From 4f7ec780f6bffd437ae62873aee01c278247b4a2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 06:41:19 +0000 Subject: [PATCH 01/28] chore(deps): bump rand in /packages/cheers-acp-connector-rs Bumps [rand](https://github.com/rust-random/rand) from 0.8.6 to 0.10.2. - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/0.8.6...0.10.2) --- updated-dependencies: - dependency-name: rand dependency-version: 0.10.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- packages/cheers-acp-connector-rs/Cargo.lock | 8 ++++---- packages/cheers-acp-connector-rs/Cargo.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/cheers-acp-connector-rs/Cargo.lock b/packages/cheers-acp-connector-rs/Cargo.lock index fd20a02d..199a9689 100644 --- a/packages/cheers-acp-connector-rs/Cargo.lock +++ b/packages/cheers-acp-connector-rs/Cargo.lock @@ -333,7 +333,7 @@ dependencies = [ "libc", "mime_guess", "notify", - "rand 0.8.6", + "rand 0.10.2", "reqwest", "rustls", "serde", @@ -1701,9 +1701,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.6" +version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" +checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a" dependencies = [ "libc", "rand_chacha", @@ -2663,7 +2663,7 @@ dependencies = [ "http", "httparse", "log", - "rand 0.8.6", + "rand 0.8.7", "rustls", "rustls-pki-types", "sha1", diff --git a/packages/cheers-acp-connector-rs/Cargo.toml b/packages/cheers-acp-connector-rs/Cargo.toml index 7b635f99..1b86cb5e 100644 --- a/packages/cheers-acp-connector-rs/Cargo.toml +++ b/packages/cheers-acp-connector-rs/Cargo.toml @@ -42,7 +42,7 @@ mime_guess = "2" # unsolicited workspace_event frames). We drive it with a manual ~300ms debounce # (no notify-debouncer crate) so event coalescing + the watch TTL live in one task. notify = "8" -rand = "0.8" +rand = "0.10" # Self-update downloads (signed manifest + binaries) through the gateway's # release proxy. rustls-only, matching tokio-tungstenite's TLS stack. reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots"] } From a39b93578a07938f12c66ef5b15bfbd107385c20 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 14:52:44 +0800 Subject: [PATCH 02/28] =?UTF-8?q?docs(website):=20add=20user-facing=20ACP?= =?UTF-8?q?=20connector=20guide=20(EN=20+=20=E4=B8=AD=E6=96=87)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New connector.html / connector.zh-CN.html walk a non-developer through installing, getting a token, writing one config file, and — importantly — keeping the ACP connector updated, with the "bot can't see attached files → update the connector" failure mode called out prominently (the exact symptom from a real haowe_codex report). Linked from both homepages' Docs grids; recorded in website/README.md. Co-Authored-By: Claude Opus 4.8 --- website/README.md | 4 + website/connector.html | 388 +++++++++++++++++++++++++++++++++++ website/connector.zh-CN.html | 378 ++++++++++++++++++++++++++++++++++ website/index.html | 1 + website/index.zh-CN.html | 1 + 5 files changed, 772 insertions(+) create mode 100644 website/connector.html create mode 100644 website/connector.zh-CN.html diff --git a/website/README.md b/website/README.md index 074b4463..38f0c28e 100644 --- a/website/README.md +++ b/website/README.md @@ -11,6 +11,10 @@ Pages: - `index.zh-CN.html` — Chinese mirror of the homepage; the two link to each other via the 中文 / EN button in the nav. Keep both in sync when editing. - `plugin-dev.html` — workbench renderer plugin guide (English only for now). +- `connector.html` / `connector.zh-CN.html` — user-facing guide to the ACP + connector (connect your own Claude/Codex bot): install, token, config, keeping + it updated, and the "bot can't see attached files → update the connector" + fix. The two mirror each other via the 中文 / EN button; keep both in sync. ## Preview locally diff --git a/website/connector.html b/website/connector.html new file mode 100644 index 00000000..d49cb85e --- /dev/null +++ b/website/connector.html @@ -0,0 +1,388 @@ + + + + + +Connect your AI agent — Cheers ACP Connector + + + + + + +
+
+ 🍻 Cheers + +
+ 中文 + + GitHub +
+
+
+ +
+
+
User Guide
+

Connect your AI agent

+

The ACP connector is a small program you run on your own computer. It plugs your + personal Claude or Codex into a Cheers bot so it can read channels, see the files you attach, and reply — all + using your own agent subscription. This guide walks a non-developer through it: install, connect, keep it + updated, and fix the most common surprise.

+ +
The one thing to remember: when the connector is out of date, your bot + quietly loses new features — most visibly, it stops seeing files you attach to a message. If a bot + replies "please upload the files or give me the path" even though you attached them, jump to + step 6 — keep it updated.
+ +

1. What the connector is (30-second version)

+

Cheers has no AI built in. Instead, you bring your own agent and connect it from your machine. + Three pieces talk to each other:

+
your browser ──▶ Cheers gateway (the server) ◀──── connector (runs on your PC) ──▶ your AI agent
+                                                    └ one config file = one bot
+
    +
  • The gateway is the Cheers server your team already runs.
    • +
  • The connector (cce-acp-connector) is the little bridge you install and run.
    • +
  • Your agent is Claude or Codex, signed in with your own subscription — no extra API key needed.
    • +
+

One config file describes one bot. Want two bots (say a Claude bot and a Codex bot)? Two files, run two of them. + They're fully independent.

+ +

2. Before you start

+
+ + + + + +
You needHow to check
A Cheers server you can reachAsk your admin for the address, e.g. ws://localhost:8000 or your team's URL
Your agent installedRun command -v claude-agent-acp (or codex-acp) — it should print a path
Your agent signed inThe folder ~/.claude (or ~/.codex) exists — that's your subscription login
Permission to manage a botYou (or an admin) can open Settings → Bots in Cheers
+

That's it — you do not need Rust, Docker, or an API key. Signing into your agent once is enough.

+ +

3. Install the connector

+

Download the prebuilt binary for your OS — no toolchain required. Paste this into a terminal:

+
# pick the right file for your OS/CPU, download it, make it runnable
+os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+mkdir -p ~/.cheers/bin
+curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
+  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+chmod +x ~/.cheers/bin/cce-acp-connector
+export PATH="$HOME/.cheers/bin:$PATH"   # add this line to your ~/.zshrc so it sticks
+cce-acp-connector --help                # prints help = success
+
If the repo is private, plain curl returns a 404. Download with the + GitHub CLI instead, e.g. + gh release download connector-v0.1.28 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector.
+ +

4. Create the bot and get its token

+

A token is the connector's password to log in to the gateway as your bot. Get one in the UI:

+
    +
  1. Sign in to Cheers and open Settings → Bots.
    2. +
  2. Create a bot (or open an existing one). Give it a name like claude, and set its + bridge/provider type to generic / ACP.
    3. +
  3. Issue a token and copy it. Save it into a small file that only you can read: +
    mkdir -p ~/.cheers/secrets && chmod 700 ~/.cheers/secrets
+# paste the token in place of PASTE_TOKEN_HERE:
+printf '%s' 'PASTE_TOKEN_HERE' > ~/.cheers/secrets/claude.token
+chmod 600 ~/.cheers/secrets/claude.token
    +
    4. +
+
Keep the token in a file, never inside the config. Config files get shared, + screenshotted, and committed to git — a token pasted inline leaks. Issuing a new token also replaces the + old one, so only one connector should use a bot at a time.
+ +

5. Write one config file

+

Create ~/.cheers/cheers-daemon.claude.toml. This is the minimal form — the rest have sensible + defaults. Change the two URLs to match your gateway, and the command to your agent's path:

+
version = 1
+
+[daemon]
+state_path = "state-claude.json"   # these are relative to this file's folder (~/.cheers)
+log_dir    = "logs-claude"
+
+[accounts.claude.bridge]
+control_url    = "ws://localhost:8000/ws/agent-bridge/control"
+data_url       = "ws://localhost:8000/ws/agent-bridge/data"
+bot_token_file = "secrets/claude.token"   # the file from step 4 — never paste the token here
+
+[accounts.claude.adapter]
+type    = "stdio"
+command = "/opt/homebrew/bin/claude-agent-acp"   # output of: command -v claude-agent-acp
+args    = []
+
+[accounts.claude.policy.prompt]
+allow             = true
+allow_attachments = true    # ← lets the bot receive files you attach to a message
+allow_images      = true
+
+[accounts.claude.policy.workspace]
+default_cwd   = "~/.cheers/workspace"
+allowed_roots = ["~/.cheers/workspace"]
+backend_may_set_cwd = true
+
+[accounts.claude.policy.env]
+inherit = false
+allow   = ["HOME", "PATH"]   # HOME lets the agent read your ~/.claude subscription login
+
+[accounts.claude.policy.permission]
+forward_to_backend = true    # tool-use asks show up as an approval card in the channel
+wait_timeout_ms    = 900000
+on_timeout         = "cancel"
+auto_allow         = false
+
+[accounts.claude.policy.mcp]
+inject_cheers = true         # gives the agent the Cheers tools (read files, post messages…)
+

The config folder ends up looking like this:

+
~/.cheers/
+├─ cheers-daemon.claude.toml     # one file = one bot
+├─ secrets/claude.token          # the token, chmod 600
+├─ workspace/                    # where the agent works
+└─ logs-claude/                  # its logs
+ +

Start it & check it's online

+
cce-acp-connector start  --config ~/.cheers/cheers-daemon.claude.toml --name claude
+cce-acp-connector status --name claude          # → status=running
+cce-acp-connector logs   --name claude --lines 40
+# expect "initialized ACP agent" + "BridgeRuntime started", no ERROR lines
+

Now @-mention the bot in a Cheers channel. A reply means you're connected. 🎉 Because the token lives in a file, + restarts need no extra steps: cce-acp-connector restart --name claude.

+ +

6. Keep it updated (important)

+

New Cheers features often need a matching connector version. An outdated connector still connects and + runs fine — it just silently skips whatever it doesn't understand yet. The most common casualty is + attached context: the file chips show in the chat, but your bot never receives them and asks you + to upload the files. Updating fixes it.

+ +

See whether you're behind

+
cce-acp-connector status --name claude
+# if a newer release exists you'll see an "update available:" line here,
+# and a warning in the logs at startup.
+ +

Option A — turn on signed auto-update (connector ≥ 0.1.27)

+

Add this to your config, then restart once. From then on the connector updates itself safely (it checks an + ed25519 signature and checksum, waits until it's idle, swaps in place, and rolls back if the new one is unhealthy):

+
[update]
+auto = true
+
Upgrading a very old install? Binaries older than 0.1.27 reject a + config that contains [update]. In that case update the binary first (Option B), then add the + [update] section.
+ +

Option B — update by hand

+

Re-run the download from step 3 (it overwrites the old binary), then restart:

+
os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
+  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+chmod +x ~/.cheers/bin/cce-acp-connector
+cce-acp-connector restart --name claude
+

Auto-update is off by default on purpose — updating runs downloaded code, so the owner of the + machine opts in. You can hard-disable it anytime with CHEERS_ACP_NO_SELF_UPDATE=1.

+ +

7. How attaching files works

+

In the message composer, Add context lets you attach a file (or a line range like + review.md:1-1, or a file from a workspace). Each attachment becomes a small chip on your message. + When you send, Cheers passes those references to the bot's connector, which puts them into the agent's prompt so + it knows what you're pointing at.

+
    +
  • The bot resolves the reference on its side (it reads the file through the Cheers tools) — so it works even for + large files without pasting the whole thing.
    • +
  • For this to happen, the bot's config needs allow_attachments = true (it's in the template above) + and a current connector. Old connectors drop the references silently.
    • +
+ +

8. Troubleshooting

+
+ + + + + + + + +
What you seeLikely causeFix
Bot ignores files you attached — asks you to upload them or give a path, even though the chips are on your messageThe connector is older than the version that renders attached context into the promptUpdate the connector (≥ 0.1.28), then restart. Also confirm allow_attachments = true.
start exits right away, log mentions the tokenThe token file is missing or emptyRe-do step 4; check ~/.cheers/secrets/<name>.token exists and isn't empty
log: command not foundWrong path to your agentcommand -v claude-agent-acp and put the absolute path in adapter.command
Agent starts but never replies / auth failsThe agent can't read your subscription loginMake sure policy.env.allow includes HOME
Keeps reconnecting / never connectsWrong gateway address, or gateway downCheck the two ws://… URLs with your admin; confirm the server is up
unsupported protocolVersion … ClosingYour agent's version doesn't match the connectorUpdate the agent (claude-agent-acp / codex-acp) to a current version
A tool action hangs "waiting for approval"auto_allow = false (the safe default)Approve it on the channel's approval card, or set auto_allow = true to trust it locally
+ +

Read more

+
+ + 📖 Local Bot Setup Guide + The full reference: every config field, multiple bots, token strategy, all options. + + + 🔌 Agent Bridge Guide + Concepts, creating a bot in the UI, and the containerized bot path. + + + 🔎 Troubleshooting Q&A + Health checks, logs, and what to do when a bot goes quiet. + +
+
+
+ +
+
+
🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
+
+ Home + GitHub + License +
+
+
+ + + + diff --git a/website/connector.zh-CN.html b/website/connector.zh-CN.html new file mode 100644 index 00000000..d0eb57d3 --- /dev/null +++ b/website/connector.zh-CN.html @@ -0,0 +1,378 @@ + + + + + +连接你的 AI 智能体 — Cheers ACP 连接器 + + + + + + +
+
+ 🍻 Cheers + +
+ EN + + GitHub +
+
+
+ +
+
+
用户指南
+

连接你的 AI 智能体

+

ACP 连接器是一个跑在你自己电脑上的小程序。它把你个人的 Claude 或 Codex 接到一个 Cheers 机器人上， + 让它能读频道、看到你附加的文件、并回复——全程用你自己的智能体订阅。本文面向非开发者，带你走一遍：安装、连接、保持更新， + 并解决那个最常见的意外。

+ +
只需记住一件事：连接器一旦过期，你的机器人会悄悄失去新功能——最明显的就是 + 看不到你附加到消息里的文件。如果你明明附了文件，机器人却回复"请上传这些文件或提供路径"，直接跳到 + 第 6 步——保持更新。
+ +

1. 连接器是什么（30 秒版）

+

Cheers 本身不内置 AI。相反，你自带智能体，从你的电脑把它连进来。三个部件互相通信：

+
你的浏览器 ──▶ Cheers 网关（服务器） ◀──── 连接器（跑在你电脑上） ──▶ 你的 AI 智能体
+                                          └ 一个配置文件 = 一个机器人
+
    +
  • 网关是你团队已经在跑的 Cheers 服务器。
    • +
  • 连接器（cce-acp-connector）是你要安装并运行的小桥梁。
    • +
  • 你的智能体是 Claude 或 Codex，用你自己的订阅登录——不需要额外的 API key。
    • +
+

一个配置文件描述一个机器人。想要两个机器人（比如一个 Claude、一个 Codex）？两个文件，跑两份，彼此完全独立。

+ +

2. 开始之前

+
+ + + + + +
你需要怎么确认
能连上的 Cheers 服务器问管理员要地址，比如 ws://localhost:8000 或团队的 URL
已安装智能体运行 command -v claude-agent-acp（或 codex-acp），应打印出一个路径
智能体已登录存在 ~/.claude（或 ~/.codex）目录——那就是你的订阅登录
有管理机器人的权限你（或管理员）能在 Cheers 里打开 设置 → 机器人
+

就这些——你不需要 Rust、Docker，也不需要 API key。给智能体登录一次就够了。

+ +

3. 安装连接器

+

下载对应你系统的预编译二进制，无需任何工具链。把下面这段粘进终端：

+
# 自动挑选对应系统/CPU 的文件、下载、赋予可执行权限
+os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+mkdir -p ~/.cheers/bin
+curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
+  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+chmod +x ~/.cheers/bin/cce-acp-connector
+export PATH="$HOME/.cheers/bin:$PATH"   # 把这行加进 ~/.zshrc 就能长期生效
+cce-acp-connector --help                # 打印出帮助 = 成功
+
如果仓库是私有的，直接 curl 会返回 404。改用 GitHub CLI 下载，例如 + gh release download connector-v0.1.28 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector。
+ +

4. 创建机器人并拿到令牌

+

令牌（token）是连接器以你的机器人身份登录网关用的"密码"。在界面里获取：

+
    +
  1. 登录 Cheers，打开 设置 → 机器人。
    2. +
  2. 创建一个机器人（或打开已有的）。取个名字如 claude，把 bridge/provider 类型设为 + generic / ACP。
    3. +
  3. 签发令牌并复制。把它存进一个只有你能读的小文件： +
    mkdir -p ~/.cheers/secrets && chmod 700 ~/.cheers/secrets
+# 把 PASTE_TOKEN_HERE 换成你复制的令牌：
+printf '%s' 'PASTE_TOKEN_HERE' > ~/.cheers/secrets/claude.token
+chmod 600 ~/.cheers/secrets/claude.token
    +
    4. +
+
令牌放文件里，绝不要写进配置文件。配置文件会被分享、截图、提交到 git——内联的令牌一定会泄露。 + 另外，重新签发会作废旧令牌，所以同一个机器人同一时间只能有一个连接器在用。
+ +

5. 写一个配置文件

+

创建 ~/.cheers/cheers-daemon.claude.toml。这是最小形式——其余字段都有合理默认值。把两个 URL 改成你的网关地址， + 把 command 改成你智能体的路径：

+
version = 1
+
+[daemon]
+state_path = "state-claude.json"   # 相对于本文件所在目录（~/.cheers）
+log_dir    = "logs-claude"
+
+[accounts.claude.bridge]
+control_url    = "ws://localhost:8000/ws/agent-bridge/control"
+data_url       = "ws://localhost:8000/ws/agent-bridge/data"
+bot_token_file = "secrets/claude.token"   # 第 4 步的文件——绝不在这里直接写令牌
+
+[accounts.claude.adapter]
+type    = "stdio"
+command = "/opt/homebrew/bin/claude-agent-acp"   # command -v claude-agent-acp 的输出
+args    = []
+
+[accounts.claude.policy.prompt]
+allow             = true
+allow_attachments = true    # ← 让机器人能收到你附加的文件
+allow_images      = true
+
+[accounts.claude.policy.workspace]
+default_cwd   = "~/.cheers/workspace"
+allowed_roots = ["~/.cheers/workspace"]
+backend_may_set_cwd = true
+
+[accounts.claude.policy.env]
+inherit = false
+allow   = ["HOME", "PATH"]   # HOME 让智能体能读到你 ~/.claude 的订阅登录
+
+[accounts.claude.policy.permission]
+forward_to_backend = true    # 工具调用请求会作为审批卡片出现在频道里
+wait_timeout_ms    = 900000
+on_timeout         = "cancel"
+auto_allow         = false
+
+[accounts.claude.policy.mcp]
+inject_cheers = true         # 给智能体注入 Cheers 工具（读文件、发消息……）
+

配置目录最终长这样：

+
~/.cheers/
+├─ cheers-daemon.claude.toml     # 一个文件 = 一个机器人
+├─ secrets/claude.token          # 令牌，权限 600
+├─ workspace/                    # 智能体的工作目录
+└─ logs-claude/                  # 它的日志
+ +

启动并确认在线

+
cce-acp-connector start  --config ~/.cheers/cheers-daemon.claude.toml --name claude
+cce-acp-connector status --name claude          # → status=running
+cce-acp-connector logs   --name claude --lines 40
+# 应看到 "initialized ACP agent" 和 "BridgeRuntime started"，没有 ERROR
+

现在在 Cheers 频道里 @ 这个机器人。有回复就说明连上了。🎉 因为令牌存在文件里，重启不需要任何额外步骤： + cce-acp-connector restart --name claude。

+ +

6. 保持更新 （重要）

+

Cheers 的新功能往往需要相匹配的连接器版本。过期的连接器照样能连、照样能跑——它只是会悄悄跳过自己还看不懂的东西。 + 最常见的"受害者"就是附加的 context：文件小标签（chip）在聊天里显示得好好的，但机器人根本没收到，还反过来让你上传文件。 + 更新一下就能修好。

+ +

先看你是不是落后了

+
cce-acp-connector status --name claude
+# 若有更新版本，这里会出现一行 "update available:"，
+# 启动时的日志里也会有一条提醒。
+ +

方式 A —— 打开带签名的自动更新（连接器 ≥ 0.1.27）

+

在配置里加上这段，然后重启一次。之后连接器会安全地自我更新（校验 ed25519 签名和 sha256、等空闲、原地替换， + 新版本不健康还会自动回滚）：

+
[update]
+auto = true
+
升级很老的版本？低于 0.1.27 的二进制会拒绝含 [update] 的配置。 + 这种情况先用方式 B 更新二进制，再加 [update] 段。
+ +

方式 B —— 手动更新

+

重新跑一遍第 3 步的下载（会覆盖旧二进制），然后重启：

+
os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
+  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+chmod +x ~/.cheers/bin/cce-acp-connector
+cce-acp-connector restart --name claude
+

自动更新默认关闭是有意为之——更新意味着执行下载来的代码，所以由机器主人自己选择开启。 + 你随时可以用 CHEERS_ACP_NO_SELF_UPDATE=1 彻底禁用它。

+ +

7. 附加文件是怎么工作的

+

在消息输入框里，Add context（添加上下文）让你附加一个文件（或像 review.md:1-1 这样的行范围， + 或工作区里的某个文件）。每个附件会在你的消息上变成一个小标签。发送时，Cheers 把这些引用传给机器人的连接器， + 连接器再把它们写进智能体的 prompt，让它知道你指的是什么。

+
    +
  • 机器人在它那侧解析这些引用（通过 Cheers 工具去读文件）——所以大文件也不用整段粘贴。
    • +
  • 要实现这一点，机器人的配置需要 allow_attachments = true（上面模板里已有），并且连接器要是 + 较新版本。旧连接器会静默丢弃这些引用。
    • +
+ +

8. 排障

+
+ + + + + + + + +
你看到的现象可能原因处理
机器人无视你附加的文件——让你上传或给路径，尽管消息上明明有小标签连接器版本旧于"把附加 context 渲染进 prompt"的那一版更新连接器（≥ 0.1.28）后 restart；同时确认 allow_attachments = true。
start 立刻退出，日志提到 token令牌文件缺失或为空重做第 4 步；确认 ~/.cheers/secrets/<名字>.token 存在且非空
日志：command not found智能体路径不对command -v claude-agent-acp，把绝对路径填进 adapter.command
智能体启动了但从不回复 / 鉴权失败智能体读不到你的订阅登录确保 policy.env.allow 里包含 HOME
反复重连 / 一直连不上网关地址不对，或网关没起找管理员核对两个 ws://… URL；确认服务器在线
unsupported protocolVersion … Closing你的智能体版本和连接器不匹配把智能体（claude-agent-acp / codex-acp）更新到较新版本
某个工具动作卡在"等待审批"auto_allow = false（安全默认）在频道的审批卡片上批准；或设 auto_allow = true 在本地信任它
+ +

延伸阅读

+
+ + 📖 本地 Bot 配置指南 + 完整参考：每个配置字段、多机器人、令牌策略、全部选项。 + + + 🔌 Agent Bridge 接入指南 + 概念、在界面里创建机器人、容器化机器人路径。 + + + 🔎 技术排查 Q&A + 健康检查、日志，以及机器人不吭声时怎么办。 + +
+
+
+ +
+
+
🍻 Cheers —— 面向人类与 AI 智能体的开源协作。MIT 许可。
+
+ 首页 + GitHub + 许可证 +
+
+
+ + + + diff --git a/website/index.html b/website/index.html index c514df82..51a5d0ac 100644 --- a/website/index.html +++ b/website/index.html @@ -555,6 +555,7 @@

Go deeper

📚 Documentation HomeIndex of user, admin, and operations guides. + 🔗 Connect your AI agentPlug your own Claude / Codex into Cheers with the ACP connector — install, token, config, updates. 🐳 Docker Compose DeploySingle-host stack, JWT keys, bot setup, TLS, ops. ☸️ Helm ChartKubernetes deployment, values, secrets, ingress. 🏗️ ArchitectureSystem design, data flow, and protocols. diff --git a/website/index.zh-CN.html b/website/index.zh-CN.html index 1ffd6171..5bc02730 100644 --- a/website/index.zh-CN.html +++ b/website/index.zh-CN.html @@ -554,6 +554,7 @@

