iven
bcaab50c56
fix(desktop): resolve all remaining P1 defects (P1-02/05/06, P1-01 experimental)
...
CI / Build Frontend (push) Has been cancelled
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- P1-02: Heartbeat auto-initialized in kernel_init for default agent
- P1-05: CloneManager shows warning when deleting active agent + auto-switch
- P1-06: AgentInfo returns soul/system_prompt/temperature/max_tokens
- P1-01: Browser Hand marked experimental (requires Fantoccini bridge)
- Updated DEFECT_LIST.md: all P1 resolved (0 active)
- Updated RELEASE_READINESS.md: all P1 sections reflect current status
2026-04-05 21:21:33 +08:00
iven
90855dc83e
fix(desktop): resolve 2 release-blocking P1 defects
...
P1-04: GenerationPipeline hardcoded model="default" causing classroom
generation 404. Added model field to GenerationPipeline struct, passed
from kernel config via with_driver(driver, model). Static scene
generation now receives model parameter.
P1-03: LLM API concurrent 500 DATABASE_ERROR. Added transient DB error
retry (PoolTimedOut/Io) in create_relay_task with 200ms backoff.
Recommend setting ZCLAW_DB_MIN_CONNECTIONS=10 for burst resilience.
2026-04-05 19:18:41 +08:00
iven
9ee89ff67c
fix(desktop): 功能验证 6 项缺陷修复
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- ISS-002: SkillInfoResponse 增加 source/path 字段，修复技能系统显示 0 个
- ISS-003: Sidebar 添加自动化/技能市场导航入口 + App 返回按钮
- ISS-004: SaaS fetchAvailableModels 添加 .catch() 防限流崩溃
- ISS-006: SaaSSettings/PricingPage 包裹 ErrorBoundary 防白屏
- ISS-008: listModels 加载 localStorage 自定义模型，修复仅显示 1 个模型
- configStore listSkills 映射添加 source/path 转发
2026-04-05 16:12:06 +08:00
iven
fb0b8d2af3
fix(tauri): @reserved annotations for 16 unconnected commands
...
Complete Tauri command audit: 177 total (160 @connected + 16 @reserved + 1 unregistered identity_init)
Corrected zclaw_doctor from @connected to @reserved
2026-04-05 01:06:58 +08:00
iven
f846f3d632
fix(tauri): update @reserved annotations + remove dead SaaS client methods
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- Update 9 @reserved → @connected for commands with frontend consumers:
zclaw_status, zclaw_start, zclaw_stop, zclaw_restart, zclaw_doctor,
viking_add_with_metadata, viking_store_with_summaries,
trigger_execute, scheduled_task_create
- Remove 10 dead SaaS client methods with zero callers:
healthCheck, listDevices (saas-client.ts)
getRelayTask, getUsage/relay (saas-relay.ts)
listPrompts, getPrompt, listPromptVersions, getPromptVersion (saas-prompt.ts)
getPlan, getUsage/billing (saas-billing.ts)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-05 00:22:45 +08:00
iven
ac24d15bab
fix(tauri): add @reserved annotations to 3 unconnected commands
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- classroom_chat_history: @reserved (no frontend consumer)
- orchestration_execute: @reserved (no frontend consumer)
- orchestration_validate: @reserved (no frontend consumer)
Update AUDIT_TRACKER: V11-P2-05 verified (89 connected / 18 @reserved)
DEAD-05 re-evaluated: 12 truly dead methods (not 39), documented in tracker
2026-04-05 00:04:20 +08:00
iven
1fec8cfbc1
fix(arch): unify TS/Rust types + classroom persistence registration + approval audit
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- M11-03: Register ClassroomPersistence via Tauri .setup() hook with
in-memory fallback. Previously missing — classroom commands would crash at runtime.
- M3-02: Document BrowserHand as schema validator + TypeScript delegation
passthrough (dual-path architecture explicitly documented).
- M4-04: Add defense-in-depth audit logging in execute_hand() and
execute_hand_with_source() when needs_approval hands bypass approval gate.
- TYPE-01: Add #[serde(rename_all = "camelCase")] to Rust AgentInfo.
Add missing fields to TS AgentInfo (messageCount, createdAt, updatedAt).
Fix KernelStatus TS interface to match Rust KernelStatusResponse
(baseUrl/model instead of defaultProvider/defaultModel).
- SEC2-P1-01: Document EXTRACTION_DRIVER OnceCell as legacy path;
Kernel struct field is the active path.
- TriggerSource: Add #[derive(PartialEq)] for approval audit comparisons.
