40 Commits

Author	SHA1	Message	Date
iven	2e70e1a3f8	test: add 30 smoke tests for break detection across SaaS/Admin/Desktop ... Layer 1 断裂探测矩阵: - S1-S6: SaaS API 端到端 (auth/lockout/relay/permissions/billing/knowledge) - A1-A6: Admin V2 连通性 (login/dashboard/CRUD/knowledge/roles/models) - D1-D6: Desktop 聊天流 (gateway/kernel/relay/cancel/offline/error) - F1-F6: Desktop 功能闭环 (agent/hands/pipeline/memory/butler/skills) - X1-X6: 跨系统闭环 (provider→desktop/disabled user/knowledge/stats/totp/billing) Also adds: admin-v2 Playwright config, updated spec doc with cross-reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 09:47:35 +08:00
iven	c37c7218c2	test(saas): add 36 security/validation/permission tests (184 total, 0 failures) ... New test files: - auth_security_test.rs (12): account lockout DB state, lockout reset, password version invalidation, disabled account, refresh token revocation, boundary validation (username/password), role enforcement, TOTP 2FA flow - account_security_test.rs (9): role management, privilege escalation prevention, account disable/enable, cross-account access control, operation logs - relay_validation_test.rs (8): input validation (missing fields, empty messages, invalid roles), disabled provider, model listing, task isolation - permission_matrix_test.rs (7): super_admin full access, user allowed/ forbidden endpoints, public endpoints, unauthenticated rejection, API token lifecycle Discovered: account lockout runtime check broken — handlers.rs:213 parse_from_rfc3339 fails on PostgreSQL TIMESTAMPTZ::TEXT format, silently skipping lockout. DB state is correct but login not rejected.	2026-04-10 08:11:02 +08:00
iven	87537e7c53	test: storyline 2/3/4 exploratory test results + BUG-009/010 ... Storyline 2 (Teacher): 3 PASS, 1 FAIL (BUG-008 confirmed) Storyline 3 (Tech user): SSE verified, model switch OK, BUG-009 middleware bypass Storyline 4 (Mom): 3 PASS, scene 4.3 anomalous BUG-008 behavior with kimi New findings: - BUG-009 (P1): SaaS Relay bypasses all 14 middleware layers - BUG-010 (P3): No cancel button during streaming	2026-04-09 23:02:58 +08:00
iven	d6ccb18336	docs: add pre-release functional test design + screenshots	2026-04-09 17:48:40 +08:00
iven	4b15ead8e7	feat(hermes): implement intelligence pipeline — 4 chunks, 684 tests passing ... Hermes Intelligence Pipeline closes breakpoints in ZCLAW's existing intelligence components with 4 self-contained modules: Chunk 1 — Self-improvement Loop: - ExperienceStore (zclaw-growth): FTS5+TF-IDF wrapper with scope prefix - ExperienceExtractor (desktop/intelligence): template-based extraction from successful proposals with implicit keyword detection Chunk 2 — User Modeling: - UserProfileStore (zclaw-memory): SQLite-backed structured profiles with industry/role/expertise/comm_style/recent_topics/pain_points - UserProfiler (desktop/intelligence): fact classification by category (Preference/Knowledge/Behavior) with profile summary formatting Chunk 3 — NL Cron Chinese Time Parser: - NlScheduleParser (zclaw-runtime): 6 pattern matchers for Chinese time expressions (每天/每周/工作日/间隔/每月/一次性) producing cron expressions - Period-aware hour adjustment (下午3点→15, 晚上8点→20) - Schedule intent detection + task description extraction Chunk 4 — Trajectory Compression: - TrajectoryStore (zclaw-memory): trajectory_events + compressed_trajectories - TrajectoryRecorderMiddleware (zclaw-runtime/middleware): priority 650, async non-blocking event recording via tokio::spawn - TrajectoryCompressor (desktop/intelligence): dedup, request classification, satisfaction detection, execution chain JSON Schema migrations: v2→v3 (user_profiles), v3→v4 (trajectory tables)	2026-04-09 17:47:43 +08:00
