mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-10-14 12:16:54 +00:00
e39e97ee1b31853c5b64d4daba2127c6f2e128c8
1158
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 viettranx
|
e39e97ee1b |
test(tasks,agent): cover TaskTicker and agent helpers
Add lifecycle and utility function tests: - tasks/task_ticker_test.go: TaskTicker lifecycle, recoverAll, followup - agent/pruning_test.go: resolvePruningSettings, findAssistantCutoff, takeHead/Tail - agent/extractive_memory_test.go: ExtractiveMemoryFallback, dedup - agent/intent_classify_test.go: quickClassify, containsWholeWord, ClassifyIntent - agent/loop_utils_test.go: uniquifyToolCallIDs, shouldShareKG, InvalidateUserWorkspace - agent/inject_and_misc_test.go: truncateForLog, processInjectedMessage, drainInjectChannel |
||
|
viettranx
|
0494721af2 |
test(gateway,http): add unit tests for server/methods/handlers
Add server and RPC handler tests: - gateway/ratelimit_test.go: rate limiter pure unit - gateway/event_filter_test.go: event routing logic - gateway/server_test.go: handleHealth, tokenAuth, checkOrigin, desktopCORS - gateway/methods/sessions_test.go: sessions RPC handlers - gateway/methods/skills_test.go: skills RPC handlers - gateway/methods/cron_test.go: cron RPC handlers - http/files_path_security_test.go: path traversal, workspace boundary, auth - http/auth_helpers_test.go: extractBearerToken, tokenMatch, extractUserID/AgentID |
||
|
viettranx
|
509286a8ad |
test(store/pg): deepen v3 integration tests — Wave 1
Add comprehensive integration tests for core v3 store APIs: - v3_session_store_ext_test.go: pagination, isolation, rich-list - v3_agent_store_ext_test.go: context files, profiles, overrides, types - v3_agent_links_store_test.go: delegation links CRUD - v3_cron_store_ext_test.go: cron CRUD, enable toggle, run log - v3_vault_store_ext_test.go: vault docs CRUD/search/links - v3_memory_store_ext_test.go: memory BM25 search/isolation |
||
|
viettranx
|
27c9415193 |
build(ci): add coverage ratchet gate with per-package floors
Add automated coverage floor validation: - scripts/check_coverage.go: parses coverage.out, compares to per-package thresholds, supports --update to lock current floors - scripts/coverage_thresholds.json: 61 packages, initial floors from Phase 1 - .github/workflows/ci.yaml: new 'Coverage ratchet gate' step in CI - internal/testutil/: test utilities (context builders, TestDB, doc.go) |
||
|
viettranx
|
eb2419beed | fix(tests): align sqlite smoke test vault AgentID pointer type | ||
|
viettranx
|
8ef11d0cbe |
feat(ui): vault document docType + metadata support
- Update vault.ts: add VaultDocument union type, metadata field in VaultLink - Update vault-graph-adapter.ts: map document nodes to green color node class - Update vault-detail-dialog.tsx: handle isBinary branch for download vs preview - Update vault-document-sidebar.tsx: filter by type with document type icon + label - Update vault-documents-table.tsx: render document type badge + path_basename column - Add i18n translations: type.document + type.document_desc across en/vi/zh |
||
|
viettranx
|
e62c027b7d |
feat(vault): task + delegation auto-linking in enrich worker
- Add enrich_auto_linking.go: deterministic auto-link logic for task/delegation contexts - Add team_task_siblings.go (PG + SQLite): find all tasks in same delegation for batch link - Update enrich_worker.go: call enrich_auto_linking Phase 2 hook + skip re-embed for binary - Update team_store.go: add TaskSiblings interface method + TeamStore binding - Add context_keys.go + test: define ContextDelegationIDKey + ContextTaskIDKey for propagation - Update vault_interceptor.go: extract + inject delegation ID from request - Update run_context.go: propagate DelegationID from request - Update loop_context.go: inject DelegationID from run context - Update teams_tasks.go: DeleteTask(s) → cleanup auto-links via vault_source_cleanup - Update teams_tasks_activity.go: DetachFileFromTask → cleanup related auto-links - Update vault_documents_enrichment.go: populate summary from media_summary - Update cmd/gateway.go: wire TeamStore to handler bootstrap |
||
|
viettranx
|
2644a08b2b |
feat(store): vault media linking schema migration + document support
- Add migration 000048: vault_documents.path_basename + vault_links.metadata (PG) - Update SQLite schema.sql: add path_basename, metadata columns + v15→v16 markers - Add schema.go backfill: loop-patch v15→v16 + basename extraction for existing docs - Update vault_documents store: SELECT/INSERT with path_basename (PG + SQLite) - Update vault_links store: SELECT/INSERT with metadata (PG + SQLite) - Add vault_source_cleanup: helper to purge orphaned sources + links by source ID - Add basename_helper.go + test: extract filename from path for DB sync - Update version.go: RequiredSchemaVersion → 48, SQLite SchemaVersion → 16 - Update vault_store.go: DeleteLinksBySource + BatchFindByDelegationIDs interface |
||
|
viettranx
|
5623f97961 |
feat(vault): extension whitelist + document docType + media summary
- Add extension_whitelist.go to deterministically skip binary .bin/.exe/.dll - Add media_summary.go: synthesize docType + generate short summary from vault fields - Update rescan.go: detect document type for PDF/office files + propagate docType - Update safe_walk.go test: .bin now filtered by whitelist, use .txt instead - Update rescan_test.go: add document docType coverage - Add link_types.go: define AUTO_LINK_TASK, AUTO_LINK_DELEGATION link types |
||
|
viettranx
|
4b27a337d1 |
test(router): pin stale raw-UUID entry eviction on Get
Pin that a pre-hardening fragmented entry written under the raw UUID cache key (tenantID:<uuidStr>) is still evicted by the TTL branch in Router.Get when a UUID-form caller arrives after TTL expiry. The test synthesizes the fragmented entry directly via a test-only map write, then asserts the subsequent Get evicts the raw-UUID entry, re-invokes the resolver once, and writes the canonical tenantID:agentKey entry — leaving no fragmented entries behind. |
||
|
viettranx
|
93099cc682 |
fix(http/agents): validate agent_key slug on update path
handleUpdate accepted any string in the agent_key allowlist field without running it through isValidSlug. A client could rename an agent to "weird:key", which would break router cache exact-segment invalidation (the cache splits on the last colon for invalidation matching). Add the slug check inline after the allowlist filter and return MsgInvalidSlug on failure. The slug regex already rejects colons, slashes, whitespace, and other characters that would confuse path rendering or cache key parsing — add a dedicated predicate test covering the full trap surface. |
||
|
viettranx
|
c7a93703ba |
test(ws): cover resolveAgentUUIDCached cache hit fast path
The existing tests exercise only the DB fallback path via errorAgentStore. Add a test that primes the router cache with a stub implementing both agent.Agent and agentUUIDProvider, then asserts the cache-aware helper returns the cached UUID without touching the store — the raison d'etre of the helper. Uses the same sentinel-error store so a broken fast path surfaces as a sentinel error rather than a silent pass. |
||
|
viettranx
|
de4f742b0e |
fix(store/pg): error-propagate parseUUID in kg dedup insert paths
insertDedupCandidate and ScanDuplicates both swallowed uuid.Parse errors before feeding entity IDs to the INSERT. Currently safe because all inputs originate from DB SELECT rows or caller-validated UUIDs, but aligning with parseUUID keeps write-path policy uniform: bad UUID → clean Go error + skip, not silent uuid.Nil write. |
||
|
viettranx
|
6c9cf321ad |
fix(store/pg): error-propagate parseUUID in kg EmbedEntity
The EmbedEntity helper ran UPDATE kg_entities SET embedding = $1 WHERE id = parseUUIDOrNil(entityID). A bad UUID would resolve to uuid.Nil and the UPDATE would silently match no rows. Today's only caller passes a freshly-minted UUID, but swapping to parseUUID with an explicit Warn log closes the latent trap and aligns with the hardening policy (writes must fail fast on bad input). |
||
|
viettranx
|
7799a9c88a |
fix(router): evict stale canonical entry on double-check TTL miss
Router.Get's canonical double-check branch trusted any existing entry under the canonical key without re-checking TTL. If an earlier agent_key caller wrote the entry and the TTL expired, a later UUID-form caller would resolve fresh, hit the canonical branch, find the stale entry, and return it — indefinitely — because the raw-UUID key was never the map key and the initial-miss eviction branch did nothing. Re-check TTL inside the double-check branch and evict+rewrite when stale. Regression test primes a canonical entry with cachedAt set 2×TTL in the past, then asserts a UUID-form Get re-invokes the resolver and the returned agent reflects the fresh resolver output. |
