_result_summaries, replan tests

Also: geo_server.py refactor (ServerConfig.from_yaml), delete llm_config.yaml
 2026-06-15 12:41:32 +08:00
chiguyong 0c63d813dc fix: code review P0/P1 fixes — history param bug, llm dict access, WS ping 
- Fix P0: _build_history_messages(conv.id, message_text) passed string as
  limit param causing TypeError at runtime — removed erroneous second arg
- Fix P0: llm.py /llm/models used attribute access on dict (model_config.max_tokens)
  causing AttributeError — changed to dict.get() access
- Fix P1: Portal WS ignored ping messages — added pong response handler
- Fix: composition.py f-string without placeholders
 2026-06-15 08:30:49 +08:00
chiguyong 99fe4c99f7 fix: comprehensive code review fixes + WS test stability 2026-06-15 08:17:34 +08:00
chiguyong 7384ecb03e feat: Expert Team Mode — plan-execute collaboration with conversation UI 
Implements B+C hybrid Expert Team Mode with ExpertConfig, CollaborationPlan,
TeamOrchestrator, ExpertTeamRouter, HandoffTransport, SharedWorkspace, and
Expert wrapper. Frontend includes ExpertTeamView, ExpertMessage,
PlanVisualization, team store, and WS event handlers.

Code review fixes: sentinel-based close, per-phase retry, name validation,
Vue component integration, teamState dedup, Redis reset, plan reassign,
event_type validation, hmac timing-safe compare, message dedup,
reactive updatePhases, O(1) phase lookup, iterative DFS, bounded Queue.

232 unit tests passing.
 2026-06-14 22:20:14 +08:00
chiguyong 94c4c8b887 feat: accumulated frontend enhancements, docs, and static assets 
- Frontend view updates (ChatView, EvolutionView, SkillsView, etc.)
- Updated portal routes and chat store
- New frontend components (FilePreview, ToolCallCard, IconNav)
- Updated static build assets
- New test files (merged router, parallel tools, ReWOO fallback)
- Documentation and brainstorm files
- Codegraph and understand-anything artifacts
 2026-06-14 16:35:01 +08:00
chiguyong 6e0e081f23 feat: gap closure sprint — dark theme, @-mention, LocalComputerUse, tests 
P0: U4 UsageStore + U5 CascadeStateStore independent test files (57 tests)
P1: Dark theme — tokens.css [data-theme="dark"] + theme.ts Pinia store
    + TopNav toggle button + App.vue dynamic Ant Design theme
P1: @-mention — MentionDropdown.vue + /skills/mention-suggest API
    + ChatInput integration with @ detection
P2: LocalComputerUseSession — pyautogui + screencapture (replaces Docker stub)
P2: Integration tests for gap closure (12 tests)
Fix: create_cascade_state_store() now passes session_ttl to InMemory fallback
 2026-06-14 16:16:50 +08:00
chiguyong 0ccef7be5c feat: P0 production hardening — LLM cache, semantic routing, state persistence 
U1: LLM Cache Core (exact + semantic match, InMemory + Redis backends)
U2: Cache integration into LLMGateway with CacheConfig
U3: Semantic Router as Layer 1.5 in CostAwareRouter
U4: UsageStore persistence (Redis Hash + InMemory fallback)
U5: CascadeStateStore persistence (Redis INCR + InMemory TTL)
U6: EvolutionStore interface unification (Protocol + PostgreSQL backend)
U7: Configuration integration + E2E tests