iven	5da6c0e4aa	docs: add release assessment report + update TRUTH.md command counts ... Phase 5+6 complete: - 182 Tauri commands audited: 92 connected, 20 reserved, 70 orphan - Release assessment: CONDITIONAL GO for beta - TRUTH.md updated with accurate command counts from cross-validation - All P2 bugs fixed, core features verified across 3 LLM models	2026-04-08 23:15:06 +08:00
iven	d5ad07d0a7	docs: add Phase 4 test report (Role C teacher agent, 13/14 PASS) ... All core and extended test scenarios passed for the high school math teacher persona using DeepSeek-V3 and Kimi models. Key findings: - Math problem solving, quiz generation, memory flywheel all working - Model switching (deepseek→kimi) verified mid-conversation - Safety boundary correctly rejects sensitive requests - 1 P2 bug: sidebar AnimatePresence tab switching fails	2026-04-08 23:02:54 +08:00
iven	ade534d1ce	feat: 添加MCP调试插件并优化流式超时处理 ... refactor(relay): 将Provider Key管理路由移至model_config模块 fix(saas): 修复demo_keys与provider_keys的匹配逻辑 perf(runtime): 将流式响应超时从60秒延长至180秒以适配思考型模型 docs: 新增模块化审计和上线前功能测试方案文档 chore: 添加tauri-plugin-mcp依赖及相关配置	2026-04-08 13:39:06 +08:00
iven	deb206ec0b	docs(verification): Chunk 1 OpenViking e2e verification report ... All 5 modules verified — no broken links found: - Extractor: ✅ full chain (3 new e2e tests) - Reflection: ✅ full cycle (2 new tests) - Heartbeat: ✅ 10 commands, 5 real checks - Compaction: ✅ middleware chain + memory flush - VikingInject: ✅ middleware chain, auto-inject Minor issues noted: dual extraction path, dual reflection counter. Chunk 1 complete — ready for Chunk 2/3/4.	2026-04-07 07:51:00 +08:00
iven	f9e1ce1d6e	docs: add Tauri functional test report with P0-P2 findings	2026-04-05 22:03:14 +08:00
iven	0a3ba2fad4	docs: add pre-launch functional audit test execution plan (T1-T12, 5 chunks, 112 TCs)	2026-04-05 17:53:39 +08:00
iven	2ceeeaba3d	fix(production-readiness): 3-batch production readiness cleanup — 12 tasks ... Batch 1 — User-facing fixes: - B1-1: Pipeline verified end-to-end (14 Rust commands, 8 frontend invoke, fully connected) - B1-2: MessageSearch restored to ChatArea with search button in DeerFlow header - B1-3: Viking cleanup — removed 5 orphan invokes (no Rust impl), added addWithMetadata + storeWithSummaries methods + summary generation UI - B1-4: api-fallbacks transparency — added _isFallback markers + console.warn to all 6 fallback functions Batch 2 — System health: - B2-1: Document drift calibration — TRUTH.md/README.md numbers verified and updated - B2-2: @reserved annotations on 15 SaaS handler functions with no frontend callers - B2-3: Scheduled Task Admin V2 — new service + page + route + sidebar navigation - B2-4: TRUTH.md Pipeline/Viking/ScheduledTask records corrected Batch 3 — Long-term quality: - B3-1: hand_run_status/hand_run_list verified as fully implemented (not stubs) - B3-2: Identity snapshot rollback UI added to RightPanel - B3-3: P2 code quality — 4 fixes (TODO comments, fire-and-forget notes, design notes, table name validation), 2 verified N/A, 1 upstream - B3-4: Config PATCH→PUT alignment (admin-v2 config.ts matched to SaaS backend)	2026-04-03 21:34:56 +08:00
iven	1c697d0b46	chore: 清理临时管理目录并更新文档索引 ... 删除 admin-temp-dir 目录及其内容 更新文档索引以包含 dashmap 相关文件	2026-04-03 00:42:48 +08:00
iven	d8e2954d73	docs: stabilization directive + TRUTH document + AI session prompts + dockerignore ... - STABILIZATION_DIRECTIVE.md: feature freeze rules, banned actions, priorities - TRUTH.md: single source of truth for system state (crate counts, store counts) - AI_SESSION_PROMPTS.md: three-layer prompt system for AI sessions - Industry agent delivery design spec - Stabilization test suite for regression prevention - Delete stale ISSUE-TRACKER.md - Add .dockerignore for container builds - Add brainstorm session artifacts	2026-04-03 00:29:16 +08:00
