Repository navigation
Release v2.8.0 - #4200
Merged
Merged
Release v2.8.0#4200
Conversation
* feat(deploy): add optional nginx HTTPS termination for docker and k8s installs - Add HTTPS mode option (disabled/self-signed/custom) to install TUI, persisted in deploy.options and reusable on non-interactive reruns - Support auto-generated self-signed certs (99-year validity, SAN from env or NIC auto-detection) and user-provided certs with validation (PEM format, key/cert match, expiry, encrypted key decryption) - Decrypt passphrase-protected keys to a 0600 plaintext copy mounted by nginx; passphrase stored via existing .env credential pattern - Add nexent-nginx helm chart (deployment/service/configmap/secret) terminating TLS on NodePort 30000 via error_page 497 same-port redirect; web service steps down to ClusterIP when HTTPS is enabled - Render cert/key as YAML literal blocks; store TLS as Opaque secret with server.pem/server.key keys - Update offline packaging, env example, install docs and common tests * fix(deploy): address HTTPS review findings - Seed HTTPS config from NEXENT_HTTPS_* env vars before defaults - Detect SAN via ip -o -4 addr (Linux) with ifconfig fallback - Start docker nginx before core services; clean up on disabled; bind web to loopback 3001 when HTTPS is enabled - chmod 600 generated Helm values containing private keys - Support EC keys via openssl pkey with LibreSSL fallback - Route nginx image through NGINX_IMAGE and registry prefix - Validate cert/key pair and expiry when reusing self-signed certs - Persist custom key passphrase to .env * refactor(deploy): split HTTP and HTTPS entry ports for nginx HTTPS - Give HTTPS a dedicated entry: Docker port 3100, K8s NodePort 31000 - Keep the plain HTTP entry unchanged (Docker 3000 / K8s NodePort 30000); web no longer steps down to ClusterIP or a loopback-only binding - Drop the same-port error_page 497 redirect now that entries are split - Update TUI/summary wording, tests and install docs for the new ports * docs(deploy): list the HTTPS entry port in the port mapping table * fix(deploy): always bundle nginx image in offline package Offline hosts cannot pull the nginx image after delivery when the user enables HTTPS during installation. Bundle nginx:alpine with the infrastructure images instead of gating it on build-time HTTPS options, and drop the HTTPS flags from the offline build passthrough list. * feat(deploy): make HTTP and HTTPS entry ports configurable Introduce NEXENT_WEB_PORT and NEXENT_HTTPS_PORT so users can change the entry ports for both Docker (host port mapping) and Kubernetes (NodePort) deployments. Defaults keep the current behavior (Docker 3000/3100, K8s 30000/31000). Also fix the deploy script overwriting a user-set web port mapping when HTTPS is disabled, and document the new variables in .env.example and the installation guides. * feat(deploy): validate k8s nodePort range for entry ports Reject NEXENT_WEB_PORT and NEXENT_HTTPS_PORT values outside the Kubernetes nodePort range (30000-32767) before rendering Helm values, so users get a clear error instead of a cryptic API server message. Ports are only validated when HTTPS mode needs them, and empty values keep using defaults. * fix(deploy): render nginx nodePort in generated Helm values The live Helm values renderer (deployment_render_helm_chart_values) only rendered the nginx image block, so the nginx Service fell back to the chart default NodePort and a user-set NEXENT_HTTPS_PORT never took effect. Render the nginx services block the same way the port-policy renderer does, and cover it with a Helm values assertion. * test(deploy): include nginx image in offline push test fixtures
1. 修复在对话过程中无法正常显示指示灯的问题，“绿色”代表正在回答，“蓝色”代表回答完成 (#4050) 2. 修复在对话过程中，用户发送的消息无法正常显示换行的问题 3. 修复无法正常重命名“当前会话”的标题
Replace the retired project link (8icfxll43r.apifox.cn) with the new shared docs URL in both zh and en API reference pages. Generated-by: glm-5.3-flash Co-authored-by: ZCode <noreply@zcode.ai>
* 修改Windows 本机 runtime 与 Docker Linux 路径不兼容的问题 * 实现 HTTPS/WSS 保留业务功能，消除明文连接问题 * 修改了安全存储密钥，校验了证书身份，客户端和测试服务端明确要求 TLS 1.2+ * 恢复了Agent 初始化失败后重新分配 kernel的特性 * test: align workspace initialization tests with lease-owned recovery * fix: keep sandbox WSS connections off environment proxies * test: support websocket-client redirect rejection across versions --------- Co-authored-by: DoYX <du.yuxiao@gmail.com>
* refactor(data-process): replace Ray with Celery prefork Run parsing in process-local Celery prefork children, keep orchestration and forwarding on thread workers, and remove the Ray runtime, dependency, and deployment surface. Co-authored-by: Codex <noreply@openai.com> Generated-by: gpt-5-codex * fix(data-process): preserve sync parser result metadata * fix(data-process): wait for parser readiness in result backend * fix(data-process): tolerate lightweight worker app doubles * test(model): mock authentication for temporary healthcheck * Revert "test(model): mock authentication for temporary healthcheck" This reverts commit 9aa8d45. * test(data-process): configure Celery URLs in isolated tests * test(data-process): cover prefork task boundaries * test(data-process): isolate prefork coverage from redis backend * test(data-process): cover lazy prefork branches * fix(data-process): complete celery prefork migration review fixes * test(data-process): align prefork tests with current APIs * fix(data-process): avoid logging user-controlled image paths * test(data-process): isolate router tests from celery bootstrap * test(model): provide auth for temporary healthcheck * test(data-process): stub redis chunk loader in router test * test(data-process): cover parser cancellation and lifecycle helpers * test(data-process): re-export process_sync from tasks module Keep the synchronous parse entry point reachable through the tasks module so coverage and isolation tests can patch one import site. Use a redundant-alias re-export to satisfy F401. * 🧪 Test: restore stubbed sys.modules after app router fixture Problem: the stub_modules fixture in test_data_process_app.py assigned stub modules directly to sys.modules without restoring them, so the stubs leaked into every later test file sharing the same pytest process. Running test_data_process_app.py before test_data_process_service.py failed all 52 service tests in setUp with AttributeError: '_CeleryAppStub' object has no attribute 'reset_mock'. The leak was invisible to CI because run_all_test.py runs each test file in its own subprocess. Fix: replace the six direct sys.modules assignments with monkeypatch.setitem so the real modules are restored when the fixture tears down. Behavior during each test is unchanged. Verification: - pytest test/backend/app/test_data_process_app.py test/backend/services/test_data_process_service.py -> 76 passed (was 24 passed / 52 failed) - each file alone: 24 passed / 52 passed (no regression) - wider combo (app + services + tasks + worker + coverage): app+services now pass together; the remaining failures are a pre-existing module-level mock leak in test_data_process_service.py that exists on develop and is out of scope here.
…avoid blocking other interfaces. (#4054)
* [WIP]♻️ Agent prompt refactor * [WIP]♻️ Agent prompt refactor * 🧪 Add test files * 🧪 Add test files * 🧪 Add test files * 🧪 Add test files * 🧪 Add test files * ♻️ Merge system prompts into one chunk * 🧪 Add test files * 🧪 Add test files
…4055) * feat: 为模型管理接口添加安全审计日志记录 实现了模型创建、更新、删除、批量操作等接口的安全审计日志功能，过滤了敏感凭证信息，确保审计日志安全合规。新增了审计安全字段过滤工具函数，补充了对应的测试用例验证审计日志的正确性和安全性。 * feat: 为多个接口添加安全审计日志记录 为agent和agent_repository相关的API接口添加安全审计事件记录，包括代理更新、图标上传、删除、导出、导入、版本发布/回滚/更新/删除等操作，同时补充对应的测试用例验证审计日志的正确性，确保敏感数据不被记录。 * feat: 为MCP和技能相关接口添加上下文安全审计日志 为tool、mcp、remote_mcp、skill模块的所有关键增删改接口添加安全审计日志，记录操作人、资源信息等关键字段，同时避免记录敏感信息如凭证、密钥等。新增对应的测试用例验证审计日志的正确性，确保敏感数据不会被泄露。 * feat: 添加安全审计日志并限制审计详情列表长度 在多个服务端点添加安全审计日志，记录关键操作信息 同时统一审计详情列表的长度限制为20，防止日志被恶意payload撑爆 * feat: 为配置相关接口添加安全审计日志记录 为 config_sync_app 和 memory_config_app 的配置操作接口添加安全审计事件记录，记录操作人、租户、操作类型和相关字段信息，同时更新测试用例验证审计日志的正确性，确保敏感配置值不被记录。 * test: 为上传测试用例添加 http_request 参数默认值 为测试用例中的 upload_files 调用添加 http_request=None 参数，避免测试时可能出现的未定义错误
* test:baseline cases
* test:add local test process
* doc:add test deploy guide
* bugfiix:优化测试流程
* bugfix：修复测试用例
* doc:轻量化bugfix的spec设计和测试用例设计
* test:修复测试用例
* test:修复D1测试用例
* test: 修复 D3 用例脚本并记录失败归因
* test: 移除 D3 变更记录，仅保留测试修复
* fix(test-e2e): make D5 tests portable and isolate evaluation workloads
* fix(test-e2e): repair Windows case contracts and D4 journeys
* feat(test-e2e): launch repository daily from a pinned branch
* test:修复D4读取config问题
* test:修复测试用例，删掉过期用例
* test：修复测试用例
* test:修复测试用例
* doc：测试规范修改
* test：增加外部记忆mock服务
* test：测试用例修复
* fix(prompt): reject blank task descriptions before SSE generation
* fix(agent): return 404 for missing discovery resources
* fix(agent): validate relationships before update writes
* fix(model): preserve provider error status on provider create
A provider failure (e.g. an upstream connection_failed) was raised as
HTTPException(502) by create_provider_models_for_tenant, but the generic
except Exception handlers in the service and the app layer swallowed it and
re-wrapped it, so /model/provider/create answered 500 with the real status
only surviving as text in the message body (API-049).