||
|
viettranx
|
6e86ba9a39 |
fix(agent): use agent_key in v3 workspace path resolver
The v3 workspace resolver block in injectContext was passing l.agentUUID.String() as ResolveParams.AgentID, but the resolver uses this value as a filesystem path segment. The v2 path in loop_pipeline_callbacks.go and the session_key anchor both use agent_key, so a UUID-based v3 path would produce a parallel filesystem for the same logical agent the moment any consumer reads the v3 workspace context. No active bug today because workspace.FromContext has zero consumers, but this closes the landmine before the v3 wiring lands. |
||
|
viettranx
|
c8ebe9a789 |
refactor(comments): remove plan/phase refs from agent identity hardening code
Rewrite inline comments added during the agent identity hardening so they explain the code as it stands today, rather than tying to internal plan terminology (phase numbers, FR/NFR/H/M/C codes, PR references, trap zone labels). Commit history already carries the plan archaeology. Comments now keep the non-obvious invariants (cache boundaries, bypass gaps, silent-nil traps, dual-tenant semantics) and drop the scaffolding. Comment-only — no runtime behavior change. |
||
|
viettranx
|
ca7f7b4f24 |
docs(code): add inline comments at agent identity trap zones
Clarify the agent_key vs UUID contract inline at the four highest-ROI trap zones: the Loop struct identity fields, DomainEvent identity fields, the parseUUID/parseUUIDOrNil store helpers, and the WS method resolver helpers. Each comment explains the invariant and links to docs/agent-identity-conventions.md so future readers can find the full rules without archaeology. Comments only — no runtime behavior change. |
||
|
viettranx
|
bf771a12f4 |
docs(agent-identity): add agent_key vs UUID convention doc
Distills the dual-identity rules from the agent identity hardening work into a single permanent reference. Covers all 5 trap zones with post- hardening status, batch fail-fast contract change, router cache canonicalization, FK safety net, telemetry type-layer defense, and dual-tenant agent_key semantics. Adds a CLAUDE.md pointer under Key Patterns so contributors find it via the standard onboarding path. |
||
|
viettranx
|
dd65fbcba0 |
test(integration): fix pre-existing bugs + post-Phase-4 contract update
Three fixes required to run the integration suite after Phase 4: 1. v3_vault_store_test.go makeVaultDoc: AgentID is *string (nullable), not string — was a pre-existing type error from v3 commit |
||
|
viettranx
|
d29c3dd943 |
refactor(store/pg): rename mustParseUUID to parseUUIDOrNil (honest name)
Final step of Phase 4: rename the silently-nil-on-error helper so its behavior is self-documenting at the call site. No behavior change — all remaining call sites (~24) were already classified as WARN-acceptable (read-only SELECT WHERE paths with validated inputs from cursor pagination or WS boundary) during sub-step 4b migration. The parseUUID error variant stays as-is for CRITICAL writes. Also cleans up a now-stale comment in vault_handler_upload.go. Phase 4 Step 4d of agent identity hardening (TD-1). |
||
|
viettranx
|
5ff29d051d |
refactor(store/pg): error-propagate parseUUID in vault_links
All 16 sites migrated. Covers BatchCreateLinks (2 sites in loop with fail-fast per Q7), CreateLink, DeleteLink, GetOutLinks, GetOutLinksBatch, GetBacklinks, DeleteDocLinks, DeleteDocLinksByType, DeleteDocLinksByTypes. BatchCreateLinks previously silently dropped bad UUIDs via loop-over- validated-docs; post-P4 the parse layer rejects the entire batch on first bad doc_id — a documented contract change per Q7. Phase 4 Step 4b.7 of agent identity hardening (TD-1). |
||
|
viettranx
|
2aa3ca31ae |
refactor(store/pg): error-propagate parseUUID in remaining kg + memory files
Five files, targeted CRITICAL-site migrations: - knowledge_graph_temporal.go: SupersedeEntity (line 71 — C1 from red-team, UPDATE + INSERT in transaction). ListEntitiesTemporal remains on mustParseUUID (WARN-acceptable SELECT WHERE). - memory_admin.go: ListAllDocuments, GetDocumentDetail, ListChunks (3 sites, all return errors). Adds fmt import. - memory_search.go: Search (1 site, agent_id resolves hybrid FTS+vector). - knowledge_graph_traversal.go: Traverse (2 sites — agent + startEntity). - vault_documents_enrichment.go: UpdateSummaryAndReembed (2 sites — tenant, doc). FindSimilarDocs was migrated earlier with optAgentUUID wrapper fix. Phase 4 Steps 4b.6, 4b.8, 4b.9, 4b.11, 4b.12 of agent identity hardening. Still pending: - vault_links.go (16 sites — next commit) - knowledge_graph_embedding.go line 124 (SAFE per scout — audit only) - agents_export_queries.go lines 312,354 (SAFE cursor per scout — audit only) |
||
|
viettranx
|
63dc84f7e8 |
refactor(store/pg): error-propagate parseUUID in knowledge_graph_dedup
All 8 sites migrated: - DedupAfterExtraction, ScanDuplicates (agent) - MergeEntities (agent, target, source — 3 sites in one transaction) - ListDedupCandidates (agent) - DismissCandidate (agent, candidate) Phase 4 Step 4b.5 of agent identity hardening (TD-1). |
||
|
viettranx
|
e6896d2673 |
refactor(store/pg): error-propagate parseUUID in knowledge_graph_relations
All 11 sites migrated (counted higher than scout's 7 CRITICAL because plan treats the file as a single commit unit): - UpsertRelation (agent, source, target — 3 sites in one INSERT) - DeleteRelation (agent, id) - ListRelations, ListAllRelations (agent + entity) - IngestExtraction (agent) - PruneByConfidence, Stats (agent) Phase 4 Step 4b.4 of agent identity hardening (TD-1). |
||
|
viettranx
|
47bdea8259 |
refactor(store/pg): error-propagate parseUUID in vault_documents
CRITICAL sites migrated in the following methods (9 total): - GetDocument, GetDocumentByID, GetDocumentsByIDs, GetDocumentByBasename - DeleteDocument, ListDocuments, CountDocuments, UpdateHash UpsertDocument and Search were migrated earlier as part of the optAgentUUID wrapper fix (commit 6f6b52fb). 4 sites remain in the private helpers appendTeamFilter and buildSearchTeamFilter — these are WARN-acceptable (team IDs from opts structs are already validated at WS boundary). They will rename to parseUUIDOrNil in sub-step 4d. Phase 4 Step 4b.1 of agent identity hardening (TD-1). |
||
|
viettranx
|
4ebd6698b0 |
refactor(store/pg): error-propagate parseUUID in knowledge_graph
5 CRITICAL sites migrated: UpsertEntity (INSERT), GetEntity (SELECT), DeleteEntity (DELETE), ListEntities (SELECT), SearchEntities (SELECT). All now return wrapped parse errors at the caller boundary instead of hitting FK violations (writes) or returning empty results (reads). Phase 4 Step 4b.3 of agent identity hardening (TD-1). |
||
|
viettranx
|
642603e14e |
refactor(store/pg): error-propagate parseUUID in memory_docs
5 CRITICAL sites migrated from mustParseUUID to parseUUID with wrapped errors: GetDocument, PutDocument, DeleteDocument, ListDocuments, IndexDocument. All handle bad agent_id input at the caller boundary instead of hitting FK violation (writes) or returning empty results (reads). Scout classified GetDocument as both CRITICAL and WARN — migrating all 5 is safer and consistent (M8 note). Phase 4 Step 4b.2 of agent identity hardening (TD-1). |
||
|
viettranx
|
32af80b28c |
refactor(store/pg): propagate error from optAgentUUID wrapper
optAgentUUID now returns (*uuid.UUID, error). All three known callers updated to check the error and wrap with context: 1. vault_documents.go UpsertDocument — also migrates tenant_id and team_id to parseUUID in the same hot path. 2. vault_documents.go Search — migrates tenant_id and agent_id. 3. vault_documents_enrichment.go FindSimilarDocs — migrates tenant_id, agent_id, and doc_id. Pre-Phase-4, the wrapper silently converted garbage agent_id strings to uuid.Nil, letting the downstream INSERT hit a FK violation with cryptic PG code 23503. Now bad input fails at the caller boundary with a clear Go error wrapping the raw value. Phase 4 Step 4e of agent identity hardening (TD-1). Covers sub-step 4b migrations for vault_documents.go and vault_documents_enrichment.go as a side effect. |
||
|
viettranx
|
9a8eb396b0 |
refactor(store/pg): add parseUUID error variant
Two new helpers alongside existing mustParseUUID: - parseUUID(s) (uuid.UUID, error) — use for INSERT/UPDATE/UPSERT/DELETE and SELECT-WHERE paths where silent nil hides bugs. Returns a wrapped error that includes the raw value (for debuggability) and the underlying uuid parse error (for errors.Is unwrap). - parseUUIDOrNil(s) uuid.UUID — intentionally silent, for read-only SELECT-WHERE paths where empty result is acceptable. mustParseUUID is kept as a transitional alias delegating to parseUUIDOrNil so existing call sites compile unchanged. Sub-step 4d will rename it. Phase 4 Step 4a of agent identity hardening (TD-1). |