深入了解

📚 文档主页用户、管理员与运维指南索引。 + 🔗 连接你的 AI 智能体用 ACP 连接器把你自己的 Claude / Codex 接入 Cheers——安装、令牌、配置、更新。 🐳 Docker Compose 部署单机全栈、JWT 密钥、bot 配置、TLS、运维。 ☸️ Helm ChartKubernetes 部署、values、密钥、ingress。（英文） 🏗️ 架构系统设计、数据流与协议。（英文） From 2a5e8426c1625b3daf39febc8fc86e78ee6ad629 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 16:15:09 +0800 Subject: [PATCH 03/28] perf(post_message): trim the bot post_message hot path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The MCP post_message tool maps to the channel.messages.create resource, which crosses MCP → loopback HTTP → connector WS → gateway. Four changes cut latency on that path and make it measurable: - loopback: HTTP keep-alive so the MCP↔connector socket is reused across resource calls instead of reconnecting per call (Connection: close → keep-alive, with carry-over buffering for pipelined requests, a clean-EOF signal, and a 120s idle timeout). Helps every tool, not just post_message. - gateway: spawn the post-commit broadcast (Redis PUBLISH + chain resolution + bot@bot trigger) off the reply's critical path, so post_message returns as soon as the row commits. Ordering stays correct — the frontend re-sorts incoming message frames by channel_seq. - gateway: resolve mention_names in one batched ANY() query instead of one round-trip per name (the lone N+1 in the create path), mirroring validate_mention_ids. Group-token expansion and error/order semantics preserved. - instrumentation: debug-level timing spans on the connector WS round-trip and the gateway db-path, plus the off-path broadcast, so the dominant hop is a number rather than a guess. Co-Authored-By: Claude Opus 4.8 --- .../src/bridge_runtime/mod.rs | 11 + .../cheers-acp-connector-rs/src/loopback.rs | 311 +++++++++++++----- server/src/domain/mentions.rs | 100 ++++-- server/src/gateway/ws/agent_bridge.rs | 40 ++- server/src/resource/messages.rs | 14 + 5 files changed, 344 insertions(+), 132 deletions(-) diff --git a/packages/cheers-acp-connector-rs/src/bridge_runtime/mod.rs b/packages/cheers-acp-connector-rs/src/bridge_runtime/mod.rs index ffd424ed..423b3c16 100644 --- a/packages/cheers-acp-connector-rs/src/bridge_runtime/mod.rs +++ b/packages/cheers-acp-connector-rs/src/bridge_runtime/mod.rs @@ -1767,6 +1767,10 @@ impl RuntimeContext { .await .pending_resources .insert(request.req_id.clone(), tx); + // Perf instrumentation: wall-clock of the connector→gateway→connector round-trip + // for one resource call (the WS hop). Compare with the gateway-side + // `messages.create db-path complete` span to see which hop dominates latency. + let started = std::time::Instant::now(); tracing::debug!(%req_id, %resource, "loopback resource_req sent"); self.io .send_data(DataOutbound::ResourceReq { @@ -1792,6 +1796,13 @@ impl RuntimeContext { error: Some("resource response timed out".to_string()), code: Some("RESOURCE_TIMEOUT".to_string()), }); + tracing::debug!( + %req_id, + %resource, + ok = response.ok, + elapsed_ms = started.elapsed().as_millis() as u64, + "loopback resource round-trip complete" + ); // inbox_deliver / inbox_stage create a channel file; record its id on the // active run so the Done reply attaches it as a chat attachment. if response.ok && (resource == "channel.files.create" || resource == "channel.files.stage") diff --git a/packages/cheers-acp-connector-rs/src/loopback.rs b/packages/cheers-acp-connector-rs/src/loopback.rs index f3d373ab..087d9594 100644 --- a/packages/cheers-acp-connector-rs/src/loopback.rs +++ b/packages/cheers-acp-connector-rs/src/loopback.rs @@ -2,14 +2,20 @@ use std::collections::BTreeMap; use std::net::SocketAddr; +use std::time::Duration; use anyhow::{anyhow, Context}; use serde_json::{json, Value}; use tokio::io::{AsyncReadExt, AsyncWriteExt}; use tokio::net::{TcpListener, TcpStream}; use tokio::sync::{mpsc, oneshot}; +use tokio::time::timeout; use uuid::Uuid; +/// Drop a kept-alive loopback connection after this long with no new request, so +/// a pooled-but-idle MCP socket can't leak a task/fd for the life of the session. +const LOOPBACK_IDLE_TIMEOUT: Duration = Duration::from_secs(120); + #[derive(Debug, Clone)] pub struct LoopbackHandle { pub url: String, @@ -69,131 +75,179 @@ async fn handle_connection( tx: mpsc::Sender, expected_token: &str, ) -> anyhow::Result<()> { - let request = read_http_request(&mut stream).await?; - if request.method != "POST" { - write_http_json( - &mut stream, - 405, - &json!({ "ok": false, "code": "METHOD_NOT_ALLOWED", "error": "loopback only accepts POST" }), - ) - .await?; - return Ok(()); - } - if !request_has_token(&request.headers, expected_token) { + // Persist across requests: bytes read past one request's body belong to the + // next pipelined request on the same kept-alive connection. + let mut buf: Vec = Vec::new(); + loop { + let request = + match timeout(LOOPBACK_IDLE_TIMEOUT, read_http_request(&mut stream, &mut buf)).await { + Ok(result) => match result? { + Some(request) => request, + None => return Ok(()), // client closed the idle connection cleanly + }, + Err(_) => return Ok(()), // idle too long — drop the connection + }; + let keep_alive = request.wants_keep_alive(); + + // Error responses always close: a bad method/token connection is not worth + // keeping around, and closing keeps the state machine simple. + if request.method != "POST" { + write_http_json( + &mut stream, + 405, + false, + &json!({ "ok": false, "code": "METHOD_NOT_ALLOWED", "error": "loopback only accepts POST" }), + ) + .await?; + return Ok(()); + } + if !request_has_token(&request.headers, expected_token) { + write_http_json( + &mut stream, + 401, + false, + &json!({ "ok": false, "code": "UNAUTHORIZED", "error": "invalid loopback token" }), + ) + .await?; + return Ok(()); + } + + let body: Value = + serde_json::from_slice(&request.body).context("loopback request body JSON")?; + let resource = body + .get("resource") + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("loopback request requires resource"))? + .to_string(); + let params = body.get("params").cloned(); + let req_id = body + .get("req_id") + .or_else(|| body.get("reqId")) + .and_then(Value::as_str) + .map(ToString::to_string) + .unwrap_or_else(|| Uuid::new_v4().to_string()); + let (respond_to, response_rx) = oneshot::channel(); + tx.send(LoopbackRequest { + req_id: req_id.clone(), + resource, + params, + respond_to, + }) + .await + .context("loopback runtime receiver closed")?; + let response = response_rx.await.unwrap_or_else(|_| LoopbackResponse { + ok: false, + data: None, + error: Some("runtime did not answer loopback request".to_string()), + code: Some("RUNTIME_CLOSED".to_string()), + }); write_http_json( &mut stream, - 401, - &json!({ "ok": false, "code": "UNAUTHORIZED", "error": "invalid loopback token" }), + 200, + keep_alive, + &json!({ + "ok": response.ok, + "req_id": req_id, + "data": response.data, + "error": response.error, + "code": response.code, + }), ) .await?; - return Ok(()); + if !keep_alive { + return Ok(()); + } } - - let body: Value = - serde_json::from_slice(&request.body).context("loopback request body JSON")?; - let resource = body - .get("resource") - .and_then(Value::as_str) - .ok_or_else(|| anyhow!("loopback request requires resource"))? - .to_string(); - let params = body.get("params").cloned(); - let req_id = body - .get("req_id") - .or_else(|| body.get("reqId")) - .and_then(Value::as_str) - .map(ToString::to_string) - .unwrap_or_else(|| Uuid::new_v4().to_string()); - let (respond_to, response_rx) = oneshot::channel(); - tx.send(LoopbackRequest { - req_id: req_id.clone(), - resource, - params, - respond_to, - }) - .await - .context("loopback runtime receiver closed")?; - let response = response_rx.await.unwrap_or_else(|_| LoopbackResponse { - ok: false, - data: None, - error: Some("runtime did not answer loopback request".to_string()), - code: Some("RUNTIME_CLOSED".to_string()), - }); - write_http_json( - &mut stream, - 200, - &json!({ - "ok": response.ok, - "req_id": req_id, - "data": response.data, - "error": response.error, - "code": response.code, - }), - ) - .await?; - Ok(()) } #[derive(Debug)] struct HttpRequest { method: String, + version: String, headers: BTreeMap, body: Vec, } -async fn read_http_request(stream: &mut TcpStream) -> anyhow::Result { - let mut buf = Vec::new(); +impl HttpRequest { + /// HTTP/1.1 keeps the connection alive unless `Connection: close`; HTTP/1.0 + /// closes unless `Connection: keep-alive`. reqwest's pool sends 1.1, so the + /// common path reuses the socket. + fn wants_keep_alive(&self) -> bool { + match self.headers.get("connection") { + Some(value) if value.eq_ignore_ascii_case("close") => false, + Some(value) if value.eq_ignore_ascii_case("keep-alive") => true, + _ => self.version != "HTTP/1.0", + } + } +} + +/// Read one HTTP request off the stream, reusing `buf` as a carry-over buffer so +/// bytes belonging to a following pipelined request survive to the next call. +/// Returns `Ok(None)` on a clean EOF with nothing buffered — a client closing an +/// idle kept-alive connection, which is not an error. +async fn read_http_request( + stream: &mut TcpStream, + buf: &mut Vec, +) -> anyhow::Result> { let mut tmp = [0_u8; 1024]; - let header_end; - loop { + let header_end = loop { + if let Some(pos) = find_header_end(buf) { + break pos; + } let read = stream.read(&mut tmp).await?; if read == 0 { + if buf.is_empty() { + return Ok(None); // idle connection closed cleanly between requests + } return Err(anyhow!("connection closed before HTTP headers")); } buf.extend_from_slice(&tmp[..read]); - if let Some(pos) = find_header_end(&buf) { - header_end = pos; - break; - } if buf.len() > 64 * 1024 { return Err(anyhow!("loopback HTTP headers too large")); } - } - let headers_text = - std::str::from_utf8(&buf[..header_end]).context("loopback HTTP headers are not utf8")?; - let mut lines = headers_text.lines(); - let request_line = lines - .next() - .ok_or_else(|| anyhow!("missing loopback HTTP request line"))?; - let method = request_line - .split_whitespace() - .next() - .unwrap_or_default() - .to_string(); - let mut headers = BTreeMap::new(); - for line in lines { - if let Some((key, value)) = line.split_once(':') { - headers.insert(key.trim().to_ascii_lowercase(), value.trim().to_string()); + }; + let (method, version, headers) = { + let headers_text = std::str::from_utf8(&buf[..header_end]) + .context("loopback HTTP headers are not utf8")?; + let mut lines = headers_text.lines(); + let request_line = lines + .next() + .ok_or_else(|| anyhow!("missing loopback HTTP request line"))?; + let mut parts = request_line.split_whitespace(); + let method = parts.next().unwrap_or_default().to_string(); + let _path = parts.next(); + let version = parts.next().unwrap_or("HTTP/1.1").to_string(); + let mut headers = BTreeMap::new(); + for line in lines { + if let Some((key, value)) = line.split_once(':') { + headers.insert(key.trim().to_ascii_lowercase(), value.trim().to_string()); + } } - } + (method, version, headers) + }; let content_length = headers .get("content-length") .and_then(|value| value.parse::().ok()) .unwrap_or(0); let body_start = header_end + 4; - let mut body = buf.get(body_start..).unwrap_or_default().to_vec(); - while body.len() < content_length { + let body_end = body_start + content_length; + while buf.len() < body_end { let read = stream.read(&mut tmp).await?; if read == 0 { break; } - body.extend_from_slice(&tmp[..read]); + buf.extend_from_slice(&tmp[..read]); } - body.truncate(content_length); - Ok(HttpRequest { + let available_end = body_end.min(buf.len()); + let body = buf[body_start..available_end].to_vec(); + // Drop this request's bytes; anything left is the start of the next request. + buf.drain(..available_end); + Ok(Some(HttpRequest { method, + version, headers, body, - }) + })) } fn request_has_token(headers: &BTreeMap, expected: &str) -> bool { @@ -212,18 +266,26 @@ fn find_header_end(buf: &[u8]) -> Option { buf.windows(4).position(|window| window == b"\r\n\r\n") } -async fn write_http_json(stream: &mut TcpStream, status: u16, body: &Value) -> anyhow::Result<()> { +async fn write_http_json( + stream: &mut TcpStream, + status: u16, + keep_alive: bool, + body: &Value, +) -> anyhow::Result<()> { let status_text = match status { 200 => "OK", 401 => "Unauthorized", 405 => "Method Not Allowed", _ => "Error", }; + // Content-Length is always present, so the client can frame the body and reuse + // the socket when we keep it alive. + let connection = if keep_alive { "keep-alive" } else { "close" }; let body = serde_json::to_vec(body)?; stream .write_all( format!( - "HTTP/1.1 {status} {status_text}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", + "HTTP/1.1 {status} {status_text}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: {connection}\r\n\r\n", body.len() ) .as_bytes(), @@ -247,4 +309,73 @@ mod tests { headers.insert("x-cheers-loopback-token".to_string(), "secret".to_string()); assert!(request_has_token(&headers, "secret")); } + + fn req(version: &str, connection: Option<&str>) -> HttpRequest { + let mut headers = BTreeMap::new(); + if let Some(value) = connection { + headers.insert("connection".to_string(), value.to_string()); + } + HttpRequest { + method: "POST".to_string(), + version: version.to_string(), + headers, + body: Vec::new(), + } + } + + #[test] + fn keep_alive_decision_follows_http_semantics() { + // HTTP/1.1 defaults to keep-alive; explicit close overrides. + assert!(req("HTTP/1.1", None).wants_keep_alive()); + assert!(!req("HTTP/1.1", Some("close")).wants_keep_alive()); + assert!(req("HTTP/1.1", Some("keep-alive")).wants_keep_alive()); + // HTTP/1.0 defaults to close; explicit keep-alive overrides. + assert!(!req("HTTP/1.0", None).wants_keep_alive()); + assert!(req("HTTP/1.0", Some("keep-alive")).wants_keep_alive()); + } + + #[tokio::test] + async fn parses_two_pipelined_requests_then_clean_eof() { + let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap(); + let addr = listener.local_addr().unwrap(); + + // Client writes two POSTs back-to-back on one connection, then half-closes + // the write side so the server sees EOF only after both are consumed. + let client = tokio::spawn(async move { + let mut stream = TcpStream::connect(addr).await.unwrap(); + let wire = "POST /resource HTTP/1.1\r\nContent-Length: 16\r\n\r\n\ + {\"resource\":\"a\"}\ + POST /resource HTTP/1.1\r\nContent-Length: 16\r\n\r\n\ + {\"resource\":\"b\"}"; + stream.write_all(wire.as_bytes()).await.unwrap(); + // Half-close the write side so the server sees EOF after both requests; + // keep the read side open (drop happens when the task ends). + stream.shutdown().await.unwrap(); + stream + }); + + let (mut server, _) = listener.accept().await.unwrap(); + let mut buf = Vec::new(); + + let first = read_http_request(&mut server, &mut buf) + .await + .unwrap() + .expect("first request"); + assert_eq!(first.method, "POST"); + assert_eq!(first.body, b"{\"resource\":\"a\"}"); + assert!(first.wants_keep_alive()); + + let second = read_http_request(&mut server, &mut buf) + .await + .unwrap() + .expect("second pipelined request"); + assert_eq!(second.body, b"{\"resource\":\"b\"}"); + + // Both consumed; the next read hits a clean EOF, which must be Ok(None). + let third = read_http_request(&mut server, &mut buf).await.unwrap(); + assert!(third.is_none()); + + // Keep the client socket alive until now, then let both ends close. + let _client_stream = client.await.unwrap(); + } } diff --git a/server/src/domain/mentions.rs b/server/src/domain/mentions.rs index 36ca045a..4860cbd0 100644 --- a/server/src/domain/mentions.rs +++ b/server/src/domain/mentions.rs @@ -198,16 +198,26 @@ pub async fn resolve_mention_names( channel_id: Uuid, names: &[String], ) -> Result, MentionParseError> { - let mut mentions = Vec::new(); - for name in names { - if let Some(scope) = group_mention_scope(name) { - for mention in expand_group_mention(db, channel_id, scope).await? { - push_unique(&mut mentions, mention.member_id, mention.member_type); - } - continue; - } - let row = sqlx::query( - "SELECT cm.member_id, cm.member_type + if names.is_empty() { + return Ok(Vec::new()); + } + + // Plain (non-group) names resolve in ONE batched query instead of one round-trip + // per name — mirroring `validate_mention_ids`. Group tokens (@all/@bots/@humans) + // still expand per token via `expand_group_mention`. + let plain_names: Vec = names + .iter() + .filter(|n| group_mention_scope(n).is_none()) + .cloned() + .collect(); + + let name_to_mention: std::collections::HashMap = if plain_names.is_empty() { + std::collections::HashMap::new() + } else { + let rows = sqlx::query( + "SELECT cm.member_id, cm.member_type, + COALESCE(u.username, ba.username) AS username, + COALESCE(u.display_name, ba.display_name) AS display_name FROM channel_memberships cm LEFT JOIN users u ON u.user_id = cm.member_id AND cm.member_type = 'user' @@ -215,34 +225,62 @@ pub async fn resolve_mention_names( ON ba.bot_id = cm.member_id AND cm.member_type = 'bot' WHERE cm.channel_id = $1 AND ( - (cm.member_type = 'user' AND (u.username = $2 OR u.display_name = $2)) + (cm.member_type = 'user' AND (u.username = ANY($2) OR u.display_name = ANY($2))) OR - (cm.member_type = 'bot' AND (ba.username = $2 OR ba.display_name = $2)) - ) - LIMIT 1", + (cm.member_type = 'bot' AND (ba.username = ANY($2) OR ba.display_name = ANY($2))) + )", ) .bind(channel_id.to_string()) - .bind(name) - .fetch_optional(db) + .bind(&plain_names) + .fetch_all(db) .await?; - let Some(row) = row else { - return Err(MentionParseError::NameNotFound { name: name.clone() }); - }; - - let member_id: Uuid = row - .try_get::("member_id") - .ok() - .and_then(|s| s.parse().ok()) - .ok_or_else(|| MentionParseError::NameNotFound { name: name.clone() })?; + // Key every returned member by both its username and display_name. First row + // wins on a name collision — ambiguous names were already resolved + // arbitrarily under the old per-name `LIMIT 1`. + let mut map: std::collections::HashMap = + std::collections::HashMap::new(); + for row in &rows { + let Some(member_id) = row + .try_get::("member_id") + .ok() + .and_then(|s| s.parse::().ok()) + else { + continue; + }; + let member_type = match row.try_get::("member_type").as_deref() { + Ok("bot") => MemberType::Bot, + Ok("user") => MemberType::User, + _ => continue, + }; + let mention = Mention { + member_id, + member_type, + }; + for key in ["username", "display_name"] { + if let Ok(Some(value)) = row.try_get::, _>(key) { + map.entry(value).or_insert(mention); + } + } + } + map + }; - let member_type = match row.try_get::("member_type").as_deref() { - Ok("bot") => MemberType::Bot, - Ok("user") => MemberType::User, - _ => return Err(MentionParseError::NameNotFound { name: name.clone() }), + // Second pass in input order: groups expand in place; plain names resolve from + // the batch map. The first unresolved name errors — preserving the old + // "first not found in order" semantics. + let mut mentions = Vec::new(); + for name in names { + if let Some(scope) = group_mention_scope(name) { + for mention in expand_group_mention(db, channel_id, scope).await? { + push_unique(&mut mentions, mention.member_id, mention.member_type); + } + continue; + } + let Some(mention) = name_to_mention.get(name) else { + return Err(MentionParseError::NameNotFound { name: name.clone() }); }; - - push_unique(&mut mentions, member_id, member_type); + push_unique(&mut mentions, mention.member_id, mention.member_type); } Ok(mentions) } diff --git a/server/src/gateway/ws/agent_bridge.rs b/server/src/gateway/ws/agent_bridge.rs index 5551738a..fa8aaabc 100644 --- a/server/src/gateway/ws/agent_bridge.rs +++ b/server/src/gateway/ws/agent_bridge.rs @@ -806,17 +806,35 @@ async fn handle_data_frame(frame: &Value, state: &AppState, bot: &BotInfo, socke && resp.get("ok").and_then(Value::as_bool) == Some(true) { if let Some(created) = resp.get("data") { - // Fire-and-forget: the returned trigger handle is intentionally - // dropped so the next bot@bot hop runs off this read loop. - let _ = broadcast_and_trigger_created_message( - &state.stream_registry, - &state.fanout, - &state.db, - &state.bot_locator, - bot.bot_id, - created, - ) - .await; + // Off the critical path: the message is already committed, so the + // resource_res below can return immediately. The live broadcast + // (Redis PUBLISH) + chain resolution + bot@bot trigger all run in a + // spawned task instead of blocking the caller's post_message reply. + // Ordering is safe: the frontend re-sorts incoming "message" frames + // by channel_seq (ChannelView.upsertMessage), so a broadcast that + // lands after the reply can't misorder the channel. + let registry = state.stream_registry.clone(); + let fanout = state.fanout.clone(); + let db = state.db.clone(); + let bot_locator = state.bot_locator.clone(); + let author_bot_id = bot.bot_id; + let created = created.clone(); + tokio::spawn(async move { + let started = std::time::Instant::now(); + let _ = broadcast_and_trigger_created_message( + ®istry, + &fanout, + &db, + &bot_locator, + author_bot_id, + &created, + ) + .await; + tracing::debug!( + elapsed_ms = started.elapsed().as_millis() as u64, + "post_message broadcast+trigger complete (off critical path)" + ); + }); } } // bot 退出频道成功 → 成员集变了，在 WS 边界补发全量 presence diff --git a/server/src/resource/messages.rs b/server/src/resource/messages.rs index 14ca9223..52bd3879 100644 --- a/server/src/resource/messages.rs +++ b/server/src/resource/messages.rs @@ -177,6 +177,10 @@ fn fallback_message_value(channel_id: Uuid) -> Value { } pub async fn handle_create(db: &PgPool, principal: &Principal, params: &Value) -> ResourceResult { + // Perf instrumentation: total time spent in the DB-only create handler (authz + + // mention resolution + tx). Broadcast/bot-trigger happen at the WS boundary and + // are timed separately in agent_bridge — see docs on the post_message hot path. + let started = std::time::Instant::now(); let channel_id: Uuid = params .get("channel_id") .and_then(|v| v.as_str()) @@ -283,6 +287,7 @@ pub async fn handle_create(db: &PgPool, principal: &Principal, params: &Value) - let files = load_message_file_refs(db, &file_ids) .await .map_err(|_| super::resource_error("INTERNAL_ERROR", "db error"))?; + let files_len = files.len(); let mention_dtos = mention_dtos(&mentions); let dto = MessageDto { @@ -306,6 +311,15 @@ pub async fn handle_create(db: &PgPool, principal: &Principal, params: &Value) - context_bundle, }; + tracing::debug!( + %channel_id, + %msg_id, + mentions = mentions.len(), + files = files_len, + elapsed_ms = started.elapsed().as_millis() as u64, + "messages.create db-path complete" + ); + Ok(serde_json::to_value(dto).unwrap_or_else(|_| { serde_json::json!({ "v": MESSAGE_SCHEMA_VERSION, From 42db4e70816098a89168593a74fcd6c07e122abd Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 16:15:17 +0800 Subject: [PATCH 04/28] docs(website): add MCP tool reference page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New website/mcp.html: a GitHub Pages reference for the Cheers MCP server — its 26 tools grouped by capability with read/write/destructive access tags, the four-hop request path, and where post_message spends its time. Reuses the site's existing chrome (nav, theme toggle, table/callout/docs-grid recipes and amber palette) so it matches index.html and plugin-dev.html. Wire it into the nav and developer docs of index.html and plugin-dev.html, and list it in website/README.md. Co-Authored-By: Claude Opus 4.8 --- website/README.md | 2 + website/index.html | 5 + website/mcp.html | 326 ++++++++++++++++++++++++++++++++++++++++ website/plugin-dev.html | 3 +- 4 files changed, 335 insertions(+), 1 deletion(-) create mode 100644 website/mcp.html diff --git a/website/README.md b/website/README.md index 074b4463..a572c787 100644 --- a/website/README.md +++ b/website/README.md @@ -11,6 +11,8 @@ Pages: - `index.zh-CN.html` — Chinese mirror of the homepage; the two link to each other via the 中文 / EN button in the nav. Keep both in sync when editing. - `plugin-dev.html` — workbench renderer plugin guide (English only for now). +- `mcp.html` — Cheers MCP tool reference: the 26 tools an external agent uses, + the request path, and post_message performance notes (English only for now). ## Preview locally diff --git a/website/index.html b/website/index.html index c514df82..925c1692 100644 --- a/website/index.html +++ b/website/index.html @@ -245,6 +245,7 @@ Screenshots For Users For Developers + MCP Tools Quick Start Docs @@ -478,6 +479,10 @@

How it fits together

Plugin Development → Build a workbench renderer plugin: one sandboxed HTML file. + + MCP Tool Reference → + The 26 tools an external agent uses to live inside a channel. +
diff --git a/website/mcp.html b/website/mcp.html new file mode 100644 index 00000000..3b589bb1 --- /dev/null +++ b/website/mcp.html @@ -0,0 +1,326 @@ + + + + + +MCP Tool Reference — Cheers + + + + + +
+
+ 🍻 Cheers + +
+ + GitHub +
+
+
+ +
+
+
Developer Reference
+

The Cheers MCP server

+

The standard bridge an external agent uses to live inside a channel — reading + messages, posting, handling attachments, and keeping its own private workspace. A thin stdio translator that + maps each tool call to one gateway resource verb; all the logic lives in the Rust gateway.