Code review fixes:
- P0: date iteration bug (day>=28), semantic router index never built,
      Redis connection leak (per-call → persistent pool)
- P1: cache degradation recovery, semantic_search degradation,
      double miss counting, asyncio.Lock for PG init, LIMIT on queries,
      __import__ anti-pattern → _utcnow()
- P2: InMemory TTL cleanup, embedding preservation on put(),
      data TTL = max(exact_ttl, semantic_ttl)
 2026-06-14 15:16:00 +08:00
chiguyong bc43b962c7 feat(client): add Tauri 2.x desktop client with sidecar process management 
- Tauri 2.x project scaffold with dual-window (splash + main)
- Rust sidecar management: spawn/kill Python backend, port discovery via stdout
- CancellationToken for graceful task cancellation on exit
- System tray with show/quit, close-to-tray behavior
- Frontend: dynamic baseURL, SplashScreen, TitleBar, Tauri IPC adapter
- PyInstaller build scripts for cross-platform sidecar packaging
- GitHub Actions CI for Win/Mac/Linux release builds
- CSP security policy, proper capabilities configuration
 2026-06-14 10:06:12 +08:00
chiguyong 321c2333d6 fix(monitor): 对话完成后自动记录经验到监控面板 
- portal.py: 对话完成后调用 _record_experience 记录经验到 dashboard
- portal.py: 修复 routing_result.skill → routing_result.skill_name 属性名
- 经验记录触发 experience_added 和 metrics_updated 事件广播
- metrics API 从 _experiences 内存列表计算 total_tasks/success_rate/avg_duration
 2026-06-13 11:50:57 +08:00
chiguyong 6945b78c55 fix(server): 自动发现 CWD 下的 agentkit.yaml 和 .env 
之前 create_app 只在 AGENTKIT_CONFIG_PATH 环境变量设置时才加载配置和 .env，
导致 uvicorn 直接启动时 LLM provider 未注册（No provider registered）。
现在当 AGENTKIT_CONFIG_PATH 未设置时，自动查找 CWD 下的 agentkit.yaml，
并加载同目录的 .env 文件注入环境变量。
 2026-06-13 11:40:26 +08:00
chiguyong 905c1f6b18 fix(gui): 修复对话无skill时无法聊天、空对话列表、输入框清空、监控数据 
- portal.py: 移除 all_skills 空检查，无 skill 时 fallback 到直接 LLM 对话
- portal.py: general 路径 agent 为 None 时也 fallback 到直接对话
- ChatView.vue: onMounted 自动创建默认对话
- ChatInput.vue: nextTick 清空输入框
- evolution_dashboard.py: usage API 从 LLMGateway.UsageTracker 读取真实数据
- DashboardOverview.vue: 活跃 agent 从 capabilities API 获取
 2026-06-13 11:32:45 +08:00
chiguyong d02a6d5200 fix(gui): 修复空对话列表、默认对话、输入框清空、监控数据 
- portal.py: 延迟创建对话到第一条消息，避免空对话出现在历史列表
- portal.py: 添加用户消息到 ConversationStore 以支持历史注入
- ChatView.vue: onMounted 自动创建默认对话，无需手动点击新建
- ChatInput.vue: 输入框清空改用 nextTick 确保 Ant Design Vue v-model 同步
- evolution_dashboard.py: usage API 从 LLMGateway.UsageTracker 读取真实 token 数据
- DashboardOverview.vue: 活跃 agent 数从 capabilities API 获取
 2026-06-13 11:11:00 +08:00
chiguyong 4c53dbaaeb fix(gui): 修复对话上下文注入、输入框清空、对齐及工作流空状态居中 
- portal.py: greeting/general 路径注入最近 20 条历史消息，解决对话记忆不连贯
- ChatInput.vue: 移除 disabled 提前 return，确保提交后清空输入框
- ChatInput.vue: textarea 设置 min-height: 40px，与按钮对齐
- WorkflowView.vue: 空状态 a-empty 垂直水平居中
- chat.ts: sendWsMessage 先检查 WS 状态避免重复消息
- types.ts: WsServerMessage 类型匹配后端嵌套 data 结构
- vite.config.ts: 代理添加 ws: true 支持 WebSocket
- portal.py/terminal.py: WebSocket accept 顺序修复
 2026-06-13 10:48:06 +08:00
chiguyong af50cc7fe1 fix(api): support absolute paths in BaseApiClient.request() 
When path starts with /api/, treat it as an absolute URL instead of
prepending baseUrl. This fixes installSkill/uninstallSkill URL
concatenation that produced /api/v1/skill-management/api/v1/skills/...
 2026-06-13 10:03:56 +08:00
chiguyong 5b63214bc1 fix(gui): address all P1 code review findings 
- AgentLayout: lazy-load views via defineAsyncComponent, wire route meta to quadrant tab switching
- QuadrantPanel: ARIA tablist/tab/tabpanel roles, keyboard nav, v-if via computed, expose setActiveTab
- SplitPane: touch support, keyboard resize, ARIA separator role
- ChatMessage: DOMPurify sanitization, anchor toolCalls regex to line start
- TerminalEmulator: fix ANSI span imbalance with depth tracking
- theme.ts: read CSS custom properties at runtime via readToken()
- responsive.css: fix bottom-right auto-collapse selector
- app.py: path traversal protection, exclude docs/openapi.json
- skills.ts: use BaseApiClient.request() for installSkill/uninstallSkill
 2026-06-13 10:01:26 +08:00
chiguyong f4e454b727 fix(review): address code review findings 
- QuadrantPanel: persist activeTab and collapsed state to localStorage via watch
- TopNav: remove v-if="false" dead code for TaskSelector, remove unused ASelect import