- service: re-raise HTTPException instead of wrapping it
- app: pass HTTPException through on /provider/create and
/manage/provider/create
- schema: reject a blank provider with 422 at the boundary
- tests: regression coverage for both behaviours
* fix: correct conversation access and stopped-turn regressions
* fix: enforce tenant isolation and edit permissions for agent relations
* fix: enforce tenant isolation and edit permissions for agent relations1
* 🐛 Fix tag projection crash on first-attempt ES write failure
Problem:
project_document_assignments() dereferenced the prior ledger state
without a None guard in its generic exception handler. On a document's
first-ever projection attempt there is no ledger row yet, so an ES write
failure crashed with AttributeError before the failed state was
persisted. The failure then became invisible: no retry_count, no
next_attempt_at, retry_pending_document_projections() never picked the
document up, and tag-filtered retrieval silently ignored the document
until its tags were re-saved.
Fix:
Treat a missing prior state as retry_count 0 in the failure handler
((current or {}).get("retry_count")), so first-attempt failures record a
retryable failed state with correct exponential backoff. Added a
regression unit test for the no-prior-state failure path (previously
only the existing-state path was covered). Also added one blank line
after the import block to satisfy the repo ruff pre-commit hook on this
file (pre-existing I001).
Verification:
- test/backend/services/test_tag_document_projection.py 28/28 passed,
incl. new test_first_attempt_failure_records_retryable_state
- Neighboring regression: test_tag_management_service.py and
test_tag_document_batch_status.py, 53/53 passed
- ruff (E,F,I,W hook rule set) clean on the touched backend file
- Matches the state-machine expectations of e2e case
API-AUTO-357B84F01BA6D321 (daily run 2026-10-09)
* Fix A2A publication smoke scope and remove Mock dependency
* fix(a2a): execute the version recorded by A2A publication
* [WIP] Fix accepted semantic repair stream commits (#4057)
* feat(audit): add security audit logging to backend management APIs (#4055)
* feat: 为模型管理接口添加安全审计日志记录
实现了模型创建、更新、删除、批量操作等接口的安全审计日志功能，过滤了敏感凭证信息，确保审计日志安全合规。新增了审计安全字段过滤工具函数，补充了对应的测试用例验证审计日志的正确性和安全性。
* feat: 为多个接口添加安全审计日志记录
为agent和agent_repository相关的API接口添加安全审计事件记录，包括代理更新、图标上传、删除、导出、导入、版本发布/回滚/更新/删除等操作，同时补充对应的测试用例验证审计日志的正确性，确保敏感数据不被记录。
* feat: 为MCP和技能相关接口添加上下文安全审计日志
为tool、mcp、remote_mcp、skill模块的所有关键增删改接口添加安全审计日志，记录操作人、资源信息等关键字段，同时避免记录敏感信息如凭证、密钥等。新增对应的测试用例验证审计日志的正确性，确保敏感数据不会被泄露。
* feat: 添加安全审计日志并限制审计详情列表长度
在多个服务端点添加安全审计日志，记录关键操作信息
同时统一审计详情列表的长度限制为20，防止日志被恶意payload撑爆
* feat: 为配置相关接口添加安全审计日志记录
为 config_sync_app 和 memory_config_app 的配置操作接口添加安全审计事件记录，记录操作人、租户、操作类型和相关字段信息，同时更新测试用例验证审计日志的正确性，确保敏感配置值不被记录。
* test: 为上传测试用例添加 http_request 参数默认值
为测试用例中的 upload_files 调用添加 http_request=None 参数，避免测试时可能出现的未定义错误
* chore: bootstrap semantic repair stream fix draft
* fix(agent): commit accepted streamed code action repairs
* test(agent): verify repaired streams in deployed runtime and browser
* test(agent): clarify deployed repair assertion failures
---------
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
* fix: repair agent repository e2e cases and API-type MCP health check (#4061)
* fix: repair four failing e2e cases (API-086, API-063, PW-MCP-CONTAINER-01, PW-MCP-MARKET-01)
* fix: skip MCP protocol handshake for API-type MCP health check
* fix(test-e2e): align runtime contracts and strengthen local test diagnostics
* fix(test-e2e): reconcile standalone semantic repair tests with formal cases
* test:修改workflow
* test:修复测试用例
* fix: preserve manual titles and metadata-free A2A calls
* test: repair D1-D5 runtime contracts and execution evidence
* test: repair daily assertions and remove excluded cases
* fix: guard MCP tag refresh and repair daily test isolation
* test：修复测试用例
* test:修复测试用例
* test:修复测试用例
---------
Co-authored-by: panyehong <2655992392@qq.com>
Co-authored-by: xuyaqist <xuyaqist@gmail.com>
Co-authored-by: chase <byzhangxin11@126.com>
Co-authored-by: cj2026-bit <647646783@qq.com>
Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com>
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
Co-authored-by: MoeexT <yuwancumian666@outlook.com>
* test:baseline cases
* test:add local test process
* doc:add test deploy guide
* bugfiix:优化测试流程
* bugfix：修复测试用例
* doc:轻量化bugfix的spec设计和测试用例设计
* test:修复测试用例
* test:修复D1测试用例
* test: 修复 D3 用例脚本并记录失败归因
* test: 移除 D3 变更记录，仅保留测试修复
* fix(test-e2e): make D5 tests portable and isolate evaluation workloads
* fix(test-e2e): repair Windows case contracts and D4 journeys
* feat(test-e2e): launch repository daily from a pinned branch
* test:修复D4读取config问题
* test:修复测试用例，删掉过期用例
* test：修复测试用例
* test:修复测试用例
* doc：测试规范修改
* test：增加外部记忆mock服务
* test：测试用例修复
* fix(prompt): reject blank task descriptions before SSE generation
* fix(agent): return 404 for missing discovery resources
* fix(agent): validate relationships before update writes
* fix(model): preserve provider error status on provider create
A provider failure (e.g. an upstream connection_failed) was raised as
HTTPException(502) by create_provider_models_for_tenant, but the generic
except Exception handlers in the service and the app layer swallowed it and
re-wrapped it, so /model/provider/create answered 500 with the real status
only surviving as text in the message body (API-049).
- service: re-raise HTTPException instead of wrapping it
- app: pass HTTPException through on /provider/create and
/manage/provider/create
- schema: reject a blank provider with 422 at the boundary
- tests: regression coverage for both behaviours
* fix: correct conversation access and stopped-turn regressions
* fix: enforce tenant isolation and edit permissions for agent relations
* fix: enforce tenant isolation and edit permissions for agent relations1
* 🐛 Fix tag projection crash on first-attempt ES write failure
Problem:
project_document_assignments() dereferenced the prior ledger state
without a None guard in its generic exception handler. On a document's
first-ever projection attempt there is no ledger row yet, so an ES write
failure crashed with AttributeError before the failed state was
persisted. The failure then became invisible: no retry_count, no
next_attempt_at, retry_pending_document_projections() never picked the
document up, and tag-filtered retrieval silently ignored the document
until its tags were re-saved.
Fix:
Treat a missing prior state as retry_count 0 in the failure handler
((current or {}).get("retry_count")), so first-attempt failures record a
retryable failed state with correct exponential backoff. Added a
regression unit test for the no-prior-state failure path (previously
only the existing-state path was covered). Also added one blank line
after the import block to satisfy the repo ruff pre-commit hook on this
file (pre-existing I001).