+ +

A translator, not a backend

+

The MCP server speaks JSON-RPC over stdio to the agent and forwards each tool call as a + {resource, params} envelope. It holds no business logic — post_message becomes + channel.messages.create, inbox_open becomes channel.files.read, and so + on. Persistence, authorization, fan-out, and bot-to-bot triggering all happen in the gateway.

+
Never fetch the gateway HTTP API yourself. An agent has no gateway HTTP + session — download / preview URLs on attachments are for the human web UI and return 401. The only way to read + an attachment is inbox_open.
+ +

Every tool call is a four-hop round-trip

+

A tool call is not a direct call — it crosses four processes, and each hop adds one serialization pass and one + round-trip. The reply travels the same path in reverse. Latency is a property of the path, not of any + single line of tool code.

+
+
01
Agent
Calls a tool, e.g. post_message.
stdio · JSON-RPC
+
02
cheers-mcp-server
Maps tool → resource verb, POSTs the envelope.
loopback HTTP
+
03
ACP connector
Correlates by req_id over the data socket.
agent-bridge WS
+
04
Rust gateway
Authz, seq, insert, broadcast, trigger.
Postgres · Redis
+
+ +

26 tools, by capability

+

read tools never mutate state. write tools persist a change; + a few are destructive and remove data or membership.

+ +

Channel read · 4 tools

+
+ + + + + +
ToolAccessWhat it does
get_channel_inforeadMetadata for a channel: name, type, workspace.
list_membersreadWho is in the room — humans and bots, with member_id, bio, and live status.
get_contextreadCondensed context bundle: topic, pinned info, summary.
read_activityreadThe unified channel_seq event stream: messages plus channel operations.
+ +

Messages read · 4 tools

+
+ + + + + +
ToolAccessWhat it does
read_messagesreadRecent messages by pagination cursor or channel_seq.
messages_indexreadmin_seq, max_seq and count for finalized messages.
messages_by_seqreadFetch messages in an inclusive channel_seq range.
search_messagesreadCase-insensitive substring search over message content.
+ +

Context references read · 3 tools

+
+ + + + +
ToolAccessWhat it does
read_planreadThe channel's live plan / progress board. Resolves a handed-over "plan" reference.
read_sessionsreadBot sessions active in this channel (id, bot, mode).
read_costreadToken-usage / cost totals for this channel.
+ +

Messages & status write · 2 tools

+
+ + + +
ToolAccessWhat it does
post_messagewritePost to a channel. @-mention a bot (by id or name) to hand off work; attach context references so the recipient reads the same plan or file.
set_statuswriteUpdate your own member card — status text, emoji, bio — pushed live to every channel.
+ +

Membership 1 tool

+
+ + +
ToolAccessWhat it does
leave_channeldestructiveRemove yourself from a channel. You stop receiving its tasks immediately; a human must re-invite you.
+ +

Inbox chat attachments · 4 tools

+
+ + + + + +
ToolAccessWhat it does
inbox_listreadFiles people uploaded to the chat (pdf/csv/images), addressed by file_id.
inbox_openreadOpen an attachment by file_id; text inline, binaries as base64 (≤8MB). Read-only.
inbox_deliverwritePost a new file (base64, ≤8MB) into the channel as a downloadable attachment.
inbox_stagewriteRegister a local file path for lazy delivery — uploaded on demand when a user clicks it.
+ +

Desk private workspace · 7 tools

+
+ + + + + + + + +
ToolAccessWhat it does
desk_listreadList your editable workspace files under a path prefix.
desk_readreadRead one of your workspace files by path; returns text + version.
desk_writewriteCreate or overwrite a workspace file (≤256KB), with optimistic version lock.
desk_editwriteReplace exactly one occurrence of old_string with new_string in a file.
desk_appendwriteAppend text to a workspace file, creating it if missing.
desk_mvwriteRename or move a workspace file or subtree.
desk_rmdestructiveRemove a workspace file or subtree (recursive for a subtree).
+ +

Cross-bot 1 tool

+
+ + +
ToolAccessWhat it does
read_workspacereadLive-read a file from another bot's workspace via a handed-over reference — brokered under your own permission, never a stale snapshot.
+ +
Desk vs. Inbox. If you're thinking in a path it's the desk (your private, + editable workspace). If you're holding a file_id it's the inbox (read-only files people uploaded). Never + desk_write a file_id, and never inbox_open a path.
+ +

Where a post_message spends its time

+

The tool code is lean — no embedding or model calls. The measurable cost lives on the path: the connection + between the MCP server and the connector, and work done inline on the gateway before the reply is sent.

+
+ + + + +
CostWhereNote
Connection setup per callMCP → connectorThe loopback HTTP hop; kept-alive so the socket is reused across calls.
Live broadcastgatewayRedis PUBLISH + chain resolution, moved off the reply's critical path.
Mention resolutiongatewaymention_names resolved in one batched query instead of one per name.
+ +