- SplitPane: add null guard before containerRef.value access in onMouseDown
- Router: fix /agent/code route loading ChatView instead of WorkflowView
- Router: add default redirect for /legacy to /legacy/chat
 2026-06-13 09:50:56 +08:00
chiguyong c60e0b9971 refactor(gui): migrate hardcoded colors to Design Tokens across all components 
- Migrate 15+ component files from Ant Design default colors to Design Token system
- Workflow nodes (Skill/Parallel/Condition/Approval): #1890ff→var(--color-primary), #52c41a→var(--color-success), etc.
- Evolution panels (Dashboard/Metrics/Usage/Timeline/Pitfall/PathOptimizer): all CSS colors→var() tokens
- Skills components (SkillCard/SkillDetail): link/text colors→Design Tokens
- KB component (SearchTest): bg/border/text colors→Design Tokens
- JS/inline styles use new palette hex values (#7c3aed primary, #10b981 success, #f59e0b warning)
- Provider brand colors (OpenAI/Anthropic/Azure/DeepSeek/Zhipu) preserved as-is
- Remaining ~27 hex values are in JS/template contexts where CSS vars cannot be used
 2026-06-13 03:01:13 +08:00
chiguyong 4d051c2f25 feat(gui): add transitions, responsive breakpoints and bug fixes (U7) 
- Add transitions.css with fade, slide, collapse, scale, stagger-list, skeleton-pulse, pulse-dot animations
- Add responsive.css with breakpoints (≥1440px full, 1280-1439px compact, <1280px prompt)
- Add small-screen prompt in AgentLayout with DesktopOutlined icon
- Fix SPA serving in app.py for Vue build output
- Fix TypeScript errors in kb.ts, skills.ts, workflow.ts, FlowCanvas.vue, SideNav.vue
- Fix unused imports in ExperienceTimeline, PathOptimizerPanel, PitfallPanel
 2026-06-13 02:47:51 +08:00
chiguyong db216a5cc4 feat(gui): streamline evolution panel and group settings (U6) 
- EvolutionView: simplify from 6 sub-panels to 3 tabs (概览+指标, 经验+坑点, 用量)
- SettingsView: group into 4 tabs (LLM, 技能, 知识库, 系统), each with independent save
- SkillsView: replace hardcoded colors with Design Tokens
- All three views: replace hardcoded colors with Design Token references
 2026-06-13 02:43:41 +08:00
chiguyong 3dc5c68135 feat(gui): refactor terminal panel with One Dark Pro theme and Ant Design Modal (U5) 
- TerminalView: replace native HTML confirmation with Ant Design Modal,
  make command history sidebar collapsible (default collapsed)
- TerminalEmulator: use One Dark Pro CSS variables for ANSI colors,
  replace all hardcoded colors with Design Tokens
- CommandHistory: replace all hardcoded colors with Design Tokens
 2026-06-13 02:41:46 +08:00
chiguyong 79a400afe8 feat(gui): add code/preview panel with diff viewer and file tree (U4) 
- Create CodeDiffViewer.vue with line-level diff highlighting
- Create FileTree.vue with status badges (added/modified/deleted)
- Update WorkflowView.vue: replace hardcoded colors with Design Tokens
- Update KnowledgeBaseView.vue: replace hardcoded colors with Design Tokens
 2026-06-13 02:40:14 +08:00
chiguyong 6d5a08cb0c feat(gui): refactor chat panel with Markdown rendering and tool indicators (U3) 
- ChatMessage: replace v-html with markdown-it, add ToolCallIndicator
- ChatInput: add ContextPill support for file/skill context
- ChatSidebar: make collapsible (default collapsed)
- Create ToolCallIndicator.vue with color-coded tool type badges
- Create ContextPill.vue for context references
- Replace all hardcoded colors with Design Token references
- Install markdown-it for Markdown rendering
 2026-06-13 02:38:37 +08:00
chiguyong 9273612a5b feat(gui): add four-quadrant Agent-First layout with top navigation (U2) 
- Create AgentLayout.vue with CSS Grid four-quadrant layout
- Create SplitPane.vue with draggable divider and localStorage persistence
- Create TopNav.vue with logo, status indicator, and settings entry
- Create QuadrantPanel.vue with tab switching and collapse support
- Restructure router: /agent as main route, legacy routes redirect
- App.vue now uses router-view for layout switching
 2026-06-13 02:35:28 +08:00
chiguyong 2988d3768e feat(gui): add Design Token system and theme configuration (U1) 
- Create tokens.css with CSS custom properties for colors, spacing,
  radius, fonts, shadows, transitions, and code theme
- Create theme.ts mapping tokens to Ant Design Vue ConfigProvider
- Create styles/index.ts as unified entry point
- Inject theme into App.vue ConfigProvider
- Import styles in main.ts