Verification:
- test/backend/services/test_tag_document_projection.py 28/28 passed,
incl. new test_first_attempt_failure_records_retryable_state
- Neighboring regression: test_tag_management_service.py and
test_tag_document_batch_status.py, 53/53 passed
- ruff (E,F,I,W hook rule set) clean on the touched backend file
- Matches the state-machine expectations of e2e case
API-AUTO-357B84F01BA6D321 (daily run 2026-10-09)
* Fix A2A publication smoke scope and remove Mock dependency
* fix(a2a): execute the version recorded by A2A publication
* [WIP] Fix accepted semantic repair stream commits (#4057)
* feat(audit): add security audit logging to backend management APIs (#4055)
* feat: 为模型管理接口添加安全审计日志记录
实现了模型创建、更新、删除、批量操作等接口的安全审计日志功能，过滤了敏感凭证信息，确保审计日志安全合规。新增了审计安全字段过滤工具函数，补充了对应的测试用例验证审计日志的正确性和安全性。
* feat: 为多个接口添加安全审计日志记录
为agent和agent_repository相关的API接口添加安全审计事件记录，包括代理更新、图标上传、删除、导出、导入、版本发布/回滚/更新/删除等操作，同时补充对应的测试用例验证审计日志的正确性，确保敏感数据不被记录。
* feat: 为MCP和技能相关接口添加上下文安全审计日志
为tool、mcp、remote_mcp、skill模块的所有关键增删改接口添加安全审计日志，记录操作人、资源信息等关键字段，同时避免记录敏感信息如凭证、密钥等。新增对应的测试用例验证审计日志的正确性，确保敏感数据不会被泄露。
* feat: 添加安全审计日志并限制审计详情列表长度
在多个服务端点添加安全审计日志，记录关键操作信息
同时统一审计详情列表的长度限制为20，防止日志被恶意payload撑爆
* feat: 为配置相关接口添加安全审计日志记录
为 config_sync_app 和 memory_config_app 的配置操作接口添加安全审计事件记录，记录操作人、租户、操作类型和相关字段信息，同时更新测试用例验证审计日志的正确性，确保敏感配置值不被记录。
* test: 为上传测试用例添加 http_request 参数默认值
为测试用例中的 upload_files 调用添加 http_request=None 参数，避免测试时可能出现的未定义错误
* chore: bootstrap semantic repair stream fix draft
* fix(agent): commit accepted streamed code action repairs
* test(agent): verify repaired streams in deployed runtime and browser
* test(agent): clarify deployed repair assertion failures
---------
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
* chore: bootstrap think prefix compatibility fix
* fix: repair agent repository e2e cases and API-type MCP health check (#4061)
* fix: repair four failing e2e cases (API-086, API-063, PW-MCP-CONTAINER-01, PW-MCP-MARKET-01)
* fix: skip MCP protocol handshake for API-type MCP health check
* fix(test-e2e): align runtime contracts and strengthen local test diagnostics
* fix(test-e2e): reconcile standalone semantic repair tests with formal cases
* fix(agent): tolerate incomplete thinking prefixes without raw protocol finals
* test:修改workflow
* test:修复测试用例
* fix: preserve manual titles and metadata-free A2A calls
* test: repair D1-D5 runtime contracts and execution evidence
* test: repair daily assertions and remove excluded cases
* fix: guard MCP tag refresh and repair daily test isolation
* test：修复测试用例
* test:修复测试用例
* test:修复测试用例
* docs(test): update controlled provider invocation after migration
* test: verify migrated browser authentication and persisted skill results
* test: complete think-prefix acceptance obligations
* test: document and validate deployed TPC fixture
* doc:优化测试用例生成skill
* test: regenerate TPC proof at required UT and runtime boundaries
---------
Co-authored-by: dongjibao2001 <332722455@qq.com>
Co-authored-by: panyehong <2655992392@qq.com>
Co-authored-by: xuyaqist <xuyaqist@gmail.com>
Co-authored-by: chase <byzhangxin11@126.com>
Co-authored-by: cj2026-bit <647646783@qq.com>
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
Co-authored-by: MoeexT <yuwancumian666@outlook.com>
…4066) * fix(model): restore type-aware advanced settings in add/edit dialogs PR #4007's v0 dialogs rendered the LLM capacity grid (context window, input/output/reserve tokens, temperature, top_p) for every model type, losing the type-specific parameters the old dialog exposed: - embedding / multi_embedding: multimodal switch, chunk-size slider and chunk batch were gone; chunk params were no longer sent on create and multi_embedding models could not be added at all - rerank: max-tokens field was gone - stt / tts: provider select + App ID + Access Token were gone, which also broke the volcengine connectivity probe Restore the old per-type field set: - ModelAdvancedConfig now renders the capacity grid only for the llm/vlm/vlm2/vlm3 family (supportsCapacityGrid mirrors the old supportsCapacityFields set, shared via modelTypeUi); embedding rows get the multimodal switch (live type flip via onModelTypeChange) plus the chunk-size slider and batch input; rerank gets max tokens; stt/tts get the provider select and Volcano credentials (tts adds max tokens) - create, verify and update paths map the snake_case spec keys to the camelCase request contract (expectedChunkSize / maximumChunkSize / chunkingBatchSize / maxTokens / modelFactory / modelAppid / accessToken); embedding rows always carry chunk params with the old-dialog defaults (1024 / 1536 / 10), and both embedding types use max_tokens 1024 as the dimension placeholder - the edit dialog pre-fills the type-specific fields from the record, sends them on save and rides them along the probe; the multimodal switch stays hidden there because the edit path locks the embedding pair's type * fix(model): gate type-specific overrides and prefill voice provider Address review findings on #4066: - gate the rerank/voice payload mappings and the probe credential pass-through by the row's model type: gear settings survive a row type change, and a stale rerank max_tokens must not overwrite an embedding row's 1024 dimension placeholder, nor stale voice credentials a non-voice model's factory / probe - prefill the stt/tts provider select from model.source: getAllModels maps the API's model_factory into source only (model.modelFactory is never populated), so editing an existing volcengine voice model showed the dashscope fallback and saving would overwrite the factory - add the missing rowSettingsDescEmbedding / voiceProviderHint entries to both locale files so English users no longer see Chinese copy Not addressed (intentional): clearing App ID / Access Token keeps the stored credential (empty becomes undefined and is dropped from the update payload). This matches the old dialog's behavior — switching the provider to dashscope stops the backend from consuming the stored credentials. * fix(model): drop the static voice-provider hint line The hint was static (shown for dashscope too, describing volcengine credentials) and redundant with the App ID / Access Token placeholders, so remove it along with its locale entries. * fix(model): gate edit-dialog type-specific fields by current type The type select is editable in the edit dialog (only the embedding pair is locked), and the advanced values prefilled for the original type survive a type change — the save/probe mappings must therefore be gated by the CURRENT type, mirroring the add-dialog fix: - chunk params only for embedding-family records - factory / App ID / Access Token only for stt/tts records - max tokens only for rerank/tts records Also skip the max-tokens prefill when the record's value is 0 (the list mapper falls back to 0 for an unset column); a literal 0 reads worse than the empty default. * refactor(model): dedupe type-specific mapping into shared helpers Address review findings on #4066: - extract buildVoiceCredentialParams into ModelAdvancedSettings: the four call sites (add verify x2, edit verify, add/edit save) each re-implemented the same camelCase mapping with a 4-6 line comment explaining it; the full rationale now lives in the helper's doc block and call sites are one-liners - add supportsMaxTokensField to modelTypeUi so the (rerank || tts) && max_tokens gate is not duplicated between the add and edit save paths - add DEFAULT_CHUNKING_BATCH_SIZE next to the other chunk defaults and use it for the fallback and the input placeholder instead of the magic 10 - rename ModelChunkSizeSilder.tsx -> ModelChunkSizeSlider.tsx (typo, pre-existing) and update the four importers --------- Co-authored-by: ljy <ljy@DESKTOP-65OBISN.(none)>
* feat(frontend): align agent UI and shared components with design
* feat(frontend): add agent list table view
* feat(frontend): add resource-picker drawers and param-config modals
- 新增 components/resource-picker/ 共享组件库：
- AddAgentDrawer / AddKnowledgeDrawer / AddModelDrawer / AddSkillDrawer / AddToolDrawer
五个右侧滑出 760px 抽屉，点击按钮后滑出，高保真对齐设计稿。
- ParamDialog 系列：ModelConfigModal / SkillConfigModal / ToolConfigModal
居中 480px 弹窗（antd Modal centered），覆盖模型/技能/工具配置参数，
ToolConfigModal 支持 mode=config(参数配置态) 与 mode=debug(调试态，含点击测试与结果区)。
- 均为独立可调用组件，统一经 index.ts barrel 导出；数据先 mock，不修改后端。
- 补充 zh/en common.json 的 resourcePicker.* 本地化文案。
* feat(frontend): refine workbench UI per design specs
* feat(frontend): wire resource-picker drawers to real APIs and fix pagination
Replace the mock data in the five add-resource drawers (agent, knowledge,
model, skill, tool) with real data from existing hooks, and make the
resource drawers fetch and render 10 items per page with working pagination.