Read more

+
+ + 📦 cheers-mcp-server + The MCP server source — one file mapping tools to resource verbs. + + + 📐 Architecture overview + The external-agent-first design: gateway, frontend, and how agents connect. + + + 🔌 ACP connector + The bridge that carries resource calls between the agent and the gateway. + +
+
+
+ +
+
+
🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
+
+ Home + Plugins + GitHub + License +
+
+
+ + + + diff --git a/website/plugin-dev.html b/website/plugin-dev.html index bb06125a..0123f1ac 100644 --- a/website/plugin-dev.html +++ b/website/plugin-dev.html @@ -139,7 +139,8 @@
From 4db8c34dd569eef8b5823a50e7d77fd16c9dda60 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 17:22:33 +0800 Subject: [PATCH 05/28] style(loopback): satisfy rustfmt on the keep-alive read MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `cargo fmt --check` (CI: Agent Package Check) rejected the `timeout(...)` call in handle_connection. Formatting only — no behaviour change. Co-Authored-By: Claude Opus 4.8 --- .../cheers-acp-connector-rs/src/loopback.rs | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/packages/cheers-acp-connector-rs/src/loopback.rs b/packages/cheers-acp-connector-rs/src/loopback.rs index 087d9594..f5545c7d 100644 --- a/packages/cheers-acp-connector-rs/src/loopback.rs +++ b/packages/cheers-acp-connector-rs/src/loopback.rs @@ -79,14 +79,18 @@ async fn handle_connection( // next pipelined request on the same kept-alive connection. let mut buf: Vec = Vec::new(); loop { - let request = - match timeout(LOOPBACK_IDLE_TIMEOUT, read_http_request(&mut stream, &mut buf)).await { - Ok(result) => match result? { - Some(request) => request, - None => return Ok(()), // client closed the idle connection cleanly - }, - Err(_) => return Ok(()), // idle too long — drop the connection - }; + let request = match timeout( + LOOPBACK_IDLE_TIMEOUT, + read_http_request(&mut stream, &mut buf), + ) + .await + { + Ok(result) => match result? { + Some(request) => request, + None => return Ok(()), // client closed the idle connection cleanly + }, + Err(_) => return Ok(()), // idle too long — drop the connection + }; let keep_alive = request.wants_keep_alive(); // Error responses always close: a bad method/token connection is not worth From 8868202027da98ab58c24b2896803e337d788523 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 17:39:40 +0800 Subject: [PATCH 06/28] refactor(resource): give resource writes a transport-neutral effects seam MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `resource::dispatch` is db-only by design, so a successful write there is only half the operation: creating a message must also broadcast the live frame and trigger @mentioned bots, leaving a channel must re-broadcast presence, and an fs.* write must nudge open Desk views. Those need AppState (fanout / stream_registry / bot_locator), which dispatch doesn't have — so each effect was patched in at the bot-bridge WS boundary. That put the rule "creating a message ⇒ broadcast + trigger" at exactly one call site. A second transport (the Streamable-HTTP MCP endpoint we're considering) calling resource::dispatch directly would persist the row, return ok, and silently skip the broadcast and the trigger — no error, just a channel that never updates and an @mentioned bot that never wakes. Introduce gateway::resource_effects::dispatch_with_effects(state, principal, frame): dispatch plus the effects it can't perform, so every transport routes through one seam and gets the complete semantics of each verb. Moves the four effect blocks (messages.create, channel.leave, fs.*, bot.status.write) out of agent_bridge, which shrinks by ~114 lines to a single call. Behaviour-preserving: same effects, same ok-gating, same off-critical-path spawn for the message broadcast. `workspace.read` stays intercepted at the bridge — it is an alternate dispatch, not a post-dispatch effect, and fails loudly rather than silently elsewhere. Co-Authored-By: Claude Opus 4.8 --- server/src/gateway/mod.rs | 1 + server/src/gateway/resource_effects.rs | 157 +++++++++++++++++++++++++ server/src/gateway/ws/agent_bridge.rs | 141 ++-------------------- 3 files changed, 171 insertions(+), 128 deletions(-) create mode 100644 server/src/gateway/resource_effects.rs diff --git a/server/src/gateway/mod.rs b/server/src/gateway/mod.rs index b0b4b071..d77fd861 100644 --- a/server/src/gateway/mod.rs +++ b/server/src/gateway/mod.rs @@ -12,6 +12,7 @@ pub mod reclaimer; #[allow(dead_code)] pub mod redis_registry; pub mod registry; +pub mod resource_effects; pub mod stream; pub mod transcription_worker; pub mod workspace_rpc; diff --git a/server/src/gateway/resource_effects.rs b/server/src/gateway/resource_effects.rs new file mode 100644 index 00000000..406bfc7e --- /dev/null +++ b/server/src/gateway/resource_effects.rs @@ -0,0 +1,157 @@ +//! Transport-neutral resource dispatch — `resource::dispatch` **plus the side effects +//! it structurally cannot perform**. +//! +//! [`resource::dispatch`] is deliberately db-only: it takes a `PgPool` and nothing else. +//! That keeps the resource layer transport-agnostic and easy to test, but it also means +//! a successful write there is only *half* the operation. Creating a message must also +//! push the live `message` frame to the channel and trigger any @mentioned bots; leaving +//! a channel must re-broadcast presence; a workspace write must nudge open Desk views. +//! All of those need `AppState` (fanout / stream_registry / bot_locator), which +//! `dispatch` does not have. +//! +//! Historically each of those effects was patched in at the bot-bridge WS boundary, so +//! the rule "creating a message ⇒ broadcast + trigger" existed only at that one call +//! site. That is a trap for the next transport: a Streamable-HTTP MCP endpoint calling +//! `resource::dispatch` directly would persist the row, return 200, and **silently** skip +//! the broadcast and the bot trigger — no error, just a channel that never updates and an +//! @mentioned bot that never wakes. Bugs of omission don't announce themselves. +//! +//! [`dispatch_with_effects`] is the seam that closes it: **every** transport routes +//! resource frames through here and gets the complete semantics of each verb. Adding a +//! new effect means adding it once, here, rather than in every boundary. +//! +//! Not covered: `workspace.read`, which is an alternate *dispatch* (brokering a read of +//! another bot's machine) rather than a post-dispatch effect, and stays at the bot-bridge +//! boundary. It fails loudly (`UNKNOWN_RESOURCE`) elsewhere rather than silently. + +use serde_json::{json, Value}; +use uuid::Uuid; + +use crate::{ + app_state::AppState, + gateway::{realtime::frame::WireFrame, stream::broadcast_and_trigger_created_message}, + resource::{self, Principal}, +}; + +/// Dispatch a `resource_req` frame and apply the post-write effects the db-only +/// resource layer can't. Returns the `resource_res` frame verbatim from +/// [`resource::dispatch`] — effects never change the reply, and never fail it. +pub async fn dispatch_with_effects(state: &AppState, principal: Principal, frame: &Value) -> Value { + let resp = resource::dispatch(&state.db, principal, frame).await; + + // Effects run only for a write that actually landed. + if resp.get("ok").and_then(Value::as_bool) != Some(true) { + return resp; + } + match frame.get("resource").and_then(Value::as_str) { + Some("channel.messages.create") => { + if let Some(created) = resp.get("data") { + spawn_created_message_effects(state, principal.principal_id, created.clone()); + } + } + // A bot left → the member set changed, so re-broadcast the full presence. + Some("channel.leave") => { + if let Some(cid) = frame + .get("params") + .and_then(|p| p.get("channel_id")) + .and_then(Value::as_str) + .and_then(|s| Uuid::parse_str(s).ok()) + { + crate::gateway::presence::broadcast_presence(state, cid).await; + } + } + // Live Desk: a mutating `fs.*` verb changed the channel's workspace files — + // nudge any open Desk view to re-pull. Data-free: clients re-fetch through + // their own authz'd fs.ls/fs.read. Board name "files" is a cross-slice contract. + Some("fs.write" | "fs.edit" | "fs.append" | "fs.rm" | "fs.mv") => { + if let Some(cid) = resp + .get("data") + .and_then(|d| d.get("channel_id")) + .and_then(Value::as_str) + .and_then(|s| s.parse::().ok()) + { + let wire = WireFrame::channel( + cid, + "board_signal", + json!({ "channel_id": cid, "board": "files" }), + ); + state.fanout.broadcast_channel(cid, wire).await; + } + } + // The agent wrote its own status card (the set_status tool). Persisted by + // dispatch; the live member_updated push to every channel it's in needs fanout. + Some("bot.status.write") => { + let bot_id = principal.principal_id.to_string(); + crate::api::bots::broadcast_bot_member_update(state, &bot_id).await; + audit_status_write(state, &bot_id, frame).await; + } + _ => {} + } + resp +} + +/// Broadcast the new message and trigger any @mentioned bots — **off the caller's +/// critical path**. The row is already committed, so the `resource_res` returns without +/// waiting on a Redis PUBLISH or the next bot@bot hop. Ordering is safe: the frontend +/// re-sorts incoming `message` frames by `channel_seq` (`ChannelView.upsertMessage`), so +/// a broadcast that lands after the reply cannot misorder the channel. +fn spawn_created_message_effects(state: &AppState, author_bot_id: Uuid, created: Value) { + let registry = state.stream_registry.clone(); + let fanout = state.fanout.clone(); + let db = state.db.clone(); + let bot_locator = state.bot_locator.clone(); + tokio::spawn(async move { + let started = std::time::Instant::now(); + let _ = broadcast_and_trigger_created_message( + ®istry, + &fanout, + &db, + &bot_locator, + author_bot_id, + &created, + ) + .await; + tracing::debug!( + elapsed_ms = started.elapsed().as_millis() as u64, + "post_message broadcast+trigger complete (off critical path)" + ); + }); +} + +/// Record a self-status write to `acp_event_log` so status changes are auditable +/// alongside every other ACP event. Summary ONLY — which fields were set and their char +/// lengths, NEVER the text itself. `channel_id` is NULL (a self-card write isn't +/// channel-scoped); `session_id` rides the frame if present. Best-effort: a log-write +/// failure must never disrupt the live agent. +async fn audit_status_write(state: &AppState, bot_id: &str, frame: &Value) { + let params = frame.get("params"); + let field_len = |key: &str| { + params + .and_then(|p| p.get(key)) + .and_then(Value::as_str) + .map(str::trim) + .filter(|s| !s.is_empty()) + .map(|s| s.chars().count()) + }; + let audit_payload = json!({ + "status_text_len": field_len("status_text"), + "status_emoji_len": field_len("status_emoji"), + "info_len": field_len("info"), + }); + if let Err(err) = sqlx::query( + "INSERT INTO acp_event_log (id, bot_id, channel_id, session_id, name, home, payload) + VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)", + ) + .bind(Uuid::new_v4().to_string()) + .bind(bot_id) + .bind(Option::<&str>::None) + .bind(frame.get("session_id").and_then(Value::as_str)) + .bind("bot.status.write") + .bind("cheers") + .bind(audit_payload.to_string()) + .execute(&state.db) + .await + { + tracing::warn!(bot_id = %bot_id, error = %err, "bot.status.write audit log write failed"); + } +} diff --git a/server/src/gateway/ws/agent_bridge.rs b/server/src/gateway/ws/agent_bridge.rs index fa8aaabc..6efe892a 100644 --- a/server/src/gateway/ws/agent_bridge.rs +++ b/server/src/gateway/ws/agent_bridge.rs @@ -21,10 +21,7 @@ use crate::{ domain::{acp_capability, channel_seq, sessions}, gateway::{ realtime::frame::WireFrame, - stream::{ - broadcast_and_trigger_created_message, handle_delta, handle_done, handle_send, - handle_session_update, - }, + stream::{handle_delta, handle_done, handle_send, handle_session_update}, }, infra::crypto::hash_bot_token, infra::db::models::MESSAGE_SCHEMA_VERSION, @@ -792,135 +789,23 @@ async fn handle_data_frame(frame: &Value, state: &AppState, bot: &BotInfo, socke "resource_req" => { // `workspace.read` is a REMOTE-workspace pull (unified context model, P3): // a reader bot resolves ANOTHER bot's workspace file under its own read - // grant. It can't go through the db-only `resource::dispatch` — brokering - // the read needs `AppState` (the identity-free workspace RPC + presence). - // Intercept here at the WS boundary; every other verb falls through. + // grant. Brokering it needs the identity-free workspace RPC, so it is an + // alternate dispatch rather than a plain resource verb — intercepted here. + // + // Every other verb goes through `dispatch_with_effects`, never the db-only + // `resource::dispatch`: the live broadcast / bot@bot trigger / presence / + // Desk signal a successful write implies all live there, so any transport + // gets the complete semantics (see gateway::resource_effects). let resp = if frame.get("resource").and_then(Value::as_str) == Some("workspace.read") { broker_workspace_read(state, bot.bot_id, frame).await } else { - resource::dispatch(&state.db, resource::Principal::bot(bot.bot_id), frame).await - }; - // bot 主动 post_message（channel.messages.create）落库后，resource::dispatch 只有 - // db、无 fanout/registry/bot_locator，故在此 WS 边界补 live 广播 + bot@bot 触发。 - if frame.get("resource").and_then(Value::as_str) == Some("channel.messages.create") - && resp.get("ok").and_then(Value::as_bool) == Some(true) - { - if let Some(created) = resp.get("data") { - // Off the critical path: the message is already committed, so the - // resource_res below can return immediately. The live broadcast - // (Redis PUBLISH) + chain resolution + bot@bot trigger all run in a - // spawned task instead of blocking the caller's post_message reply. - // Ordering is safe: the frontend re-sorts incoming "message" frames - // by channel_seq (ChannelView.upsertMessage), so a broadcast that - // lands after the reply can't misorder the channel. - let registry = state.stream_registry.clone(); - let fanout = state.fanout.clone(); - let db = state.db.clone(); - let bot_locator = state.bot_locator.clone(); - let author_bot_id = bot.bot_id; - let created = created.clone(); - tokio::spawn(async move { - let started = std::time::Instant::now(); - let _ = broadcast_and_trigger_created_message( - ®istry, - &fanout, - &db, - &bot_locator, - author_bot_id, - &created, - ) - .await; - tracing::debug!( - elapsed_ms = started.elapsed().as_millis() as u64, - "post_message broadcast+trigger complete (off critical path)" - ); - }); - } - } - // bot 退出频道成功 → 成员集变了，在 WS 边界补发全量 presence - //（resource::dispatch 只有 db，拿不到 fanout/bot_locator）。 - if frame.get("resource").and_then(Value::as_str) == Some("channel.leave") - && resp.get("ok").and_then(Value::as_bool) == Some(true) - { - if let Some(cid) = frame - .get("params") - .and_then(|p| p.get("channel_id")) - .and_then(Value::as_str) - .and_then(|s| Uuid::parse_str(s).ok()) - { - crate::gateway::presence::broadcast_presence(state, cid).await; - } - } - // Live Desk: a successful mutating `fs.*` verb changed the channel's - // workspace files — nudge any open Desk view to re-pull. Mirrors the - // channel.messages.create / channel.leave live-broadcast pattern above: - // resource::dispatch only holds `db`, so the fanout tick is emitted here - // at the WS boundary. Data-free — clients re-fetch via their own authz'd - // fs.ls/fs.read. board name "files" (cross-slice contract). - if matches!( - frame.get("resource").and_then(Value::as_str), - Some("fs.write" | "fs.edit" | "fs.append" | "fs.rm" | "fs.mv") - ) && resp.get("ok").and_then(Value::as_bool) == Some(true) - { - if let Some(cid) = resp - .get("data") - .and_then(|d| d.get("channel_id")) - .and_then(Value::as_str) - .and_then(|s| s.parse::().ok()) - { - let wire = WireFrame::channel( - cid, - "board_signal", - json!({ "channel_id": cid, "board": "files" }), - ); - state.fanout.broadcast_channel(cid, wire).await; - } - } - // Agent wrote its own status card (`bot.status.write`, the set_status - // tool): persisted in dispatch (db-only); the live member_updated push - // to every channel the bot is in needs the fanout, so it's emitted - // here at the WS boundary — same pattern as the blocks above. - if frame.get("resource").and_then(Value::as_str) == Some("bot.status.write") - && resp.get("ok").and_then(Value::as_bool) == Some(true) - { - crate::api::bots::broadcast_bot_member_update(state, &bot.bot_id.to_string()).await; - // Traceability (audit items 3 + 9): record the self-status write to - // acp_event_log so status changes are auditable alongside every other - // ACP event. Summary ONLY — which fields were set and their char - // lengths, NEVER the text itself. channel_id is NULL (a self-card write - // isn't channel-scoped); session_id rides the frame if present. - // Best-effort: a log-write failure must never disrupt the live agent. - let params = frame.get("params"); - let field_len = |key: &str| { - params - .and_then(|p| p.get(key)) - .and_then(Value::as_str) - .map(str::trim) - .filter(|s| !s.is_empty()) - .map(|s| s.chars().count()) - }; - let audit_payload = json!({ - "status_text_len": field_len("status_text"), - "status_emoji_len": field_len("status_emoji"), - "info_len": field_len("info"), - }); - if let Err(err) = sqlx::query( - "INSERT INTO acp_event_log (id, bot_id, channel_id, session_id, name, home, payload) - VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)", + crate::gateway::resource_effects::dispatch_with_effects( + state, + resource::Principal::bot(bot.bot_id), + frame, ) - .bind(Uuid::new_v4().to_string()) - .bind(bot.bot_id.to_string()) - .bind(Option::<&str>::None) - .bind(frame.get("session_id").and_then(Value::as_str)) - .bind("bot.status.write") - .bind("cheers") - .bind(audit_payload.to_string()) - .execute(&state.db) .await - { - tracing::warn!(bot_id = %bot.bot_id, error = %err, "bot.status.write audit log write failed"); - } - } + }; // resource_res 发回给 bot（通过同一条 data WS） let _ = ws_send(socket, &resp).await; } From 209e7ffcf2155fc385cf36b3b3c56a0ce910ccca Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 18:43:08 +0800 Subject: [PATCH 07/28] feat(workbench): session-level temporary plugins + normative plugin docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dev loop for renderer plugins without admin install: drop a .html on the drawer (or Load extension) and its renderers join the candidates for this browser session only, marked ⏱ in pickers. A same-id session plugin shadows the installed one so a deployed plugin can be iterated on live; reload restores the installed version. - PluginMeta gains inline bundle?/transient? (session-only; never on the wire); SandboxRenderer uses the inline bundle instead of fetching - manifest shape validation extracted to dependency-free pluginManifest.ts (shared by admin upload + temp load), with vitest coverage; uploads now reject empty/renderer-less (legacy panels) manifests with a named reason - 2 MiB bundle cap on the temp load path (server install cap follows in the protocol PR) - delete retired panels/cheers:init protocol examples (notes-plugin, research-plugin); point RESEARCH_SCENARIO at a current-protocol example - PLUGIN_DEVELOPMENT.md restructured as the normative reference (Quickstart dev loop, protocol reference incl. cheers:resource + lifecycle/conflict flows, cookbook, troubleshooting); RENDERER_PLUGIN.md marked design original deferring to it; WORKBENCH/examples/READMEs updated Verified e2e (kind stack + vite): temp-load md-checklist → ⏱ candidate ranked first → checklist renders in sandbox → toggle saves (v2) and persists in the file → session plugin gone after reload. Co-Authored-By: Claude Fable 5 --- docs/arch/RENDERER_PLUGIN.md | 8 +- docs/arch/RESEARCH_SCENARIO.md | 7 +- docs/arch/WORKBENCH.md | 4 +- docs/arch/examples/README.md | 2 +- docs/developer/PLUGIN_DEVELOPMENT.md | 205 +++++++++++++----- .../src/features/chat/workbench/README.md | 6 +- .../chat/workbench/WorkbenchDrawer.tsx | 72 +++++- .../chat/workbench/panels/FilePanel.tsx | 5 + .../workbench/sandbox/SandboxRenderer.tsx | 7 +- .../features/chat/workbench/sandbox/api.ts | 43 ++-- .../sandbox/examples/notes-plugin.html | 64 ------ .../sandbox/examples/research-plugin.html | 145 ------------- .../workbench/sandbox/pluginManifest.test.ts | 81 +++++++ .../chat/workbench/sandbox/pluginManifest.ts | 61 ++++++ 14 files changed, 392 insertions(+), 318 deletions(-) delete mode 100644 frontend/src/features/chat/workbench/sandbox/examples/notes-plugin.html delete mode 100644 frontend/src/features/chat/workbench/sandbox/examples/research-plugin.html create mode 100644 frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts create mode 100644 frontend/src/features/chat/workbench/sandbox/pluginManifest.ts diff --git a/docs/arch/RENDERER_PLUGIN.md b/docs/arch/RENDERER_PLUGIN.md index 6d760f8b..69764786 100644 --- a/docs/arch/RENDERER_PLUGIN.md +++ b/docs/arch/RENDERER_PLUGIN.md @@ -1,8 +1,11 @@ # 渲染器插件开发指南 -> **Language**: [English](../developer/PLUGIN_DEVELOPMENT.md) | 中文(本文,设计原文) +> **Language**: [English(规范版)](../developer/PLUGIN_DEVELOPMENT.md) | 中文(本文,设计原文) +> +> ⚠️ **规范以英文版为准**:协议消息表、manifest 校验规则、Troubleshooting 都维护在 +> [PLUGIN_DEVELOPMENT.md](../developer/PLUGIN_DEVELOPMENT.md);本文保留设计动机与中文语境,两边冲突时以英文版为准。 -> 状态:**v1 已实现**。host 侧 `render/save` 协议已落地——工作台 **File 面板**里选中一个文件,用顶部「渲染器」下拉选内置 lens 或已装插件;绑定(`path → renderer id`)存进 `.workbench.json`。旧的 `panels`/`init` 沙箱(场景插件)仍并存。代码:`renderers/registry.ts`、`renderers/RendererHost.tsx`、`sandbox/SandboxRenderer.tsx`、`panels/FilePanel.tsx`。 +> 状态:**v1 已实现**。host 侧 `render/save` 协议已落地——工作台 **File 面板**里选中一个文件,用顶部「渲染器」下拉选内置 lens 或已装插件;绑定(`path → renderer id`)存进 `.workbench.json`。旧的 `panels`/`init` 沙箱(场景插件)**已退役**(上传会被拒绝,示例已删除)。代码:`renderers/registry.ts`、`renderers/RendererHost.tsx`、`sandbox/SandboxRenderer.tsx`、`panels/FilePanel.tsx`。 > 关联:[[WORKBENCH]]「关系与边界」· [[context-and-environment]] ## 0. 一分钟心智模型 @@ -202,6 +205,7 @@ var info = await res("channel.info", {}); // → { ok, data } ## 7. 安装与绑定 +- **试用/开发**(人人):把 `.html` 拖进工作台抽屉(或点「Load extension」选文件)——**仅本浏览器会话**生效,渲染器立即进入匹配文件的候选列表(⏱ 标记);同 id 会话插件会遮蔽已安装版本,方便迭代调试,刷新即消失。 - **安装**(admin):设置 → Workbench extensions → 上传 `.html`(进 `workbench_plugins` 表,全频道可见)。 - **绑定**:打开某文件时,工作台按 `.workbench.json` 的 `bindings[path]` 选渲染器;没有就默认「原文」(textarea)或让用户从候选里挑,选择持久化进 `.workbench.json`(`path → rendererId`)。**绑定不进文件**,文件始终是纯内容。 diff --git a/docs/arch/RESEARCH_SCENARIO.md b/docs/arch/RESEARCH_SCENARIO.md index 6c56473e..ac04b3a9 100644 --- a/docs/arch/RESEARCH_SCENARIO.md +++ b/docs/arch/RESEARCH_SCENARIO.md @@ -372,9 +372,10 @@ crosshair + tooltip, recessive hairline grid, tabular numerals. ### 6.3 Knowledge graph — sandbox plugin (Phase 2) Paper/citation graph fits the sandboxed iframe plugin renderer -(`workbench/sandbox/`, table `workbench_plugins`, example -`sandbox/examples/research-plugin.html`): reads a `context_files` JSON via the -whitelisted postMessage fs proxy, draws client-side, network-isolated by CSP. +(`workbench/sandbox/`, table `workbench_plugins`, current-protocol example +`sandbox/examples/lit-review.html`): the host assigns one `context_files` JSON +over the render/save postMessage protocol, the plugin draws client-side, +network-isolated by the sandbox. ### 6.4 Daily recommendation / email — out of scope SMTP exists, but no scheduler/cron. A recurring digest needs new backend work; excluded diff --git a/docs/arch/WORKBENCH.md b/docs/arch/WORKBENCH.md index 0d703edd..aec4087e 100644 --- a/docs/arch/WORKBENCH.md +++ b/docs/arch/WORKBENCH.md @@ -43,8 +43,8 @@ Workbench 是频道右侧的工作台:一个频道一个,浏览/编辑 bot 工 | 本质 | **声明式场景清单**(数据) | **渲染器**(代码),可选自带一个默认场景 | | 是什么 | 「视图声明 + seed 文件」,激活时 seed 进当前频道 | 自带 UI 渲染逻辑的代码单元 | | 需要插件机制吗 | **不需要**——它只是数据 | **需要**——沙箱、服务端安装、代码加载 | -| 作用域 | **全局**(admin 装,全频道可见)**或临时**(浏览器会话内上传,仅本会话) | server-level(admin 装一次,全频道) | -| 装在哪 | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉「临时模板」(人人) | 设置 → Workbench extensions(admin) | +| 作用域 | **全局**(admin 装,全频道可见)**或临时**(浏览器会话内上传,仅本会话) | server-level(admin 装一次,全频道)**或临时**(会话内,调试用) | +| 装在哪 | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉「Load extension」(人人) | 全局:设置 → Workbench extensions(admin);临时:工作台抽屉拖入 `.html`(人人,仅本会话,同 id 遮蔽已装版) | | 渲染靠 | 内置 lens **或** 插件提供的渲染器 | 自身(iframe 里自带渲染器) | | 格式 | 声明式 manifest JSON(纯数据) | `.html` bundle(代码)+ 内嵌 manifest | | 后端存储 | `workbench_templates` 表(全局,仅 manifest);临时模板**不入库** | `workbench_plugins` 表(manifest + bundle) | diff --git a/docs/arch/examples/README.md b/docs/arch/examples/README.md index f26a262b..16d0ab2c 100644 --- a/docs/arch/examples/README.md +++ b/docs/arch/examples/README.md @@ -5,7 +5,7 @@ ## 渲染器插件(代码/沙箱) -设置 → Workbench extensions → 「插件」卡上传 `.html`。 +设置 → Workbench extensions → 「插件」卡上传 `.html`;或**直接把 `.html` 拖进工作台抽屉临时试用**(仅本会话,⏱ 标记,刷新即消失——插件开发的调试回路)。 | 文件 | 场景 | 说明 | |---|---|---| diff --git a/docs/developer/PLUGIN_DEVELOPMENT.md b/docs/developer/PLUGIN_DEVELOPMENT.md index 107020c5..82242561 100644 --- a/docs/developer/PLUGIN_DEVELOPMENT.md +++ b/docs/developer/PLUGIN_DEVELOPMENT.md @@ -1,38 +1,63 @@ # Workbench Plugin Development Guide -> **Language**: English | [中文(设计原文)](../arch/RENDERER_PLUGIN.md) +> **Language**: English (**normative**) | [中文(设计原文)](../arch/RENDERER_PLUGIN.md) > -> Status: **v1 implemented.** The host-side `render/save` protocol is live: open a file -> in the Workbench **Files panel**, then pick a built-in lens or an installed plugin -> from the "Renderer" dropdown. Bindings (`path → renderer id`) persist in -> `.workbench.json`. Ready-to-upload examples live in +> This document is the authoritative reference for the workbench renderer-plugin +> contract. The Chinese design original explains *why* the model looks like this; +> when the two disagree, this document wins. +> +> Status: **v1 implemented.** Open a file in the Workbench **Files panel**, then pick a +> built-in lens or a plugin renderer from the "Renderer" dropdown. Bindings +> (`path → renderer id`) persist in `.workbench.json`. Ready-to-upload examples live in > [`docs/arch/examples/`](../arch/examples/README.md). -## 1. Mental model: renderers are CSS for files +## 1. Quickstart: the zero-admin dev loop + +You do **not** need admin access (or an install step) to develop a plugin: + +1. Copy the skeleton from §6 (or an example from + [`docs/arch/examples/`](../arch/examples/README.md)) into `my-plugin.html`. +2. Open any channel → Workbench drawer → **drag the `.html` onto the drawer** + (or use the **Load extension** button and pick the file). +3. The plugin loads for **this browser session only** — it is parsed, validated, and + its renderers immediately join the candidate list of every matching file, marked + with **⏱** in the renderer dropdown. +4. Select a file the plugin claims (its `match`, §4) → **Preview** → pick your + renderer → interact → edits save back to the file. +5. Iterate: edit `my-plugin.html`, drop it again. A session plugin **shadows an + installed plugin with the same id** for your session, so you can iterate on a + deployed plugin without touching the installation. Reload the page and the + session plugin is gone (existing bindings fall back to the installed version). + +When it works, install it for everyone: *Settings → Workbench extensions* (admin, §8). + +## 2. Concepts: renderers are CSS for files - A **file** is pure content (Markdown is the primary format). It never declares which renderer to use. - A **renderer plugin** carries all the judgment — *what it accepts, how it parses, how it draws* — turning a file into an interactive UI and writing edits back to that file. - An **environment template** only seeds initial files; it never references a renderer. +- A **binding** (`path → renderer id`, stored in `.workbench.json`, never in the file) + records the user's explicit renderer choice; without one, the best content match leads. A renderer can be narrow ("markdown checklists with `- [ ]` lines") or broad. Small, focused renderers coexist — like CSS rules that each match a specific selector. -## 2. A plugin is one sandboxed HTML file +## 3. A plugin is one sandboxed HTML file A plugin is a **single `.html` file** containing: 1. an **embedded manifest** (` ``` -Complete working examples (upload as-is): +## 7. Cookbook + +Complete working examples (upload as-is, or drop on the drawer to try): - [`md-checklist.plugin.html`](../arch/examples/md-checklist.plugin.html) — markdown - todo list → interactive checklist (general). + todo list → interactive checklist. The canonical *"markdown convention + narrow + `match` + line-preserving rewrite"* recipe. - [`lit-review.plugin.html`](../arch/examples/lit-review.plugin.html) — paper-tracker - table over `{ "papers": [...] }` JSON, with status + star rating (research). + table over `{ "papers": [...] }` JSON (`match.jsonHas` pre-filter + runtime array + check + form-driven JSON writeback). - [`code-review.plugin.html`](../arch/examples/code-review.plugin.html) — markdown - review findings (`## file` sections, `- [ ] [P0|P1|P2]` items) with severity badges - (coding). + review findings (`## file` sections, `- [ ] [P0|P1|P2]` items) with severity badges. + The *"structured markdown sections"* recipe. Matching environment templates: [`md-demo`](../arch/examples/md-demo.template.json), [`lit-review`](../arch/examples/lit-review.template.json), [`code-project`](../arch/examples/code-project.template.json). -## 6. Security model (three layers) +Recipes in words: + +- **Claim a markdown convention** — declare `format:"markdown"` plus `requireAny` + /`requireAll` markers for your convention; split content into lines on render, edit + lines in place, `join("\n")` on save so non-convention lines survive byte-for-byte. +- **Claim a JSON structure** — declare `jsonHas` for your top-level keys; on render, + `JSON.parse` in try/catch and verify shapes, `cheers:unsupported` when they don't + hold; save with `JSON.stringify(data, null, 2)`. +- **Use channel context** — call the §5.4 resource helper, e.g. `channel.members` to + resolve author ids to names in your UI. Data may be stale seconds later; re-fetch on + each `cheers:render` rather than caching across renders. + +## 8. Install & bind + +- **Try/dev** (anyone): drop the `.html` on the Workbench drawer — session-only (§1). +- **Install** (admin): Settings → Workbench extensions → upload the `.html` (stored in + the `workbench_plugins` table, visible to all channels). The installer vouches for + the code — that is the trust model. +- **Bind**: when a file is open, the Workbench resolves `bindings[path]` from + `.workbench.json`; without a binding it offers the candidate list (most specific + `match` first, CSS-style cascade) and defaults to the best match, falling back to + raw text. The user's explicit choice always wins and persists ("Auto" clears it). + Bindings never live in the file itself — files stay pure content. + +## 9. Security model (three layers) 1. **Opaque origin** — `sandbox="allow-scripts"` without `allow-same-origin`: the plugin cannot steal host credentials. @@ -151,33 +253,20 @@ Matching environment templates: [`md-demo`](../arch/examples/md-demo.template.js `path`; server-side channel-role auth is unchanged. 