2026-04-04 21:09:02 +08:00
iven
88172aa651
feat(classroom): add SQLite persistence + security hardening
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
M11-03: Classroom data persistence
- New persist.rs: SQLite-backed ClassroomPersistence with open/load_all/save
- Schema: classrooms (JSON blob) + classroom_chats tables
- generate.rs: auto-persist classroom after generation
- chat.rs: auto-persist chat messages after each exchange
- mod.rs: init_persistence() for app setup integration
M1-01: Gemini API key now uses x-goog-api-key header
- No longer leaks API key in URL query params or debug logs
M1-03/04: Mutex unwrap() replaced with unwrap_or_else(|e| e.into_inner())
- MemoryMiddleware and LoopGuardMiddleware recover from poison
M2-08: Agent creation input validation
- Reject empty names, out-of-range temperature (0-2), zero max_tokens
M11-06: Classroom chat message ID uses crypto.randomUUID()
2026-04-04 19:26:59 +08:00
iven
619bad30cb
fix(security): Gemini API key header + Mutex safety + Agent validation
...
CI / Build Frontend (push) Has been cancelled
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
M1-01: Move Gemini API key from URL query param to x-goog-api-key header,
preventing key leakage in logs/proxy/telemetry (matches Anthropic/OpenAI pattern)
M1-03/M1-04: Replace Mutex .unwrap() with .unwrap_or_else(|e| e.into_inner())
in MemoryMiddleware and LoopGuardMiddleware — recovers from poison
instead of panicking async runtime
M2-08: Add input validation to agent_create — reject empty names,
out-of-range temperature (0-2), and zero max_tokens
M11-06: Replace Date.now() message ID with crypto.randomUUID()
to prevent collisions in classroom chat
2026-04-04 19:15:50 +08:00
iven
985644dd9a
fix(memory): FTS5 full-text search + browser hand autonomy gate
...
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
M4-05: Replace LIKE-only search with FTS5-first strategy:
- Add memories_fts virtual table (unicode61 tokenizer)
- FTS5 MATCH primary path with CJK LIKE fallback
- Sync FTS index on store()
M3-03: Add autonomy approval check to browserHandStore:
- executeTemplate: check canAutoExecute before running
- executeScript: check approval gate for JS execution
2026-04-04 18:52:02 +08:00
iven
59f660b93b
fix(hands): add max_concurrent + timeout_secs fields + hand timeout enforcement
...
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
M3-04/M3-05 audit fixes:
- HandConfig: add max_concurrent (u32) and timeout_secs (u64) with serde defaults
- Kernel execute_hand: enforce timeout via tokio::time::timeout, cancel on expiry
- All 9 hand implementations: add max_concurrent: 0, timeout_secs: 0
- Agent createClone: pass soul field through to kernel
- Fix duplicate soul block in agent_create command
2026-04-04 18:41:15 +08:00
iven
6d1f2d108a
fix(audit): P1 心跳自启动 + refreshToken body + 类型修复
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
审计修复 Batch 2 (M4-03/M7-04/M11-01):
M4-03: 心跳引擎自动启动
- chat.rs auto-init 块: engine 创建后立即 start()
- 通过 engines.get() 获取引用避免 move 后使用
M7-04: refreshToken 发送 body 修复
- SaaSClient 新增 refreshTokenValue 存储 refresh_token
- refreshToken() 发送 { refresh_token } body
- SaaSRefreshResponse 新增 refresh_token 字段
- login/register 自动存储 refresh_token
- 添加 getRefreshToken/setRefreshToken 访问器
M11-01: blocking_lock 死锁修复 (已存在)
- 确认 try_lock + Result 匹配模式已正确
2026-04-04 18:26:10 +08:00
iven
05762261be
fix(audit): P0 反思引擎 LLM 接入 + P1 hand run_id/skill triggers/pipeline v2
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
审计修复 Batch 1 (M4-02/M3-01/M5-01/M6-02):
P0 M4-02: reflection_reflect 从 KernelState 获取 LLM driver
- 新增 kernel_state 参数，从 kernel.driver() 获取驱动
- 自动路径(post_conversation_hook)已正常，手动 Tauri 命令路径已修复
P1 M3-01: hand_execute 返回 run_id 给前端
- HandResult 新增 run_id 字段
- execute_hand 结果包含 run_id.to_string()
P1 M5-01: skill-discovery 使用后端 triggers 字段
- BackendSkillInfo 新增 triggers 字段
- convertFromBackend 优先使用 triggers，fallback tags
P1 M6-02: pipeline_list 支持 v2 YAML 格式
- scan_pipelines_with_paths 增加 v2 fallback 解析
- 新增 pipeline_v2_to_info 转换函数
- discovery.rs 导入 parse_pipeline_v2_yaml
注: M4-01 双数据库问题已在之前批次修复
M6-01 route_intent 已确认注册，审计结论过时
2026-04-04 18:11:21 +08:00
iven
f4ed1b33e0
feat(kernel): add multi-skill orchestration bridge + true parallel execution
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- Kernel orchestration bridge: execute_orchestration, auto_compose_skills,
validate_orchestration methods on Kernel struct
- True parallel execution: replace sequential for-loop with tokio::JoinSet
for concurrent node execution within parallel groups
- Tauri commands: orchestration_execute (auto-compose or pre-defined graph),
orchestration_validate (dry-run validation)
- Full type conversions: OrchestrationRequest/Response with camelCase serde
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-04 09:18:26 +08:00