Changes:
- AddAgentDrawer: load local agents from usePublishedAgentList and external
agents from useExternalAgents; derive the label dropdown from agent tags.
- AddKnowledgeDrawer: load knowledge bases from useKnowledgeList; use the
source field for the label filter (no tags field on KnowledgeBase).
- AddSkillDrawer: load skills from useSkillList; derive labels from skill.tags.
- AddToolDrawer: load tools from useToolList; derive labels from tool.labels.
- AddModelDrawer: switch the data source from the preset catalog
(useModelCatalog) to the account's own models (useModelList), grouping LLM
models by source, since this drawer adds models already connected by the
account on the model config page.
- AddResourceDrawer: make ResourcePagination a controlled component and add
search/tab/filter -> page-1 reset so page navigation works.
- types: add optional tags to AgentCardItem.
Root cause of the pagination bug: ResourcePagination kept its own state and
the parent never sliced the list, so every page rendered the full result set
and the page controls were inert.
* feat(frontend): rename landing examples heading to recommended prompts
* feat(frontend): polish resource-picker drawers per design specs
Align the five "add resource" drawers with the design mockups.
- AddAgentDrawer: add a divider between local/external tabs, show the
agent update time with a status dot, and add a refresh button next to
select-all (reuse usePublishedAgentList/useExternalAgents refetch).
- AddKnowledgeDrawer: change the item meta label from "更新" to "使用过"
to match the design.
- AddModelDrawer: source data from useModelList (the account's already
connected models) instead of the preset useModelCatalog, group models
by their source, add a refresh button, and render a checkbox on the
right of each model row.
- AddSkillDrawer: always render both official and custom tabs instead of
deriving tabs from data so the "官方" tab no longer disappears.
- useSkillList: treat both "official" and "官方" as official sources.
- AddResourceDrawer: restyle the pagination jump box as a single
96x32px rounded white field with the "跳转" suffix inside.
- types: rename AgentCardItem.publishedAt to updatedAt.
* fix(frontend): refine pagination jump box input/button
Make the jump box match the design: keep the vertical divider full
height instead of inset, and turn the "跳转" suffix into a real button
whose click jumps to the entered page (via a ref), with Enter still
working in the input.
* feat(frontend): match composer toolbar icons to design
* feat(frontend): redesign new chat experience
* feat(frontend): agent config high-fidelity layout, resource drawers and debug page
- High-fidelity agent config layout with selected resource rows and add button
- Resource picker drawers for models, skills, tools and child agents
- Agent creation guide and first-creation welcome experience
- High-fidelity debug layout with welcome and question suggestions
- configurationLayout/debugLayout support in Thread and Composer
- Tags mapping in published agent list service
- D1/D4 test assets, automation cases and handoff docs
* feat(frontend): merge new chat redesign and restore workbench composer toolbar
* fix(frontend): remove duplicate planning menu in workbench composer
* feat(frontend): unify sidebar frame across pages and redraw knowledge icon
* fix(frontend): align workbench sidebar frame with new chat page
* fix(frontend): align new chat layout and agent conversation interactions
* fix(frontend): connect chat resource actions and localized sidebar navigation
* feat(frontend): migrate agent resource dialogs to resource-picker drawers
Replace the legacy add-tool / add-agent / add-skill / add-knowledge dialogs with the shared AddResourceDrawer skeleton while preserving data flows and API calls.
AddToolDrawer / AddAgentDrawer use the skeleton layout (search, single-select tag, selected chips, list header, tabs, pagination); AddAgentDrawer uses a 2-column card grid with instant selection and no confirm footer.
AddSkillDrawer selected chips resolve names by merging persisted skill instances (skill_name) with the catalog, matching SelectedSkillManagement hydration.
Extract the per-model parameter override popup into ModelParamsModal, wired into agent-prompt.
Delete orphaned legacy components (SelectToolsDialog, SelectSkillsDialog, SkillRowContent, capability/skill/utils, collaborative-agent-selector-modal).
Update the version-name label test to assert against collaborative-agent.tsx.
* feat(frontend): refine workbench composer alignment per design
* fix(frontend): hide empty attachment row above workbench composer input
* feat(frontend): refine agent development list layout
* fix(frontend): hide inactive sidebar controls
* fix(frontend): rename and reorder workbench menu
* fix(frontend): preserve conversation completion feedback after merge
* fix(frontend): repair quality gate interaction and duplication findings
* refactor(test): share duplicated editor browser fixtures
* test: add case-local PR4058 regressions and remove temporary docs
* fix(frontend): align new chat resource controls
* test: expand agent editor E2E and restore readonly mode navigation
* fix(frontend): load creation templates from Agent API
* fix(frontend): complete PR4058 localization and verified review fixes
---------
Co-authored-by: hzw <hzw@qq.com>
Co-authored-by: qianshengjia <840646206@qq.com>
Co-authored-by: ljy <ljy@DESKTOP-65OBISN.(none)>
Co-authored-by: 高天 <高天@DESKTOP-NKC6LHG.(none)>
…used the sandbox kernel to become unhealthy. (#4068) * 🐛 Bugfix: Fixed the issue where concurrent calls to the same agent caused the sandbox kernel to become unhealthy. * 🐛 Bugfix: Fixed the issue where concurrent calls to the same agent caused the sandbox kernel to become unhealthy. * test(sandbox): consolidate invocation regression coverage
* test:baseline cases
* test:add local test process
* doc:add test deploy guide
* bugfiix:优化测试流程
* bugfix：修复测试用例
* doc:轻量化bugfix的spec设计和测试用例设计
* test:修复测试用例
* test:修复D1测试用例
* test: 修复 D3 用例脚本并记录失败归因
* test: 移除 D3 变更记录，仅保留测试修复
* fix(test-e2e): make D5 tests portable and isolate evaluation workloads
* fix(test-e2e): repair Windows case contracts and D4 journeys
* feat(test-e2e): launch repository daily from a pinned branch
* test:修复D4读取config问题
* test:修复测试用例，删掉过期用例
* test：修复测试用例
* test:修复测试用例
* doc：测试规范修改
* test：增加外部记忆mock服务
* test：测试用例修复
* fix(prompt): reject blank task descriptions before SSE generation
* fix(agent): return 404 for missing discovery resources
* fix(agent): validate relationships before update writes
* fix(model): preserve provider error status on provider create
A provider failure (e.g. an upstream connection_failed) was raised as
HTTPException(502) by create_provider_models_for_tenant, but the generic
except Exception handlers in the service and the app layer swallowed it and
re-wrapped it, so /model/provider/create answered 500 with the real status
only surviving as text in the message body (API-049).
- service: re-raise HTTPException instead of wrapping it
- app: pass HTTPException through on /provider/create and
/manage/provider/create
- schema: reject a blank provider with 422 at the boundary
- tests: regression coverage for both behaviours
* fix: correct conversation access and stopped-turn regressions
* fix: enforce tenant isolation and edit permissions for agent relations
* fix: enforce tenant isolation and edit permissions for agent relations1
* 🐛 Fix tag projection crash on first-attempt ES write failure
Problem:
project_document_assignments() dereferenced the prior ledger state
without a None guard in its generic exception handler. On a document's
first-ever projection attempt there is no ledger row yet, so an ES write
failure crashed with AttributeError before the failed state was
persisted. The failure then became invisible: no retry_count, no
next_attempt_at, retry_pending_document_projections() never picked the
document up, and tag-filtered retrieval silently ignored the document
until its tags were re-saved.
Fix:
Treat a missing prior state as retry_count 0 in the failure handler
((current or {}).get("retry_count")), so first-attempt failures record a
retryable failed state with correct exponential backoff. Added a
regression unit test for the no-prior-state failure path (previously
only the existing-state path was covered). Also added one blank line
after the import block to satisfy the repo ruff pre-commit hook on this
file (pre-existing I001).