||
|
viettranx
|
6bbe1b66ff |
refactor(ws/teams): accept agent_key or UUID + fix handleAddMember error leak
Two teams handlers migrated to resolveAgentUUIDCached: - handleRemoveMember (params.AgentID) accepts agent_key or UUID. - handleTaskAssign (params.AgentID) accepts agent_key or UUID. handleAddMember already used resolveAgentInfo, but leaked raw store errors via "agent: " + err.Error() on resolution failure. H10 fix replaces the leak with i18n.MsgInvalidID — no more store schema info surfacing to WS clients. Phase 3 of agent identity hardening. |
||
|
viettranx
|
ef730ac84a |
refactor(ws/channels): accept agent_key or UUID (adds agentStore to struct)
NFR-2 exception (Phase 3 C2): ChannelInstancesMethods struct gains an agentStore field, required to support agent_key input via the cache-aware resolver. Constructor signature expanded and single caller at cmd/gateway_channels_setup.go:146 updated. Router is passed nil — channel_instances methods are not wired to the router today, so falls back to pure DB lookup. Acceptable given create is a rare operation. Preserves the existing i18n key MsgInvalidID. Phase 3 of agent identity hardening. |
||
|
viettranx
|
21a9076298 |
refactor(ws/config): accept agent_key or UUID for permission handlers
All 3 handlers (handleList, handleGrant, handleRevoke) now accept either a UUID or an agent_key for params.agentId via resolveAgentUUIDCached. Adds ConfigPermissionsMethods.SetAgentRouter setter wired from cmd/gateway_methods.go (already staged in previous commit). Phase 3 of agent identity hardening. |
||
|
viettranx
|
84babc1c3c |
refactor(ws/heartbeat): accept agent_key or UUID via cache-aware resolver
All 7 heartbeat handlers (get/set/toggle/test/logs/checklistGet/checklistSet) now accept either a UUID or an agent_key for params.agentId. Behavior additive — existing UUID-only clients keep working. Adds HeartbeatMethods.SetAgentRouter setter wired from cmd/gateway_methods.go so the fast path avoids a DB roundtrip for cached agents. Preserves the literal "invalid agentId" error string (no i18n key change). Phase 3 of agent identity hardening. |
||
|
viettranx
|
6c17aad8d7 |
feat(gateway/methods): add cache-aware resolveAgentUUIDCached helper
Three-part addition so WS handlers can accept agent_key input without a DB roundtrip on every request: 1. Router.GetCached — lock-free TTL cache read, no resolver fallback. 2. Loop.UUID() — canonical UUID accessor (agent_key stays on ID()). 3. resolveAgentUUIDCached — fast-path checks router cache via an agentUUIDProvider interface, falls back to resolveAgentUUID on miss or when input is a UUID string (un-cached post-canonicalization). Helper delegates to pure DB lookup when router is nil, so handlers with no router dependency still work. Tests cover nil-router, cache-miss, and UUID-input paths — cache-hit coverage is exercised via downstream handler integration tests. Phase 3 foundation (TD-2). |
||
|
viettranx
|
82dc4d3b94 |
chore(agents): remove dead UUID invalidation in agents_update
Post-Phase-2 canonicalization, router cache entries are always keyed as tenantID:agent_key. The belt-and-suspenders m.agents.InvalidateAgent(ag.ID.String()) call never matched any entry — exact-segment match on the final ":"- delimited segment cannot match a UUID as the agentKey. Removes the dead call and the misleading comment that justified it. Phase 2 follow-up (H7). |
||
|
viettranx
|
c599387248 |
fix(router): canonicalize cache key, exact-segment match, tenant-aware IsRunning
Three related fixes to agent router identity handling: 1. Canonicalize on resolve — Router.Get now stores entries under the canonical tenantID:agent_key after a successful resolver call, regardless of whether the caller passed a UUID or agent_key. Prevents fragmentation where the same logical agent would occupy two cache slots. Callers that pass the UUID form are now un-cached and resolve on every call; all production callers pass agent_key today. 2. Exact-segment match — matchAgentCacheKey helper replaces HasSuffix in Router.Remove and Router.InvalidateAgent. Prevents substring collisions like "tenantX:sub-foo" being wiped when invalidating "foo". Rejects empty agentKey to guard against wildcard wipes. 3. Tenant-scoped IsRunning (C6) — Router.IsRunning now accepts ctx and uses agentCacheKey for lookup. Pre-fix, the bare r.agents[agentID] lookup always returned false in tenant-scoped deployments, causing agents.list to report every live agent as idle. Updates the sole caller at gateway/methods/agents.go:134. Phase 2 of agent identity hardening (TD-3). |
||
|
viettranx
|
d848286b4b |
fix(vault): validate agent_id/team_id form params at HTTP boundary
validateTeamMembership short-circuits on owner role and nil teamAccess (lite edition), leaving downstream mustParseUUID calls as a silent-nil trap. Validate UUIDs at the HTTP boundary — before workspace resolution, store upsert, or event publish — so bad form input is rejected for every caller regardless of role or edition. Closes the owner/lite gap identified in red-team H9. Phase 1 Fix B of agent identity hardening. |
||
|
viettranx
|
89862981e6 |
fix(agent): set AgentUUID in memoryflush SystemPromptConfig
memoryflush.go constructed SystemPromptConfig without AgentUUID, while loop_history.go set both AgentID (agent_key) and AgentUUID. buildRuntimeSection renders below the cache boundary so the omission did not bust the prompt cache — but the runtime identity line dropped the UUID during compaction flush turns. Extract a pure helper buildMemoryFlushPromptConfig so tests can assert the config shape without a full Loop fixture (M7 mitigation from red-team review). Phase 1 Fix A of agent identity hardening. |
||
|
viettranx
|
de2bc201fa |
fix(eventbus): add non-UUID AgentID publish-time guard
Publish-time observer warns (does not block) when DomainEvent.AgentID is non-empty and fails uuid.Parse. Distinct log field `non_uuid_agent_id` avoids colliding with existing telemetry that parses `agent_id` as UUID. Safety net for PR #826-class regressions. Validator lives in bus.Publish so all call sites are covered without per-publisher instrumentation. Phase 1 Fix C of agent identity hardening. |
||
|
Duc Nguyen
|
52f48e5ea6 |
fix(backup): detect pg server major for version-aware pg_dump hints (#829) (#830)
* fix(backup): detect pg server major for version-aware pg_dump hints pg_dump aborts when its major version is older than the server's, so backup preflight now runs SHOW server_version_num against the live PG server and uses the detected major to drive: - the missing-pg_dump hint (names the exact postgresqlNN-client) - a new compat check that flags an installed-but-too-old pg_dump as not-ready, instead of letting backup fail partway through the dump Adds ParsePgDumpMajor helper for Debian/Homebrew/EDB output shapes, covered by table-driven unit tests. Normalizes nil ctx once at RunPreflight boundary so downstream exec.CommandContext calls are safe. Stubs detectPGServerMajor + checkPgDumpServerCompat for the sqliteonly build. UI: removes the duplicate static hint from the preflight alert box so the dynamic, actionable warning is the single source of truth. Drops the obsolete pgDumpHint i18n key from en/vi/zh locale files. Refs #829 * fix(docker): bump runtime base alpine 3.22 → 3.23 Alpine 3.23 main ships postgresql16-client, postgresql17-client, and postgresql18-client simultaneously. Alpine 3.22 only shipped up to postgresql17-client, so the backup preflight's dynamic hint to install postgresql18-client previously failed with "no such package" on PG 18 deployments. No client package is pre-bundled: the on-demand install via the Packages page now resolves for any supported PG major. Refs #829 |
||
|
Viet Tran
|
17965bcfcb | Update copyright holder | ||
|
viettranx
|
6dd53b9892 |
fix(deps): bump vite 8.0.3 → 8.0.8 to patch 3 CVEs
- CVE-2026-39363 (High): arbitrary file read via dev server WebSocket - CVE-2026-39364 (High): server.fs.deny bypass with query strings - CVE-2026-39365 (Medium): path traversal in optimized deps .map handling Dev-scope only. Updates both ui/web and ui/desktop/frontend lockfiles. |
||
|
viettranx
|
9e8478d792 | Merge remote-tracking branch 'origin/main' into dev | ||
|
+3
|
cc330b66ad |
feat: release v3.3.0 — v3 core redesign, vault improvements, channels, UI polish (#827)
* fix(ci): skip CI condition in semantic-release for main branch
go-semantic-release auto-detects the default branch from GitHub API
(which is dev), but releases are cut from main. The CI condition
rejects runs on non-default branches. Use --no-ci to bypass this
check since the workflow already gates on push to main.