3. **Inert manifest** — parsed with `DOMParser`, never executed. -Note the sandbox isolates *tokens and DOM*, not *network*: a plugin that reads channel -data could `fetch` it out. That is why the resource whitelist is read-only and -conservative, and plugins are **admin-installed** (the installer vouches for them). - -## 7. Development checklist - -- [ ] One `.html` with an embedded `#cheers-plugin` manifest (`id` / `title` / `renderers[]`). -- [ ] Each renderer declares `match.format` (coarse selector); precise judgment lives in code. -- [ ] Send `cheers:ready` last; parse `content` on `cheers:render`; edits go through - `cheers:save`; update `version` on `cheers:saved`. -- [ ] Touch only the assigned file; assume no other paths. -- [ ] Untrusted content via `textContent` / controlled forms only — never `innerHTML`. -- [ ] Prefer Markdown as the primary format; supporting json/xml is your renderer's own - business (declare the right `match.format`). - -## 8. Install & bind +## 10. Troubleshooting -- **Install** (admin): Settings → Workbench extensions → upload the `.html` (stored in - the `workbench_plugins` table, visible to all channels). -- **Bind**: when a file is open, the Workbench resolves `bindings[path]` from - `.workbench.json`; without a binding it defaults to raw text and lets the user pick - from the candidate list (most specific `match` first, CSS-style cascade). The user's - explicit choice always wins and persists. Bindings never live in the file itself — - files stay pure content. +| Symptom | Likely cause → fix | +|---|---| +| **My renderer never appears in the dropdown** | Its `match` doesn't accept the file. Check in order: ① `match.format` vs the file's extension class (`.md`→markdown, `.json`→json, `.toml`→toml, `.xml`→xml, anything else→text); ② every `requireAll` substring is really in the content (exact match, case-sensitive); ③ at least one `requireAny` hit; ④ `jsonHas`: file must parse as a JSON **object** (not array) containing all listed keys; ⑤ `glob` matches the full path. | +| **The plugin loads but the iframe stays blank** | You never sent `cheers:ready`, or sent it before wiring your `message` listener (the host's `cheers:render` answer raced past you). Send `ready` as the **last** line of your script. | +| **"This renderer can't render this file"** | Your own runtime verdict — you replied `cheers:unsupported`. If unexpected, your parse is stricter than your `match`; align them. | +| **Saves fail repeatedly / edits bounce back** | Version conflict: someone (often the bot) wrote the file between your render and your save. Contract: on `cheers:saved {ok:false}` the host re-sends `cheers:render` with fresh content — re-render and let the user reapply. If you cached `version` yourself and reused it, stop: the host tracks the version, you never send one. | +| **Upload rejected: invalid manifest** | The embedded `#cheers-plugin` JSON failed validation — the error message names the field. Common: missing `renderers` (a legacy `panels` manifest), duplicate renderer ids, `match` not an object. | +| **Works when dropped, gone after reload** | That's the design: dropped plugins are session-only. Install via Settings → Workbench extensions to persist. | ## Related - Chinese design original: [docs/arch/RENDERER_PLUGIN.md](../arch/RENDERER_PLUGIN.md) - Workbench architecture: [docs/arch/WORKBENCH.md](../arch/WORKBENCH.md) +- Environment templates (data, not code): [frontend workbench README](../../frontend/src/features/chat/workbench/README.md) - Examples index: [docs/arch/examples/README.md](../arch/examples/README.md) diff --git a/frontend/src/features/chat/workbench/README.md b/frontend/src/features/chat/workbench/README.md index 39ef2e68..a5859711 100644 --- a/frontend/src/features/chat/workbench/README.md +++ b/frontend/src/features/chat/workbench/README.md @@ -56,8 +56,10 @@ boards are automatically **shared human↔bot state**. `examples/research.json`, `examples/lit-review.json`. Code renderers (sandboxed iframe plugins) are the separate, heavier kind — shipped as -`.html` via `/workbench/plugins`; see -[docs/arch/WORKBENCH.md](../../../../../docs/arch/WORKBENCH.md) and +`.html` via `/workbench/plugins`, or dropped on the drawer for a **session-only +temporary load** (the plugin dev loop — ⏱ in pickers, gone on reload); see +[docs/developer/PLUGIN_DEVELOPMENT.md](../../../../../docs/developer/PLUGIN_DEVELOPMENT.md) +(normative), plus [docs/arch/WORKBENCH.md](../../../../../docs/arch/WORKBENCH.md) and [docs/arch/RENDERER_PLUGIN.md](../../../../../docs/arch/RENDERER_PLUGIN.md). --- diff --git a/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx b/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx index 4ec748a4..bbda0565 100644 --- a/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx +++ b/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx @@ -12,7 +12,7 @@ import { getBuiltinEnvironments, WORKBENCH_CONFIG_PATH } from "./environmentRegi import { seedManifest, validateManifest, type TemplateManifest } from "./manifest"; import { FilePanel } from "./panels/FilePanel"; import { listGlobalTemplates } from "./templatesApi"; -import { listPlugins, type PluginMeta } from "./sandbox/api"; +import { listPlugins, parsePluginHtml, MAX_PLUGIN_BUNDLE_BYTES, type PluginMeta } from "./sandbox/api"; import researchExample from "./examples/research.json"; import "./lens/builtins"; import "./environments"; @@ -93,6 +93,7 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi const [globalTemplates, setGlobalTemplates] = useState([]); const [sessionTemplates, setSessionTemplates] = useState([]); const [serverPlugins, setServerPlugins] = useState([]); + const [sessionPlugins, setSessionPlugins] = useState([]); const [busy, setBusy] = useState(false); /** Drag-over highlight — deliberately separate from `busy` (which gates controls). */ const [dragOver, setDragOver] = useState(false); @@ -239,24 +240,56 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi [activate] ); + // Temporary plugin: parse the .html's embedded manifest and keep it in THIS session + // only (bundle inline, never installed) — the plugin dev loop, no admin needed. A + // same-id session plugin shadows the installed one for this session, so existing + // bindings transparently resolve to the fresh bundle while you iterate. + const loadTemporaryPlugin = useCallback((html: string) => { + if (html.length > MAX_PLUGIN_BUNDLE_BYTES) { + setNotice("Plugin bundle too large (max 2 MiB)"); + return; + } + try { + const { id, title, manifest } = parsePluginHtml(html); + setSessionPlugins((prev) => [ + { plugin_id: id, title, manifest, bundle: html, transient: true }, + ...prev.filter((p) => p.plugin_id !== id), + ]); + setNotice( + `Loaded plugin temporarily: ${title} (this session only; to install globally go to Settings → Workbench extensions)` + ); + } catch (e) { + setNotice(errMsg(e)); + } + }, []); + + // One extension entry point, routed by extension: .json => template, .html => plugin. + const loadExtensionFile = useCallback( + (file: File) => { + if (file.name.endsWith(".json")) void file.text().then(loadTemporary); + else if (file.name.endsWith(".html")) void file.text().then(loadTemporaryPlugin); + else setNotice("Drop a .json template or a .html renderer plugin"); + }, + [loadTemporary, loadTemporaryPlugin] + ); + const onDrop = useCallback( (e: React.DragEvent) => { e.preventDefault(); setDragOver(false); const file = e.dataTransfer.files?.[0]; - if (file && file.name.endsWith(".json")) void file.text().then(loadTemporary); - else setNotice("Drop a .json template file"); + if (file) loadExtensionFile(file); }, - [loadTemporary] + [loadExtensionFile] ); const onPickFile = useCallback( (e: React.ChangeEvent) => { const file = e.target.files?.[0]; - if (file) void file.text().then(loadTemporary); + if (file) loadExtensionFile(file); e.target.value = ""; }, - [loadTemporary] + [loadExtensionFile] ); // Session templates first so a temporary upload overrides a same-id global for this session. @@ -268,6 +301,15 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi }, [sessionTemplates, globalTemplates]); const sessionIds = useMemo(() => new Set(sessionTemplates.map((t) => t.id)), [sessionTemplates]); + // Session plugins first: a temporary upload shadows a same-id installed plugin for + // this session. Dedup at the PluginMeta level — renderer ids are composite + // (plugin::), so it must happen before renderer expansion. + const plugins = useMemo(() => { + const byId = new Map(); + for (const p of [...sessionPlugins, ...serverPlugins]) if (!byId.has(p.plugin_id)) byId.set(p.plugin_id, p); + return [...byId.values()]; + }, [sessionPlugins, serverPlugins]); + const selectedId = cfg.environment ?? null; const switchScenario = useCallback( @@ -325,14 +367,14 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi sendResourceReq, pinned, togglePin, - plugins: serverPlugins, + plugins, bindings, setBinding, configs, openTarget: focus, filesTick, }), - [channelId, fs, sendResourceReq, pinned, togglePin, serverPlugins, bindings, setBinding, configs, focus, filesTick] + [channelId, fs, sendResourceReq, pinned, togglePin, plugins, bindings, setBinding, configs, focus, filesTick] ); // Desktop: the original card chrome, placed in the work area — hidden (but @@ -420,10 +462,10 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi {pinned.length > 0 && (
@@ -462,7 +504,13 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi )} )} - +
- - -
- - - diff --git a/frontend/src/features/chat/workbench/sandbox/examples/research-plugin.html b/frontend/src/features/chat/workbench/sandbox/examples/research-plugin.html deleted file mode 100644 index 59376790..00000000 --- a/frontend/src/features/chat/workbench/sandbox/examples/research-plugin.html +++ /dev/null @@ -1,145 +0,0 @@ - - - - - - - - - -
Research
-
-
- - - diff --git a/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts b/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts new file mode 100644 index 00000000..f67eb7c4 --- /dev/null +++ b/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts @@ -0,0 +1,81 @@ +import { describe, expect, it } from "vitest"; +import { validatePluginManifest } from "./pluginManifest"; + +const ok = { + id: "md-checklist", + title: "Markdown checklist", + renderers: [{ id: "checklist", title: "Checklist", match: { format: "markdown" } }], +}; + +describe("validatePluginManifest", () => { + it("accepts a well-formed manifest", () => { + expect(validatePluginManifest(ok)).toBeNull(); + }); + + it("accepts a renderer without match (match is optional)", () => { + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R" }] }) + ).toBeNull(); + }); + + it("accepts multiple renderers with distinct ids", () => { + expect( + validatePluginManifest({ + ...ok, + renderers: [ + { id: "a", title: "A" }, + { id: "b", title: "B" }, + ], + }) + ).toBeNull(); + }); + + it("rejects non-objects", () => { + expect(validatePluginManifest(null)).toMatch(/object/); + expect(validatePluginManifest("hi")).toMatch(/object/); + expect(validatePluginManifest([ok])).toMatch(/object/); + }); + + it("rejects missing/empty id or title", () => { + expect(validatePluginManifest({ ...ok, id: undefined })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, id: " " })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, title: undefined })).toMatch(/title/); + expect(validatePluginManifest({ ...ok, title: "" })).toMatch(/title/); + }); + + it("rejects missing or empty renderers (incl. retired panels-only manifests)", () => { + expect(validatePluginManifest({ id: "x", title: "X" })).toMatch(/renderers/); + expect(validatePluginManifest({ id: "x", title: "X", renderers: [] })).toMatch(/renderers/); + // a legacy scenario plugin declares panels but no renderers — same rejection path + expect( + validatePluginManifest({ id: "x", title: "X", panels: [{ id: "notes", title: "Notes" }] }) + ).toMatch(/renderers/); + }); + + it("rejects malformed renderer entries", () => { + expect(validatePluginManifest({ ...ok, renderers: ["nope"] })).toMatch(/renderer/); + expect(validatePluginManifest({ ...ok, renderers: [{ title: "no id" }] })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, renderers: [{ id: "r" }] })).toMatch(/title/); + }); + + it("rejects duplicate renderer ids within a plugin", () => { + expect( + validatePluginManifest({ + ...ok, + renderers: [ + { id: "dup", title: "One" }, + { id: "dup", title: "Two" }, + ], + }) + ).toMatch(/duplicate/); + }); + + it("rejects a non-object match", () => { + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: "markdown" }] }) + ).toMatch(/match/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: ["markdown"] }] }) + ).toMatch(/match/); + }); +}); diff --git a/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts new file mode 100644 index 00000000..586b5b04 --- /dev/null +++ b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts @@ -0,0 +1,61 @@ +// Plugin manifest types + shape validation. Deliberately dependency-free (no DOM, no +// api client) so it is unit-testable in node and shared by every manifest consumer: +// the admin upload, the drawer's temporary (session) load, and the renderer registry. + +// What a renderer ACCEPTS — declared by the renderer, evaluated cheaply by the host to +// build the candidate list (no plugin boot). A renderer is offered for a file only if +// its content passes this. The fine "can I really render this" judgment still happens +// inside the renderer at render time (it may reply cheers:unsupported). +export interface RendererMatch { + format?: string; // "markdown" | "json" | "toml" | "xml" | "text" (by file extension) + glob?: string; // optional path glob, e.g. "reviews/*.md" + requireAll?: string[]; // content must contain ALL of these substrings (e.g. md headings) + requireAny?: string[]; // content must contain AT LEAST ONE of these + jsonHas?: string[]; // json only: parsed object must have ALL these top-level keys +} + +export interface PluginManifest { + id?: string; + title?: string; + // renderer plugins declare renderers (render/save protocol, SandboxRenderer). The old + // `panels` scenario-plugin protocol is retired; an installed plugin without `renderers` + // simply contributes nothing. + renderers?: { id: string; title: string; match?: RendererMatch }[]; +} + +export interface PluginMeta { + plugin_id: string; + title: string; + manifest: PluginManifest; + /** Inline sandbox bundle — present only on SESSION-loaded (temporary) plugins; the + * server never sends it (installed bundles are fetched lazily via fetchBundle). */ + bundle?: string; + /** Session-only marker (loaded via the drawer, never installed) — ⏱ in pickers. */ + transient?: boolean; +} + +/** Upper bound for a plugin bundle. Guards the session (temporary) load path; the + * server enforces the same cap on install. Also the sane ceiling for iframe srcDoc. */ +export const MAX_PLUGIN_BUNDLE_BYTES = 2 * 1024 * 1024; + +/** Shape-check a parsed plugin manifest. Returns an error message, or null when valid. */ +export function validatePluginManifest(m: unknown): string | null { + if (!m || typeof m !== "object" || Array.isArray(m)) return "manifest must be a JSON object"; + const o = m as Record; + if (typeof o.id !== "string" || !o.id.trim()) return "manifest.id must be a non-empty string"; + if (typeof o.title !== "string" || !o.title.trim()) return "manifest.title must be a non-empty string"; + if (!Array.isArray(o.renderers) || o.renderers.length === 0) + return "manifest.renderers must be a non-empty array (the old `panels` protocol is retired — see docs/developer/PLUGIN_DEVELOPMENT.md)"; + const seen = new Set(); + for (const r of o.renderers as unknown[]) { + if (!r || typeof r !== "object" || Array.isArray(r)) return "each renderer must be an object"; + const rr = r as Record; + if (typeof rr.id !== "string" || !rr.id.trim()) return "each renderer needs a non-empty string id"; + if (typeof rr.title !== "string" || !rr.title.trim()) return "each renderer needs a non-empty string title"; + if (seen.has(rr.id)) return `duplicate renderer id: ${rr.id}`; + seen.add(rr.id); + if (rr.match !== undefined && (!rr.match || typeof rr.match !== "object" || Array.isArray(rr.match))) + return "renderer match must be an object when present"; + } + return null; +} From 40c93122abd44cf56ce9ece5b6edecefe0cd1fad Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 20:14:37 +0800 Subject: [PATCH 08/28] =?UTF-8?q?feat(workbench):=20plugin=20protocol=201?= =?UTF-8?q?=20=E2=80=94=20versioned=20manifest,=20richer=20match=20vocabul?= =?UTF-8?q?ary,=20server-side=20validation,=20inline=20SDK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The plugin contract gets a version and a normative spec, so it can evolve without breaking installed plugins. - manifest gains protocol (absent = 1, the documented default covering all pre-field installs); hosts skip plugins declaring an unimplemented protocol instead of half-rendering them; the server rejects them at install - match vocabulary (protocol 1 final): format accepts a string OR list; dataHas = top-level keys of parsed structured content (format-agnostic successor of jsonHas, which stays valid with frozen JSON-only semantics); dataKind object|array — the only way to claim a JSON array. Specificity counts the new constraints; unknown match keys are ignored by design - builtin chart migrates jsonHas -> dataHas (same behavior) - server: validate_manifest on PUT /workbench/plugins/:id — id charset + path-param match, title, protocol, legacy panels reject, per-renderer shape, match type-checks; 2 MiB bundle / 64 KiB manifest caps (413). The old "{}"-manifest default hole is closed; already-installed rows are never revalidated - cheers-plugin-sdk.js (docs/arch/examples): ~50-line copy-paste-inline helper wrapping ready/render/save/resource; examples declare protocol: 1 - PLUGIN_DEVELOPMENT.md: protocol field + vocabulary + server error table + SDK section + explicit JSON-RPC/MCP-Apps deferral note; zh doc pointer Tests: 8 new cargo cases (validation matrix), 14 vitest cases across the registry vocabulary + manifest validation; full suites green (165 cargo / 41 vitest). Co-Authored-By: Claude Fable 5 --- docs/arch/RENDERER_PLUGIN.md | 4 +- docs/arch/examples/cheers-plugin-sdk.js | 63 ++++++ docs/arch/examples/code-review.plugin.html | 1 + docs/arch/examples/lit-review.plugin.html | 1 + docs/arch/examples/md-checklist.plugin.html | 1 + docs/developer/PLUGIN_DEVELOPMENT.md | 61 +++++- .../chat/workbench/renderers/registry.test.ts | 64 ++++++ .../chat/workbench/renderers/registry.ts | Bin 5988 -> 7699 bytes .../features/chat/workbench/sandbox/api.ts | 1 + .../sandbox/examples/code-review.html | 1 + .../sandbox/examples/lit-review.html | 1 + .../sandbox/examples/md-checklist.html | 1 + .../workbench/sandbox/pluginManifest.test.ts | 18 +- .../chat/workbench/sandbox/pluginManifest.ts | 29 ++- server/src/api/workbench.rs | 36 +-- server/src/domain/workbench_plugins.rs | 207 +++++++++++++++++- 16 files changed, 460 insertions(+), 29 deletions(-) create mode 100644 docs/arch/examples/cheers-plugin-sdk.js diff --git a/docs/arch/RENDERER_PLUGIN.md b/docs/arch/RENDERER_PLUGIN.md index 69764786..9f55e7ab 100644 --- a/docs/arch/RENDERER_PLUGIN.md +++ b/docs/arch/RENDERER_PLUGIN.md @@ -50,7 +50,9 @@ | `renderers[].match.glob` | (可选)按路径窄化,如 `"reviews/*.md"` | | `renderers[].match.requireAll` | (可选)内容必须**全部包含**这些子串。用于「md 含某些标题」,如 `["## 待办","## 进行中"]`。 | | `renderers[].match.requireAny` | (可选)内容至少包含**其一**,如 `["- [ ]","- [x]"]`(待办行)。 | -| `renderers[].match.jsonHas` | (可选,仅 json)解析后的对象必须**含全部**这些顶层键,如 `["columns","cards"]`。 | +| `renderers[].match.jsonHas` | (可选,仅 json)解析后的对象必须**含全部**这些顶层键,如 `["columns","cards"]`。**已弃用**:新 manifest 用 `dataHas`。 | + +> **协议 1 补充(规范见英文版)**:manifest 顶层可声明 `"protocol": 1`(缺省即 1);`match.format` 可为字符串**数组**;新增 `dataHas`(结构化内容顶层键,格式无关,取代 `jsonHas`)与 `dataKind`(`"object" | "array"`,声明顶层形状——认领「JSON 数组」的唯一方式)。服务端安装时校验 manifest(错误表见英文版 §8);bundle ≤ 2 MiB。 > **`match` = 你声明「我接受什么」**。host 拿文件内容廉价评估(子串/JSON 键,**不**启动你的沙箱),据此决定你**是否出现在该文件的渲染器候选里**——所以一个需要 `## ` 标题的渲染器,不会被推荐给一篇纯散文。 > diff --git a/docs/arch/examples/cheers-plugin-sdk.js b/docs/arch/examples/cheers-plugin-sdk.js new file mode 100644 index 00000000..7afd8141 --- /dev/null +++ b/docs/arch/examples/cheers-plugin-sdk.js @@ -0,0 +1,63 @@ +/* cheers-plugin-sdk v1 — protocol 1. + * + * Copy-paste this function INLINE into your plugin's + + + +
+
+ + + diff --git a/server/assets/workbench-plugins/cheers-frontmatter.plugin.html b/server/assets/workbench-plugins/cheers-frontmatter.plugin.html new file mode 100644 index 00000000..bb427e0e --- /dev/null +++ b/server/assets/workbench-plugins/cheers-frontmatter.plugin.html @@ -0,0 +1,144 @@ + + + + + + + + + +
+
+
+ + + diff --git a/server/assets/workbench-plugins/cheers-kanban-md.plugin.html b/server/assets/workbench-plugins/cheers-kanban-md.plugin.html new file mode 100644 index 00000000..3528477b --- /dev/null +++ b/server/assets/workbench-plugins/cheers-kanban-md.plugin.html @@ -0,0 +1,171 @@ + + + + + + + + + +
+
+ + + diff --git a/server/assets/workbench-plugins/cheers-table.plugin.html b/server/assets/workbench-plugins/cheers-table.plugin.html new file mode 100644 index 00000000..b55852d4 --- /dev/null +++ b/server/assets/workbench-plugins/cheers-table.plugin.html @@ -0,0 +1,177 @@ + + + + + + + + + +
+ + +
+
+ + + diff --git a/server/migrations/0048_workbench_plugin_origin.sql b/server/migrations/0048_workbench_plugin_origin.sql new file mode 100644 index 00000000..5b2b2df9 --- /dev/null +++ b/server/migrations/0048_workbench_plugin_origin.sql @@ -0,0 +1,21 @@ +-- Official (gateway-seeded) workbench plugins: provenance + seed bookkeeping. +-- Note: 0009's header comment still shows the retired `panels` manifest shape; applied +-- migrations are checksummed and immutable, so the correction lives here — the current +-- manifest shape is { id, protocol, title, renderers:[{id,title,match}] }, validated on +-- install (docs/developer/PLUGIN_DEVELOPMENT.md). + +-- 'admin' = installed via the API by an admin (the only value that existed before). +-- 'system' = seeded from the gateway binary; the binary is its source of truth, so the +-- API rejects PUT on these rows (copy under a new id to customize). +ALTER TABLE workbench_plugins + ADD COLUMN origin VARCHAR(16) NOT NULL DEFAULT 'admin'; + +-- One row per official plugin ever seeded into THIS database: the embedded `version` +-- it has seen. Deleting the plugin row does NOT delete its state row — that is what +-- keeps an admin deletion sticky across restarts of the same release; only a release +-- shipping a HIGHER version re-seeds it. +CREATE TABLE workbench_official_plugin_state ( + plugin_id VARCHAR(64) PRIMARY KEY, + seeded_version INT NOT NULL, + seeded_at TIMESTAMPTZ NOT NULL DEFAULT NOW() +); diff --git a/server/src/api/workbench.rs b/server/src/api/workbench.rs index c3b86f32..7c1ca705 100644 --- a/server/src/api/workbench.rs +++ b/server/src/api/workbench.rs @@ -55,6 +55,16 @@ pub async fn install_plugin( Json(body): Json, ) -> Result, AppError> { require_admin(&claims)?; + // Official (gateway-seeded) plugins are managed by releases — an admin PUT here + // would be silently clobbered on the next version bump. Refuse instead. + if domain::workbench_plugins::get_origin(&state.db, &plugin_id).await?.as_deref() + == Some("system") + { + return Err(AppError::BadRequest( + "official plugin — managed by gateway releases; copy it under a new id to customize" + .into(), + )); + } let manifest = body .get("manifest") .ok_or_else(|| AppError::BadRequest("plugin manifest is required".into()))?; @@ -85,6 +95,7 @@ pub async fn install_plugin( &manifest_str, bundle, &claims.sub, + "admin", ) .await?; Ok(Json(json!({ "plugin_id": plugin_id, "ok": true }))) diff --git a/server/src/domain/mod.rs b/server/src/domain/mod.rs index bfac1d7c..70acae88 100644 --- a/server/src/domain/mod.rs +++ b/server/src/domain/mod.rs @@ -24,6 +24,7 @@ pub mod stt_settings; pub mod task_chains; pub mod trace; pub mod usage_store; +pub mod workbench_official; pub mod workbench_plugins; pub mod workbench_templates; pub mod workspaces; diff --git a/server/src/domain/workbench_official.rs b/server/src/domain/workbench_official.rs new file mode 100644 index 00000000..e389ac32 --- /dev/null +++ b/server/src/domain/workbench_official.rs @@ -0,0 +1,205 @@ +//! Official workbench plugins — embedded in the gateway binary (include_str!) and +//! seeded into `workbench_plugins` at startup, so a fresh install has a useful +//! renderer set with zero admin steps. +//! +//! Policy (pure `decide`, unit-tested): +//! - the BINARY is the source of truth for official plugins (`origin='system'`); +//! - an admin deletion is sticky across restarts of the same release — only a release +//! shipping a HIGHER manifest `version` re-seeds that plugin; +//! - a row an admin claimed under the same id (`origin='admin'`) is never overwritten. +//! +//! Sources live in server/assets/workbench-plugins/*.plugin.html (self-contained, +//! also hand-uploadable for testing). A unit test walks every embedded bundle through +//! extract_manifest + validate_manifest, so CI cannot ship a malformed official plugin. + +use serde_json::Value; +use sqlx::PgPool; +use tracing::{info, warn}; + +use super::workbench_plugins; + +/// The official set (one self-contained .html per plugin). +pub const OFFICIAL: &[&str] = &[ + include_str!("../../assets/workbench-plugins/cheers-checklist.plugin.html"), + include_str!("../../assets/workbench-plugins/cheers-table.plugin.html"), + include_str!("../../assets/workbench-plugins/cheers-kanban-md.plugin.html"), + include_str!("../../assets/workbench-plugins/cheers-frontmatter.plugin.html"), +]; + +/// Extract the embedded `#cheers-plugin` manifest from a bundle. A literal substring +/// scan is enough — these files are ours and CI-verified (see module tests). +pub fn extract_manifest(html: &str) -> Result { + const OPEN: &str = r#"") + .ok_or("unterminated manifest script")? + + start; + serde_json::from_str(&html[start..end]).map_err(|e| format!