Primary color unified to #7c3aed (purple gradient brand color).
 2026-06-13 02:32:29 +08:00
chiguyong 09698d7a06 feat: frontend productization with code review fixes 
- Workflow: visual canvas, undo/redo, drag-and-drop, real-time execution WebSocket
- Evolution: dashboard, ECharts metrics, experience timeline, pitfall warnings, usage panel
- KB: source CRUD, document upload, search test
- Terminal: interactive PTY WebSocket, whitelist security
- Security: hmac.compare_digest, API key auth on all endpoints, whitelist bypass fix
- Fixes: ECharts async init, WebSocket intentional disconnect, TOCTOU race, Pydantic models
 2026-06-13 01:29:58 +08:00
chiguyong 5ef08a3b30 fix(review): comprehensive P0-P2 code review fixes 2026-06-12 22:18:25 +08:00
chiguyong 2e55aae775 fix(review): address code review findings for speed optimization 
- P0: Rename WAL buffer to pending buffer, add crash-loss warning
- P1: Fix keyword substring false matches with word-boundary regex
- P1: Pass connection pool params in _build_llm_config
- P1: Change parallel_tools default to False (safer default)
- P1: Add classifier value validation in CostAwareRouter
- P2: Replace __import__ with proper datetime import
- P2: Add max_buffer_size enforcement in AsyncWriteQueue
 2026-06-12 13:21:44 +08:00
chiguyong a36bc3d1c1 feat: optimize chat response speed for sub-1s first token latency 
- Add HeuristicClassifier to replace LLM quick_classify with zero-cost
  local heuristic (keyword/length/code-pattern scoring), gated by
  router.classifier config (default: heuristic)
- Add parallel tool execution in ReActEngine via asyncio.gather for
  multiple independent tool_calls, gated by parallel_tools param
- Add AsyncWriteQueue for non-blocking session persistence with WAL
  buffer, gated by async_writes param on SessionManager
- Add httpx.Limits connection pool config to all LLM providers
- Add router config section to ServerConfig and agentkit.yaml
- All optimizations have config switches for safe rollback
 2026-06-12 13:15:06 +08:00
chiguyong 2110c84fb6 fix: switch default model to qwen3-coder-plus for better function calling 
DeepSeek-chat has limited/partial function calling support. Qwen3-coder-plus
(DashScope) has robust OpenAI-compatible function calling.