iven
1c99e5f3a3
fix(browser): stability enhancements + MCP frontend client
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
S7 Browser Hand:
- Remove dead code: browser/actions.rs (314 lines of unused BrowserAction/ActionResult types)
- Fix browser_scrape_page: log failed selector matches instead of silently swallowing errors
- Fix element_to_info: document known limitation for always-None location/size fields
- Fix browserHandStore: reuse activeSessionId in executeScript/takeScreenshot/executeTemplate
instead of creating orphan Browser sessions
- Add Browser.connect(sessionId) method for session reuse
MCP Frontend:
- Add desktop/src/lib/mcp-client.ts (77 lines) — typed client for MCP Tauri commands
(startMcpService, stopMcpService, listMcpServices, callMcpTool)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-03 22:16:12 +08:00
iven
943afe3b6b
feat(protocols): MCP tool adapter + Tauri commands + initialize bug fix
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
S6 MCP Protocol:
- Fix McpTransport::initialize() — store actual server capabilities instead
of discarding them and storing empty ServerCapabilities::default()
- Add send_notification() method to McpTransport for JSON-RPC notifications
- Send notifications/initialized after MCP handshake (spec requirement)
- Add McpToolAdapter: bridges MCP server tools into the tool execution path
- Add McpServiceManager: lifecycle management for MCP server connections
- Add 4 Tauri commands: mcp_start_service, mcp_stop_service,
mcp_list_services, mcp_call_tool
- Register zclaw-protocols dependency in desktop Cargo.toml
New files:
- crates/zclaw-protocols/src/mcp_tool_adapter.rs (153 lines)
- desktop/src-tauri/src/kernel_commands/mcp.rs (145 lines)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-03 22:07:35 +08:00
iven
65b73c547f
fix(desktop): resolve Tauri state panic on startup
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
SessionStreamGuard and StreamCancelFlags were type aliases to the same
Arc<DashMap<String, Arc<AtomicBool>>> type. Tauri distinguishes managed
state by Rust type, so registering both caused a runtime panic:
"state for type ... is already being managed".
Changed to newtype structs with Deref impl to the inner Arc<DashMap>,
keeping all call sites compatible without changes.
2026-04-03 12:29:10 +08:00
iven
15d578c5bc
fix(tauri): replace silent let _ = with structured logging across 20 modules
...
Replace error-swallowing let _ = patterns with tracing::warn! in browser,
classroom, gateway, intelligence, memory, pipeline, secure_storage, and
viking command handlers. Ensures errors are observable in production logs.
2026-04-03 00:28:39 +08:00
iven
0a04b260a4
refactor(desktop): ChatStore structured split + IDB persistence + stream cancel
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
Split monolithic chatStore.ts (908 lines) into 4 focused stores:
- chatStore.ts: facade layer, owns messages[], backward-compatible selectors
- conversationStore.ts: conversation CRUD, agent switching, IndexedDB persistence
- streamStore.ts: streaming orchestration, chat mode, suggestions
- messageStore.ts: token tracking
Key fixes from 3-round deep audit:
- C1: Fix Rust serde camelCase vs TS snake_case mismatch (toolStart/toolEnd/iterationStart)
- C2: Fix IDB async rehydration race with persist.hasHydrated() subscribe
- C3: Add sessionKey to partialize to survive page refresh
- H3: Fix IDB migration retry on failure (don't set migrated=true in catch)
- M3: Fix ToolCallStep deduplication (toolStart creates, toolEnd updates)
- M-NEW-2: Clear sessionKey on cancelStream
Also adds:
- Rust backend stream cancellation via AtomicBool + cancel_stream command
- IndexedDB storage adapter with one-time localStorage migration
- HMR cleanup for cross-store subscriptions
2026-04-03 00:24:16 +08:00
iven
da438ad868
fix(billing): resolve all audit findings — CSRF, float precision, TOCTOU, error sanitization
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- Add CSRF token protection for mock payment (SHA256 + constant-time verify)
- Replace f64 currency conversion with pure integer string parsing (parse_yuan_to_cents)
- Move subscription check inside transaction to prevent TOCTOU race
- Rewrite increment_usage to use atomic SQL (account_id+period_start WHERE)
- Add trade_no format validation in payment callback
- Sanitize error messages to prevent sensitive data leakage
- Use i32::try_from for WeChat amount conversion (prevent truncation)
- Replace window.__ZCLAW_STATS_SYNC_INTERVAL__ with useRef pattern
- Replace eprintln/println with tracing macros in lifecycle
- Remove unused variable in scheduler
- Remove duplicate sha2 and unused hmac from Cargo.toml
2026-04-02 20:04:43 +08:00
iven
28299807b6
fix(desktop): DeerFlow UI — ChatArea refactor + ai-elements + dead CSS cleanup
...