* docs: document CI/CD pipelines, release flow, and v2.66.0 changelog
- CLAUDE.md: add CI/CD & Releases section with workflow table, tag
patterns, Docker variants, beta/desktop release commands
- CONTRIBUTING.md: expand Releases section with standard (auto),
beta (manual tag), and desktop release workflows
- docs/17-changelog.md: add v2.66.0 entry covering IDOR fix, BytePlus
provider, per-agent grants, beta pipeline, and CI fixes
* fix(telegram): handle group-to-supergroup migration seamlessly
When a Telegram group upgrades to a supergroup, the chat ID changes and
all existing references become stale. This caused send failures (400),
orphaned sessions, and required manual re-pairing.
Add dual-path migration handling:
- Proactive: intercept inbound MigrateToChatID before isServiceMessage
- Reactive: detect 400 + MigrateToChatID on send, migrate DB, retry
DB migration updates in a single transaction (scoped by tenant + channel):
- paired_devices: sender_id, chat_id
- sessions: session_key, user_id
- channel_contacts: sender_id
- channel_pending_messages: history_key
Also invalidates in-memory caches (approvedGroups, pairingReplySent,
groupHistory) and handles media sends via migration retry in Send().
* fix(tools): quote-aware shell operator detection in credentialed exec (#700) (#702)
* fix(tools): quote-aware shell operator detection in credentialed exec (#700)
- Replace detectShellOperators with detectUnquotedShellOperators in
credentialed exec path — respects single/double quoting so that
characters like | inside argument values (e.g. --jq '.[0] | .name')
are not falsely flagged as shell operators
- Pass raw command string (preserving quotes) to executeCredentialed
instead of reconstructing from parsed args
- Downgrade "no credential found" log from Warn to Debug (fires for
every non-credentialed command, too noisy at Warn)
- Add extractUnquotedSegments() helper with comprehensive tests
* fix(tools): handle backslash escape outside quotes in shell operator detection
extractUnquotedSegments did not handle \ as an escape character outside
of quotes, causing \" to incorrectly enter double-quote mode. This hid
subsequent shell operators from detection (e.g. gh \"arg\" | env would
not detect the unquoted pipe).
Add backslash escape handling in the unquoted state to match
go-shellwords parsing behavior. Both \ and the escaped character are
emitted as unquoted content so operator detection still catches them.
---------
Co-authored-by: viettranx <viettranx@gmail.com>
* feat(infra): tracing recovery, browser cleanup, CLI fixes, UI workspace split (#709)
- Tracing: recover stale running traces/spans on startup (PG + SQLite)
- Browser: Chrome orphan cleanup via launcher PID, timeouts, Leakless
- Claude CLI: WaitDelay 5s + context-cancel early exit
- Agent loop: safety-net defer to finalize orphan root traces
- UI: split workspace sharing into separate Memory and KG toggles
- Minor: for-range idiom, min() builtin
* fix(prompt): skip credentialed CLI context when exec tool is denied
Agents with exec in their deny list cannot run CLI commands, so
injecting wrangler/gh credential context is misleading — the LLM
sees instructions for tools it cannot use. Gate the section on
exec being present in the filtered tool list.
* fix(ui): improve traces table layout and readability
Compact columns: status as icon-only, merge time+duration into one column.
Truncate long user IDs, clean <media:*> tags from preview, move badges to second line.
* fix(security): harden exec path exemption matching
- Add absolute path exemption for dataDir/skills-store/ (fixes skill
scripts using absolute paths like /app/data/skills-store/ being denied)
- Strip surrounding quotes before prefix matching (LLMs often quote paths)
- Reject path traversal ("..") in exempt fields to prevent escape
- Switch from "any field exempt → skip" to per-field matching: only exempt
if ALL fields that match the deny pattern are individually exempt
- Closes pipe/comment bypass vectors where an exempt path in one argument
would exempt the entire command including non-exempt paths
Includes 27 test cases covering: legitimate access, quoted paths,
path traversal, unicode bypass, pipe/comment bypass, mixed args.
* feat(whatsapp): add native WhatsApp channel with whatsmeow (#720)
Replace Node.js Baileys bridge with native go.mau.fi/whatsmeow — zero
external dependencies. QR auth, media support, markdown formatting,
typing indicators, dual JID/LID identity, group policies, pairing.
Resolves #703
* fix(chat): load message history on first conversation click (#730)
* fix(chat): load message history when selecting existing conversation from clean state
The skipNextHistoryRef was unconditionally set when sessionKey transitioned
from empty to non-empty. This prevented loadHistory() from running when
clicking an existing conversation from the initial /chat page. The skip
was only intended for the new-chat send flow where the optimistic message
is already displayed.
Guard the skip with expectingRunRef so it only activates when a message
send is in flight.
Closes #729
* docs: add UI diff evidence for PR #730
Before/after screenshots and HTML comparison report showing
first conversation click behavior fix.
* fix(permissions): use cron-specific permission check for cron tool (#725)
* fix(security): harden exec path exemption matching (#721)
- Add absolute path exemption for dataDir/skills-store/ (fixes skill
scripts using absolute paths like /app/data/skills-store/ being denied)
- Strip surrounding quotes before prefix matching (LLMs often quote paths)
- Reject path traversal ("..") in exempt fields to prevent escape
- Switch from "any field exempt → skip" to per-field matching: only exempt
if ALL fields that match the deny pattern are individually exempt
- Closes pipe/comment bypass vectors where an exempt path in one argument
would exempt the entire command including non-exempt paths
Includes 27 test cases covering: legitimate access, quoted paths,
path traversal, unicode bypass, pipe/comment bypass, mixed args.
* fix(permissions): use cron-specific permission check for cron tool
Cron tool was hardcoded to check `file_writer` configType via
CheckFileWriterPermission(), ignoring the `cron` configType that
the UI actually saves when granting cron permissions. This caused
agents in group chats to be denied cron access even with correct
permission configured.
Add ConfigTypeCron constant and CheckCronPermission() that checks
`cron` configType first, falling back to `file_writer`.
---------
Co-authored-by: Viet Tran <viettranx@gmail.com>
* fix(exec): allow uploaded files in active workspaces (#748)
Shell-aware command parsing, dynamic workspace exemptions, and symlink canonicalization for exec path denial. Fixes #739.
* refactor(exec): extract path exemption logic to separate file
Move shell-aware parsing, dynamic workspace exemptions, path alias
variants, and canonicalization functions from shell.go (688 LOC) to
shell_path_exemption.go (284 LOC) for maintainability.
* feat(agent): centralized tenant user identity resolution for credentials
Add CredentialUserID context key that resolves channel contacts to merged
tenant users for credential lookups (SecureCLI, MCP). Keeps UserID
unchanged for session/workspace scoping. Resolves group senders, group
contacts, and unresolved DMs via ContactStore with 60s TTL cache.
* fix(ui): improve traces table column layout
Add width constraints and whitespace-nowrap to prevent column wrapping
on narrow viewports. Cherry-picked from dev-v3.
* fix(ui): enable search filtering on knowledge graph view (#758)
Search box on /knowledge-graph only filtered table view. Add useMemo client-side filtering of graph entities by name/type/description, only show relations where both endpoints match.
Closes #759
* feat: add zoom controls to knowledge graph (#757)
Add +/- buttons and percentage display to the knowledge graph stats bar
so users can zoom without relying solely on mouse wheel. Uses existing
react-force-graph-2D zoom() API with 1.5x step and 300ms animation.
Closes #755
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(providers): use DB name for ClaudeCLI, ACP, and Anthropic registration
Provider Name() methods returned hardcoded strings, so DB-registered
providers with custom names got wrong registry key — causing "provider
not found" fallback. Add WithClaudeCLIName/WithACPName/WithAnthropicName
options, pass p.Name from DB registration paths. Config-based paths
keep hardcoded defaults.
Closes #742
* fix(agent): correct soft-trim head/tail budget allocation when tail is important (#723)
Co-authored-by: quxy5 <quxy5@outlook.com>
* feat(v3): core architecture redesign — pipeline, memory, vault, evolution, providers, orchestration (#790)
* feat(v3): add core interface contracts and migration for v3 redesign
Foundation interfaces: TokenCounter, WorkspaceContext, DomainEventBus,
ProviderAdapter/Capabilities. Pipeline: Stage, RunState, MessageBuffer,
substates, Pipeline orchestrator. Memory: EpisodicStore, AutoInjector,
KG temporal extensions, consolidation workers. System integration:
PromptConfig, ToolCapability, Retriever. Orchestration: OrchestrationMode,
EvolutionMetrics/SuggestionStore. Migration 000037: episodic_summaries,
evolution tables, KG temporal columns. Schema version 36→37.