iven	0a04b260a4	refactor(desktop): ChatStore structured split + IDB persistence + stream cancel ... Split monolithic chatStore.ts (908 lines) into 4 focused stores: - chatStore.ts: facade layer, owns messages[], backward-compatible selectors - conversationStore.ts: conversation CRUD, agent switching, IndexedDB persistence - streamStore.ts: streaming orchestration, chat mode, suggestions - messageStore.ts: token tracking Key fixes from 3-round deep audit: - C1: Fix Rust serde camelCase vs TS snake_case mismatch (toolStart/toolEnd/iterationStart) - C2: Fix IDB async rehydration race with persist.hasHydrated() subscribe - C3: Add sessionKey to partialize to survive page refresh - H3: Fix IDB migration retry on failure (don't set migrated=true in catch) - M3: Fix ToolCallStep deduplication (toolStart creates, toolEnd updates) - M-NEW-2: Clear sessionKey on cancelStream Also adds: - Rust backend stream cancellation via AtomicBool + cancel_stream command - IndexedDB storage adapter with one-time localStorage migration - HMR cleanup for cross-store subscriptions	2026-04-03 00:24:16 +08:00
iven	8898bb399e	docs: audit reports + feature docs + skills + admin-v2 + config sync ... Update audit tracker, roadmap, architecture docs, add admin-v2 Roles page + Billing tests, sync CLAUDE.md, Cargo.toml, docker-compose.yml, add deep-research / frontend-design / chart-visualization skills Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-02 19:25:00 +08:00
iven	62df7feac1	docs(spec): switch payment integration from Stripe to Alipay/WeChat Pay direct ... Target market is domestic China users only — integrate Alipay Face-to-Face Payment and WeChat Native Pay directly instead of Stripe as intermediary. Updated billing module structure, risk table, and verification criteria. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-01 23:21:22 +08:00
iven	f79560a911	refactor(desktop): split kernel_commands/pipeline_commands into modules, add SaaS client libs and gateway modules ... Split monolithic kernel_commands.rs (2185 lines) and pipeline_commands.rs (1391 lines) into focused sub-modules under kernel_commands/ and pipeline_commands/ directories. Add gateway module (commands, config, io, runtime), health_check, and 15 new TypeScript client libraries for SaaS relay, auth, admin, telemetry, and kernel sub-systems (a2a, agent, chat, hands, skills, triggers). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-31 11:12:47 +08:00
iven	eb956d0dce	feat: 新增管理后台前端项目及安全加固 ... refactor(saas): 重构认证中间件与限流策略 - 登录限流调整为5次/分钟/IP - 注册限流调整为3次/小时/IP - GET请求不计入限流 fix(saas): 修复调度器时间戳处理 - 使用NOW()替代文本时间戳 - 兼容TEXT和TIMESTAMPTZ列类型 feat(saas): 实现环境变量插值 - 支持${ENV_VAR}语法解析 - 数据库密码支持环境变量注入 chore: 新增前端管理界面 - 基于React+Ant Design Pro - 包含路由守卫/错误边界 - 对接58个API端点 docs: 更新安全加固文档 - 新增密钥管理规范 - 记录P0安全项审计结果 - 补充TLS终止说明 test: 完善配置解析单元测试 - 新增环境变量插值测试用例	2026-03-31 00:11:33 +08:00
iven	bc8c77e7fe	fix(security): P0 审计修复 — 6项关键安全/编译问题 ... F1: kernel.rs multi-agent 编译错误 — 重排 spawn_agent 中 A2A 注册顺序， 在 config 被 registry.register() 消费前使用 F2: saas-config.toml 从 git 追踪中移除 — 包含数据库密码已进入版本历史 F3: config.rs 硬编码开发密钥改用 #[cfg(debug_assertions)] 编译时门控 — dev fallback 密钥不再进入 release 构建 F4: 公共认证端点添加 IP 速率限制 (20 RPM) — 防止暴力破解 F5: SSE relay 路由分离出全局 15s TimeoutLayer — 避免长流式响应被截断 F6: Provider API 密钥入库前 AES-256-GCM 加密 — 明文存储修复 附带：完整审计报告 docs/superpowers/specs/2026-03-30-comprehensive-audit-report.md	2026-03-30 13:32:22 +08:00