("manifest is not valid JSON: {e}")) +} + +/// What the seeder should do for one official plugin. +#[derive(Debug, PartialEq, Eq)] +pub enum Action { + Install, + Noop, + SkipAdminClaimed, +} + +/// Pure seeding policy. `seeded_version` = this DB's state row (None = never seeded: +/// fresh DB or pre-feature DB); `existing_origin` = the current plugin row's origin +/// (None = no row, e.g. admin-deleted). +pub fn decide( + embedded_version: i64, + seeded_version: Option, + existing_origin: Option<&str>, +) -> Action { + if existing_origin == Some("admin") { + // The id belongs to an admin-installed plugin (claimed before this feature, or + // re-claimed after deleting the official one). Their row, not ours. + return Action::SkipAdminClaimed; + } + match seeded_version { + None => Action::Install, + Some(v) if embedded_version > v => Action::Install, // upgrade — restores deletions too + Some(_) => Action::Noop, // same/older release: an admin deletion stays deleted + } +} + +/// Seed the official set. Called once at gateway startup (after migrations). Upserts +/// are idempotent; per-plugin problems are logged and skipped, never fatal. +pub async fn seed(db: &PgPool) -> Result<(), sqlx::Error> { + for bundle in OFFICIAL { + let manifest = match extract_manifest(bundle) { + Ok(m) => m, + Err(e) => { + warn!(error = %e, "official plugin bundle is malformed; skipping"); + continue; + } + }; + let id = manifest + .get("id") + .and_then(Value::as_str) + .unwrap_or_default() + .to_string(); + if let Err(e) = workbench_plugins::validate_manifest(&id, &manifest) { + warn!(plugin = %id, error = %e, "official plugin failed manifest validation; skipping"); + continue; + } + let version = manifest.get("version").and_then(Value::as_i64).unwrap_or(1); + + let seeded: Option = sqlx::query_scalar( + "SELECT seeded_version FROM workbench_official_plugin_state WHERE plugin_id = $1", + ) + .bind(&id) + .fetch_optional(db) + .await?; + let origin: Option = + sqlx::query_scalar("SELECT origin FROM workbench_plugins WHERE plugin_id = $1") + .bind(&id) + .fetch_optional(db) + .await?; + + match decide(version, seeded.map(i64::from), origin.as_deref()) { + Action::Install => { + let title = manifest + .get("title") + .and_then(Value::as_str) + .unwrap_or(&id); + workbench_plugins::install( + db, + &id, + title, + &manifest.to_string(), + bundle, + "system", + "system", + ) + .await?; + sqlx::query( + "INSERT INTO workbench_official_plugin_state (plugin_id, seeded_version) + VALUES ($1, $2) + ON CONFLICT (plugin_id) + DO UPDATE SET seeded_version = $2, seeded_at = NOW()", + ) + .bind(&id) + .bind(version as i32) + .execute(db) + .await?; + info!(plugin = %id, version, "official workbench plugin seeded"); + } + Action::Noop => {} + Action::SkipAdminClaimed => { + warn!(plugin = %id, "official plugin id is admin-claimed; leaving their row alone"); + } + } + } + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::*; + + /// CI gate: every embedded official bundle must carry a valid protocol-1 manifest. + #[test] + fn every_official_bundle_is_valid() { + assert!(!OFFICIAL.is_empty()); + for bundle in OFFICIAL { + let m = extract_manifest(bundle).expect("manifest extracts"); + let id = m.get("id").and_then(Value::as_str).expect("has id"); + assert!(id.starts_with("cheers-"), "official ids use the cheers- prefix: {id}"); + workbench_plugins::validate_manifest(id, &m).expect("manifest validates"); + assert!( + m.get("version").and_then(Value::as_i64).is_some(), + "official manifests carry an integer version (drives re-seeding): {id}" + ); + } + } + + #[test] + fn official_ids_are_unique() { + let mut ids: Vec = OFFICIAL + .iter() + .map(|b| { + extract_manifest(b).unwrap()["id"] + .as_str() + .unwrap() + .to_string() + }) + .collect(); + ids.sort(); + ids.dedup(); + assert_eq!(ids.len(), OFFICIAL.len()); + } + + #[test] + fn decide_fresh_db_installs() { + assert_eq!(decide(1, None, None), Action::Install); + } + + #[test] + fn decide_same_version_is_noop_and_keeps_deletions() { + // present at same version + assert_eq!(decide(1, Some(1), Some("system")), Action::Noop); + // admin deleted it; same release restarts must NOT resurrect it + assert_eq!(decide(1, Some(1), None), Action::Noop); + // downgrade (rollback deploy): leave the newer data alone + assert_eq!(decide(1, Some(2), Some("system")), Action::Noop); + } + + #[test] + fn decide_version_bump_reinstalls_even_after_deletion() { + assert_eq!(decide(2, Some(1), Some("system")), Action::Install); + assert_eq!(decide(2, Some(1), None), Action::Install); // restore deleted + } + + #[test] + fn decide_never_touches_admin_claimed_ids() { + assert_eq!(decide(2, Some(1), Some("admin")), Action::SkipAdminClaimed); + assert_eq!(decide(1, None, Some("admin")), Action::SkipAdminClaimed); + } +} diff --git a/server/src/domain/workbench_plugins.rs b/server/src/domain/workbench_plugins.rs index 2f9a9c04..1d7e0ca9 100644 --- a/server/src/domain/workbench_plugins.rs +++ b/server/src/domain/workbench_plugins.rs @@ -119,7 +119,7 @@ pub fn validate_manifest(plugin_id: &str, manifest: &Value) -> Result<(), String /// List installed plugins (metadata only — manifest parsed, bundle omitted to stay light). pub async fn list(db: &PgPool) -> Result, sqlx::Error> { let rows = sqlx::query( - "SELECT plugin_id, title, manifest FROM workbench_plugins ORDER BY installed_at DESC", + "SELECT plugin_id, title, manifest, origin FROM workbench_plugins ORDER BY installed_at DESC", ) .fetch_all(db) .await?; @@ -135,11 +135,20 @@ pub async fn list(db: &PgPool) -> Result, sqlx::Error> { "plugin_id": r.try_get::("plugin_id").unwrap_or_default(), "title": r.try_get::("title").unwrap_or_default(), "manifest": manifest, + "origin": r.try_get::("origin").unwrap_or_else(|_| "admin".into()), }) }) .collect()) } +/// The origin of an installed plugin ('admin' | 'system'), or None if not installed. +pub async fn get_origin(db: &PgPool, plugin_id: &str) -> Result, sqlx::Error> { + sqlx::query_scalar("SELECT origin FROM workbench_plugins WHERE plugin_id = $1") + .bind(plugin_id) + .fetch_optional(db) + .await +} + /// The sandboxed bundle (HTML/JS) for one plugin, or None if not installed. pub async fn get_bundle(db: &PgPool, plugin_id: &str) -> Result, sqlx::Error> { sqlx::query_scalar("SELECT bundle FROM workbench_plugins WHERE plugin_id = $1") @@ -148,7 +157,8 @@ pub async fn get_bundle(db: &PgPool, plugin_id: &str) -> Result, .await } -/// Install or update a plugin (admin only — enforced at the API layer). +/// Install or update a plugin. Admin-only on the API path (which also refuses to touch +/// `origin='system'` rows); the startup seeder calls this with origin='system'. pub async fn install( db: &PgPool, plugin_id: &str, @@ -156,18 +166,20 @@ pub async fn install( manifest: &str, bundle: &str, installed_by: &str, + origin: &str, ) -> Result<(), sqlx::Error> { sqlx::query( - "INSERT INTO workbench_plugins (plugin_id, title, manifest, bundle, installed_by) - VALUES ($1, $2, $3, $4, $5) + "INSERT INTO workbench_plugins (plugin_id, title, manifest, bundle, installed_by, origin) + VALUES ($1, $2, $3, $4, $5, $6) ON CONFLICT (plugin_id) - DO UPDATE SET title = $2, manifest = $3, bundle = $4, updated_at = NOW()", + DO UPDATE SET title = $2, manifest = $3, bundle = $4, origin = $6, updated_at = NOW()", ) .bind(plugin_id) .bind(title) .bind(manifest) .bind(bundle) .bind(installed_by) + .bind(origin) .execute(db) .await?; Ok(()) diff --git a/server/src/main.rs b/server/src/main.rs index 610f3284..822b47a0 100644 --- a/server/src/main.rs +++ b/server/src/main.rs @@ -51,6 +51,10 @@ async fn main() -> anyhow::Result<()> { // migration), so the gateway is reachable for the login/demo flow. server::domain::seed::ensure_admin_user(&db).await?; + // Seed the official workbench plugins (embedded in this binary). Version-gated + // upserts: admin deletions stick within a release; see domain/workbench_official.rs. + server::domain::workbench_official::seed(&db).await?; + // S3 / RustFS client for gateway-proxied file storage. Bucket bootstrap is // best-effort: a missing object store must not block the core chat loop. let s3 = infra::s3::build_client(&config); diff --git a/server/tests/official_plugins.rs b/server/tests/official_plugins.rs new file mode 100644 index 00000000..0f468bbe --- /dev/null +++ b/server/tests/official_plugins.rs @@ -0,0 +1,125 @@ +//! Integration tests for official workbench-plugin seeding (domain/workbench_official). +//! +//! Same harness as flows.rs: `#[sqlx::test]` provisions an isolated temp database per +//! test (runs ./migrations, drops it afterwards); needs `DATABASE_URL` pointing at a +//! Postgres that may CREATE DATABASE. Gated by the `integration` feature: +//! +//! ```bash +//! DATABASE_URL=postgres://cheers:cheers@localhost:5432/cheers \ +//! cargo test --features integration --test official_plugins +//! ``` +#![cfg(feature = "integration")] + +use sqlx::{PgPool, Row}; + +use server::domain::workbench_official::{extract_manifest, seed, OFFICIAL}; + +async fn plugin_rows(db: &PgPool) -> Vec<(String, String)> { + sqlx::query("SELECT plugin_id, origin FROM workbench_plugins ORDER BY plugin_id") + .fetch_all(db) + .await + .unwrap() + .into_iter() + .map(|r| (r.get::("plugin_id"), r.get::("origin"))) + .collect() +} + +fn first_official_id() -> String { + extract_manifest(OFFICIAL[0]).unwrap()["id"] + .as_str() + .unwrap() + .to_string() +} + +#[sqlx::test] +async fn seeds_full_set_on_empty_db(db: PgPool) { + seed(&db).await.unwrap(); + let rows = plugin_rows(&db).await; + assert_eq!(rows.len(), OFFICIAL.len()); + assert!(rows.iter().all(|(_, origin)| origin == "system")); + let states: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM workbench_official_plugin_state") + .fetch_one(&db) + .await + .unwrap(); + assert_eq!(states as usize, OFFICIAL.len()); + // bundles are actually served + let bundle: Option = + sqlx::query_scalar("SELECT bundle FROM workbench_plugins WHERE plugin_id = $1") + .bind(first_official_id()) + .fetch_optional(&db) + .await + .unwrap(); + assert!(bundle.unwrap().contains("cheers-plugin")); +} + +#[sqlx::test] +async fn reseeding_same_version_is_idempotent_and_keeps_deletions(db: PgPool) { + seed(&db).await.unwrap(); + let id = first_official_id(); + // admin deletes one official plugin + sqlx::query("DELETE FROM workbench_plugins WHERE plugin_id = $1") + .bind(&id) + .execute(&db) + .await + .unwrap(); + // same release restarts: the deletion must stick + seed(&db).await.unwrap(); + assert_eq!(plugin_rows(&db).await.len(), OFFICIAL.len() - 1); +} + +#[sqlx::test] +async fn version_bump_restores_a_deleted_official_plugin(db: PgPool) { + seed(&db).await.unwrap(); + let id = first_official_id(); + sqlx::query("DELETE FROM workbench_plugins WHERE plugin_id = $1") + .bind(&id) + .execute(&db) + .await + .unwrap(); + // simulate "this DB last saw an older release" — the embedded version is now higher + sqlx::query("UPDATE workbench_official_plugin_state SET seeded_version = 0 WHERE plugin_id = $1") + .bind(&id) + .execute(&db) + .await + .unwrap(); + seed(&db).await.unwrap(); + let rows = plugin_rows(&db).await; + assert_eq!(rows.len(), OFFICIAL.len()); + assert!(rows.iter().any(|(pid, origin)| pid == &id && origin == "system")); +} + +#[sqlx::test] +async fn admin_claimed_id_is_never_overwritten(db: PgPool) { + seed(&db).await.unwrap(); + let id = first_official_id(); + // admin deletes the official plugin, then installs their own under the same id + sqlx::query("DELETE FROM workbench_plugins WHERE plugin_id = $1") + .bind(&id) + .execute(&db) + .await + .unwrap(); + server::domain::workbench_plugins::install( + &db, + &id, + "Admin's own", + r#"{"id":"x"}"#, + "", + "someone", + "admin", + ) + .await + .unwrap(); + // even a version bump must not clobber their row + sqlx::query("UPDATE workbench_official_plugin_state SET seeded_version = 0 WHERE plugin_id = $1") + .bind(&id) + .execute(&db) + .await + .unwrap(); + seed(&db).await.unwrap(); + let title: String = sqlx::query_scalar("SELECT title FROM workbench_plugins WHERE plugin_id = $1") + .bind(&id) + .fetch_one(&db) + .await + .unwrap(); + assert_eq!(title, "Admin's own"); +} From ed86b058e4eeaab8106d5896b6afe68cd9329782 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:40:43 +0000 Subject: [PATCH 10/28] chore(deps): Bump actions/setup-node from 4 to 7 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0f8b651d..61c6dd98 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -148,7 +148,7 @@ jobs: - uses: actions/checkout@v4 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: "20" cache: "npm" From c6fbdc583070f4ef89c90d65583a54f3bdf192a5 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 20:40:50 +0800 Subject: [PATCH 11/28] feat(workbench): YAML as a first-class board format with comment-preserving writes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Structured boards can now be .yaml/.yml, and — the point of choosing YAML over JSON — their comments survive machine rewrites. The lens save path patches the parsed Document (yamlDoc.applyEdits: deep diff -> setIn/deleteIn on the CST) instead of re-serializing, so '# notes for humans/bots' and blank lines ride through UI edits untouched. Documented loss cases (correctness over comment retention): unparseable input, multi-document streams, and anchors/aliases fall back to a full re-stringify; an array whose length/order changed is replaced wholesale. - Format layer: YAML_FMT with serialize(data, prevText) round-trip context (useFile threads the last-loaded text); .yaml seeds serialize as YAML - registry: formatOf classifies yaml; dataHas/dataKind evaluate on parsed YAML (jsonHas stays frozen to JSON, tested); builtin table/kanban/chart claim ['json','yaml'] - builtin table becomes PICKABLE: columns come from template config when present, else inferred from the union of row keys (dataKind:'array' gates the offer) — this is also the official YAML answer, since sandboxed plugins would have to inline their own parser (documented) - docs: match table + yaml plugin note + YAML 1.2 semantics warning Tests: 11 yamlDoc round-trip cases (comments above/inline, blank lines, key add/delete, nested edits, array-resize/anchor/multi-doc fallbacks), 5 registry yaml cases; 55 vitest total green. Verified live (kind stack): seeded ydemo/rows.yaml (commented array) -> builtin Table auto-offered with inferred name/role columns -> cell edit -> Save -> Raw shows both comments intact plus the edit; metrics.yaml with 'series' renders the chart. Co-Authored-By: Claude Fable 5 --- docs/arch/RENDERER_PLUGIN.md | 2 +- docs/developer/PLUGIN_DEVELOPMENT.md | 18 +++- frontend/package-lock.json | 16 +++ frontend/package.json | 1 + .../src/features/chat/workbench/README.md | 7 +- .../src/features/chat/workbench/jsonFile.ts | 32 +++++- .../chat/workbench/lens/LensPanel.tsx | 4 +- .../features/chat/workbench/lens/builtins.tsx | 19 +++- .../src/features/chat/workbench/manifest.ts | 11 +- .../chat/workbench/renderers/registry.test.ts | 39 ++++++- .../chat/workbench/renderers/registry.ts | Bin 7699 -> 8495 bytes .../features/chat/workbench/yamlDoc.test.ts | 99 ++++++++++++++++++ .../src/features/chat/workbench/yamlDoc.ts | 59 +++++++++++ 13 files changed, 286 insertions(+), 21 deletions(-) create mode 100644 frontend/src/features/chat/workbench/yamlDoc.test.ts create mode 100644 frontend/src/features/chat/workbench/yamlDoc.ts diff --git a/docs/arch/RENDERER_PLUGIN.md b/docs/arch/RENDERER_PLUGIN.md index 9f55e7ab..e46e1967 100644 --- a/docs/arch/RENDERER_PLUGIN.md +++ b/docs/arch/RENDERER_PLUGIN.md @@ -46,7 +46,7 @@ | `title` | 给人看的名字 | | `renderers[]` | 这个插件提供的渲染器,可多个 | | `renderers[].id` | 渲染器在插件内唯一 | -| `renderers[].match.format` | `markdown` / `json` / `toml` / `xml` / `text`。host 按扩展名归类(`.md`→markdown,无扩展名→text)。 | +| `renderers[].match.format` | `markdown` / `json` / `yaml` / `toml` / `xml` / `text`(可为数组)。host 按扩展名归类(`.md`→markdown,`.yaml`/`.yml`→yaml,无扩展名→text)。 | | `renderers[].match.glob` | (可选)按路径窄化,如 `"reviews/*.md"` | | `renderers[].match.requireAll` | (可选)内容必须**全部包含**这些子串。用于「md 含某些标题」,如 `["## 待办","## 进行中"]`。 | | `renderers[].match.requireAny` | (可选)内容至少包含**其一**,如 `["- [ ]","- [x]"]`(待办行)。 | diff --git a/docs/developer/PLUGIN_DEVELOPMENT.md b/docs/developer/PLUGIN_DEVELOPMENT.md index be0f8c8f..34824642 100644 --- a/docs/developer/PLUGIN_DEVELOPMENT.md +++ b/docs/developer/PLUGIN_DEVELOPMENT.md @@ -78,12 +78,12 @@ file the host assigns to it. Bundles are capped at **2 MiB**. | `renderers[]` | Renderers this plugin provides (non-empty; ids unique within the plugin) | | `renderers[].id` | Unique within the plugin (≤64 bytes) | | `renderers[].title` | Shown in the renderer dropdown | -| `renderers[].match.format` | Coarse format(s) by extension — a string **or a list**: `markdown` / `json` / `toml` / `xml` / `text` (`text` is the catch-all, matching any path) | +| `renderers[].match.format` | Coarse format(s) by extension — a string **or a list**: `markdown` / `json` / `yaml` / `toml` / `xml` / `text` (`text` is the catch-all, matching any path) | | `renderers[].match.glob` | Optional path narrowing, e.g. `"reviews/*.md"` | | `renderers[].match.requireAll` | Content must contain **all** of these substrings | | `renderers[].match.requireAny` | Content must contain **at least one** of these | -| `renderers[].match.dataHas` | Parsed **structured** content (JSON today; YAML when supported) must have **all** these top-level keys | -| `renderers[].match.dataKind` | Top-level shape of parsed structured content: `"object"` or `"array"` — the only way to claim "a JSON array" (arrays have no keys for `dataHas`) | +| `renderers[].match.dataHas` | Parsed **structured** content (JSON or YAML) must have **all** these top-level keys | +| `renderers[].match.dataKind` | Top-level shape of parsed structured content: `"object"` or `"array"` — the only way to claim "a JSON/YAML array" (arrays have no keys for `dataHas`) | | `renderers[].match.jsonHas` | **Deprecated** alias of `dataHas` with frozen **JSON-only** semantics (will never match YAML). Valid forever under protocol 1; new manifests should use `dataHas`. | Hosts **ignore unknown manifest keys** (and unknown `match` keys), so the vocabulary @@ -101,6 +101,16 @@ renderer candidates. Acceptance has **two layers**, both owned by the renderer: > The retired `panels` manifest shape (scenario plugins) is **rejected on upload**. > A plugin only provides renderers. +**YAML note.** The host classifies `.yaml`/`.yml` as `format: "yaml"` and evaluates +`dataHas`/`dataKind` on the parsed document, but `cheers:render` still hands your +sandbox the **raw text** — a plugin claiming YAML must inline its own parser (the +sandbox loads nothing external). In practice, prefer letting the **built-in lenses** +cover YAML: the builtin table (arrays of objects) and chart (`series`) accept both +JSON and YAML, and their writes go through a comment-preserving round-trip — +comments and blank lines in the file survive machine edits. Also remember YAML 1.2 +semantics: `yes`/`no`/`on`/`off` are plain strings, not booleans — agents writing +1.1-style files will get strings back. + ## 5. Protocol reference (protocol 1) ### 5.1 Messages @@ -329,7 +339,7 @@ Lifecycle rules (enforced; policy in `server/src/domain/workbench_official.rs`): | Symptom | Likely cause → fix | |---|---| -| **My renderer never appears in the dropdown** | Its `match` doesn't accept the file. Check in order: ① `match.format` vs the file's extension class (`.md`→markdown, `.json`→json, `.toml`→toml, `.xml`→xml, anything else→text); ② every `requireAll` substring is really in the content (exact match, case-sensitive); ③ at least one `requireAny` hit; ④ `jsonHas`: file must parse as a JSON **object** (not array) containing all listed keys; ⑤ `glob` matches the full path. | +| **My renderer never appears in the dropdown** | Its `match` doesn't accept the file. Check in order: ① `match.format` vs the file's extension class (`.md`→markdown, `.json`→json, `.yaml`/`.yml`→yaml, `.toml`→toml, `.xml`→xml, anything else→text); ② every `requireAll` substring is really in the content (exact match, case-sensitive); ③ at least one `requireAny` hit; ④ `dataHas`/`dataKind`: file must parse (JSON or YAML) with the claimed keys/shape — and `jsonHas` never matches YAML; ⑤ `glob` matches the full path. | | **The plugin loads but the iframe stays blank** | You never sent `cheers:ready`, or sent it before wiring your `message` listener (the host's `cheers:render` answer raced past you). Send `ready` as the **last** line of your script. | | **"This renderer can't render this file"** | Your own runtime verdict — you replied `cheers:unsupported`. If unexpected, your parse is stricter than your `match`; align them. | | **Saves fail repeatedly / edits bounce back** | Version conflict: someone (often the bot) wrote the file between your render and your save. Contract: on `cheers:saved {ok:false}` the host re-sends `cheers:render` with fresh content — re-render and let the user reapply. If you cached `version` yourself and reused it, stop: the host tracks the version, you never send one. | diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c3355fe2..5a9432ae 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -29,6 +29,7 @@ "react-router-dom": "^7.0.2", "remark-gfm": "^4.0.0", "tailwind-merge": "^2.5.5", + "yaml": "^2.9.0", "zustand": "^5.0.2" }, "devDependencies": { @@ -6743,6 +6744,21 @@ "dev": true, "license": "ISC" }, + "node_modules/yaml": { + "version": "2.9.0", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", + "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "license": "ISC", + "bin": { + "yaml": "bin.mjs" + }, + "engines": { + "node": ">= 14.6" + }, + "funding": { + "url": "https://github.com/sponsors/eemeli" + } + }, "node_modules/zustand": { "version": "5.0.14", "resolved": "https://registry.npmjs.org/zustand/-/zustand-5.0.14.tgz", diff --git a/frontend/package.json b/frontend/package.json index 30b984a9..6e48ee99 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -32,6 +32,7 @@ "react-router-dom": "^7.0.2", "remark-gfm": "^4.0.0", "tailwind-merge": "^2.5.5", + "yaml": "^2.9.0", "zustand": "^5.0.2" }, "devDependencies": { diff --git a/frontend/src/features/chat/workbench/README.md b/frontend/src/features/chat/workbench/README.md index a5859711..da256f6d 100644 --- a/frontend/src/features/chat/workbench/README.md +++ b/frontend/src/features/chat/workbench/README.md @@ -37,9 +37,14 @@ boards are automatically **shared human↔bot state**. ``` - **Lenses (built-in renderers)**: `table` (array of row objects; columns from - `config`), `kanban` (`{columns:[{name,items:[]}]}`), `markdown` (a string), + `config`, else inferred from the union of row keys), `kanban` + (`{columns:[{name,items:[]}]}`), `markdown` (a string), `chart` (`{xLabel?, yLabel?, series:[{name, points:[[x,y],…]}]}`, view-only). Unknown lens ids fail validation — data can never smuggle in code. +- **Formats**: structured lenses accept `.json` **and** `.yaml`/`.yml` files. YAML + writes are comment-preserving (the lens patches the parsed document instead of + re-serializing), so a board can carry `# comments` for humans/bots and survive UI + edits; seeds targeting a `.yaml` path serialize as YAML. - **On activation** the workbench seeds the files (create-only), writes `bindings[file] = "builtin:"` + `configs[file] = config` into `.workbench.json` (create-only — a user's explicit binding is never overwritten), diff --git a/frontend/src/features/chat/workbench/jsonFile.ts b/frontend/src/features/chat/workbench/jsonFile.ts index ede6ae8c..40f1f759 100644 --- a/frontend/src/features/chat/workbench/jsonFile.ts +++ b/frontend/src/features/chat/workbench/jsonFile.ts @@ -1,6 +1,8 @@ import { useCallback, useEffect, useRef, useState } from "react"; +import { parse as yamlParse } from "yaml"; import { ResourceError } from "../hooks/useChatRealtime"; import type { FsClient } from "./fsClient"; +import { applyEdits } from "./yamlDoc"; export function errMsg(e: unknown): string { if (e instanceof ResourceError) return `${e.code}: ${e.message}`; @@ -8,22 +10,35 @@ export function errMsg(e: unknown): string { } // ── Format layer: string <-> data, chosen by file extension ────────────────── -// JSON for structured boards, plain text for Markdown / prompts. (YAML can be -// added as another Format later; XML intentionally unsupported.) +// JSON and YAML for structured boards, plain text for Markdown / prompts. +// (XML intentionally unsupported.) `serialize` receives the previously loaded +// text so a format can round-trip what plain data can't carry — YAML uses it +// to preserve comments/blank lines across machine rewrites (see yamlDoc.ts). interface Format { parse: (s: string) => unknown; - serialize: (d: unknown) => string; + serialize: (d: unknown, prevText?: string) => string; } const JSON_FMT: Format = { parse: (s) => (s.trim() ? JSON.parse(s) : null), serialize: (d) => JSON.stringify(d, null, 2), }; +const YAML_FMT: Format = { + parse: (s) => (s.trim() ? (yamlParse(s) as unknown) : null), + serialize: (d, prevText) => applyEdits(prevText ?? "", d), +}; const TEXT_FMT: Format = { parse: (s) => s, serialize: (d) => (typeof d === "string" ? d : String(d)), }; +export function isStructuredPath(path: string): boolean { + const p = path.toLowerCase(); + return p.endsWith(".json") || p.endsWith(".yaml") || p.endsWith(".yml"); +} export function formatFor(path: string): Format { - return path.endsWith(".json") ? JSON_FMT : TEXT_FMT; + const p = path.toLowerCase(); + if (p.endsWith(".json")) return JSON_FMT; + if (p.endsWith(".yaml") || p.endsWith(".yml")) return YAML_FMT; + return TEXT_FMT; } // Generic file-backed state: load a workspace file (parsed by its format), edit in @@ -34,14 +49,19 @@ export function useFile(fs: FsClient, path: string, fallback: T) { const [data, setData] = useState(fallback); const [version, setVersion] = useState(null); const [status, setStatus] = useState(null); + // Last text loaded from / written to the server — the serialize round-trip context + // (YAML patches this text to keep comments; JSON/TEXT ignore it). + const rawRef = useRef(""); const load = useCallback(async () => { try { const f = await fs.read(path); + rawRef.current = f.content; setData(fmt.parse(f.content) as T); setVersion(f.version); } catch (e) { if (e instanceof ResourceError && e.code === "NOT_FOUND") { + rawRef.current = ""; setVersion(null); setData(fallback); } else { @@ -59,7 +79,9 @@ export function useFile(fs: FsClient, path: string, fallback: T) { async (next: T) => { setStatus(null); try { - const r = await fs.write(path, fmt.serialize(next), version ?? 0); + const body = fmt.serialize(next, rawRef.current); + const r = await fs.write(path, body, version ?? 