* refactor(plans): mark all v3 design phases complete with file references
* fix(v3): address code review findings on design contracts
- C1: add missing l0_abstract column to episodic_summaries migration
- C2: align EpisodicSummary ID/TenantID/AgentID to uuid.UUID
- H1: document tenant_id scoping requirement on EpisodicStore
- H2: add UNIQUE constraint on (agent_id, user_id, source_id) for dedup
- H4: clarify ProviderAdapter vs Provider relationship in doc
- M3: set state.ExitCode on BreakLoop/AbortRun in pipeline
- M6: store full PipelineConfig in Pipeline struct
- Edge: add WHERE embedding IS NOT NULL on HNSW index
* fix(v3): second-pass review fixes
- H1: use context.WithoutCancel for finalize + set ExitCode on ctx cancel
- H2: use utf8.RuneCountInString consistently in FallbackCounter
- H3: longest-prefix-match in ModelContextWindow (prevents wrong tokenizer)
- H4: return unsubscribe cleanup func from consolidation.Register
* feat(v3): implement DomainEventBus with worker pool, dedup, and retry
Worker pool processes events from buffered channel. SourceID-based dedup
prevents duplicate processing. Exponential backoff retry on handler error.
Panic recovery per handler. Graceful shutdown via Drain(). 8/8 tests pass
with race detector.
* feat(v3): implement ProviderAdapter for Anthropic, OpenAI, DashScope, Codex
Add CapabilitiesAware to all 6 providers. Create ProviderAdapter
implementations that delegate to existing buildRequestBody/parseResponse
for DRY. ClaudeCLI and ACP get capabilities only (subprocess transport).
DashScope wraps OpenAI adapter with StreamWithTools=false override.
* feat(v3): implement WorkspaceContext Resolver for 6 scenarios
Stateless resolver produces immutable WorkspaceContext at run start.
Handles personal/group/predefined/team-shared/team-isolated/delegation.
Wired into loop_context.go behind v3PipelineEnabled flag (additive,
v2 path unchanged). Includes delegation path boundary check,
master tenant bypass, and tenant slug path composition.
* feat(v3): implement tiktoken TokenCounter with BPE encoding + cache
Adds tiktoken-go for accurate cl100k_base/o200k_base token counting.
Per-message FNV-1a hash cache avoids re-encoding unchanged history.
Falls back to rune/3 heuristic for unknown models. NewTokenCounter
factory selects implementation at build time.
* feat(v3): promote 12 other_config JSONB fields to dedicated agent columns
Extract emoji, agent_description, thinking_level, max_tokens,
self_evolve, skill_evolve, skill_nudge_interval, reasoning_config,
workspace_sharing, chatgpt_oauth_routing, shell_deny_groups, and
kg_dedup_config from the catch-all other_config JSONB into proper
columns with DB-level types and defaults.
- Migration: PG (000037) + SQLite (schema v6→7) with backfill
- Go: AgentData struct + simplified Parse* methods
- Store: SELECT/INSERT/scan updated for both PG and SQLite
- Gateway: create/update handlers accept promoted fields
- HTTP: export/import with legacy backward compat
- Web UI: all 15 frontend files read/write from top level
* feat(v3): implement Knowledge Vault with unified search, wikilinks, and FS sync
Migration 000038 adds vault_documents (FTS+pgvector), vault_links, vault_versions
tables. VaultStore interface with PG implementation for document CRUD, hybrid
FTS+vector search, and bidirectional link management. All queries enforce
tenant_id isolation including JOIN-based scoping on link operations.
FS sync layer: SHA-256 content hashing, VaultInterceptor hooks into write_file/
read_file for auto-registration and lazy sync, fsnotify watcher with 500ms
debounce. Wikilink engine parses [[target]] syntax, resolves targets via
3-step strategy, and maintains vault_links on write.
VaultSearchService fans out queries across vault, episodic, and KG stores in
parallel with per-source score normalization and weighted merge. AutoInjector
and Retriever implementations for pipeline integration.
Three agent tools: vault_search (unified discovery), vault_link (explicit
linking), vault_backlinks (dependency tracing). Feature-flagged via
v3_vault_enabled agent setting.
* feat(v3): wire vault into gateway startup + add unit tests
Wire VaultStore embedding provider, VaultSearchService, VaultInterceptor
on read/write tools, and register vault_search/vault_link/vault_backlinks
tools in gateway_vault_wiring.go. All wiring gated by stores.Vault != nil.
Add 28 unit tests for ContentHash, ContentHashFile, and ExtractWikilinks
covering edge cases, unicode, display text, context windows, and offsets.
* feat(v3): implement stage-based pipeline loop with 8 pluggable stages
Decompose monolithic agent loop into internal/pipeline/ package:
- 6 stages: Context, Think, Prune+MemoryFlush, Tool, Observe+Checkpoint, Finalize
- Foundation types: Stage interface, RunState with 7 typed substates, MessageBuffer
- Pipeline orchestrator with setup/iteration/finalize 3-phase execution
- Callback-based PipelineDeps avoids circular import with agent package
- Feature-flagged via v3PipelineEnabled in Loop.Run()
- All 7 exit conditions preserved (no tools, max iter, truncation, loop kill,
read-only streak, tool budget, ctx cancel)
* feat(v3): wire pipeline callbacks to Loop methods + add 71 unit tests
Wire 15 of 17 PipelineDeps callbacks from Loop methods via closures:
- Context: LoadContextFiles, BuildMessages, EnrichMedia, InjectReminders
- Think: BuildFilteredTools, CallLLM (stream/sync)
- Prune: PruneMessages, CompactMessages
- Memory: RunMemoryFlush
- Finalize: SanitizeContent, FlushMessages, UpdateMetadata, BootstrapCleanup, MaybeSummarize
- Remaining: ExecuteToolCall, CheckReadOnly (deep loop.go integration)
Add comprehensive test suite (71 tests, all passing with -race):
- MessageBuffer: 10 tests (append, flush, replace, counts)
- Pipeline.Run: 14 tests (3-phase flow, exit conditions, ctx cancel)
- Stage tests: 47 tests (ThinkStage nudges/truncation, PruneStage budget,
ToolStage parallel/exit, ObserveStage content, CheckpointStage interval,
FinalizeStage cleanup)
* feat(v3): wire remaining 2 callbacks (ExecuteToolCall, CheckReadOnly)
Complete callback wiring — 17/17 PipelineDeps callbacks now active:
- ExecuteToolCall: resolves tool name, executes via registry, processes
result via existing processToolResult with loop detection bridge
- CheckReadOnly: delegates to checkReadOnlyStreak via bridge runState
- Bridge runState shares loop detection state between pipeline and agent
* fix(v3): eliminate data race in tool execution + capture injected messages
- Remove parallel tool execution path — serialize all tool calls to avoid
data races on shared bridgeRS (loop detector, media results, deliverables)
- Loop kill checked after each tool (mid-batch early exit)
- BuildFilteredTools: capture and append injected tool-awareness messages
- Rename test to reflect sequential execution
* feat(v3): wire ResolveWorkspace, safe parallel tools, ContextStage tests
- Wire ResolveWorkspace callback via workspace.NewResolver() with
ResolveParams from Loop fields (no longer a nil stub)
- Re-add safe parallel tool execution: split into ExecuteToolRaw
(parallel I/O) + ProcessToolResult (sequential state mutation)
with opaque rawData pass-through (no double execution)
- Add 12 unit tests for ContextStage (8) + MemoryFlushStage (3)
- Split tool callbacks to loop_pipeline_tool_callbacks.go (under 200 lines)
- Capture buildFilteredTools injected messages
* feat(v3): add episodic memory store + temporal KG columns
Phase 1 — Episodic Store:
- Migration 000039: episodic_summaries table with pgvector, FTS, L0 abstracts
- EpisodicStore PG impl: CRUD, hybrid FTS+vector search, ExistsBySourceID,
PruneExpired. Idempotent via source_id UNIQUE constraint.
Phase 2 — Temporal KG:
- Migration 000040: valid_from/valid_until on kg_entities + kg_relations,
partial indexes for current-facts queries, epoch→timestamptz backfill
- ListEntitiesTemporal: current-only, point-in-time, or include-expired modes
- SupersedeEntity: atomic expire-old + insert-new in single transaction
Schema version bumped to 40.