ChatArea retry button uses setInput instead of direct sendToGateway,
fix bootstrap spinner stuck for non-logged-in users,
remove dead CSS (aurora-title/sidebar-open/quick-action-chips),
add ai components (ReasoningBlock/StreamingText/ChatMode/ModelSelector/TaskProgress),
add ClassroomPlayer + ResizableChatLayout + artifact panel
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-02 19:24:44 +08:00
iven
73ff5e8c5e
feat(desktop): DeerFlow visual redesign + stream hang fix + intelligence client
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
DeerFlow frontend visual overhaul:
- Card-style input box (white rounded card, textarea top, actions bottom)
- Dropdown mode selector (闪速/思考/Pro/Ultra with icons+descriptions)
- Colored quick-action chips (小惊喜/写作/研究/收集/学习)
- Minimal top bar (title + token count + export)
- Warm gray color system (#faf9f6 bg, #f5f4f1 sidebar, #e8e6e1 border)
- DeerFlow-style sidebar (新对话/对话/智能体 nav)
- Reasoning block, tool call chain, task progress visualization
- Streaming text, model selector, suggestion chips components
- Resizable artifact panel with drag handle
- Virtualized message list for 100+ messages
Bug fixes:
- Stream hang: GatewayClient onclose code 1000 now calls onComplete
- WebView2 textarea border: CSS !important override for UA styles
- Gateway stream event handling (response/phase/tool_call types)
Intelligence client:
- Unified client with fallback drivers (compactor/heartbeat/identity/memory/reflection)
- Gateway API types and type conversions
2026-04-01 22:03:07 +08:00
iven
e3b93ff96d
fix(security): implement all 15 security fixes from penetration test V1
...
Security audit (2026-03-31): 5 HIGH + 10 MEDIUM issues, all fixed.
HIGH:
- H1: JWT password_version mechanism (pwv in Claims, middleware verification,
auto-increment on password change)
- H2: Docker saas port bound to 127.0.0.1
- H3: TOTP encryption key decoupled from JWT secret (production bailout)
- H4+H5: Tauri CSP hardened (removed unsafe-inline, restricted connect-src)
MEDIUM:
- M1: Persistent rate limiting (PostgreSQL rate_limit_events table)
- M2: Account lockout (5 failures -> 15min lock)
- M3: RFC 5322 email validation with regex
- M4: Device registration typed struct with length limits
- M5: Provider URL validation on create/update (SSRF prevention)
- M6: Legacy TOTP secret migration (fixed nonce -> random nonce)
- M7: Legacy frontend crypto migration (static salt -> random salt)
- M8+M9: Admin frontend: removed JS token storage, HttpOnly cookie only
- M10: Pipeline debug log sanitization (keys only, 100-char truncation)
Also: fixed CLAUDE.md Section 12 (was corrupted), added title.rs middleware
skeleton, fixed RegisterDeviceRequest visibility.
2026-04-01 08:38:37 +08:00
iven
f79560a911
refactor(desktop): split kernel_commands/pipeline_commands into modules, add SaaS client libs and gateway modules
...
Split monolithic kernel_commands.rs (2185 lines) and pipeline_commands.rs (1391 lines)
into focused sub-modules under kernel_commands/ and pipeline_commands/ directories.
Add gateway module (commands, config, io, runtime), health_check, and 15 new
TypeScript client libraries for SaaS relay, auth, admin, telemetry, and kernel
sub-systems (a2a, agent, chat, hands, skills, triggers).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-31 11:12:47 +08:00
iven
eb956d0dce
feat: 新增管理后台前端项目及安全加固
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
refactor(saas): 重构认证中间件与限流策略
- 登录限流调整为5次/分钟/IP
- 注册限流调整为3次/小时/IP
- GET请求不计入限流
fix(saas): 修复调度器时间戳处理
- 使用NOW()替代文本时间戳
- 兼容TEXT和TIMESTAMPTZ列类型
feat(saas): 实现环境变量插值
- 支持${ENV_VAR}语法解析
- 数据库密码支持环境变量注入
chore: 新增前端管理界面
- 基于React+Ant Design Pro
- 包含路由守卫/错误边界
- 对接58个API端点
docs: 更新安全加固文档
- 新增密钥管理规范
- 记录P0安全项审计结果
- 补充TLS终止说明
test: 完善配置解析单元测试
- 新增环境变量插值测试用例
2026-03-31 00:11:33 +08:00
iven
a0bbd4ba82
feat(scheduler): 定时任务后端持久化 + Pipeline trigger 编译修复
...