Also added tool usage instructions to system prompt and enhanced logging
to trace tool propagation through the pipeline.
 2026-06-12 09:27:52 +08:00
chiguyong 44f19fcf14 feat: loading animation + tool descriptions in system prompt 
1. Loading indicator: three-dot bouncing animation appears after
   sending a message and disappears when server starts responding.

2. Tool descriptions: resolve_skill_routing now appends available
   tools (name + description + parameters) to the system prompt so
   the LLM knows what tools it can call.
 2026-06-11 22:25:21 +08:00
chiguyong b6ec13cbca debug: log tools count and names in portal before execute_stream 2026-06-11 21:44:20 +08:00
chiguyong 32c800d1e4 fix: portal routing + response speed + IME input 
1. Portal unified routing: ws_chat now uses CostAwareRouter uniformly
   (handles Layer 0/1/2), replacing direct IntentRouter calls.
   Greeting/chat_mode requests skip IntentRouter LLM call entirely.

2. Response speed: greeting & simple chat now use direct LLM call
   (no ReAct loop), zero-cost Layer 0 detection.

3. IME input fix: use e.isComposing (native browser property)
   instead of compositionstart/end for Enter key detection.

4. Test: fix InMemoryMessageBus.request() parameter name
   timeout -> timeout_seconds.
 2026-06-11 21:30:25 +08:00
chiguyong ae95b56465 fix: use e.isComposing for IME detection instead of manual flag 
e.isComposing is a standard KeyboardEvent property that's true during
IME composition. More reliable than compositionstart/compositionend
which can fire at unpredictable timing relative to keydown.
 2026-06-11 20:43:38 +08:00
chiguyong 66d0901938 fix: prevent Enter from submitting during IME composition 
Added compositionstart/compositionend event listeners to track IME
composing state. Enter key now only submits when not composing,
so Chinese/Japanese/Korean input methods work correctly.
 2026-06-11 15:37:06 +08:00
chiguyong ec51dbb259 feat: optimize劣势项 — 拍卖开关/审计采样/线程安全/评分锚定 
1. 拍卖机制: 已有配置开关(marketplace.auction_enabled), 默认关闭
2. LLM审计采样: 新增 audit_sample_rate (0.0-1.0), 默认1.0, 可降低审计频率
3. AlignmentConfig.from_dict: 忽略未知键, 防止YAML额外字段崩溃
4. 配置热重载线程安全: 用 threading.Event 替代布尔标志, 消除数据竞态
5. Reflexion评分锚定: 添加评分维度(Completeness/Correctness/Clarity)和锚定点
 2026-06-11 13:04:36 +08:00
chiguyong bba394be38 fix(marketplace): address code review findings 
- Fix str.format() crash when user input contains curly braces
- Fix Layer 2 passing str to find_best_agent (expects list[str])
- Fix AlignmentGuard fail-open on LLM audit failure (now fail-closed)
- Fix _config_reload_lock not initialized in create_app()
- Fix evolve_soul redundant reflector.reflect() call (reuse existing reflection)
- Fix test mocks using AsyncMock for sync find_best_agent method
- Remove unused _COMPLEXITY_CLASSIFY_PROMPT constant
 2026-06-10 19:21:40 +08:00
chiguyong 8713636d50 feat(marketplace): add Phase B/C - CostAwareRouter, OrganizationContext, AlignmentGuard, Soul Evolution, Auction, Server Integration 
Phase B:
- U1: CostAwareRouter with 3-layer routing (rule/LLM/capability matching)
- U6: OrganizationContext with agent profiles and capability-based discovery
- U7: AlignmentGuard with constraint injection and cascade detection

Phase C:
- U8: Soul dynamic evolution with version tracking and reflection-triggered updates
- U9: Auction mechanism as optional advanced routing mode
- U10: Server integration + end-to-end integration tests