* fix(v3): review fixes for episodic store + temporal KG
- C1: Fix column name mismatch turn_count vs message_count in Go SQL
- C2: Remove redundant migration 000040 (000037 already adds temporal KG columns)
- H1: Use time.Time not int64 for TIMESTAMPTZ columns in SupersedeEntity
- H2: Add tenant_id scoping to Get/Delete for tenant isolation
- M2: Fix scanEntityTemporal to convert TIMESTAMPTZ→UnixMilli correctly
- L1: Remove unused uuid import from episodic_search.go
- Schema version corrected to 39 (only 000039 is new)
* feat(v3): implement consolidation pipeline with 3 event-driven workers
Event chain: session.completed → EpisodicWorker → episodic.created →
SemanticWorker → entity.upserted → DedupWorker
- EpisodicWorker: reuses compaction summary or calls LLM, generates L0
abstract (extractive), idempotent via source_id check
- SemanticWorker: extracts KG facts from episodic summary via existing
Extractor, sets temporal valid_from, publishes entity.upserted
- DedupWorker: runs DedupAfterExtraction on new entity IDs (terminal)
- L0 abstract: sentence-based extraction (~50 tokens), no LLM needed
- All workers registered via DomainEventBus.Subscribe()
* feat(v3): implement progressive loading with L0 auto-inject + unified search
- AutoInjector: searches episodic store, builds L0 prompt section (~200 tokens),
skips trivial messages via stopword filter
- L1Cache: in-memory LRU (500 entries, 1h TTL) for structured overviews
- UnifiedSearch: cross-tier search merging episodic + document results by score
- ContextStage integration: AutoInject callback appends memory section to system prompt
- MemorySection field added to ContextState for observability
* feat(v3): add memory_expand tool for L2 episodic retrieval
New tool: memory_expand(id) returns full episodic summary with metadata.
Complements memory_search L0/L1 results with deep L2 access.
Nil-safe: returns error message when episodic store not available.
Gateway wiring + memory_search depth param + kg_search temporal param
deferred to runtime integration phase.
* feat(v3): complete Phase 5 — tool extensions + gateway wiring
- memory_search: add depth param + episodic tier search merged with docs
- kg_search: add as_of temporal param, use ListEntitiesTemporal
- memory_expand: registered in gateway startup
- Gateway: Episodic field in Stores, PGEpisodicStore in factory,
embedding provider wired, tools connected to episodic store
* fix(v3): Phase 3 review fixes — tenant isolation + AutoInject args
- C1: Add tenant_id filter to ftsSearch, vectorSearch, List queries
(prevents cross-tenant episodic memory leaks)
- C2: Fix AutoInject callback signature — agent/tenant captured by
closure, only userMessage + userID passed explicitly
- H1: Add tenant_id to List query
* feat(v3): wire per-agent v3 flags from DB into dual-mode gate
Parse v3_pipeline_enabled, v3_memory_enabled, v3_retrieval_enabled from
agent other_config JSONB via ParseV3Flags(). Resolver now sets all flags
on LoopConfig so the existing gate in loop_run.go reads from DB.
- V3Flags struct + ParseV3Flags() + ValidateV3Flags() in store layer
- v3MemoryEnabled/v3RetrievalEnabled added to Loop, LoopConfig, PipelineConfig
- Auto-inject gated on V3RetrievalEnabled (was unconditional)
- Structured perf logging for v3 pipeline runs
- v3 flag validation on both WS agent.update and HTTP PUT endpoints
* feat(v3): wire AutoInjector into pipeline for L0 memory auto-inject
Create AutoInjector at gateway startup from episodic store, pass through
ResolverDeps → LoopConfig → Loop. Pipeline adapter builds AutoInject
callback capturing agent/tenant context via closure.
ContextStage already gates on V3RetrievalEnabled + AutoInject != nil.
* feat(v3): add tool metadata map + capability-based deny rules
Registry gains per-tool ToolMetadata map with RegisterWithMetadata()
and GetMetadata() (infers defaults from tool name when not explicit).
PolicyEngine gains DenyCapability() for RBAC integration — tools with
denied capabilities filtered at step 8 after existing 7-step pipeline.
* fix(v3): add RWMutex to PolicyEngine capability deny fields
DenyCapability() and SetRegistry() now guarded by sync.RWMutex.
FilterTools reads snapshot under RLock. Prevents data race when
capability rules are modified concurrently with tool filtering.
* feat(v3): implement delegate tool for inter-agent task delegation
New `delegate` tool wraps existing agent_links infrastructure
(CanDelegate, DelegateTargets). Supports async (fire-and-forget)
and sync (block with timeout) modes. Permission checked via
AgentLinkStore. Events emitted: delegate.sent/completed/failed.
DelegateRunFunc injected by gateway to avoid circular dependency.
* feat(v3): complete 3 deferred implementations
1. OrchestrationMode resolution: ResolveOrchestrationMode() checks
team membership → delegate links → spawn (priority order).
2. PG EvolutionMetricsStore: RecordMetric, QueryMetrics, aggregate
tool/retrieval metrics, TTL cleanup. All queries tenant-scoped.
3. BridgePromptBuilder: implements PromptBuilder interface by
delegating to existing BuildSystemPrompt(). Appends v3 memory
L0 section when enabled. Ready for template engine swap later.
* fix(v3): address code review findings on commits 5-6
- C1: CanDelegate now tenant-scoped (fail-closed on missing tenant)
- H1: Sync delegate timeout capped at 600s
- H2: Async goroutine gets 10min deadline (prevents leaks)
- H3: JSONB casts use COALESCE/NULLIF guards (handles missing fields)
- M1/M2: Remove dead code (formatVaultSection, memoryL0ToStrings)
* fix(teams): stop auto-creating agent_links for team members
Teams use agent_team_members table directly — agent_links caused
context confusion between team dispatch and delegation systems.
- Remove autoCreateTeamLinks() calls from team create + member add
- Remove link cleanup from member remove
- Remove dead autoCreateTeamLinks() function
- Append DELETE to migration 000039: clear team-created agent_links
* fix(v3): tenant isolation for all agent_links queries + PromptBuilder Instructions
- DelegateTargets, GetLinkBetween, SearchDelegateTargets,
SearchDelegateTargetsByEmbedding, DeleteTeamLinksForAgent all now
scoped by tenant_id (fail-closed on missing tenant)
- BridgePromptBuilder now maps Instructions/InstructionContent to
AGENTS.md context file (was silently dropped)
* feat(v3): wire orchestration mode + evolution metrics into agent loop
- Orchestration mode: resolver resolves mode from team/links, tool filter
hides delegate/team_tasks based on mode, prompt builder injects delegation
targets section
- Evolution metrics: non-blocking goroutine records tool execution metrics
(name, success, duration) via EvolutionMetricsStore in both v2 loop and
v3 pipeline paths (sequential + parallel)
- Fix review findings: tenant ID propagated via store.WithTenantID in
background goroutine, 5s timeout prevents goroutine leak
* feat(v3): implement suggestion engine with pluggable analysis rules
- PG EvolutionSuggestionStore: CRUD for agent_evolution_suggestions table
- SuggestionEngine: aggregates 7-day metrics, runs rules, deduplicates
pending suggestions per type before creating new ones
- 3 initial rules: LowRetrievalUsage (usage_rate<0.2), ToolFailure
(success_rate<0.1), RepeatedTool (>100 calls/week → suggest skill)
- EventSuggestionCreated event type added to eventbus
- Cron wiring deferred to gateway startup integration pass
* feat(v3): implement auto-adapt guardrails with apply/rollback
- AdaptationGuardrails: max delta per cycle, min data points, locked
params, rollback-on-drop percentage
- ApplySuggestion: applies threshold suggestions to agent other_config
JSONB, stores baseline for rollback
- RollbackSuggestion: restores baseline values from suggestion params
- EvaluateApplied: compares post-apply metrics to baseline, auto-rolls
back when quality drops beyond threshold
- Scope limited to retrieval params only (never security settings)
* feat(v3): wire evolution stores + daily/weekly cron for suggestions
- Add EvolutionMetrics + EvolutionSuggestions to Stores struct + PG factory
- Wire EvolutionMetricsStore into ResolverDeps (cmd/gateway_managed.go)
- Add gateway_evolution_cron.go: daily suggestion analysis + weekly
evaluation/rollback for applied suggestions
- Cron runs as background goroutine with 5-min timeout per cycle
* fix(v3): address code review findings on evolution engine
- C1: persist baseline parameters before marking suggestion as applied
(was building map but never saving — rollback would always fail)
- H1: add tenant_id isolation to UpdateSuggestionStatus, GetSuggestion,
and new UpdateSuggestionParameters method
* test(v3): add unit tests for orchestration, suggestions, guardrails, prompt
- orchestration_mode_test: orchModeDenyTools (4 modes) + ResolveOrchestrationMode
(4 scenarios with mock stores)
- suggestion_rules_test: LowRetrievalUsage, ToolFailure, RepeatedTool with