S4/S8 定时任务后端:
- 新增 scheduled_tasks 表 (migration v7)
- 新增 scheduled_task CRUD 模块 (handlers/service/types)
- 注册 /api/scheduler/tasks 路由 (GET/POST/PATCH/DELETE)
- 新增 start_user_task_scheduler() 30秒轮询循环
- 支持 cron/interval/once 三种调度类型
- once 类型执行后自动禁用
修复:
- pipeline_commands.rs: 修复 pipeline.trigger 字段不存在的编译错误
(Pipeline 结构体无 trigger 字段，改用 metadata.tags/description)
2026-03-30 19:46:45 +08:00
iven
834aa12076
fix: P0 panic风险修复 + P1编译warnings清零 + P2代码/文档清理
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
P0 安全性:
- account/handlers.rs: .unwrap() → .expect() 语义化错误信息
- relay/handlers.rs: SSE Response .unwrap() → .expect()
P1 编译质量 (6 warnings → 0):
- kernel.rs: 移除未使用的 Capability import 和 config_clone 变量
- pipeline_commands.rs: 未使用变量 id → _id
- db.rs: 移除多余括号
- relay/service.rs: 移除未使用的 StreamExt import
- telemetry/service.rs: 抑制 param_idx 未读赋值警告
- main.rs: TcpKeepalive::with_retries() Linux-only 条件编译
P2 代码清理:
- 移除 handStore/HandsPanel/HandTaskPanel/gateway-api/SchedulerPanel 调试 console.log
- SchedulerPanel: 修复 updateWorkflow 未解构导致 TS 编译错误
- 文档清理 zclaw-channels 已移除 crate 的引用
2026-03-30 11:33:47 +08:00
iven
813b49a986
feat: P0 KernelClient功能修复 + P1/P2/P3质量改进
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询
P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证
2026-03-30 10:55:08 +08:00
iven
13c0b18bbc
feat: Batch 5-9 — GrowthIntegration桥接、验证补全、死代码清理、Pipeline模板、Speech/Twitter真实实现
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
Batch 5 (P0): GrowthIntegration 接入 Tauri
- Kernel 新增 set_viking()/set_extraction_driver() 桥接 SqliteStorage
- 中间件链共享存储，MemoryExtractor 接入 LLM 驱动
Batch 6 (P1): 输入验证 + Heartbeat
- Relay 验证补全（stream 兼容检查、API key 格式校验）
- UUID 类型校验、SessionId 错误返回
- Heartbeat 默认开启 + 首次聊天自动初始化
Batch 7 (P2): 死代码清理
- zclaw-channels 整体移除（317 行）
- multi-agent 特性门控、admin 方法标注
Batch 8 (P2): Pipeline 模板
- PipelineMetadata 新增 annotations 字段
- pipeline_templates 命令 + 2 个示例模板
- fallback driver base_url 修复（doubao/qwen/deepseek 端点）
Batch 9 (P1): SpeechHand/TwitterHand 真实实现
- SpeechHand: tts_method 字段 + Browser TTS 前端集成 (Web Speech API)
- TwitterHand: 12 个 action 全部替换为 Twitter API v2 真实 HTTP 调用
- chatStore/useAutomationEvents 双路径 TTS 触发
2026-03-30 09:24:50 +08:00
iven
f3f586efef
feat(kernel): Agent 导入/导出 + message_count 跟踪
...