Verification:
- test/backend/services/test_tag_document_projection.py 28/28 passed,
incl. new test_first_attempt_failure_records_retryable_state
- Neighboring regression: test_tag_management_service.py and
test_tag_document_batch_status.py, 53/53 passed
- ruff (E,F,I,W hook rule set) clean on the touched backend file
- Matches the state-machine expectations of e2e case
API-AUTO-357B84F01BA6D321 (daily run 2026-10-09)
* Fix A2A publication smoke scope and remove Mock dependency
* fix(a2a): execute the version recorded by A2A publication
* [WIP] Fix accepted semantic repair stream commits (#4057)
* feat(audit): add security audit logging to backend management APIs (#4055)
* feat: 为模型管理接口添加安全审计日志记录
实现了模型创建、更新、删除、批量操作等接口的安全审计日志功能，过滤了敏感凭证信息，确保审计日志安全合规。新增了审计安全字段过滤工具函数，补充了对应的测试用例验证审计日志的正确性和安全性。
* feat: 为多个接口添加安全审计日志记录
为agent和agent_repository相关的API接口添加安全审计事件记录，包括代理更新、图标上传、删除、导出、导入、版本发布/回滚/更新/删除等操作，同时补充对应的测试用例验证审计日志的正确性，确保敏感数据不被记录。
* feat: 为MCP和技能相关接口添加上下文安全审计日志
为tool、mcp、remote_mcp、skill模块的所有关键增删改接口添加安全审计日志，记录操作人、资源信息等关键字段，同时避免记录敏感信息如凭证、密钥等。新增对应的测试用例验证审计日志的正确性，确保敏感数据不会被泄露。
* feat: 添加安全审计日志并限制审计详情列表长度
在多个服务端点添加安全审计日志，记录关键操作信息
同时统一审计详情列表的长度限制为20，防止日志被恶意payload撑爆
* feat: 为配置相关接口添加安全审计日志记录
为 config_sync_app 和 memory_config_app 的配置操作接口添加安全审计事件记录，记录操作人、租户、操作类型和相关字段信息，同时更新测试用例验证审计日志的正确性，确保敏感配置值不被记录。
* test: 为上传测试用例添加 http_request 参数默认值
为测试用例中的 upload_files 调用添加 http_request=None 参数，避免测试时可能出现的未定义错误
* chore: bootstrap semantic repair stream fix draft
* fix(agent): commit accepted streamed code action repairs
* test(agent): verify repaired streams in deployed runtime and browser
* test(agent): clarify deployed repair assertion failures
---------
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
* fix: repair agent repository e2e cases and API-type MCP health check (#4061)
* fix: repair four failing e2e cases (API-086, API-063, PW-MCP-CONTAINER-01, PW-MCP-MARKET-01)
* fix: skip MCP protocol handshake for API-type MCP health check
* fix(test-e2e): align runtime contracts and strengthen local test diagnostics
* fix(test-e2e): reconcile standalone semantic repair tests with formal cases
* test:修改workflow
* test:修复测试用例
* fix: preserve manual titles and metadata-free A2A calls
* test: repair D1-D5 runtime contracts and execution evidence
* test: repair daily assertions and remove excluded cases
* fix: guard MCP tag refresh and repair daily test isolation
* test：修复测试用例
* test:修复测试用例
* test:修复测试用例
* doc:优化测试用例生成skill
* test：新增测试报告责任人
* test: publish latest complete Daily reports for Syncthing
---------
Co-authored-by: panyehong <2655992392@qq.com>
Co-authored-by: xuyaqist <xuyaqist@gmail.com>
Co-authored-by: chase <byzhangxin11@126.com>
Co-authored-by: cj2026-bit <647646783@qq.com>
Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com>
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
Co-authored-by: MoeexT <yuwancumian666@outlook.com>
…ix (#4064) * fix(agent): export agent with display name as zip filename Use the agent display name (falling back to name) for export zip filenames, and encode Content-Disposition with RFC 5987 so non-ASCII names survive browser downloads. Extract the filename on the frontend from the encoded header. Verified: unit tests for header encoding/parsing and API-level export checks in the local cluster. * fix(agent): generate unique copy name suffix on agent copy * fix(agent): deduplicate agent name on create via update API * test(e2e): cover agent copy unique-name and availability contract Add bugfix record AGENT-COPY-DUP-20261012, update API-058 to the fixed auto-suffix dedup contract, and add D4 journey PW-AGENT-COPY-01 that copies an agent twice through the repository UI and asserts unique identifiers and availability. * test(e2e): assert agent export uses display-name filename Add bugfix record AGENT-EXPORT-NAME-20261012, update API-066 to require the display-name ZIP export path, and extend the D3 scenario to bind a skill before export and assert the RFC 5987 encoded Content-Disposition filename. * test(e2e): parse bare agent list array in copy journey /api/agent/list returns a bare JSON array; the copy journey and the shared page object unwrapped payload.data, so every poll resolved to an empty list and the case failed before its assertions ran. Parse the array first and keep the wrapped shape as a fallback. Also align case.yaml expected_results with the three spec assertions and remap acceptance bindings accordingly.
* feat(aidp): isolate knowledge list, creation, files and import pages * fix(aidp): preserve list preferences and restrict row navigation * fix(aidp): refresh knowledge list once after import * fix(aidp): refresh knowledge list when import drawer closes * docs(aidp): define import creation and files acceptance cases * fix: align AIDP file operations and knowledge list refresh with acceptance * fix: use persisted AIDP knowledge creator consistently * fix: align AIDP knowledge pages with deployed contract * fix: restore four-column knowledge cards * fix(aidp): align knowledge guide with agent workflows * fix(aidp): sanitize externally sourced log values * test(aidp): cover graph contracts and file query branches * refactor(aidp): confine knowledge management changes to module * refactor(aidp): organize frontend by pages and reusable features * fix: simplify AIDP knowledge management after backend review * fix(aidp): address knowledge page frontend review * fix(aidp): avoid overlapping permission tooltips * fix(aidp): unify knowledge page typography * fix(aidp): keep knowledge list reachable below expanded guide * test(aidp): align frontend D1 with knowledge management pages * fix(aidp): handle failed file deletion confirmations without unhandled rejections * chore(aidp): remove unused upload documentation and stale text * fix(aidp): review fixes for KB management pages - Defer graph domain validation to AIDP: the frontend sources domain options from the live graph template, so a hardcoded backend whitelist would reject newly added AIDP domains at submit time. The serializer now only requires a non-empty string. - Treat AIDP 404 on KB delete as success so orphan KBs (already removed upstream) can be cleaned up locally, and expose the delete action for unavailable rows in the KB list (card menu and table actions). - Reject same-name duplicates within one upload batch: only the first file is accepted and the rest fail immediately as duplicates, because upload responses match rows by file name only and would otherwise pair success/failure with the wrong rows.