iven	5fdf96c3f5	chore: 提交所有工作进度 — SaaS 后端增强、Admin UI、桌面端集成 ... 包含大量 SaaS 平台改进、Admin 管理后台更新、桌面端集成完善、 文档同步、测试文件重构等内容。为 QA 测试准备干净工作树。	2026-03-29 10:46:41 +08:00
iven	b3a31ec48b	docs(saas): 添加 SaaS 后台系统设计规格 ... 涵盖四大核心模块的完整设计: - 账号权限管理 (JWT/Argon2/TOTP/权限模板) - 模型与 API 配置中心 (提供商/模型/密钥/使用量) - 模型请求中转服务 (队列/流式转发/速率限制) - 系统配置迁移分析 (迁移优先级/同步协议) 技术栈: Rust + Axum 后端 + React 管理后台 目标: MVP <100 用户, 独立 SaaS 服务	2026-03-27 12:16:19 +08:00
iven	0d4fa96b82	refactor: 统一项目名称从OpenFang到ZCLAW ... 重构所有代码和文档中的项目名称，将OpenFang统一更新为ZCLAW。包括： - 配置文件中的项目名称 - 代码注释和文档引用 - 环境变量和路径 - 类型定义和接口名称 - 测试用例和模拟数据 同时优化部分代码结构，移除未使用的模块，并更新相关依赖项。	2026-03-27 07:36:03 +08:00
iven	b7f3d94950	fix(presentation): 修复 presentation 模块类型错误和语法问题 ... - 创建 types.ts 定义完整的类型系统 - 重写 DocumentRenderer.tsx 修复语法错误 - 重写 QuizRenderer.tsx 修复语法错误 - 重写 PresentationContainer.tsx 添加类型守卫 - 重写 TypeSwitcher.tsx 修复类型引用 - 更新 index.ts 移除不存在的 ChartRenderer 导出 审计结果: - 类型检查: 通过 - 单元测试: 222 passed - 构建: 成功	2026-03-26 17:19:28 +08:00
iven	4ba0a531aa	docs: add v0.2.0 release implementation plan ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-24 01:34:17 +08:00
iven	fb263a8ae2	docs: add v0.2.0 release plan design document ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-24 01:16:52 +08:00
iven	afb48f7b80	docs: add v0.2.0 release design spec ... Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-23 23:24:08 +08:00
iven	815c56326b	docs(phase3): add integration verification report ... - Track A: Chat virtual scrolling - PASS - Track B: Hands Worker isolation - SKIPPED (architecture already secure) - Track C: Intelligence cache - PASS (completed in Phase 2.5) All TypeScript compilation passed, all domain implementations verified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 21:27:59 +08:00
iven	35b06f2e4a	docs(phase3): add core optimization implementation plan ... - Track A: Chat virtual scrolling with react-window - Track B: Hands Web Worker isolation for security - Track C: Intelligence caching (already completed) Plan includes: - File structure and task breakdown - Code examples for each component - Verification checklist - Integration requirements Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 20:03:13 +08:00
iven	e2fb79917b	docs(phase2): add Phase 2 domain reorganization changelog ... - Document completed tasks and file structure - Record technical decisions and architecture changes - Note verification results and next steps Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 19:53:07 +08:00
iven	7ffd5e1531	feat(domains): create domain-driven architecture for Phase 2 ... Chat Domain: - Add types.ts with Message, Conversation, Agent types - Add store.ts with Valtio-based state management - Add hooks.ts with useChatState, useMessages, etc. - Add index.ts for public API export Hands Domain: - Add types.ts with Hand, Trigger, Approval types - Add machine.ts with XState state machine - Add store.ts with Valtio-based state management - Add hooks.ts with useHands, useApprovalQueue, etc. Shared Module: - Add types.ts with Result, AsyncResult, PaginatedResponse - Add error-handling.ts with AppError, NetworkError, etc. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 19:47:48 +08:00
iven	60ddb0b1e9	fix(plan): address review feedback for Phase 1 plan ... - Fix mock path in setup.ts to use @ alias - Add Web Crypto polyfill for Node.js test environment - Use pnpm exec for vitest version check - Update Task 4.1 to note existing isLocalhost function - Add cross-platform notes for Windows users Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 16:42:38 +08:00