Sprint 3.1 message_count 修复:
- AgentRegistry 新增 message_counts 字段跟踪每个 agent 的消息数
- increment_message_count() 在 send_message 和 send_message_stream 中调用
- get_info() 返回实际计数值
Sprint 3.3 Agent 导入/导出:
- Kernel 新增 get_agent_config() 方法返回原始 AgentConfig
- 新增 agent_export Tauri 命令，导出配置为 JSON
- 新增 agent_import Tauri 命令，从 JSON 导入并自动生成新 ID
- 注册到 Tauri invoke_handler
2026-03-30 00:19:02 +08:00
iven
7de294375b
feat(auth): 添加异步密码哈希和验证函数
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
refactor(relay): 复用HTTP客户端和请求体序列化结果
feat(kernel): 添加获取单个审批记录的方法
fix(store): 改进SaaS连接错误分类和降级处理
docs: 更新审计文档和系统架构文档
refactor(prompt): 优化SQL查询参数化绑定
refactor(migration): 使用静态SQL和COALESCE更新配置项
feat(commands): 添加审批执行状态追踪和事件通知
chore: 更新启动脚本以支持Admin后台
fix(auth-guard): 优化授权状态管理和错误处理
refactor(db): 使用异步密码哈希函数
refactor(totp): 使用异步密码验证函数
style: 清理无用文件和注释
docs: 更新功能全景和审计文档
refactor(service): 优化HTTP客户端重用和请求处理
fix(connection): 改进SaaS不可用时的降级处理
refactor(handlers): 使用异步密码验证函数
chore: 更新依赖和工具链配置
2026-03-29 21:45:29 +08:00
iven
5fdf96c3f5
chore: 提交所有工作进度 — SaaS 后端增强、Admin UI、桌面端集成
...
包含大量 SaaS 平台改进、Admin 管理后台更新、桌面端集成完善、
文档同步、测试文件重构等内容。为 QA 测试准备干净工作树。
2026-03-29 10:46:41 +08:00
iven
80d98b35a5
fix(audit): v5 审计修复 8 项 — 条件编译、安全加固、冗余清理
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- N1: Whiteboard Export 动作标注 demo=true
- N2/N3: Director + A2A 通过 #[cfg(feature)] 条件编译隔离
- N4: viking_adapter 文本匹配降级为 LOW（生产路径走 SqliteStorage）
- N5: 移除冗余 compactor_compact_llm Tauri 命令注册
- M3: hand_approve/hand_cancel 添加 hand_id 验证防跨 Hand 审批
- N7: scheduled_task 文档注释标注 PLANNNED
- 新增 COMPREHENSIVE_AUDIT_V5.md 独立审计报告
- 更新 DEEP_AUDIT_REPORT.md 追加修复记录（累计 32 项）
2026-03-27 12:33:44 +08:00
iven
256dba49db
fix(audit): 第五轮审计修复 — 反思LLM分析、语义路由、并行执行、错误中文化
...
- P2: 反思引擎接入 LLM 深度行为分析 (analyze_patterns_with_llm)
- P3-M6: 语义路由 RuntimeLlmIntentDriver 真实 LLM 匹配
- P3-L1: V2 Pipeline execute_parallel 改用 buffer_unordered 真正并行
- P3-S10: Rust 用户可见错误提示统一中文化
累计修复 27 项，完成度 ~72% → ~78%
2026-03-27 12:10:48 +08:00
iven
30b2515f07
feat(audit): 审计修复第四轮 — 跨会话搜索、LLM压缩集成、Presentation渲染器
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- S9: MessageSearch 新增 Session/Global 双模式，Global 调用 VikingStorage memory_search
- M4b: LLM 压缩器集成到 kernel AgentLoop，支持 use_llm 配置切换
- M4c: 压缩时自动提取记忆到 VikingStorage (runtime + tauri 双路径)
- H6: 新增 ChartRenderer(recharts)、Document/Slideshow 完整渲染
- 累计修复 23 项，整体完成度 ~72%，真实可用率 ~80%
2026-03-27 11:44:14 +08:00
iven
7ae6990c97
fix(audit): 修复深度审计 P2 问题 — 自主授权后端守卫、反思历史累积、心跳持久化
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- M5-补: hand_execute/skill_execute 接收 autonomy_level 参数，后端三层守卫
(supervised 全部审批 / assisted 尊重 needs_approval / autonomous 跳过)
- M3: hand_approve/hand_cancel 移除 _hand_name 下划线，添加审计日志
- M4-补: 反思历史累积存储到 reflection:history:{agent_id} 数组(最多20条)
get_history 优先读持久化历史，保留 latest key 向后兼容
- 心跳历史: VikingStorage 持久化 HeartbeatResult 数组，tick() 也存历史
heartbeat_init 恢复历史，重启后不丢失
- L2: 确认 gatewayStore 仅注释引用，无需修改
- 身份回滚: 确认 IdentityChangeProposal.tsx 已实现 HistoryItem + restoreSnapshot
- 更新 DEEP_AUDIT_REPORT.md 完成度 72% (核心 92%, 真实可用 80%)
2026-03-27 11:32:35 +08:00
iven
b7bc9ddcb1
fix(audit): 修复深度审计 P1/P2 问题 — 记忆统一、持久化、前端适配
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
H3: 重写 memory_commands.rs 统一到 VikingStorage 单一存储，移除双写