* feat: defer Docker startup for official tool actions * feat: allow JSON imports in local tool fast path * fix(sdk): align tool policy registration and cover deferred execution * test: add deployed and browser tool fastpath acceptance coverage --------- Co-authored-by: hhhhsc <name>
…b. (#4081) * ✨ Feature: Add a pipeline to synchronize the MinIO image to Docker Hub. * fix(test): align offline package fixtures with MinIO image source
* 🐛 Bugfix: final answer duplicate in subagent situation * Update final-answer browser checks for develop history groups * Fix final-answer unit test expectations and stream type mock * Cover final-answer ownership cleanup and stream rollback boundaries * Cover final-answer stream transitions and completion branches
…n and share views (#4085) * refactor(chat): remove legacy chat page and migrate conversation consumers * test(workbench): fix composer fixtures and retrieval configuration coverage * switch bettwen /workbench and /newchat * test(chat): migrate legacy D1 cases to newchat contracts
* refactor: consolidate model management services * test: update Management architecture checks for model modules
* fix: correct reasoning effort selection * fix: default workbench reasoning effort to low
* ci: add copyright header check for changed source files - Add scripts/check_copyright.py to check and auto-fix missing copyright headers on .py/.sh/.sql/.ts/.tsx/.js/.jsx/.mjs files, with a --files-from mode for incremental checks - Add .github/workflows/copyright-check.yml to incrementally check PRs targeting develop/release/hotfix branches, with an optional full scan via workflow_dispatch - Require the header in AGENTS.md shared constraints and add a .cursor/rules thin entry for compatibility - Document the requirement and local verify/fix commands in CONTRIBUTING.md * fix(ci): generate copyright year range dynamically Derive the end year of the copyright header from the current year instead of hardcoding 2025-2026, so headers inserted by --fix and the suggestion in error output stay correct in future years. The check pattern already accepts any year variant. Also document the dynamic end year in AGENTS.md and CONTRIBUTING.md. * fix(ci): limit copyright check workflow token permissions Add an explicit top-level permissions block restricting GITHUB_TOKEN to contents: read, matching the convention of other workflows and resolving the CodeQL workflow permissions alert. * fix(ci): drop push trigger and add paths filter to copyright check Remove the push trigger: on merge commits to protected branches the two-dot diff (event.before..HEAD) includes every file from the merged feature branch, which could turn previously green PRs into unexpected red builds on develop. Incremental checking is already closed-loop on pull_request events via the three-dot diff against the base branch. Simplify the fallback diff to HEAD~1..HEAD: github.event.before is only populated for push events, so the BEFORE_SHA branch is dead code now. workflow_dispatch changed mode keeps its documented latest-commit semantics. Add a pull_request paths filter matching the checker's supported source extensions so docs-only PRs no longer trigger a fetch-depth: 0 checkout. Keep the workflow file itself in the trigger set so changes to the check are still validated end-to-end. --------- Co-authored-by: zz287613978 <zz287613978@noreply.gitcode.com>
* fix(i18n): 修复问题英文界面有中文 修改 i18n 配置和 Memory 组件，使英文界面正确显示英文，中文界面保持中文。 - i18n.tsx: 设置 keySeparator=false, nsSeparator=false，强制 i18next 用 flat key 查找 locale 文件，避免带点 key 被当作嵌套结构查找失败 - MemoryManager.tsx: JSX 中文字面量（tooltip、aria-label、placeholder、按钮文案、列标题、状态映射等）改为 t() 调用形式，新增 56 个 memory.manager.* i18n key - en/common.json: 新增对应 56 个英文翻译 - zh/common.json: 新增对应 56 个中文翻译，确保两个 locale 完全对齐 Co-authored-by: Trae <noreply@trae.ai> Generated-by: glm-5.2 * docs(i18n): add verification screenshot for PR #4084 上传英文/中文界面国际化对比截图作为验证证据。 Co-authored-by: Trae <noreply@trae.ai> Generated-by: glm-5.2 * docs(i18n): remove screenshot from PR #4084 modified files 移除截图文件，改为通过 PR 评论方式提供验证截图。 Co-authored-by: Trae <noreply@trae.ai> Generated-by: glm-5.2 * fix(i18n): add model provider connection error messages 为模型提供商连接失败场景补充 en/zh 文案（title/noModels/connectionFailed/authenticationFailed/accessDenied/endpointNotFound/serverError/timeout/sslError）。 Co-authored-by: Trae <noreply@trae.ai> Generated-by: deepseek-v4.1-flash * fix(i18n): align en/zh locale keys for model config and agent pages 补齐两边 locale 缺失 key，使 en/zh 完全对齐： - zh 补 77 个：model.connectivity/status/filter、modelConfig.addDialog/button/ defaultConfig/delete/editDialog/library/list/pagination/search/spec/table/ update/verify、model.dialog.v2.searchModels、nl2agent.toolRecommendations 复数形式 - en 补 17 个：agent.a2a、agent.deployment、agent.mainAgent、agent.permission、 agent.runPolicy - 同时移除未生效的嵌套 model.dialog.error.provider 块（keySeparator=false 下 不会被解析，扁平 key 已存在） Co-authored-by: Trae <noreply@trae.ai> Generated-by: kimi-k3 * fix(i18n): remove keySeparator/nsSeparator overrides in i18next init 恢复 i18next 默认分隔符行为： - i18next 的 deepFind 会先把整串 key 当作扁平属性查找，与 keySeparator 无关； 默认 "." 是 keySeparator: false 的超集，显式关闭反而让嵌套数据与数组索引 路径（如 page.features.0.title）静默失效并返回裸 key。 - 全仓无含 ":" 的 key、也无 t("common:...") 形式的调用，nsSeparator 无实际作用。 - 已对 en/zh 全部语言包条目做等价性验证（5940 x 2 key，新旧配置解析差异 0）， 并确认移除后 page.features.0.title 恢复为正常文案。 Refs #4084 Co-authored-by: Trae <noreply@trae.ai> Generated-by: deepseek-v4.1-flash --------- Co-authored-by: Trae <noreply@trae.ai>
* test:baseline cases
* test:add local test process
* doc:add test deploy guide
* bugfiix:优化测试流程
* bugfix：修复测试用例
* doc:轻量化bugfix的spec设计和测试用例设计
* test:修复测试用例
* test:修复D1测试用例
* test: 修复 D3 用例脚本并记录失败归因
* test: 移除 D3 变更记录，仅保留测试修复
* fix(test-e2e): make D5 tests portable and isolate evaluation workloads
* fix(test-e2e): repair Windows case contracts and D4 journeys
* feat(test-e2e): launch repository daily from a pinned branch
* test:修复D4读取config问题
* test:修复测试用例，删掉过期用例
* test：修复测试用例
* test:修复测试用例
* doc：测试规范修改
* test：增加外部记忆mock服务
* test：测试用例修复
* fix(prompt): reject blank task descriptions before SSE generation
* fix(agent): return 404 for missing discovery resources
* fix(agent): validate relationships before update writes
* fix(model): preserve provider error status on provider create
A provider failure (e.g. an upstream connection_failed) was raised as
HTTPException(502) by create_provider_models_for_tenant, but the generic
except Exception handlers in the service and the app layer swallowed it and
re-wrapped it, so /model/provider/create answered 500 with the real status
only surviving as text in the message body (API-049).
- service: re-raise HTTPException instead of wrapping it
- app: pass HTTPException through on /provider/create and
/manage/provider/create
- schema: reject a blank provider with 422 at the boundary
- tests: regression coverage for both behaviours
* fix: correct conversation access and stopped-turn regressions
* fix: enforce tenant isolation and edit permissions for agent relations
* fix: enforce tenant isolation and edit permissions for agent relations1
* 🐛 Fix tag projection crash on first-attempt ES write failure
Problem:
project_document_assignments() dereferenced the prior ledger state
without a None guard in its generic exception handler. On a document's
first-ever projection attempt there is no ledger row yet, so an ES write
failure crashed with AttributeError before the failed state was
persisted. The failure then became invisible: no retry_count, no
next_attempt_at, retry_pending_document_projections() never picked the
document up, and tag-filtered retrieval silently ignored the document
until its tags were re-saved.
Fix:
Treat a missing prior state as retry_count 0 in the failure handler
((current or {}).get("retry_count")), so first-attempt failures record a
retryable failed state with correct exponential backoff. Added a
regression unit test for the no-prior-state failure path (previously
only the existing-state path was covered). Also added one blank line
after the import block to satisfy the repo ruff pre-commit hook on this
file (pre-existing I001).