threshold boundary tests (at/below/above min data points)
- evolution_guardrails_test: DefaultGuardrails values + CheckGuardrails
(insufficient data, locked params, zero-min fallback)
- prompt_builder_orchestration_test: BridgePromptBuilder orchestration section
presence/absence across 4 scenarios + target content verification
* test(v3): add integration tests for evolution metrics + suggestions
- Test helper: shared PG connection with sync.Once migration, per-test
tenant+agent seed with cleanup
- Evolution metrics: RecordMetric, AggregateToolMetrics (success rate),
Cleanup (TTL deletion)
- Evolution suggestions: full CRUD, UpdateSuggestionParameters (baseline
persist), tenant isolation (cross-tenant read blocked)
- Pipeline E2E: seed 25 failed tools + 55 low-usage retrievals, verify
SuggestionEngine creates suggestions, verify dedup on second run
- Fix: migration 039 de-duped (episodic_summaries already in 037)
- Fix: NULL reviewed_by scan via sql.NullString
* feat(v3): add HTTP API handlers for evolution, vault, episodic, orchestration, v3-flags
5 new handler files exposing v3 backend stores as REST endpoints:
- evolution_handlers.go: metrics query/aggregate + suggestions CRUD
- vault_handlers.go: cross-agent document listing + search + links
- episodic_handlers.go: episodic summaries list + hybrid search
- orchestration_handlers.go: computed mode + delegate targets (read-only)
- v3_flags_handlers.go: per-agent v3 feature flag get/toggle
Store fixes from code review:
- episodic FTS: use inline to_tsvector (no stored tsv column)
- episodic: conditional user_id filter in List + Search (admin view)
- episodic: add tenant_id to ExistsBySourceID + PruneExpired
- evolution: require tenant_id in context (no struct fallback)
- evolution: check RowsAffected on suggestion updates
- vault: optional agent_id filter in ListDocuments (cross-agent)
* feat(v3): add web UI for evolution tab, v3 settings, vault page, episodic memory
Agent Detail enhancements:
- V3 Settings section: pipeline/memory/retrieval flag toggles
- Orchestration section: mode badge + delegate targets display
- Evolution section: added metrics + suggestions v3 flag toggles
- Evolution tab: Recharts metrics charts + suggestion review table
with approve/reject/rollback actions + guardrails card
New pages:
- /vault: Knowledge Vault document registry with cross-agent listing,
hybrid search dialog, document detail with wikilinks
- Memory page: added Episodic Memory tab with summary cards,
expandable details, key topic badges, and hybrid search
Infrastructure:
- HttpClient: added patch() method
- Query keys: v3Flags, orchestration, evolution namespaces
- 4 new hooks: use-v3-flags, use-orchestration, use-evolution-metrics,
use-evolution-suggestions, use-vault, use-episodic
- i18n: vault namespace (en/vi/zh), agents + memory keys updated
- Reused formatRelativeTime from lib/format.ts (eliminated 3 duplicates)
* refactor(http): add bindJSON helper and migrate all decode call sites
Replace 36 json.NewDecoder(r.Body).Decode + error blocks with bindJSON
across 20 HTTP handler files. Standardizes decode error responses to
structured writeError format. Fixes unchecked decode in handleIndexAll.
* refactor(store): adopt sqlx for PG scan operations (Phase 1+2)
Add jmoiron/sqlx v1.4.0 with camelToSnake json tag mapper.
Migrate scan-heavy PG store methods to sqlx Get/Select:
- tracing.go: GetTrace, ListTraces, ListChildTraces, GetTraceSpans, GetCostSummary
- heartbeat.go: Get, ListDue, ListLogs
- providers.go: GetProvider, GetProviderByName, ListProviders, ListAllProviders
- mcp_servers.go: GetServer, GetServerByName, ListServers
- pairing.go: ListPending, ListPaired
- agents_export_queries.go: 5 export functions
- agents_export_team_queries.go: exportTeamMembers, ExportAgentLinks
All writes (INSERT/UPDATE/DELETE), execMapUpdate, and dynamic WHERE
builders remain raw SQL. Zero behavior change.
* refactor(store): adopt sqlx for SQLite scan operations (Phase 3)
Migrate SQLite store scan methods to sqlx Get/Select:
- providers.go: GetProvider, GetProviderByName, ListProviders, ListAllProviders
- tenants.go: GetTenant, GetTenantBySlug, ListTenants, GetTenantUser, ListUsers, ListUserTenants
- mcp_servers.go: GetServer, GetServerByName, ListServers
Create sqlx_scan_structs.go with sqliteTime-aware scan structs
(providerRow, tenantRow, tenantUserRow, mcpServerRow) to handle
SQLite TEXT timestamp parsing via StructScan.
* refactor(store): migrate PG bulk scan operations to sqlx (Phase 4)
Migrate scan-heavy methods across 6 PG store files:
- tenant_store.go: GetTenant, GetTenantBySlug, ListTenants, GetTenantUser,
ListUsers, ListUserTenants — removed 3 scan helpers
- teams.go: ListTeams, GetTeam, ListMembers, ListMembersByTenant
- teams_tasks_activity.go: ListComments, ListEvents, ListFollowUps
- pending_message_store.go: ListPending, ListByHistoryKey
- skills_grants.go: ListAgentGrants
- config_permissions.go: CheckPermission
~20 scan ops converted. Files with encryption post-processing,
pq.Array, pgvector, or dynamic SQL kept raw.
* refactor(store): extract shared CamelToSnake mapper, add UUIDArray usage note
- Move camelToSnake to internal/store/column_mapper.go (DRY)
- Both pg and sqlitestore packages now import shared CamelToSnake
- Add planned-use comment on UUIDArray type
* refactor(cli): migrate commands from config.json to HTTP API, add providers/setup/TUI
- Add unified HTTP client (gateway_http_client.go) with auth, error parsing, typed generics
- Rewrite agent list/add/delete to use gateway HTTP API instead of config.json
- Rewrite channels list to HTTP API, add channels add/delete subcommands
- Replace models command with full providers CRUD (list/add/update/delete/verify)
- Add setup wizard command (provider → agent → channel post-onboard flow)
- Add Bubble Tea TUI behind build tag (tui/!tui with noop fallback)
- Update onboard next-steps to mention goclaw setup
- Add build-tui Makefile target
- Fix URL path injection (url.PathEscape on all user-supplied path segments)
- Fix UTF-8 truncation in skills description display
* refactor(store): add explicit db struct tags, fix sqlx mapper for heartbeat scan error
Switch sqlx mapper from NewMapperFunc (which only applies CamelToSnake to
field names, not tag values) to NewMapperFunc("db", CamelToSnake) with
explicit db:"column_name" tags on all store structs.
Root cause: NewMapperFunc("json", fn) sets mapFunc but not tagMapFunc,
so camelCase json tags like "agentId" were used as-is instead of being
converted to "agent_id", causing "missing destination name" scan errors.
Fix: use db struct tags as the source of truth for column mapping.
Every DB entity field gets db:"column_name", nested JSON configs and
runtime-only structs get db:"-".
* test(store): add integration tests for 13 store interfaces (70 tests)
Cover Tier 1 (critical) + Tier 2 (security) stores with integration tests
running against pgvector pg18. Coverage from 2.4% to ~54%.
Stores tested: Session, Agent, Team/Task, Memory, KnowledgeGraph, Vault,
MCP Server, API Key, ConfigPermission, Contact.
Infrastructure: fixture builders (seedTeam, seedMCPServer, etc.),
mock EmbeddingProvider, multi-tenant helpers, expanded cleanup.
* fix(store): resolve NULL scan bugs in MCP server and task metadata
- mcp_servers: COALESCE nullable TEXT columns (display_name, command,
url, api_key, tool_prefix) to prevent sqlx scan failures
- mcp_servers_access: COALESCE nullable JSONB columns in ListAgentGrants
(tool_allow, tool_deny, config_overrides) to prevent silent row drops
- teams_tasks: default task metadata to '{}' instead of nil to satisfy
NOT NULL constraint on CreateTask
- sqlx_helpers: export InitSqlx for integration test setup
* feat(pipeline): fix v3 pipeline context injection, tracing, KG temporal filters
- Pipeline context: add InjectContext + LoadSessionHistory callbacks to
ContextStage, propagate enriched ctx via state.Ctx for iteration stages
- Pipeline tracing: wrap makeCallLLM with emitLLMSpanStart/End, wrap
makeExecuteToolCall/Raw with emitToolSpanStart/End
- Token counter: switch pipeline from FallbackCounter to TiktokenCounter
- KG temporal: add valid_until IS NULL filter to all entity/relation
queries (list, search, vector, FTS, traversal CTE, stats)
- Skills: add SkillEmbedder interface for future hybrid BM25+vector search
- Cache: remove unused tenantResolve dead code from PermissionCache
- Store: fix NULL scan bugs in tracing metadata and agent skill_nudge
- Test: add TestStoreKG_TemporalFilter integration test
- UI: add v3 version badge, evolution section, memory/traces improvements
* refactor(store): migrate KG store from raw sql.Rows to sqlx StructScan
Migrate 6 knowledge graph store files from manual rows.Scan() to
pkgSqlxDB.GetContext/SelectContext with intermediate scan row structs.