H4: 心跳引擎 record_interaction() 持久化到 VikingStorage，启动时恢复
M4: 反思结果/状态持久化到 VikingStorage metadata，重启后自动恢复
- HandApprovalModal import 修正 (handStore 替代 gatewayStore)
- kernel-client.ts 幽灵调用替换为 kernel_status
- PersistentMemoryStore dead_code warnings 清理
- 审计报告和 README 更新至 v0.6.3，完成度 58%→62%
2026-03-27 09:59:55 +08:00
iven
a71c4138cc
fix(audit): 修复深度审计发现的 P0/P1 问题 (8项)
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
基于 DEEP_AUDIT_REPORT.md 修复 2 CRITICAL + 4 HIGH + 1 MEDIUM 问题:
- C1: PromptOnly 技能集成 LLM 调用 — 定义 LlmCompleter trait，
通过 LlmDriverAdapter 桥接 zclaw_runtime::LlmDriver，
PromptOnlySkill.execute() 现在调用 LLM 生成内容
- C2: 反思引擎空记忆 bug — 新增 query_memories_for_reflection()
从 VikingStorage 查询真实记忆传入 reflect()
- H7: Agent Store 接口适配 — KernelClient 添加 listClones/createClone/
deleteClone/updateClone 方法，映射到 agent_* 命令
- H8: Hand 审批检查 — hand_execute 执行前检查 needs_approval，
需审批返回 pending_approval 状态
- M1: 幽灵命令注册 — 注册 hand_get/hand_run_status/hand_run_list
三个 Tauri 桩命令
- H1/H2: SpeechHand/TwitterHand 添加 demo 标签
- H5: 归档过时 VERIFICATION_REPORT
文档更新: DEEP_AUDIT_REPORT.md 标记修复状态，README.md 更新
关键指标和变更历史。整体完成度从 ~50% 提升至 ~58%。
2026-03-27 09:36:50 +08:00
iven
0d4fa96b82
refactor: 统一项目名称从OpenFang到ZCLAW
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
重构所有代码和文档中的项目名称，将OpenFang统一更新为ZCLAW。包括：
- 配置文件中的项目名称
- 代码注释和文档引用
- 环境变量和路径
- 类型定义和接口名称
- 测试用例和模拟数据
同时优化部分代码结构，移除未使用的模块，并更新相关依赖项。
2026-03-27 07:36:03 +08:00
iven
8bcabbfb43
refactor: 代码质量清理 - 移除死代码和遗留别名
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
基于全面审计报告的 P0-P2 修复工作：
P0 (已完成):
- intelligence 模块: 精确注释 dead_code 标注原因（Tauri runtime 注册）
- compactor.rs: 实现 LLM 摘要生成（compact_with_llm）
- pipeline_commands.rs: 替换 println! 为 tracing 宏
P1 (已完成):
- 移除 8 个 gateway_* 向后兼容别名（OpenClaw 遗留）
- 前端 tauri-gateway.ts 改为调用 zclaw_* 命令
- 清理 generation.rs 6 个重复的实例方法（-217 行）
- A2A dead_code 注释更新
P2 (已完成):
- Predictor/Lead HAND.toml 设置 enabled=false
- Wasm/Native SkillMode 添加未实现说明
- browser/mod.rs 移除未使用的 re-export（消除 4 个警告）
文档更新:
- feature-checklist.md 从 v0.4.0 更新到 v0.6.0
- CLAUDE.md Hands 状态更新
验证: cargo check 零警告, 42 测试通过, 净减 371 行代码
2026-03-27 00:54:57 +08:00
iven
9a77fd4645
fix(intelligence): 精确化 dead_code 标注并实现 LLM 上下文压缩
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- 将 intelligence/llm/memory/browser 模块的 dead_code 注释从模糊的
"reserved for future" 改为明确说明 Tauri invoke_handler 运行时注册机制
- 为 identity.rs 中 3 个真正未使用的方法添加 #[allow(dead_code)]
- 实现 compactor use_llm: true 功能：新增 compact_with_llm 方法和
compactor_compact_llm Tauri 命令，支持 LLM 驱动的对话摘要生成
- 将 pipeline_commands.rs 中 40+ 处 println!/eprintln! 调试输出替换为
tracing::debug!/warn!/error! 结构化日志
- 移除 intelligence/mod.rs 中不必要的 #[allow(unused_imports)]
2026-03-27 00:43:14 +08:00
iven
978dc5cdd8
fix(安全): 修复HTML导出中的XSS漏洞并清理调试日志
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
refactor(日志): 替换console.log为tracing日志系统
style(代码): 移除未使用的代码和依赖项
feat(测试): 添加端到端测试文档和CI工作流
docs(变更日志): 更新CHANGELOG.md记录0.1.0版本变更
perf(构建): 更新依赖版本并优化CI流程
2026-03-26 19:49:03 +08:00
iven
9ee23e444c
fix(dev-server): 修复开发服务器和前端兼容性问题
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
修复内容:
1. 修复 dev_server.rs 编译错误 - 使用 Vec::new() 替代数组转换
2. 修复 pipeline-client.ts - 添加 Tauri 运行时检测和开发服务器 fallback
3. 更新 troubleshooting.md - 添加开发服务器使用说明
测试结果:
- 所有前端模块正常加载