Verification:
- test/backend/services/test_tag_document_projection.py 28/28 passed,
incl. new test_first_attempt_failure_records_retryable_state
- Neighboring regression: test_tag_management_service.py and
test_tag_document_batch_status.py, 53/53 passed
- ruff (E,F,I,W hook rule set) clean on the touched backend file
- Matches the state-machine expectations of e2e case
API-AUTO-357B84F01BA6D321 (daily run 2026-10-09)
* Fix A2A publication smoke scope and remove Mock dependency
* fix(a2a): execute the version recorded by A2A publication
* [WIP] Fix accepted semantic repair stream commits (#4057)
* feat(audit): add security audit logging to backend management APIs (#4055)
* feat: 为模型管理接口添加安全审计日志记录
实现了模型创建、更新、删除、批量操作等接口的安全审计日志功能，过滤了敏感凭证信息，确保审计日志安全合规。新增了审计安全字段过滤工具函数，补充了对应的测试用例验证审计日志的正确性和安全性。
* feat: 为多个接口添加安全审计日志记录
为agent和agent_repository相关的API接口添加安全审计事件记录，包括代理更新、图标上传、删除、导出、导入、版本发布/回滚/更新/删除等操作，同时补充对应的测试用例验证审计日志的正确性，确保敏感数据不被记录。
* feat: 为MCP和技能相关接口添加上下文安全审计日志
为tool、mcp、remote_mcp、skill模块的所有关键增删改接口添加安全审计日志，记录操作人、资源信息等关键字段，同时避免记录敏感信息如凭证、密钥等。新增对应的测试用例验证审计日志的正确性，确保敏感数据不会被泄露。
* feat: 添加安全审计日志并限制审计详情列表长度
在多个服务端点添加安全审计日志，记录关键操作信息
同时统一审计详情列表的长度限制为20，防止日志被恶意payload撑爆
* feat: 为配置相关接口添加安全审计日志记录
为 config_sync_app 和 memory_config_app 的配置操作接口添加安全审计事件记录，记录操作人、租户、操作类型和相关字段信息，同时更新测试用例验证审计日志的正确性，确保敏感配置值不被记录。
* test: 为上传测试用例添加 http_request 参数默认值
为测试用例中的 upload_files 调用添加 http_request=None 参数，避免测试时可能出现的未定义错误
* chore: bootstrap semantic repair stream fix draft
* fix(agent): commit accepted streamed code action repairs
* test(agent): verify repaired streams in deployed runtime and browser
* test(agent): clarify deployed repair assertion failures
---------
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
* fix: repair agent repository e2e cases and API-type MCP health check (#4061)
* fix: repair four failing e2e cases (API-086, API-063, PW-MCP-CONTAINER-01, PW-MCP-MARKET-01)
* fix: skip MCP protocol handshake for API-type MCP health check
* fix(test-e2e): align runtime contracts and strengthen local test diagnostics
* fix(test-e2e): reconcile standalone semantic repair tests with formal cases
* test:修改workflow
* test:修复测试用例
* fix: preserve manual titles and metadata-free A2A calls
* test: repair D1-D5 runtime contracts and execution evidence
* test: repair daily assertions and remove excluded cases
* fix: guard MCP tag refresh and repair daily test isolation
* test：修复测试用例
* test:修复测试用例
* test:修复测试用例
* doc:优化测试用例生成skill
* test：新增测试报告责任人
* test: publish latest complete Daily reports for Syncthing
* fix(test): preserve unrelated files during Daily report publication
---------
Co-authored-by: panyehong <2655992392@qq.com>
Co-authored-by: xuyaqist <xuyaqist@gmail.com>
Co-authored-by: chase <byzhangxin11@126.com>
Co-authored-by: cj2026-bit <647646783@qq.com>
Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com>
Co-authored-by: charmingchi1 <71816192+charmingchi1@users.noreply.github.com>
Co-authored-by: MoeexT <yuwancumian666@outlook.com>
…h would not allow for model selection. (#4181) * 🐛 Bugfix: Fixed an issue where regular user sessions and the workbench would not allow for model selection. * fix(model): use permission ID 143 for USER model read
* fix(frontend): 修复标签管理搜索无法按译名和显示值匹配 标签管理弹窗的搜索此前只比对后端原始字段 definition_name 与 definition_key，而表格名称列渲染的是 i18n 译名（keywords -> 关键词），标签值（显示值 / 规范化值）完全不参与匹配，因此输入“关键”或某个值的文本都搜不到。 - 在 lib/systemTagLabels.ts 抽出共用的文本匹配逻辑，新增 getMatchingTagDefinitionIds 返回命中定义 id - TagDefinitionManagementPanel 改用该 helper，空白输入仍不过滤 - 搜不到结果时区分“没有匹配的标签定义”与“暂无标签” - 搜索框提示补充可按显示值搜索 - 新增 tagDefinitionSearch 组件回归测试，覆盖译名、标识、显示值、规范化值、禁用值、空白输入与空态文案 验证：tagDefinitionSearch / tagLibraryManagement / knowledgeCatalog 共 26 项组件测试通过（旧过滤逻辑下该 spec 有 3 项失败，确认能捕捉缺陷）；改动文件 eslint、prettier 与版权头校验通过。 * fix(frontend): 标签管理搜索按“命中来源”区分高亮与展开 上一提交让搜索能命中译名与标签值，但命中后只是过滤出行，既不指出命中位置，也无法呈现“值命中”这种行内看不到的结果。若一律展开，搜 key 反而会把大量无关 value 摊开。 改为让命中来源决定呈现方式： - 新增 components/common/HighlightedText，把命中片段包进 <mark>；名称列、标识列与内层显示值列统一复用 - getMatchingTagDefinitionIds 改为 getTagSearchMatches，返回每个定义的命中来源（definitionMatched 与 matchedValueIds）；值匹配仍覆盖全部值（含禁用值），维持既有语义 - 名称 / 译名 / 标识命中：不展开，只在行内高亮命中片段 - 仅值命中：自动展开该行，内层只列命中的值并提示“仅显示匹配搜索的标签值”，搜 key 不会摊开整列 value - 自动展开的行由 autoExpandedKeysRef 单独追踪，只在集合变化时增删，不会重开用户手动收起的行 - 清空搜索后自动展开与内层值过滤一并复原 - 新增 tagManagement.hint.matchedValues 中英文案 - tagDefinitionSearch 由 7 项扩到 12 项，覆盖自动展开、内层过滤、高亮片段、清空复原与手动收起 验证：tagDefinitionSearch / tagLibraryManagement / resourceTagManagement / resourceTagFilter 共 26 项组件测试通过；改动文件 eslint、prettier 与版权头校验通过。 * fix(frontend): 搜索时固定标签管理弹窗高度 表格滚动体只有 max-height（来自 scroll.y），行数一变高度就跟着变：搜索把行过滤掉、空态文案切换，都会让弹窗在每次输入时上下跳，而弹窗是 centered 的，跳动尤其明显。 - TagDefinitionManagementPanel 新增可选 stableTableHeight，为真时把表格滚动体钉在 scroll.y 已经要求的 500px（新增 TagDefinitionManagementPanel.module.css） - 只有 TagDefinitionManagementModal 传这个开关；资源管理页内嵌同一个面板，保持随行数自然增长 - tagDefinitionSearch 增到 14 项，覆盖开关两侧行为 验证：tagDefinitionSearch 14 项组件测试通过；改动文件 eslint、prettier 与版权头校验通过。jsdom 不做布局，实际高度表现待真机确认。 * test(e2e): 记录标签管理搜索缺陷并补充搜索契约 补充 TAG-DEFINITION-SEARCH-20261021 缺陷变更记录与轻量设计说明：说明搜索按本地化译名、原始标识与值显示文本匹配，只有值命中才自动展开并只列出命中的值，弹窗高度在搜索期间保持稳定。 Feature RESOURCE-TAG-MANAGEMENT 新增 RULE-006 记录该搜索语义；无正式 Case 引用该 Feature，行为由前端组件 UT 覆盖，故不新增 D1-D5。 验证：validate_test_assets.py --phase implementation --generate --require-ut-change TAG-DEFINITION-SEARCH-20261021 与只读全量校验均通过；tagDefinitionSearch/tagLibraryManagement/resourceTagManagement/resourceTagFilter 共 28 项组件测试通过。 * Revert "test(e2e): 记录标签管理搜索缺陷并补充搜索契约" This reverts commit a5b6f5a.
…ent Space name (#4173) * fix(agent-space): make marketplace listing tags optional A listing request no longer requires at least one tag. Missing, null or empty tags are normalized to an empty list, while provided tags keep the existing string, length and dedupe limits. - backend: _normalize_listing_tags accepts an empty result and _validate_card_fields no longer rejects missing tags - frontend: the listing modal submits without tags and the tags hint is marked optional in the en and zh locales - tests: backend unit tests and a component test for the listing modal cover the optional-tag contract * fix(frontend): unify the English Agent Space name In English mode the agent space page heading read Agent Repository while its sidebar entry and the Home quick action already read Agent Space. The page title key now uses the same name so the page no longer contradicts its own navigation entries. Chinese strings are untouched. - locales: agentRepository.page.title in en/common.json is now Agent Space - tests: a component test pins the English sidebar entry, Home quick action and page title to one name and asserts the Chinese title is unchanged
* fix(frontend): restore model parameter help tooltips Add localized Temperature and Top P tooltips with hover and focus support. Cover editable and readonly help interactions without draft mutations or dialog actions. * fix(frontend): simplify temperature label Use 温度 for the Chinese model parameter label and fallback; retain the existing English Temperature label.
* fix(test-e2e): repair eight context and prompt cases * docs(test-e2e): record develop merge verification * Delete docs/handoffs/2026-10-22-context-prompt-triage.md
…suite-owned (#4179) * 🧪 Test(e2e): repair stale knowledge/AIDP cases and make the ext mock suite-owned - Fix stale D1 fixtures/assertions and D4 page helpers for the current product UI. - Start ext-knowledge as a suite-owned controlled service on a free port; remove the required attach YAML, identity and cross-batch lock. - Add the KB/AIDP test-fix change record. * 🧪 Test(e2e): align D4 journeys with the current UI and AIDP mock - Use the current knowledge-drawer option row, workbench debug composer, unnamed publish modal and sidebar thread trigger. - Wait for the SSE stream to finish before reading the final answer; use full Chromium and an authenticated-stream fallback for blob downloads. - Pin the suite-owned ext mock to 30090 so the product AIDP_SERVER_URL can reach it. - Use the seed-only low-latency oracle phrase and align PW-KB-LOCAL-01 with the current page. * 📝 Docs(e2e): document ext-knowledge mock startup and suite usage - Clarify suite-owned 30090 binding and product-facing AIDP_SERVER_URL addresses. - Add copy-paste suite, standalone and dispatcher startup paths plus evidence path. - Add the external-knowledge entry to the mock-services dispatcher README.