iven	5edb8e347f	docs(plan): add Phase 1 implementation plan ... Detailed plan for Security + Testing phase (2 weeks): - Task 1.1-1.2: Test framework setup (Vitest) - Task 2.1-2.2: Crypto utilities module - Task 3.1: Secure storage encryption enhancement - Task 4.1: WSS enforcement - Task 5.1: ChatStore unit tests - Task 6.1-6.4: Integration and verification Each task has bite-sized steps with exact commands and expected output. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 16:38:04 +08:00
iven	d1c200a243	docs(spec): revise architecture optimization spec based on review ... Fixes from code review: - Fix terminology: VZustand → Valtio - Add terminology table for clarity - Add existing code analysis section - Add migration mapping table - Remove incorrect Web Worker claims - Update Hands section to focus on XState - Update Intelligence cache to acknowledge existing impl - Add detailed task breakdown with estimates - Add performance measurement methods - Update dependency versions to specific versions - Add 2-week buffer to timeline Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 16:23:57 +08:00
iven	52c5e8a732	docs(spec): add architecture optimization design spec ... Comprehensive design for 14-week architecture overhaul: - VZustand for fine-grained reactivity - Web Worker isolation for security - XState for Hands state machine - Domain-driven directory structure Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 16:16:24 +08:00
iven	dfeb286591	docs(plan): add automation system redesign implementation plan ... Four phases: - P1: Fix core issues (param passing, store migration, WebSocket events) - P2: UI refactor (AutomationPanel, AutomationCard, filters) - P3: Advanced features (ScheduleEditor, batch operations) - P4: Workflow integration (ApprovalQueue, ExecutionResult) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-18 15:55:18 +08:00
iven	c856673936	docs(spec): update automation design with review feedback ... Key changes: - Extend existing stores instead of creating new automationStore - Use type adapter pattern instead of new type hierarchy - Add explicit HandParamsForm parameter passing fix - Add category mapping for 7 existing Hands Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-18 15:14:36 +08:00
iven	552efb513b	docs(spec): add automation system redesign specification ... Design for Hands/Workflow unified automation panel with: - Visual scheduler without cron syntax - Result stream integration into chat - Batch operations (trigger, approve, configure) - Real-time status via WebSocket - Offline queue and error recovery Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-18 15:10:55 +08:00
iven	74dbf42644	refactor(startup): simplify stack to Tauri-managed OpenFang + optional ChromeDriver ... - Remove OpenFang CLI dependency from startup scripts - OpenFang now bundled with Tauri and managed via gateway_start/gateway_status commands - Add bootstrap screen in App.tsx to auto-start local gateway before UI loads - Update Makefile: replace start-no-gateway with start-desktop-only - Fix gateway config endpoints: use /api/config instead of /api/config/quick - Add Playwright dependencies for future E2E testing	2026-03-17 14:08:03 +08:00
iven	69c874ed59	docs(spec): add Browser Hand UI design specification ... Design for browser automation UI component integrated into HandsPanel: - Dual trigger mechanism: frontend templates + agent scripts - Real-time status + screenshot preview - Complete template system (basic, scraping, automation) - Task runner with progress tracking Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-17 08:14:41 +08:00