250 new tests passing across all units.
 2026-06-10 19:09:02 +08:00
chiguyong 6852dfe892 fix(security,reliability): resolve all P2 findings from code review 2026-06-10 15:05:40 +08:00
chiguyong 658e188939 fix(review): resolve P0/P1 findings from final code review 2026-06-10 09:57:29 +08:00
chiguyong 1d1805753c fix: resolve key P2 findings from code review 
- Shell whitelist: use exact binary match instead of startswith
- Shell audit log: use deque(maxlen=10000) to cap memory
- Terminal history: use deque(maxlen) for O(1) eviction
- Path optimizer: cap _pending_paths at 50 entries per task_type
- Pitfall detector: only add tips to matching steps, not all
- Experience store: handle non-numeric _parse_time_window input
- Extract shared is_safe_url() to utils/security.py (DRY)
- Workflow condition evaluator: handle float() ValueError
 2026-06-10 09:01:23 +08:00
chiguyong 7874e875af merge: integrate feat/agentkit-phase8-chat-adaptive (chat/gui commands + GUI mode) 
Restores agentkit chat, agentkit gui CLI commands, onboarding wizard,
and GUI mode (AGENTKIT_GUI_MODE) with static file serving.
Resolves merge conflicts in orchestrator.py, app.py, tools/__init__.py, shell.py.
 2026-06-10 07:44:06 +08:00
chiguyong 9e9f1314f6 fix(security): resolve all P0/P1 findings from code review 2026-06-10 07:12:41 +08:00
chiguyong c606ffa64a feat(phase5): implement management pages, evolution dashboard, and workflow editor (U13b/U13c/U14) 2026-06-10 01:29:01 +08:00
chiguyong a1deeecede feat(phase5): implement Vue3 portal foundation with chat interface and routing (U13a) 
- Add Portal API routes: chat, stream, capabilities, conversations, WebSocket
- Add ConversationStore for in-memory conversation management
- Add CAPABILITY_CATEGORIES mapping for 8 capability types
- Create Vue3 SPA with TypeScript, Pinia, Vue Router, Ant Design Vue
- Implement ChatView with message bubbles, input, sidebar, WebSocket support
- Add side navigation skeleton for all 8 capability sections
- Add placeholder views for workflow, knowledge, skills, terminal, etc.
- 31 backend tests passing
 2026-06-10 01:06:48 +08:00
chiguyong 31bd3b126c feat(phase8): chat adaptive enhancements, pipeline reflection, search tools upgrade 
- Enhanced chat CLI with adaptive mode and session management
- Added pipeline reflection and schema extensions
- Upgraded BaiduSearch and WebSearch tools with advanced capabilities
- Expanded server routes for skills and chat
- Added session store enhancements
- New chat module and pipeline reflection support
 2026-06-09 23:18:06 +08:00
chiguyong 45283d31e8 feat(core): integrate MessageBus into Orchestrator and AgentPool (U7) 
- Orchestrator accepts optional message_bus parameter; workers publish
  task.progress messages via MessageBus after each subtask execution
- AgentPool accepts optional message_bus; auto-registers agents on
  create and auto-unregisters on remove
- app.py initializes MessageBus from config and injects into AgentPool
- ServerConfig adds bus configuration field
- 5 new tests, all passing
 2026-06-08 00:03:40 +08:00
chiguyong 6013d5189b feat(chat): add Chat API routes with REST + WebSocket bidirectional communication 2026-06-07 22:49:26 +08:00
chiguyong b34b06724d fix(agentkit): resolve all P0/P1/P2/P3 issues from code review 2026-06-07 22:05:18 +08:00
chiguyong 286804792d feat(compression): U4 ServerConfig compression field and Agent injection 
Add compression config to ServerConfig (following telemetry pattern),
create compressor in create_app, pass through AgentPool to
ConfigDrivenAgent, and inject into ReActEngine.execute() calls.
 2026-06-07 18:20:05 +08:00
chiguyong 550d29a139 feat(mcp): U2 MCP config system and MCPManager lifecycle 
Add MCPServerConfig dataclass with stdio/streamable_http/sse transport
validation, MCPManager for declarative YAML-driven MCP server lifecycle
(start_all/stop_all), tool discovery and registration. Integrated
into FastAPI lifespan startup/shutdown.
 2026-06-07 17:25:07 +08:00
chiguyong 24e501f745 fix(core): U10 Agent status lock timeout and config hot-reload audit 
- Added _acquire_status_lock with timeout (30s) to prevent deadlocks
- Added _release_status_lock for safe lock release
- Added config_version tracking on BaseAgent
- Config hot-reload now increments version and propagates to agents
- Audit logging with config version in _on_config_change
 2026-06-06 22:52:51 +08:00
chiguyong 364fe6bd6d feat(memory): U3 EpisodicMemory ORM integration - EpisodeModel and session factory 
- EpisodeModel ORM model with pgvector embedding support
- create_episodic_session_factory for async PostgreSQL sessions
- Server app.py now resolves session_factory from database_url config
- Graceful fallback when database_url not configured
 2026-06-06 22:21:00 +08:00
chiguyong 6e362a8ae7 feat(agentkit): Phase 4 enterprise production upgrade — 12 Implementation Units 
Phase A (P0): EpisodicMemory pgvector search+EmbeddingCache, ReAct timeout+CancellationToken, evolution system fix (A/B test+LLMPromptOptimizer+StrategyTuner), AnthropicProvider native Messages API
Phase B (P1): RetryPolicy+CircuitBreaker, chat_stream fallback chain, WebSocket endpoint, SSE stream fix, Evolution+Memory API routes (7 endpoints), embedding cache+Enhanced Search per-KB degradation fix
Phase C (P2): GeminiProvider native generateContent API, Agent state lock+config hot-reload

Tests: 1301 passed, 18 skipped, 0 failed
 2026-06-06 21:51:04 +08:00
chiguyong e33dc25ad3 feat(memory): RAG pipeline optimization — 5 Implementation Units 
U1: QueryTransformer — LLM/rule-based query rewriting + sub-query decomposition
U2: HttpRAGService enhanced_search() — rerank + compression via /bases/{kb_id}/retrieve
U3: Structured context injection — source attribution headers in RAG results
U4: RetrieveKnowledgeTool — built-in tool for mid-reasoning knowledge retrieval
U5: Configurable retrieval params + per-KB weights + CJK token estimation