- 开发服务器 API 响应正确
- 类型检查通过
2026-03-26 18:10:55 +08:00
iven
85bf47bebb
feat(dev-server): 添加开发模式 HTTP/WebSocket 服务器
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
功能:
- 创建 dev_server.rs 模块，提供 HTTP/WebSocket API
- 使用 feature flag \dev-server\ 控制编译
- 仅绑定 localhost:50051，安全限制 CORS
- 生产构建不包含此模块
使用方式:
- pnpm tauri:dev:web - 启动带开发服务器的 Tauri
- pnpm tauri:dev - 常规开发模式（无服务器）
安全:
- 仅 localhost 绑定
- CORS 限制为 Vite 开发端口
- 通过 feature flag 完全移除生产代码
2026-03-26 17:38:53 +08:00
iven
b7f3d94950
fix(presentation): 修复 presentation 模块类型错误和语法问题
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- 创建 types.ts 定义完整的类型系统
- 重写 DocumentRenderer.tsx 修复语法错误
- 重写 QuizRenderer.tsx 修复语法错误
- 重写 PresentationContainer.tsx 添加类型守卫
- 重写 TypeSwitcher.tsx 修复类型引用
- 更新 index.ts 移除不存在的 ChartRenderer 导出
审计结果:
- 类型检查: 通过
- 单元测试: 222 passed
- 构建: 成功
2026-03-26 17:19:28 +08:00
iven
d0c6319fc1
feat: 添加ESLint和Prettier配置并优化代码结构
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
style: 格式化代码文件并修复样式问题
docs: 新增部署文档和系统要求文档
test: 更新测试截图和覆盖率报告
refactor: 重构SchedulerPanel加载状态逻辑
ci: 添加lint和format脚本到package.json
build: 更新依赖项并添加开发工具
chore: 添加验证报告和上线审查计划
2026-03-26 08:02:23 +08:00
iven
bf6d81f9c6
refactor: 清理未使用代码并添加未来功能标记
...
CI / Rust Check (push) Has been cancelled
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
style: 统一代码格式和注释风格
docs: 更新多个功能文档的完整度和状态
feat(runtime): 添加路径验证工具支持
fix(pipeline): 改进条件判断和变量解析逻辑
test(types): 为ID类型添加全面测试用例
chore: 更新依赖项和Cargo.lock文件
perf(mcp): 优化MCP协议传输和错误处理
2026-03-25 21:55:12 +08:00
iven
aa6a9cbd84
feat: 新增技能编排引擎和工作流构建器组件
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
refactor: 统一Hands系统常量到单个源文件
refactor: 更新Hands中文名称和描述
fix: 修复技能市场在连接状态变化时重新加载
fix: 修复身份变更提案的错误处理逻辑
docs: 更新多个功能文档的验证状态和实现位置
docs: 更新Hands系统文档
test: 添加测试文件验证工作区路径
2026-03-25 08:27:25 +08:00
iven
9c781f5f2a
feat(pipeline): implement Pipeline DSL system for automated workflows
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
Add complete Pipeline DSL system including:
- Rust backend (zclaw-pipeline crate) with parser, executor, and state management
- Frontend components: PipelinesPanel, PipelineResultPreview, ClassroomPreviewer
- Pipeline recommender for Agent conversation integration
- 5 pipeline templates: education, marketing, legal, research, productivity
- Documentation for Pipeline DSL architecture
Pipeline DSL enables declarative workflow definitions with:
- YAML-based configuration
- Expression resolution (${inputs.topic}, ${steps.step1.output})
- LLM integration, parallel execution, file export
- Agent smart recommendations in conversations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-25 00:52:12 +08:00
iven
504d5746aa
feat(skill-execution): implement execute_skill tool with full execution chain
...
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
- Add ExecuteSkillTool for LLM to call skills during conversation
- Implement SkillExecutor trait in Kernel for skill execution
- Update AgentLoop to support tool execution with skill_executor
- Add default skills_dir configuration in KernelConfig
- Connect frontend skillMarketStore to backend skill_list command
- Update technical documentation with Skill system architecture
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-24 13:24:23 +08:00