* fix(frontend): simplify automatic entry redirect * fix(frontend): unify agent creation suggestions and debug layout Select NL2Agent creation or optimization examples from the draft description. Share localized workbench creation examples and render card suggestions with one consistent workbench list style and the common suggestion heading. Align debug welcome and example placement with NL2Agent, remove excessive height-dependent padding, and apply the debug gradient to NL2Agent only. Keep transparent card defaults after reverting the experimental background. Validation: 27 focused frontend tests, one legacy debug component test, TypeScript checking, copyright checks and formal asset validation passed. Full browser debug verification remains blocked before the editor loads; retain the limitation in the change record. * fix(a2a): validate agent names and display discovery errors * fix(frontend): reorder NL2Agent optimization suggestions * fix: format model capacity tags with appropriate token units * fix(agent): expose advanced protocol control and existing setting hints * test: include A2A validation in service architecture manifest * feat(nl2agent): unify resource binding and knowledge recommendations * fix(nl2agent): move knowledge recommendations to canonical owner * test(nl2agent): register canonical knowledge recommendation module * 修复租户管理员本身会获取租户列表的问题 & 修复评估页面无法返回上级的问题 * 修复 A2A 发现超时及失败提示 * fix(nl2agent): align prompt example with unified agent prompt * fix(nl2agent): reuse backend name validation and clarify naming guidance * refactor: unify agent prompt and consolidate SQL migrations * test: assert rendered context semantics instead of legacy heading * fix(nl2agent): align name constraints with runtime validation * fix: move prompt migrations to v2.8.0 merged SQL * fix(a2a): make external agent SSL verification configurable
* fix(frontend): simplify automatic entry redirect * fix(frontend): unify agent creation suggestions and debug layout Select NL2Agent creation or optimization examples from the draft description. Share localized workbench creation examples and render card suggestions with one consistent workbench list style and the common suggestion heading. Align debug welcome and example placement with NL2Agent, remove excessive height-dependent padding, and apply the debug gradient to NL2Agent only. Keep transparent card defaults after reverting the experimental background. Validation: 27 focused frontend tests, one legacy debug component test, TypeScript checking, copyright checks and formal asset validation passed. Full browser debug verification remains blocked before the editor loads; retain the limitation in the change record. * fix(a2a): validate agent names and display discovery errors * fix(frontend): reorder NL2Agent optimization suggestions * fix: format model capacity tags with appropriate token units * fix(agent): expose advanced protocol control and existing setting hints * test: include A2A validation in service architecture manifest * feat(nl2agent): unify resource binding and knowledge recommendations * fix(nl2agent): move knowledge recommendations to canonical owner * test(nl2agent): register canonical knowledge recommendation module * 修复租户管理员本身会获取租户列表的问题 & 修复评估页面无法返回上级的问题 * 修复 A2A 发现超时及失败提示 * fix(nl2agent): align prompt example with unified agent prompt * fix(nl2agent): reuse backend name validation and clarify naming guidance * refactor: unify agent prompt and consolidate SQL migrations * test: assert rendered context semantics instead of legacy heading * fix(nl2agent): align name constraints with runtime validation * fix: move prompt migrations to v2.8.0 merged SQL * fix(a2a): make external agent SSL verification configurable * fix(nl2agent): clarify duplicate name retry in prompts * test(agent): repair configuration cases and current UI fixtures
* test: 修复EVAL-LEGACY-D5-001的准备声明和PW-EVAL-RUN-01的评估流程顺序 * chore(test-e2e): add copyright header to PW-EVAL-RUN-01 spec CI copyright check requires the standard Huawei header on changed .ts files; test.spec.ts was newly added without it. Refs #4194 Co-authored-by: Trae <noreply@trae.ai> Generated-by: glm-5.3-flash --------- Co-authored-by: Trae <noreply@trae.ai>
* fix(frontend): adapt model library pagination to the viewport The library section fills the remaining viewport height and the row list scrolls internally, but the page size was a fixed 8: tall screens showed a half-empty list below the last row while the overflow spilled onto a nearly empty second page. Derive the page size from the measured geometry instead: a ResizeObserver tracks the scroll viewport, the first row's real offsetHeight supplies the row height (64px fallback, and rows stacking taller on narrow viewports re-measure), and the desktop-only header is subtracted when visible. The result is clamped to [8, 50] so tiny viewports keep a usable page and huge ones stay bounded. Filters, page clamping, and the pager itself keep their existing behavior. Also add the copyright header the CI requires to the touched component. * fix(frontend): default workbench chat to the tenant default LLM Fresh workbench sessions fell back to the first available LLM in catalog order, ignoring the tenant-configured default model despite the model settings page promising it as the fallback for unconfigured sessions. Pass the configured default LLM id into withDefaultWorkbenchModel so a fresh session prefers it while it stays selectable, keeping the first available model as the last resort and never overriding an explicit session choice. --------- Co-authored-by: ljy <ljy@DESKTOP-65OBISN.(none)>
…ames (#4197) * fix(aidp): preserve download extensions and model display names Resolve attachment filenames before saving AIDP files and restore missing extensions from metadata. Use ModelService display labels in knowledge details and model selectors while retaining canonical model IDs for updates, including read-only views. Fixes #4196 Co-authored-by: Codex <noreply@openai.com> Generated-by: gpt-6 * fix(aidp): preserve quotes inside attachment filenames Parse quoted and unquoted filename parameters separately, remove only the surrounding double quotes, and decode quoted-pair escapes. Preserve literal apostrophes and keep UTF-8 filename precedence and malformed-encoding fallback. Refs #4196 Co-authored-by: Codex <noreply@openai.com> Generated-by: gpt-6 --------- Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: hzw <hzw@qq.com>
…oad in the history records. (#4193)
jeffwu-1999
requested review from
Dallas98,
Jasonxia007,
WMC001,
YehongPan and
hhhhsc701
as code owners
October 23, 2026 08:58
* fix(frontend): simplify automatic entry redirect * fix(frontend): unify agent creation suggestions and debug layout Select NL2Agent creation or optimization examples from the draft description. Share localized workbench creation examples and render card suggestions with one consistent workbench list style and the common suggestion heading. Align debug welcome and example placement with NL2Agent, remove excessive height-dependent padding, and apply the debug gradient to NL2Agent only. Keep transparent card defaults after reverting the experimental background. Validation: 27 focused frontend tests, one legacy debug component test, TypeScript checking, copyright checks and formal asset validation passed. Full browser debug verification remains blocked before the editor loads; retain the limitation in the change record. * fix(a2a): validate agent names and display discovery errors * fix(frontend): reorder NL2Agent optimization suggestions * fix: format model capacity tags with appropriate token units * fix(agent): expose advanced protocol control and existing setting hints * test: include A2A validation in service architecture manifest * feat(nl2agent): unify resource binding and knowledge recommendations * fix(nl2agent): move knowledge recommendations to canonical owner * test(nl2agent): register canonical knowledge recommendation module * 修复租户管理员本身会获取租户列表的问题 & 修复评估页面无法返回上级的问题 * 修复 A2A 发现超时及失败提示 * fix(nl2agent): align prompt example with unified agent prompt * fix(nl2agent): reuse backend name validation and clarify naming guidance * refactor: unify agent prompt and consolidate SQL migrations * test: assert rendered context semantics instead of legacy heading * fix(nl2agent): align name constraints with runtime validation * fix: move prompt migrations to v2.8.0 merged SQL * fix(a2a): make external agent SSL verification configurable * fix(nl2agent): clarify duplicate name retry in prompts * test(agent): repair configuration cases and current UI fixtures * Bugfix: optimize frontend
* fix(test-e2e): harden daily sync and lifecycle recovery tests Retain redacted Git synchronization receipts with bounded fetch retries and outside-checkout regression coverage. Repair the Config lifecycle case, accept explicitly verified forced-process recovery, and route ownership to system management. Remove retired API-059 assets and stale dispatch references while preserving historical records. * fix(test-e2e): repair case fixtures and recoverable deployment profiles * fix(test-e2e): align AIDP update errors and merged preparation binding
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v2.8.0
Merge develop into main for the v2.8.0 release: 118 commits, covering the Agent Workbench as the default entry, AIDP knowledge-base management, A2A agent collaboration, security audit logging, and the Ray-to-Celery data pipeline migration. SQL migrations consolidate into v2.8.0_merged_migrations.sql, and official skill bundles slim to 23.