- Add entityRow, relationRow, traversalRow, dedupCandidateRow structs
with json.RawMessage for jsonb and time.Time for timestamptz columns
- Add toEntity()/toRelation() converters (UnixMilli + json.Unmarshal)
- Add sqlxTx() helper for wrapping *sql.Tx with sqlx mapper
- Fix ScanDuplicates passing time.Now().Unix() to TIMESTAMPTZ column
- Fix ListEntitiesTemporal missing tenant scope (scopeClause)
- Fix SupersedeEntity missing tenant scope and tenant_id on INSERT
- Fix DedupCandidate.CreatedAt using Unix() instead of UnixMilli()
- Update agents_export_queries.go to reuse new scan row structs
- Net -160 lines of manual scan boilerplate removed
* refactor(store): migrate memory, skills, agents, sessions, mcp, cron, vault stores to sqlx
Batch migration of 19 store files from raw rows.Scan() to
pkgSqlxDB.GetContext/SelectContext with intermediate scan row structs.
Groups migrated:
- Memory: memory_docs, memory_admin, memory_search, memory_embedding_cache
- Episodic: episodic_search, episodic_summaries
- Skills: skills, skills_admin, skills_embedding, skills_export_queries
- Agents: agents (backfill+shares), agents_context, agents_export_team_standalone
- Sessions: sessions_list (List, ListPaged, ListPagedRich)
- MCP: mcp_servers_access, mcp_export_queries
- Cron: cron_exec (GetRunLog)
- Vault: vault_documents (ListDocuments, ftsSearch, vectorSearch)
- Tenant: tenant_configs (ListDisabled, ListAll)
7 new scan row files created. Net -510 lines of manual scan boilerplate.
INSERT/UPDATE/DELETE and scalar COUNT queries kept as raw SQL.
* fix(store): fix 3 sqlx scan struct db tag issues found by audit
- Fix vault FTS alias mismatch: `AS rank` → `AS score` (critical: runtime scan error)
- Fix episodic key_topics type: json.RawMessage → pq.StringArray (TEXT[] column)
- Fix agentShareRow.CreatedAt: string → time.Time, wire to output struct
* feat(providers): implement Wave 2 provider resilience and intelligence
9-phase implementation covering:
- Request middleware chain with composable body transformers
- OpenAI prompt caching, service tier, and fast mode middlewares
- Error classification (9 categories) with two-tier failover
- Model registry with forward-compat resolvers (Anthropic + OpenAI)
- Embedding providers (OpenAI + Voyage) with 1536-dim validation
- Cooldown/probe system with per-provider:model state tracking
- Markdown-aware chunking shared across 5 channels
- Session recall via FTS + pgvector on episodic summaries
- Dreaming/promotion pipeline for long-term memory consolidation
Migrations: 000040 (episodic search index), 000041 (promoted_at column)
Schema version: 39 → 41
* feat(providers): wire model registry into gateway provider construction
Create InMemoryRegistry with Anthropic + OpenAI forward-compat resolvers
at gateway startup. Pass to all Anthropic and OpenAI providers created
from both config and DB sources.
* feat(consolidation): wire DomainEventBus and consolidation pipeline
Create DomainEventBus at gateway startup, thread through resolver →
LoopConfig → Loop → PipelineDeps. Emit session.completed event after
each run finalization. Register consolidation pipeline (episodic →
semantic → KG dedup → dreaming) with event bus subscriptions.
* fix(store): fix episodic key_topics pq.Array, ON CONFLICT, and migration 040 immutability
- episodic_summaries.go Create: json.Marshal(KeyTopics) → pq.Array (text[] column)
- episodic_search.go scanEpisodic/scanEpisodicRow: json.RawMessage → pq.StringArray
- episodic_summaries.go Create: ON CONFLICT add WHERE source_id IS NOT NULL for partial index
- migration 040: add immutable_array_to_string wrapper (array_to_string is STABLE in PG)
* test(store): add 17 integration tests for skills, cron, episodic, tenant configs
- Skills store: 6 tests (CRUD, grants, tenant isolation)
- Cron store: 4 tests (job CRUD, run log sqlx scan, pagination, tenant isolation)
- Episodic store: 4 tests (summary CRUD, list, FTS search, tenant isolation)
- Tenant configs: 3 tests (tool/skill disable, list, tenant isolation)
- Test helper: add cleanup for skills, cron, episodic tables
* fix(permissions): use cron-specific permission check for cron tool (#725)
* fix(security): harden exec path exemption matching (#721)
- Add absolute path exemption for dataDir/skills-store/ (fixes skill
scripts using absolute paths like /app/data/skills-store/ being denied)
- Strip surrounding quotes before prefix matching (LLMs often quote paths)
- Reject path traversal ("..") in exempt fields to prevent escape
- Switch from "any field exempt → skip" to per-field matching: only exempt
if ALL fields that match the deny pattern are individually exempt
- Closes pipe/comment bypass vectors where an exempt path in one argument
would exempt the entire command including non-exempt paths
Includes 27 test cases covering: legitimate access, quoted paths,
path traversal, unicode bypass, pipe/comment bypass, mixed args.
* fix(permissions): use cron-specific permission check for cron tool
Cron tool was hardcoded to check `file_writer` configType via
CheckFileWriterPermission(), ignoring the `cron` configType that
the UI actually saves when granting cron permissions. This caused
agents in group chats to be denied cron access even with correct
permission configured.
Add ConfigTypeCron constant and CheckCronPermission() that checks
`cron` configType first, falling back to `file_writer`.
---------
Co-authored-by: Viet Tran <viettranx@gmail.com>
* fix(chat): load message history on first conversation click (#730)
* fix(chat): load message history when selecting existing conversation from clean state
The skipNextHistoryRef was unconditionally set when sessionKey transitioned
from empty to non-empty. This prevented loadHistory() from running when
clicking an existing conversation from the initial /chat page. The skip
was only intended for the new-chat send flow where the optimistic message
is already displayed.
Guard the skip with expectingRunRef so it only activates when a message
send is in flight.
Closes #729
* docs: add UI diff evidence for PR #730
Before/after screenshots and HTML comparison report showing
first conversation click behavior fix.
* feat(whatsapp): port native WhatsApp channel with whatsmeow from dev
Cherry-pick
|
||
|
|
9dee3b3d26 |
fix(agent): use agentUUID instead of agent key in DomainEvent for epi… (#826)
* fix(agent): use agentUUID instead of agent key in DomainEvent for episodic worker DomainEvent.AgentID was set to l.id (agent_key string like "goctech-leader") instead of l.agentUUID.String() (UUID). This caused episodic worker to fail with "invalid input syntax for type uuid" on every session.completed event, breaking the entire 3-tier memory consolidation pipeline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(consolidation): parse tenant/agent IDs safely in episodic worker Replace uuid.MustParse with uuid.Parse so a malformed tenant_id or agent_id in a DomainEvent no longer panics the worker goroutine. Parse up front and return a descriptive error before touching the store, so bad IDs surface with context instead of leaking into a raw PG error. Add regression tests asserting Handle rejects non-UUID agent_id and tenant_id with clear errors and skips creation — guards against the l.id vs l.agentUUID mix-up fixed in the prior commit. --------- Co-authored-by: tuannt23065 <tuannt23065@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: viettranx <viettranx@gmail.com> |
||
|
viettranx
|
9a3b6f359e | Merge branch 'main' into dev | ||
|
viettranx
|
3105a7c811 |
fix(ui/desktop): send promoted agent fields at top level to fix summoning stuck
Backend v3 (migration 000037) promoted emoji, agent_description, self_evolve, thinking_level, reasoning_config from other_config JSONB to top-level columns. Desktop app was still nesting these inside other_config, so backend saw empty agent_description and never triggered the summoning goroutine. SummoningModal then waited forever for agent.summoning WS events that were never emitted. - types/agent.ts: add promoted fields to AgentData and AgentInput - services/agent-service.ts: add emoji to AgentListItem - hooks/use-agent-detail-state.ts: read/write promoted fields at top-level, keep fallback to other_config for legacy agents, drop legacy keys on save - hooks/use-agents.ts: read emoji from top-level with fallback - components/agents/AgentFormDialog.tsx: send agent_description and emoji at top-level; read with fallback - components/agents/AgentCard.tsx: read self_evolve, emoji, agent_description from top-level with fallback to other_config - components/onboarding/AgentStep.tsx: critical fix - send agent_description at top level so backend triggers summoning |
||
|
viettranx
|
eef0dc5bfd |
fix(ui): redesign vault create dialog — larger modal, Radix components, overflow fix
Replace native radio/select with Radix RadioGroup and Select components. Widen modal from max-w-md to max-w-lg, add scroll constraint for long content, fix element overflow on mobile. |
||
|
viettranx
|
af303bfa44 | Merge remote-tracking branch 'origin/main' into dev |