Config example:
  memory:
    retrieval:
      top_k: 5
      token_budget: 2000
      context_template: structured
    query_transform:
      enabled: true
      strategy: llm
    semantic:
      search_mode: enhanced
      use_rerank: true
      kb_weights:
        industry-kb-id: 1.2
        enterprise-kb-id: 0.8

Tests: 1037 passed, 18 skipped, 0 failed
 2026-06-06 19:27:09 +08:00
chiguyong cd5b39087e feat(memory): add HttpRAGService for config-driven knowledge base integration 2026-06-06 18:36:05 +08:00
chiguyong 0456429beb fix(review): address all 14 P2 advisory findings 2026-06-06 18:20:46 +08:00
chiguyong 8620751864 fix(review): address P0+P1 findings from Tier 2 code review 
P0: MemoryRetriever.retrieve score mutation fix
P1: Redis atomic Lua script, deprecated API fix, SQLite WAL mode,
Redis URL masking, UniqueConstraint, TraceRecorder completed flag,
EpisodicMemory recall improvement, LLMReflector sanitization,
A/B test safety, generator cleanup, ContextCompressor guards,
OpenAIEmbedder reuse, Pipeline failure handling, Metrics O(1),
Health check Redis PING, CLI skill loading, CORS config,
API key direct pass-through

Tests: 924 passed, 18 skipped, 0 failed
 2026-06-06 17:57:47 +08:00
chiguyong f858d279f3 feat(agentkit): Phase 3 upgrade - persistence, memory, evolution, observability 
10 Implementation Units across 3 phases:

Phase A - Infrastructure:
- U1: RedisTaskStore with Redis/memory backend + factory function
- U2: TraceRecorder for execution trace recording
- U3: PersistentEvolutionStore with SQLite backend

Phase B - Core Capabilities:
- U4: MemoryRetriever integration into ReAct engine
- U5: Embedder abstraction + EpisodicMemory vector search
- U6: LLMReflector for LLM-in-the-loop reflection
- U7: SkillPipeline for multi-skill orchestration

Phase C - Enhancement:
- U8: SKILL.md format + progressive disclosure levels
- U9: ContextCompressor + prompt cache rendering
- U10: Structured logging + metrics endpoint + enhanced health check

Tests: 924 passed, 18 skipped, 0 failed
 2026-06-06 17:17:45 +08:00
chiguyong 74e2223153 feat(cli): pair command + doctor rename + client config priority 
- health → doctor (better naming)
- agentkit pair --name <client> generates ak_live_ API key
- agentkit pair --list / --revoke for client management
- ClientConfig class: client config > init defaults > hardcoded
- README updated with pair usage + business system pairing guide
- 38 CLI tests passing
 2026-06-06 13:08:14 +08:00
chiguyong 2844eeb548 feat(streaming): Phase C - LLM streaming + ReAct events + SSE endpoint 
U8: StreamChunk protocol + OpenAI chat_stream + Gateway streaming with usage tracking
U9: ReActEvent dataclass + execute_stream() yielding thinking/tool_call/tool_result/final_answer
U10: POST /tasks/stream SSE endpoint + Client SDK stream_task()

15 new tests passing, no regression.
 2026-06-06 11:54:17 +08:00
chiguyong ec0e221beb feat(server): Phase D - async task system (TaskStore + BackgroundRunner + API) 
U5: TaskStore - in-memory task state with TTL cleanup and max records
U6: BackgroundRunner - async task execution with semaphore concurrency control
U7: Task status/result API + cancel endpoint + async submit mode

45 tests passing (28 new + 17 existing, no regression).
 2026-06-06 11:39:41 +08:00
chiguyong 5f1c51cf9a feat(server): Phase B - auth, rate limiting, SSRF protection, handler whitelist 
U1: API Key authentication middleware (dev mode skip, health whitelist)
U2: Rate limiting middleware (fixed-window, 60 req/min default)
U3: Callback URL SSRF protection (private IP blocking)
U4: custom_handler module prefix whitelist

65 tests passing. CORS conflict fixed.
 2026-06-05 23:37:36 +08:00
chiguyong f87b790c0f feat(agentkit): v2 Phase 1 - ReAct/LLM Gateway/Skill/Server + review fixes 
535 unit + 52 integration tests passing. README added.
 2026-06-05 23:32:16 +08:00