0); + rawRef.current = body; setData(next); setVersion(r.version); setStatus("Saved"); diff --git a/frontend/src/features/chat/workbench/lens/LensPanel.tsx b/frontend/src/features/chat/workbench/lens/LensPanel.tsx index 22d7c6d3..fe86d3d9 100644 --- a/frontend/src/features/chat/workbench/lens/LensPanel.tsx +++ b/frontend/src/features/chat/workbench/lens/LensPanel.tsx @@ -2,7 +2,7 @@ import { useEffect, useRef } from "react"; import { Save } from "lucide-react"; import type { FsClient } from "../fsClient"; import type { ViewDef } from "../manifest"; -import { useFile } from "../jsonFile"; +import { isStructuredPath, useFile } from "../jsonFile"; import { getLens } from "./registry"; // Host for one built-in lens over one file: load (parsed by format) -> lens -> save on @@ -11,7 +11,7 @@ import { getLens } from "./registry"; // stale snapshot can't be written back over a concurrent agent write). export function LensPanel({ fs, view, reloadTick }: { fs: FsClient; view: ViewDef; reloadTick?: number }) { const lens = getLens(view.lens); - const fallback: unknown = view.file.endsWith(".json") ? null : ""; + const fallback: unknown = isStructuredPath(view.file) ? null : ""; const { data, setData, save, status, reload } = useFile(fs, view.file, fallback); // Live-push: the Desk changed on the server (a bot finished writing) — re-pull a diff --git a/frontend/src/features/chat/workbench/lens/builtins.tsx b/frontend/src/features/chat/workbench/lens/builtins.tsx index 4aaef781..7650778d 100644 --- a/frontend/src/features/chat/workbench/lens/builtins.tsx +++ b/frontend/src/features/chat/workbench/lens/builtins.tsx @@ -2,13 +2,28 @@ import { useState } from "react"; import { ChevronLeft, ChevronRight, Plus, Trash2, X } from "lucide-react"; import { registerLens, type LensProps } from "./registry"; -// ── table: array of row objects, columns declared in config ────────────────── +// ── table: array of row objects; columns from config, else inferred ────────── interface TableConfig { columns: { key: string; label: string; options?: string[] }[]; } +// Without a template config (the pickable path — any JSON/YAML array), infer the +// columns from the union of row keys, first-seen order. `options` dropdowns remain a +// config-only feature. +function inferColumns(rows: Record[]): TableConfig["columns"] { + const keys: string[] = []; + const seen = new Set(); + for (const r of rows) + for (const k of Object.keys(r)) + if (!seen.has(k)) { + seen.add(k); + keys.push(k); + } + return (keys.length ? keys : ["value"]).map((k) => ({ key: k, label: k })); +} function TableLens({ data, config, onChange }: LensProps) { - const columns = (config as TableConfig | undefined)?.columns ?? []; const rows = Array.isArray(data) ? (data as Record[]) : []; + const configured = (config as TableConfig | undefined)?.columns; + const columns = configured?.length ? configured : inferColumns(rows); const update = (i: number, key: string, v: string) => onChange(rows.map((r, j) => (j === i ? { ...r, [key]: v } : r))); const add = () => diff --git a/frontend/src/features/chat/workbench/manifest.ts b/frontend/src/features/chat/workbench/manifest.ts index 70d44570..23e79882 100644 --- a/frontend/src/features/chat/workbench/manifest.ts +++ b/frontend/src/features/chat/workbench/manifest.ts @@ -1,5 +1,6 @@ import { ResourceError } from "../hooks/useChatRealtime"; import type { FsClient } from "./fsClient"; +import { formatFor, isStructuredPath } from "./jsonFile"; import { getLens } from "./lens/registry"; // side effect: register the built-in lenses. validateManifest gates every view on // getLens(), so validation must be self-sufficient wherever it's imported — without @@ -51,10 +52,16 @@ export function validateManifest(m: unknown): m is TemplateManifest { } // Scaffold a manifest's starter files. Create-only (if_version=0): re-seeding never -// clobbers data a user/bot already wrote — it just fills the gaps. +// clobbers data a user/bot already wrote — it just fills the gaps. Object seeds +// serialize by the TARGET path's format (a .yaml seed must not get JSON text). export async function seedManifest(fs: FsClient, m: TemplateManifest): Promise { for (const [path, value] of Object.entries(m.seed ?? {})) { - const content = typeof value === "string" ? value : JSON.stringify(value, null, 2); + const content = + typeof value === "string" + ? value + : isStructuredPath(path) + ? formatFor(path).serialize(value) + : JSON.stringify(value, null, 2); try { await fs.write(path, content, 0); } catch (e) { diff --git a/frontend/src/features/chat/workbench/renderers/registry.test.ts b/frontend/src/features/chat/workbench/renderers/registry.test.ts index ea0bf036..2293d2d5 100644 --- a/frontend/src/features/chat/workbench/renderers/registry.test.ts +++ b/frontend/src/features/chat/workbench/renderers/registry.test.ts @@ -32,6 +32,8 @@ describe("formatOf", () => { expect(formatOf("a.md")).toBe("markdown"); expect(formatOf("a.MARKDOWN")).toBe("markdown"); expect(formatOf("a.json")).toBe("json"); + expect(formatOf("a.yaml")).toBe("yaml"); + expect(formatOf("a.YML")).toBe("yaml"); expect(formatOf("a.toml")).toBe("toml"); expect(formatOf("noext")).toBe("text"); }); @@ -82,21 +84,50 @@ describe("candidatesFor — content-aware, specificity-ordered", () => { ); }); - it("excludes config-needing builtins (table/kanban) from the picker", () => { - // json with `columns`: the plugin board is offered; built-in table/kanban are NOT (pickable=false) + it("excludes shape-uncertain builtins (kanban) and non-matching table from the picker", () => { + // json OBJECT with `columns`: the plugin board is offered; built-in kanban stays + // unpickable and built-in table doesn't accept objects (dataKind: array) const ids = idsOf("b.json", '{"columns":[]}', [kanban]); expect(ids).toContain("plugin:kb:board"); expect(ids).not.toContain("builtin:table"); expect(ids).not.toContain("builtin:kanban"); - // json that no renderer accepts → empty candidate list + // json object that no renderer accepts → empty candidate list expect(idsOf("b.json", '{"x":1}', [kanban])).toEqual([]); }); }); +describe("yaml as a structured format", () => { + it("builtin table is offered for JSON and YAML arrays, never for objects", () => { + expect(idsOf("rows.json", '[{"a":1}]', [])).toContain("builtin:table"); + expect(idsOf("rows.yaml", "- a: 1\n- a: 2\n", [])).toContain("builtin:table"); + expect(idsOf("obj.yaml", "a: 1\n", [])).not.toContain("builtin:table"); + expect(idsOf("prose.yaml", "just a scalar string", [])).not.toContain("builtin:table"); + }); + + it("dataHas matches parsed YAML top-level keys (chart via `series`)", () => { + expect(idsOf("m.yaml", "series:\n - name: s\n points: []\n", [])).toContain("builtin:chart"); + expect(idsOf("m.yaml", "other: 1\n", [])).not.toContain("builtin:chart"); + }); + + it("jsonHas stays frozen to JSON — it never matches YAML", () => { + const p: PluginMeta = { + plugin_id: "jh", + title: "jh", + manifest: { + id: "jh", + title: "jh", + renderers: [{ id: "r", title: "R", match: { format: ["json", "yaml"], jsonHas: ["columns"] } }], + }, + }; + expect(idsOf("b.json", '{"columns":[]}', [p])).toContain("plugin:jh:r"); + expect(idsOf("b.yaml", "columns: []\n", [p])).not.toContain("plugin:jh:r"); + }); +}); + describe("getRenderer", () => { it("resolves built-ins (incl. unpickable) and plugin renderers", () => { expect(getRenderer("builtin:markdown", [])?.lensId).toBe("markdown"); - expect(getRenderer("builtin:table", [])?.pickable).toBe(false); + expect(getRenderer("builtin:kanban", [])?.pickable).toBe(false); expect(getRenderer("plugin:md-checklist:checklist", [checklist])?.title).toBe("Checklist"); expect(getRenderer("nope", [])).toBeUndefined(); }); diff --git a/frontend/src/features/chat/workbench/renderers/registry.ts b/frontend/src/features/chat/workbench/renderers/registry.ts index 500a1c12927f8eab13a9fbbdade41cfde21c4b4f..190df2ebef84aeeb4cec766d7db41f6441b35ad2 100644 GIT binary patch delta 972 zcmZ8f-D=c86h>5*?uFWIFTAOKM5LQ`yG22iZVR@8;7_esK}xA~c5|{BJDCYHlWxOy zSzo}bc;!o2=@aR_PvDJ{WVg^>B{@0gJKxXA*MDv;^Egr3Vu*xkLtq9Oi^co$V}wwv z7+z8FI`uPKTPk0DoSq_SlMKu!Zlk8x&Rm19BUR%aNxC%{8AUC+h_ye~#c z&(CkxmoC>Q#3l?%4f$OC`5dOCQW;RlB?X=H5B2TZ*zwuanq@00T+wP^U|CmC8!wbd zV`)DhEk%39DLS=gj`Z039iw@zo7MxTV@*ZcxwVDBqbrD3FP&H`KG>%hO zow)UhNc-H08>mzSh}iLkW=Dog;p{CixrQ3Z3Zy(M-6>afQ!Xr*=#zCET49*Jqpg^~Qp?UqwGDdk3uxC)VJV8uM?n_w&8Rqf4W|8u!Lm zM=@$m?J$-LagpyzSGhA;1H)mjI)lR^B?O9$T(sz?OfzYzQ0Y7@f?hPB6KD4na5x!U z+aF36Q;S=A5}W;l(ZL8NVu_2girZM`;#a9H?x8TDPm(n6m6?-n=YHcs{;%=(lA7D| O3wN%nIe$F=d*(mEpFiUO delta 178 zcmZ4QG}&gOb_x6D`|PtAwe%Fcg8lsz^7C>k6-x3`5-Y70Did>a6teO&^NJO65=&Bx z6dpB9;nLTiT+6A-t&miykdj)QnVzRJc?)OaCi`${ zP2R+%viTL45Bub2!nTvOMO-+QvWoNbloV=pCO;BYp1fGZ4k)TVSwK_{A+!0Br~o5a QSW#S-4WePQpZG&g0QmAbpa1{> diff --git a/frontend/src/features/chat/workbench/yamlDoc.test.ts b/frontend/src/features/chat/workbench/yamlDoc.test.ts new file mode 100644 index 00000000..f510d1e1 --- /dev/null +++ b/frontend/src/features/chat/workbench/yamlDoc.test.ts @@ -0,0 +1,99 @@ +import { describe, expect, it } from "vitest"; +import { parse } from "yaml"; +import { applyEdits } from "./yamlDoc"; + +// NB: single space before inline comments — Document.toString() normalizes longer runs +// (the one whitespace liberty the round-trip takes; comments themselves are kept). +const BOARD = `# sprint board (bot-maintained — keep comments!) +title: Sprint 12 # visible name + +# the actual rows +rows: + - name: alpha + done: false + - name: beta + done: true + +notes: keep +`; + +describe("applyEdits — comment-preserving rewrite", () => { + it("round-trips unchanged data byte-for-byte", () => { + expect(applyEdits(BOARD, parse(BOARD))).toBe(BOARD); + }); + + it("keeps comments above and inline when a scalar changes", () => { + const data = parse(BOARD); + data.title = "Sprint 13"; + const out = applyEdits(BOARD, data); + expect(out).toContain("# sprint board (bot-maintained — keep comments!)"); + expect(out).toContain("# visible name"); + expect(out).toContain("# the actual rows"); + expect(out).toContain("Sprint 13"); + expect(parse(out).title).toBe("Sprint 13"); + }); + + it("keeps blank lines", () => { + const data = parse(BOARD); + data.notes = "changed"; + const out = applyEdits(BOARD, data); + expect(out).toContain("\n\nnotes: changed"); + }); + + it("edits nested map values in place", () => { + const data = parse(BOARD); + data.rows[0].done = true; + const out = applyEdits(BOARD, data); + expect(parse(out).rows[0].done).toBe(true); + expect(out).toContain("# the actual rows"); // sibling comment survives + expect(out).toContain("name: beta"); // untouched row intact + }); + + it("same-length array edits keep sibling comments", () => { + const src = "items:\n # first\n - a\n # second\n - b\n"; + const out = applyEdits(src, { items: ["a", "c"] }); + expect(out).toContain("# first"); + expect(parse(out).items).toEqual(["a", "c"]); + }); + + it("adds and deletes keys", () => { + const data = parse(BOARD); + delete data.notes; + data.owner = "wei"; + const out = applyEdits(BOARD, data); + const round = parse(out); + expect(round.notes).toBeUndefined(); + expect(round.owner).toBe("wei"); + expect(out).toContain("# visible name"); // unrelated comments survive + }); + + it("array push replaces the array node (documented loss) but data is correct", () => { + const data = parse(BOARD); + data.rows.push({ name: "gamma", done: false }); + const out = applyEdits(BOARD, data); + expect(parse(out).rows).toHaveLength(3); + expect(out).toContain("# sprint board (bot-maintained — keep comments!)"); // top comment survives + }); + + it("falls back to plain stringify on anchors/aliases", () => { + const src = "base: &b { x: 1 }\nuse: *b\n"; + const out = applyEdits(src, { base: { x: 2 }, use: { x: 1 } }); + expect(parse(out)).toEqual({ base: { x: 2 }, use: { x: 1 } }); + }); + + it("falls back on multi-document streams", () => { + const src = "a: 1\n---\nb: 2\n"; + const out = applyEdits(src, { a: 3 }); + expect(parse(out)).toEqual({ a: 3 }); + }); + + it("falls back on unparseable input and empty input", () => { + expect(parse(applyEdits(": : :", { a: 1 }))).toEqual({ a: 1 }); + expect(parse(applyEdits("", { a: 1 }))).toEqual({ a: 1 }); + }); + + it("replaces the root when its type changes", () => { + const out = applyEdits("a: 1\n", [1, 2]); + expect(parse(out)).toEqual([1, 2]); + }); +}); diff --git a/frontend/src/features/chat/workbench/yamlDoc.ts b/frontend/src/features/chat/workbench/yamlDoc.ts new file mode 100644 index 00000000..cfd46427 --- /dev/null +++ b/frontend/src/features/chat/workbench/yamlDoc.ts @@ -0,0 +1,59 @@ +import { parseAllDocuments, stringify as yamlStringify, visit, type Document } from "yaml"; + +// Comment-preserving YAML rewrite. The workbench machine-rewrites board files (lenses +// save whole documents), and a naive parse -> stringify would eat every comment — the +// exact failure that forced `.workbench.json`'s `_doc` field. So instead of +// re-serializing, we PATCH the parsed Document (a CST that carries comments and blank +// lines) with a deep diff of old vs new data, and only the changed nodes are touched. +// +// Documented loss cases (correctness always wins over comment retention): +// - unparseable input, MULTI-document streams, and anchors/aliases fall back to a full +// re-stringify (patching through an alias would silently edit the anchor's other +// readers — bailing is safer); +// - an array whose LENGTH or order changed is replaced wholesale, so comments attached +// inside that array are lost (per-index diffing can't tell an insert from N edits). + +function isPlainObj(v: unknown): v is Record { + return !!v && typeof v === "object" && !Array.isArray(v); +} + +type Path = (string | number)[]; + +function diffApply(doc: Document, path: Path, prev: unknown, next: unknown): void { + if (Object.is(prev, next)) return; + if (isPlainObj(prev) && isPlainObj(next)) { + for (const k of Object.keys(prev)) if (!(k in next)) doc.deleteIn([...path, k]); + for (const k of Object.keys(next)) { + if (!(k in prev)) doc.setIn([...path, k], next[k]); + else diffApply(doc, [...path, k], prev[k], next[k]); + } + return; + } + if (Array.isArray(prev) && Array.isArray(next) && prev.length === next.length) { + for (let i = 0; i < next.length; i++) diffApply(doc, [...path, i], prev[i], next[i]); + return; + } + // Scalar change, type change, or array resize: replace this node wholesale. + if (path.length === 0) doc.contents = doc.createNode(next) as never; + else doc.setIn(path, next); +} + +/** Serialize `next` by patching the Document parsed from `prevText`, preserving the + * comments and blank lines of everything that didn't change. */ +export function applyEdits(prevText: string, next: unknown): string { + if (!prevText.trim()) return yamlStringify(next); + const docs = parseAllDocuments(prevText); + if (docs.length !== 1) return yamlStringify(next); // multi-doc stream: bail (lossy) + const doc = docs[0]; + if (doc.errors.length > 0) return yamlStringify(next); + let hasAlias = false; + visit(doc, { + Alias: () => { + hasAlias = true; + return visit.BREAK; + }, + }); + if (hasAlias) return yamlStringify(next); // aliases: bail (see header) + diffApply(doc, [], doc.toJS() as unknown, next); + return doc.toString(); +} From 4adb518c46d10ef88f60e783f5484c7afcd14fc3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:01 +0000 Subject: [PATCH 12/28] chore(deps-dev): Bump @types/node from 26.1.0 to 26.1.1 in /frontend Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.0 to 26.1.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- frontend/package-lock.json | 8 ++++---- frontend/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c3355fe2..468bf92b 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -32,7 +32,7 @@ "zustand": "^5.0.2" }, "devDependencies": { - "@types/node": "^26.1.0", + "@types/node": "^26.1.1", "@types/react": "^18.3.12", "@types/react-dom": "^18.3.1", "@types/react-file-icon": "^1.0.5", @@ -2224,9 +2224,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.1.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.0.tgz", - "integrity": "sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==", + "version": "26.1.1", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz", + "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/frontend/package.json b/frontend/package.json index 30b984a9..cb7481a8 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -35,7 +35,7 @@ "zustand": "^5.0.2" }, "devDependencies": { - "@types/node": "^26.1.0", + "@types/node": "^26.1.1", "@types/react": "^18.3.12", "@types/react-dom": "^18.3.1", "@types/react-file-icon": "^1.0.5", From 44f116a2baa8974f74b18a443bcb1c7d5f880205 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:07 +0000 Subject: [PATCH 13/28] chore(deps): Bump @codemirror/lang-markdown in /frontend Bumps [@codemirror/lang-markdown](https://github.com/codemirror/lang-markdown) from 6.5.0 to 6.5.1. - [Changelog](https://github.com/codemirror/lang-markdown/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/lang-markdown/commits) --- updated-dependencies: - dependency-name: "@codemirror/lang-markdown" dependency-version: 6.5.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- frontend/package-lock.json | 8 ++++---- frontend/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c3355fe2..f89ba771 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -10,7 +10,7 @@ "dependencies": { "@codemirror/commands": "^6.10.4", "@codemirror/lang-json": "^6.0.2", - "@codemirror/lang-markdown": "^6.5.0", + "@codemirror/lang-markdown": "^6.5.1", "@codemirror/language": "^6.12.4", "@codemirror/language-data": "^6.5.2", "@codemirror/state": "^6.7.1", @@ -512,9 +512,9 @@ } }, "node_modules/@codemirror/lang-markdown": { - "version": "6.5.0", - "resolved": "https://registry.npmjs.org/@codemirror/lang-markdown/-/lang-markdown-6.5.0.tgz", - "integrity": "sha512-0K40bZ35jpHya6FriukbgaleaqzBLZfOh7HuzqbMxBXkbYMJDxfF39c23xOgxFezR+3G+tR2/Mup+Xk865OMvw==", + "version": "6.5.1", + "resolved": "https://registry.npmjs.org/@codemirror/lang-markdown/-/lang-markdown-6.5.1.tgz", + "integrity": "sha512-6re5avCNfyRMIoi3XNjbEfQM1vTeVD3JS3g/Fyegyso/eoANFM71Cyvbb66LDyYtQLMEcRFlzioywCqDo9SlLA==", "license": "MIT", "dependencies": { "@codemirror/autocomplete": "^6.7.1", diff --git a/frontend/package.json b/frontend/package.json index 30b984a9..6418e621 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -13,7 +13,7 @@ "dependencies": { "@codemirror/commands": "^6.10.4", "@codemirror/lang-json": "^6.0.2", - "@codemirror/lang-markdown": "^6.5.0", + "@codemirror/lang-markdown": "^6.5.1", "@codemirror/language": "^6.12.4", "@codemirror/language-data": "^6.5.2", "@codemirror/state": "^6.7.1", From 6487bec1e422cdcb120c473e9ee24300a80d2f4f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:12 +0000 Subject: [PATCH 14/28] chore(deps): Bump agent-client-protocol Bumps [agent-client-protocol](https://github.com/agentclientprotocol/rust-sdk) from 1.0.1 to 1.2.0. - [Release notes](https://github.com/agentclientprotocol/rust-sdk/releases) - [Commits](https://github.com/agentclientprotocol/rust-sdk/compare/agent-client-protocol-http-v1.0.1...agent-client-protocol-http-v1.2.0) --- updated-dependencies: - dependency-name: agent-client-protocol dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- packages/cheers-acp-connector-rs/Cargo.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/cheers-acp-connector-rs/Cargo.lock b/packages/cheers-acp-connector-rs/Cargo.lock index 201ecace..84ef5016 100644 --- a/packages/cheers-acp-connector-rs/Cargo.lock +++ b/packages/cheers-acp-connector-rs/Cargo.lock @@ -4,9 +4,9 @@ version = 4 [[package]] name = "agent-client-protocol" -version = "1.0.1" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16302d16c7531355db16593d99c38c8297db0c4653aa7dd80c3556bb17f4cd8c" +checksum = "882b815ffa67b023e1b40e7ea3bab3f05869654e8565d6811870c5545285e1d3" dependencies = [ "agent-client-protocol-derive", "agent-client-protocol-schema", @@ -26,9 +26,9 @@ dependencies = [ [[package]] name = "agent-client-protocol-derive" -version = "1.0.1" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88b37d552feb6981a0109febda6b71fc723678cd065974c2d76279c19c407095" +checksum = "dd5ca63f112bd2459bcaf9eda0683b9ba95fc3b5e5fdd9036ca941c6a09345b1" dependencies = [ "quote", "syn", @@ -36,9 +36,9 @@ dependencies = [ [[package]] name = "agent-client-protocol-schema" -version = "1.1.0" +version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac542aba230234b1591ace7286a47c0514fe3efc3037d43296bde31ba7ee5728" +checksum = "06679e1542356341f4550ccfb16338b64f37f6af70de2105446ef6fbb078234c" dependencies = [ "anyhow", "derive_more", From 598ddf09c120df195af07314e2b5b366d112826d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:15 +0000 Subject: [PATCH 15/28] chore(deps-dev): Bump postcss from 8.5.16 to 8.5.19 in /frontend Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to 8.5.19. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.16...8.5.19) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.19 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- frontend/package-lock.json | 8 ++++---- frontend/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c3355fe2..a78fbebe 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -38,7 +38,7 @@ "@types/react-file-icon": "^1.0.5", "@vitejs/plugin-react": "^4.3.4", "autoprefixer": "^10.4.20", - "postcss": "^8.5.16", + "postcss": "^8.5.19", "tailwindcss": "^3.4.17", "typescript": "~5.6.2", "vite": "^6.0.5", @@ -4511,9 +4511,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.19", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.19.tgz", + "integrity": "sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==", "dev": true, "funding": [ { diff --git a/frontend/package.json b/frontend/package.json index 30b984a9..239d0087 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -41,7 +41,7 @@ "@types/react-file-icon": "^1.0.5", "@vitejs/plugin-react": "^4.3.4", "autoprefixer": "^10.4.20", - "postcss": "^8.5.16", + "postcss": "^8.5.19", "tailwindcss": "^3.4.17", "typescript": "~5.6.2", "vite": "^6.0.5", From 3e3cacbbdd20d5aacb6550fbb9ee79230538ec6b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:28 +0000 Subject: [PATCH 16/28] chore(deps-dev): Bump vitest from 2.1.9 to 4.1.10 in /frontend Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 4.1.10. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- frontend/package-lock.json | 1357 +++++------------------------------- frontend/package.json | 2 +- 2 files changed, 174 insertions(+), 1185 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index c3355fe2..cd0ebe6a 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -42,7 +42,7 @@ "tailwindcss": "^3.4.17", "typescript": "~5.6.2", "vite": "^6.0.5", - "vitest": "^2.1.9" + "vitest": "^4.1.10" } }, "node_modules/@alloc/quick-lru": { @@ -2104,6 +2104,13 @@ "win32" ] }, + "node_modules/@standard-schema/spec": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz", + "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", + "dev": true, + "license": "MIT" + }, "node_modules/@tanstack/query-core": { "version": "5.101.2", "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.2.tgz", @@ -2175,6 +2182,17 @@ "@babel/types": "^7.28.2" } }, + "node_modules/@types/chai": { + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz", + "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/deep-eql": "*", + "assertion-error": "^2.0.1" + } + }, "node_modules/@types/debug": { "version": "4.1.13", "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz", @@ -2184,6 +2202,13 @@ "@types/ms": "*" } }, + "node_modules/@types/deep-eql": { + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz", + "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/estree": { "version": "1.0.9", "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz", @@ -2303,86 +2328,113 @@ } }, "node_modules/@vitest/expect": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-2.1.9.tgz", - "integrity": "sha512-UJCIkTBenHeKT1TTlKMJWy1laZewsRIzYighyYiJKZreqtdxSos/S1t+ktRMQWu2CKqaarrkeszJx1cgC5tGZw==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz", + "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@standard-schema/spec": "^1.1.0", + "@types/chai": "^5.2.2", + "@vitest/spy": "4.1.10", + "@vitest/utils": "4.1.10", + "chai": "^6.2.2", + "tinyrainbow": "^3.1.0" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/mocker": { + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz", + "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/spy": "2.1.9", - "@vitest/utils": "2.1.9", - "chai": "^5.1.2", - "tinyrainbow": "^1.2.0" + "@vitest/spy": "4.1.10", + "estree-walker": "^3.0.3", + "magic-string": "^0.30.21" }, "funding": { "url": "https://opencollective.com/vitest" + }, + "peerDependencies": { + "msw": "^2.4.9", + "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" + }, + "peerDependenciesMeta": { + "msw": { + "optional": true + }, + "vite": { + "optional": true + } } }, "node_modules/@vitest/pretty-format": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-2.1.9.tgz", - "integrity": "sha512-KhRIdGV2U9HOUzxfiHmY8IFHTdqtOhIzCpd8WRdJiE7D/HUcZVD0EgQCVjm+Q9gkUXWgBvMmTtZgIG48wq7sOQ==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz", + "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==", "dev": true, "license": "MIT", "dependencies": { - "tinyrainbow": "^1.2.0" + "tinyrainbow": "^3.1.0" }, "funding": { "url": "https://opencollective.com/vitest" } }, "node_modules/@vitest/runner": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-2.1.9.tgz", - "integrity": "sha512-ZXSSqTFIrzduD63btIfEyOmNcBmQvgOVsPNPe0jYtESiXkhd8u2erDLnMxmGrDCwHCCHE7hxwRDCT3pt0esT4g==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz", + "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/utils": "2.1.9", - "pathe": "^1.1.2" + "@vitest/utils": "4.1.10", + "pathe": "^2.0.3" }, "funding": { "url": "https://opencollective.com/vitest" } }, "node_modules/@vitest/snapshot": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-2.1.9.tgz", - "integrity": "sha512-oBO82rEjsxLNJincVhLhaxxZdEtV0EFHMK5Kmx5sJ6H9L183dHECjiefOAdnqpIgT5eZwT04PoggUnW88vOBNQ==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz", + "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/pretty-format": "2.1.9", - "magic-string": "^0.30.12", - "pathe": "^1.1.2" + "@vitest/pretty-format": "4.1.10", + "@vitest/utils": "4.1.10", + "magic-string": "^0.30.21", + "pathe": "^2.0.3" }, "funding": { "url": "https://opencollective.com/vitest" } }, "node_modules/@vitest/spy": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-2.1.9.tgz", - "integrity": "sha512-E1B35FwzXXTs9FHNK6bDszs7mtydNi5MIfUWpceJ8Xbfb1gBMscAnwLbEu+B44ed6W3XjL9/ehLPHR1fkf1KLQ==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz", + "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==", "dev": true, "license": "MIT", - "dependencies": { - "tinyspy": "^3.0.2" - }, "funding": { "url": "https://opencollective.com/vitest" } }, "node_modules/@vitest/utils": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-2.1.9.tgz", - "integrity": "sha512-v0psaMSkNJ3A2NMrUEHFRzJtDPFn+/VWZ5WxImB21T9fjucJRmS7xCS3ppEnARb9y11OAzaD+P2Ps+b+BGX5iQ==", + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz", + "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/pretty-format": "2.1.9", - "loupe": "^3.1.2", - "tinyrainbow": "^1.2.0" + "@vitest/pretty-format": "4.1.10", + "convert-source-map": "^2.0.0", + "tinyrainbow": "^3.1.0" }, "funding": { "url": "https://opencollective.com/vitest" @@ -2559,16 +2611,6 @@ "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" } }, - "node_modules/cac": { - "version": "6.7.14", - "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz", - "integrity": "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, "node_modules/camelcase-css": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz", @@ -2611,18 +2653,11 @@ } }, "node_modules/chai": { - "version": "5.3.3", - "resolved": "https://registry.npmjs.org/chai/-/chai-5.3.3.tgz", - "integrity": "sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==", + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz", + "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==", "dev": true, "license": "MIT", - "dependencies": { - "assertion-error": "^2.0.1", - "check-error": "^2.1.1", - "deep-eql": "^5.0.1", - "loupe": "^3.1.0", - "pathval": "^2.0.0" - }, "engines": { "node": ">=18" } @@ -2667,16 +2702,6 @@ "url": "https://github.com/sponsors/wooorm" } }, - "node_modules/check-error": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.3.tgz", - "integrity": "sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 16" - } - }, "node_modules/chokidar": { "version": "3.6.0", "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz", @@ -2825,16 +2850,6 @@ "url": "https://github.com/sponsors/wooorm" } }, - "node_modules/deep-eql": { - "version": "5.0.2", - "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz", - "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "node_modules/dequal": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", @@ -2889,9 +2904,9 @@ } }, "node_modules/es-module-lexer": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz", - "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==", + "version": "2.3.1", + "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz", + "integrity": "sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==", "dev": true, "license": "MIT" }, @@ -3417,13 +3432,6 @@ "loose-envify": "cli.js" } }, - "node_modules/loupe": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz", - "integrity": "sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==", - "dev": true, - "license": "MIT" - }, "node_modules/lru-cache": { "version": "5.1.1", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz", @@ -4409,6 +4417,20 @@ "node": ">= 6" } }, + "node_modules/obug": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz", + "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==", + "dev": true, + "funding": [ + "https://github.com/sponsors/sxzz", + "https://opencollective.com/debug" + ], + "license": "MIT", + "engines": { + "node": ">=12.20.0" + } + }, "node_modules/parse-entities": { "version": "4.0.2", "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz", @@ -4442,22 +4464,12 @@ "license": "MIT" }, "node_modules/pathe": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz", - "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==", + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz", + "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==", "dev": true, "license": "MIT" }, - "node_modules/pathval": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.1.tgz", - "integrity": "sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 14.16" - } - }, "node_modules/pdfjs-dist": { "version": "6.1.200", "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.1.200.tgz", @@ -5116,9 +5128,9 @@ "license": "MIT" }, "node_modules/std-env": { - "version": "3.10.0", - "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz", - "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz", + "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==", "dev": true, "license": "MIT" }, @@ -5275,11 +5287,14 @@ "license": "MIT" }, "node_modules/tinyexec": { - "version": "0.3.2", - "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz", - "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==", + "version": "1.2.4", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz", + "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==", "dev": true, - "license": "MIT" + "license": "MIT", + "engines": { + "node": ">=18" + } }, "node_modules/tinyglobby": { "version": "0.2.17", @@ -5298,30 +5313,10 @@ "url": "https://github.com/sponsors/SuperchupuDev" } }, - "node_modules/tinypool": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.1.1.tgz", - "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==", - "dev": true, - "license": "MIT", - "engines": { - "node": "^18.0.0 || >=20.0.0" - } - }, "node_modules/tinyrainbow": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-1.2.0.tgz", - "integrity": "sha512-weEDEq7Z5eTHPDh4xjX789+fHfF+P8boiFB+0vbWzpbnbsEr/GRaohi/uMKxg8RZMXnl1ItAi/IUHWMsjDV7kQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/tinyspy": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/tinyspy/-/tinyspy-3.0.2.tgz", - "integrity": "sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q==", + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz", + "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==", "dev": true, "license": "MIT", "engines": { @@ -5617,572 +5612,80 @@ } } }, - "node_modules/vite-node": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-2.1.9.tgz", - "integrity": "sha512-AM9aQ/IPrW/6ENLQg3AGY4K1N2TGZdR5e4gu/MmmR2xR3Ll1+dib+nook92g4TV3PXVyeyxdWwtaCAiUL0hMxA==", - "dev": true, - "license": "MIT", - "dependencies": { - "cac": "^6.7.14", - "debug": "^4.3.7", - "es-module-lexer": "^1.5.4", - "pathe": "^1.1.2", - "vite": "^5.0.0" + "node_modules/vitest": { + "version": "4.1.10", + "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz", + "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@vitest/expect": "4.1.10", + "@vitest/mocker": "4.1.10", + "@vitest/pretty-format": "4.1.10", + "@vitest/runner": "4.1.10", + "@vitest/snapshot": "4.1.10", + "@vitest/spy": "4.1.10", + "@vitest/utils": "4.1.10", + "es-module-lexer": "^2.0.0", + "expect-type": "^1.3.0", + "magic-string": "^0.30.21", + "obug": "^2.1.1", + "pathe": "^2.0.3", + "picomatch": "^4.0.3", + "std-env": "^4.0.0-rc.1", + "tinybench": "^2.9.0", + "tinyexec": "^1.0.2", + "tinyglobby": "^0.2.15", + "tinyrainbow": "^3.1.0", + "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", + "why-is-node-running": "^2.3.0" }, "bin": { - "vite-node": "vite-node.mjs" + "vitest": "vitest.mjs" }, "engines": { - "node": "^18.0.0 || >=20.0.0" + "node": "^20.0.0 || ^22.0.0 || >=24.0.0" }, "funding": { "url": "https://opencollective.com/vitest" - } - }, - "node_modules/vite-node/node_modules/@esbuild/aix-ppc64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz", - "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/android-arm": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz", - "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/android-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz", - "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/android-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz", - "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/darwin-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz", - "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/darwin-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz", - "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/freebsd-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz", - "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/freebsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz", - "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-arm": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz", - "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz", - "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-ia32": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz", - "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-loong64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz", - "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==", - "cpu": [ - "loong64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-mips64el": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz", - "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==", - "cpu": [ - "mips64el" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-ppc64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz", - "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-riscv64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz", - "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==", - "cpu": [ - "riscv64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-s390x": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz", - "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==", - "cpu": [ - "s390x" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/linux-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz", - "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/netbsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz", - "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/openbsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz", - "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/sunos-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz", - "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/win32-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz", - "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/win32-ia32": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz", - "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/@esbuild/win32-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz", - "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vite-node/node_modules/esbuild": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz", - "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "bin": { - "esbuild": "bin/esbuild" - }, - "engines": { - "node": ">=12" - }, - "optionalDependencies": { - "@esbuild/aix-ppc64": "0.21.5", - "@esbuild/android-arm": "0.21.5", - "@esbuild/android-arm64": "0.21.5", - "@esbuild/android-x64": "0.21.5", - "@esbuild/darwin-arm64": "0.21.5", - "@esbuild/darwin-x64": "0.21.5", - "@esbuild/freebsd-arm64": "0.21.5", - "@esbuild/freebsd-x64": "0.21.5", - "@esbuild/linux-arm": "0.21.5", - "@esbuild/linux-arm64": "0.21.5", - "@esbuild/linux-ia32": "0.21.5", - "@esbuild/linux-loong64": "0.21.5", - "@esbuild/linux-mips64el": "0.21.5", - "@esbuild/linux-ppc64": "0.21.5", - "@esbuild/linux-riscv64": "0.21.5", - "@esbuild/linux-s390x": "0.21.5", - "@esbuild/linux-x64": "0.21.5", - "@esbuild/netbsd-x64": "0.21.5", - "@esbuild/openbsd-x64": "0.21.5", - "@esbuild/sunos-x64": "0.21.5", - "@esbuild/win32-arm64": "0.21.5", - "@esbuild/win32-ia32": "0.21.5", - "@esbuild/win32-x64": "0.21.5" - } - }, - "node_modules/vite-node/node_modules/vite": { - "version": "5.4.21", - "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.21.tgz", - "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==", - "dev": true, - "license": "MIT", - "dependencies": { - "esbuild": "^0.21.3", - "postcss": "^8.4.43", - "rollup": "^4.20.0" - }, - "bin": { - "vite": "bin/vite.js" - }, - "engines": { - "node": "^18.0.0 || >=20.0.0" - }, - "funding": { - "url": "https://github.com/vitejs/vite?sponsor=1" - }, - "optionalDependencies": { - "fsevents": "~2.3.3" }, "peerDependencies": { - "@types/node": "^18.0.0 || >=20.0.0", - "less": "*", - "lightningcss": "^1.21.0", - "sass": "*", - "sass-embedded": "*", - "stylus": "*", - "sugarss": "*", - "terser": "^5.4.0" + "@edge-runtime/vm": "*", + "@opentelemetry/api": "^1.9.0", + "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", + "@vitest/browser-playwright": "4.1.10", + "@vitest/browser-preview": "4.1.10", + "@vitest/browser-webdriverio": "4.1.10", + "@vitest/coverage-istanbul": "4.1.10", + "@vitest/coverage-v8": "4.1.10", + "@vitest/ui": "4.1.10", + "happy-dom": "*", + "jsdom": "*", + "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "peerDependenciesMeta": { - "@types/node": { - "optional": true - }, - "less": { - "optional": true - }, - "lightningcss": { + "@edge-runtime/vm": { "optional": true }, - "sass": { + "@opentelemetry/api": { "optional": true }, - "sass-embedded": { + "@types/node": { "optional": true }, - "stylus": { + "@vitest/browser-playwright": { "optional": true }, - "sugarss": { + "@vitest/browser-preview": { "optional": true }, - "terser": { - "optional": true - } - } - }, - "node_modules/vitest": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/vitest/-/vitest-2.1.9.tgz", - "integrity": "sha512-MSmPM9REYqDGBI8439mA4mWhV5sKmDlBKWIYbA3lRb2PTHACE0mgKwA8yQ2xq9vxDTuk4iPrECBAEW2aoFXY0Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "@vitest/expect": "2.1.9", - "@vitest/mocker": "2.1.9", - "@vitest/pretty-format": "^2.1.9", - "@vitest/runner": "2.1.9", - "@vitest/snapshot": "2.1.9", - "@vitest/spy": "2.1.9", - "@vitest/utils": "2.1.9", - "chai": "^5.1.2", - "debug": "^4.3.7", - "expect-type": "^1.1.0", - "magic-string": "^0.30.12", - "pathe": "^1.1.2", - "std-env": "^3.8.0", - "tinybench": "^2.9.0", - "tinyexec": "^0.3.1", - "tinypool": "^1.0.1", - "tinyrainbow": "^1.2.0", - "vite": "^5.0.0", - "vite-node": "2.1.9", - "why-is-node-running": "^2.3.0" - }, - "bin": { - "vitest": "vitest.mjs" - }, - "engines": { - "node": "^18.0.0 || >=20.0.0" - }, - "funding": { - "url": "https://opencollective.com/vitest" - }, - "peerDependencies": { - "@edge-runtime/vm": "*", - "@types/node": "^18.0.0 || >=20.0.0", - "@vitest/browser": "2.1.9", - "@vitest/ui": "2.1.9", - "happy-dom": "*", - "jsdom": "*" - }, - "peerDependenciesMeta": { - "@edge-runtime/vm": { + "@vitest/browser-webdriverio": { "optional": true }, - "@types/node": { + "@vitest/coverage-istanbul": { "optional": true }, - "@vitest/browser": { + "@vitest/coverage-v8": { "optional": true }, "@vitest/ui": { @@ -6193,523 +5696,9 @@ }, "jsdom": { "optional": true - } - } - }, - "node_modules/vitest/node_modules/@esbuild/aix-ppc64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz", - "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/android-arm": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz", - "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/android-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz", - "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/android-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz", - "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/darwin-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz", - "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/darwin-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz", - "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/freebsd-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz", - "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/freebsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz", - "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-arm": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz", - "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz", - "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-ia32": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz", - "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-loong64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz", - "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==", - "cpu": [ - "loong64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-mips64el": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz", - "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==", - "cpu": [ - "mips64el" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-ppc64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz", - "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-riscv64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz", - "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==", - "cpu": [ - "riscv64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-s390x": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz", - "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==", - "cpu": [ - "s390x" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/linux-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz", - "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/netbsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz", - "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/openbsd-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz", - "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/sunos-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz", - "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/win32-arm64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz", - "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/win32-ia32": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz", - "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==", - "cpu": [ - "ia32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@esbuild/win32-x64": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz", - "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=12" - } - }, - "node_modules/vitest/node_modules/@vitest/mocker": { - "version": "2.1.9", - "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-2.1.9.tgz", - "integrity": "sha512-tVL6uJgoUdi6icpxmdrn5YNo3g3Dxv+IHJBr0GXHaEdTcw3F+cPKnsXFhli6nO+f/6SDKPHEK1UN+k+TQv0Ehg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@vitest/spy": "2.1.9", - "estree-walker": "^3.0.3", - "magic-string": "^0.30.12" - }, - "funding": { - "url": "https://opencollective.com/vitest" - }, - "peerDependencies": { - "msw": "^2.4.9", - "vite": "^5.0.0" - }, - "peerDependenciesMeta": { - "msw": { - "optional": true }, "vite": { - "optional": true - } - } - }, - "node_modules/vitest/node_modules/esbuild": { - "version": "0.21.5", - "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz", - "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "bin": { - "esbuild": "bin/esbuild" - }, - "engines": { - "node": ">=12" - }, - "optionalDependencies": { - "@esbuild/aix-ppc64": "0.21.5", - "@esbuild/android-arm": "0.21.5", - "@esbuild/android-arm64": "0.21.5", - "@esbuild/android-x64": "0.21.5", - "@esbuild/darwin-arm64": "0.21.5", - "@esbuild/darwin-x64": "0.21.5", - "@esbuild/freebsd-arm64": "0.21.5", - "@esbuild/freebsd-x64": "0.21.5", - "@esbuild/linux-arm": "0.21.5", - "@esbuild/linux-arm64": "0.21.5", - "@esbuild/linux-ia32": "0.21.5", - "@esbuild/linux-loong64": "0.21.5", - "@esbuild/linux-mips64el": "0.21.5", - "@esbuild/linux-ppc64": "0.21.5", - "@esbuild/linux-riscv64": "0.21.5", - "@esbuild/linux-s390x": "0.21.5", - "@esbuild/linux-x64": "0.21.5", - "@esbuild/netbsd-x64": "0.21.5", - "@esbuild/openbsd-x64": "0.21.5", - "@esbuild/sunos-x64": "0.21.5", - "@esbuild/win32-arm64": "0.21.5", - "@esbuild/win32-ia32": "0.21.5", - "@esbuild/win32-x64": "0.21.5" - } - }, - "node_modules/vitest/node_modules/vite": { - "version": "5.4.21", - "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.21.tgz", - "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==", - "dev": true, - "license": "MIT", - "dependencies": { - "esbuild": "^0.21.3", - "postcss": "^8.4.43", - "rollup": "^4.20.0" - }, - "bin": { - "vite": "bin/vite.js" - }, - "engines": { - "node": "^18.0.0 || >=20.0.0" - }, - "funding": { - "url": "https://github.com/vitejs/vite?sponsor=1" - }, - "optionalDependencies": { - "fsevents": "~2.3.3" - }, - "peerDependencies": { - "@types/node": "^18.0.0 || >=20.0.0", - "less": "*", - "lightningcss": "^1.21.0", - "sass": "*", - "sass-embedded": "*", - "stylus": "*", - "sugarss": "*", - "terser": "^5.4.0" - }, - "peerDependenciesMeta": { - "@types/node": { - "optional": true - }, - "less": { - "optional": true - }, - "lightningcss": { - "optional": true - }, - "sass": { - "optional": true - }, - "sass-embedded": { - "optional": true - }, - "stylus": { - "optional": true - }, - "sugarss": { - "optional": true - }, - "terser": { - "optional": true + "optional": false } } }, diff --git a/frontend/package.json b/frontend/package.json index 30b984a9..9bc51eef 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -45,6 +45,6 @@ "tailwindcss": "^3.4.17", "typescript": "~5.6.2", "vite": "^6.0.5", - "vitest": "^2.1.9" + "vitest": "^4.1.10" } } From bcf5cc58043b000c6d1f074b3d7c6fdb9e2a9c0a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:33 +0000 Subject: [PATCH 17/28] chore(deps): Bump rustls in /packages/cheers-acp-connector-rs Bumps [rustls](https://github.com/rustls/rustls) from 0.23.41 to 0.23.42. - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.41...v/0.23.42) --- updated-dependencies: - dependency-name: rustls dependency-version: 0.23.42 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- packages/cheers-acp-connector-rs/Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/cheers-acp-connector-rs/Cargo.lock b/packages/cheers-acp-connector-rs/Cargo.lock index 201ecace..966079e7 100644 --- a/packages/cheers-acp-connector-rs/Cargo.lock +++ b/packages/cheers-acp-connector-rs/Cargo.lock @@ -1883,9 +1883,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.41" +version = "0.23.42" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" +checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138" dependencies = [ "once_cell", "ring", From 6b0f940a99de8e1922e6509d3c1df9265bbfab5e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:41:43 +0000 Subject: [PATCH 18/28] chore(deps): Bump clap in /packages/cheers-acp-connector-rs Bumps [clap](https://github.com/clap-rs/clap) from 4.6.1 to 4.6.2. - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.1...clap_complete-v4.6.2) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- packages/cheers-acp-connector-rs/Cargo.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/cheers-acp-connector-rs/Cargo.lock b/packages/cheers-acp-connector-rs/Cargo.lock index 201ecace..adb2ddc4 100644 --- a/packages/cheers-acp-connector-rs/Cargo.lock +++ b/packages/cheers-acp-connector-rs/Cargo.lock @@ -396,9 +396,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.6.1" +version = "4.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51" +checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011" dependencies = [ "clap_builder", "clap_derive", @@ -406,9 +406,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.6.0" +version = "4.6.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" +checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b" dependencies = [ "anstream", "anstyle", From 412014ecb7b40ff5b6e7668246168cb428307f8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 12:42:12 +0000 Subject: [PATCH 19/28] chore(deps): Bump toml in /packages/cheers-acp-connector-rs Bumps [toml](https://github.com/toml-rs/toml) from 0.8.23 to 1.1.3+spec-1.1.0. - [Commits](https://github.com/toml-rs/toml/compare/toml-v0.8.23...toml-v1.1.3) --- updated-dependencies: - dependency-name: toml dependency-version: 1.1.3+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- packages/cheers-acp-connector-rs/Cargo.lock | 47 +++++++++------------ packages/cheers-acp-connector-rs/Cargo.toml | 2 +- 2 files changed, 22 insertions(+), 27 deletions(-) diff --git a/packages/cheers-acp-connector-rs/Cargo.lock b/packages/cheers-acp-connector-rs/Cargo.lock index 201ecace..c7918b87 100644 --- a/packages/cheers-acp-connector-rs/Cargo.lock +++ b/packages/cheers-acp-connector-rs/Cargo.lock @@ -2087,11 +2087,11 @@ dependencies = [ [[package]] name = "serde_spanned" -version = "0.6.9" +version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3" +checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26" dependencies = [ - "serde", + "serde_core", ] [[package]] @@ -2500,44 +2500,42 @@ dependencies = [ [[package]] name = "toml" -version = "0.8.23" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362" +checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c" dependencies = [ - "serde", + "indexmap 2.14.0", + "serde_core", "serde_spanned", "toml_datetime", - "toml_edit", + "toml_parser", + "toml_writer", + "winnow", ] [[package]] name = "toml_datetime" -version = "0.6.11" +version = "1.1.1+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c" +checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7" dependencies = [ - "serde", + "serde_core", ] [[package]] -name = "toml_edit" -version = "0.22.27" +name = "toml_parser" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a" +checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526" dependencies = [ - "indexmap 2.14.0", - "serde", - "serde_spanned", - "toml_datetime", - "toml_write", "winnow", ] [[package]] -name = "toml_write" -version = "0.1.2" +name = "toml_writer" +version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801" +checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" [[package]] name = "tower" @@ -3139,12 +3137,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" [[package]] name = "winnow" -version = "0.7.15" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945" -dependencies = [ - "memchr", -] +checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81" [[package]] name = "wit-bindgen" diff --git a/packages/cheers-acp-connector-rs/Cargo.toml b/packages/cheers-acp-connector-rs/Cargo.toml index 3b645f88..07a745d5 100644 --- a/packages/cheers-acp-connector-rs/Cargo.toml +++ b/packages/cheers-acp-connector-rs/Cargo.toml @@ -51,7 +51,7 @@ serde_json = "1" # Content etags for safe remote writes: lowercase-hex SHA-256 of raw file bytes # powers read/write etag replies and the write precondition (if_etag). sha2 = "0.11" -toml = "0.8" +toml = "1.1" tokio = { version = "1", features = ["full"] } tokio-tungstenite = { version = "0.24", features = ["rustls-tls-native-roots"] } # Direct dep only to pin the process-level CryptoProvider in main() — without an From a8b5e563098a028c8f89c10ba3da220a6e2db6c3 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 20:59:46 +0800 Subject: [PATCH 20/28] chore: update owner references after repo transfer to ElePerson MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GitHub repository moved from haowei2000/Cheers to ElePerson/Cheers (2026-07-16). Repo web links 301-redirect, but the GitHub Pages URL does NOT — haowei2000.github.io/Cheers is dead — and GHCR packages don't transfer either. Sweep every tracked reference to the old owner: - READMEs: badges, release links, and the (broken) live-overview Pages link -> eleperson.github.io/Cheers - runtime defaults: connector_release_repo (server/src/config.rs), install.sh CHEERS_CONNECTOR_REPO default, BotOnboardingWizard CONNECTOR_RELEASES_REPO, enrollment instructions text — releases moved with the repo, so the new owner is the correct default (old URLs also still redirect for anything already deployed) - ghcr.io/haowei2000/* -> ghcr.io/eleperson/* in Helm/deployment docs, matching cd.yml's ${{ github.repository_owner }} (images land there on the next main push; container packages do not transfer with the repo) - website/ landing pages, docs/help guides, CHANGELOG compare links, issue-template security-advisory URL, Chart.yaml home Verified: github.com/ElePerson/Cheers, releases/latest, and eleperson.github.io/Cheers all return 200; zero 'haowei2000' left in tracked files; cargo check + tsc clean (modulo pre-existing PdfViewer). Co-Authored-By: Claude Fable 5 --- .github/ISSUE_TEMPLATE/config.yml | 2 +- CHANGELOG.md | 4 +-- README.md | 6 ++-- README.zh-CN.md | 6 ++-- deploy/helm/cheers/Chart.yaml | 2 +- deploy/helm/cheers/README.md | 8 ++--- ...45\345\205\245\346\214\207\345\215\227.md" | 6 ++-- ...\205\245\346\214\207\345\215\227.zh-CN.md" | 6 ++-- docs/help/deployment.md | 2 +- docs/help/deployment.zh-CN.md | 2 +- ...15\347\275\256\346\214\207\345\215\227.md" | 6 ++-- ...\275\256\346\214\207\345\215\227.zh-CN.md" | 6 ++-- .../src/features/bots/BotOnboardingWizard.tsx | 2 +- server/assets/install.sh | 6 ++-- server/src/api/enrollment.rs | 2 +- server/src/config.rs | 2 +- website/README.md | 4 +-- website/index.html | 36 +++++++++---------- website/index.zh-CN.html | 36 +++++++++---------- website/mcp.html | 12 +++---- website/plugin-dev.html | 26 +++++++------- 21 files changed, 91 insertions(+), 91 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 907d0ede..9d1f3cca 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,5 @@ blank_issues_enabled: true contact_links: - name: Security vulnerability - url: https://github.com/haowei2000/Cheers/security/advisories/new + url: https://github.com/ElePerson/Cheers/security/advisories/new about: Please report vulnerabilities privately instead of opening a public issue. diff --git a/CHANGELOG.md b/CHANGELOG.md index 3e674b57..9f8e6944 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -101,5 +101,5 @@ First tagged public-preview release. - Status: early public preview. Deployment hardening, permission boundaries, and wider agent-ecosystem integration are still evolving. -[Unreleased]: https://github.com/haowei2000/Cheers/compare/v0.1.0...HEAD -[0.1.0]: https://github.com/haowei2000/Cheers/releases/tag/v0.1.0 +[Unreleased]: https://github.com/ElePerson/Cheers/compare/v0.1.0...HEAD +[0.1.0]: https://github.com/ElePerson/Cheers/releases/tag/v0.1.0 diff --git a/README.md b/README.md index c7d0cfa6..c6b5fde0 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,11 @@ > **Language**: English | [中文](README.zh-CN.md) -[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml) -[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases) +[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml) +[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) -🌐 **Live overview:** +🌐 **Live overview:** 🚀 **Try it live:** — public sign-up is open. Create an account (with email verification), then start a channel and `@`-mention an AI agent. diff --git a/README.zh-CN.md b/README.zh-CN.md index 3cd7458d..c33cdc19 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -2,11 +2,11 @@ > **语言**：中文 | [English](README.md) -[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml) -[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases) +[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml) +[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) -🌐 **在线介绍页：** +🌐 **在线介绍页：** 🚀 **在线体验：** —— 已开放公开注册。用邮箱验证码注册一个账号，然后创建频道并 `@` 提及 AI 智能体开始体验。 diff --git a/deploy/helm/cheers/Chart.yaml b/deploy/helm/cheers/Chart.yaml index d1653913..6b7913d3 100644 --- a/deploy/helm/cheers/Chart.yaml +++ b/deploy/helm/cheers/Chart.yaml @@ -13,6 +13,6 @@ keywords: - cheers - acp - gateway -home: https://github.com/haowei2000/Cheers +home: https://github.com/ElePerson/Cheers maintainers: - name: Cheers diff --git a/deploy/helm/cheers/README.md b/deploy/helm/cheers/README.md index ff139a27..7355412e 100644 --- a/deploy/helm/cheers/README.md +++ b/deploy/helm/cheers/README.md @@ -75,8 +75,8 @@ and every `v*.*.*` tag: | Image | Tags | |---|---| -| `ghcr.io/haowei2000/cheers-gateway` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-` | -| `ghcr.io/haowei2000/cheers-frontend` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-` | +| `ghcr.io/eleperson/cheers-gateway` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-` | +| `ghcr.io/eleperson/cheers-frontend` | `main`, `latest`, semver (`0.1.0`, `0.1`), `sha-` | To install from GHCR instead of building + loading local images (skip step 1 of the local-dev path): @@ -84,9 +84,9 @@ of the local-dev path): ```bash helm upgrade --install cheers deploy/helm/cheers -n cheers --create-namespace \ -f deploy/helm/cheers/values-dev.yaml \ - --set gateway.image.repository=ghcr.io/haowei2000/cheers-gateway \ + --set gateway.image.repository=ghcr.io/eleperson/cheers-gateway \ --set gateway.image.tag=main \ - --set frontend.image.repository=ghcr.io/haowei2000/cheers-frontend \ + --set frontend.image.repository=ghcr.io/eleperson/cheers-frontend \ --set frontend.image.tag=main \ --set-file secrets.jwtPrivateKey=/tmp/jwt_priv.pem \ --set-file secrets.jwtPublicKey=/tmp/jwt_pub.pem diff --git "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" index a3aa0833..c07b9586 100644 --- "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" +++ "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" @@ -76,7 +76,7 @@ ACP-capable agent; new deployments must not use the old OpenClaw package path. ## ACP / OpenCode ACP Provider Install — download the prebuilt binary from the project's -[GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +[GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) (no Rust toolchain needed; assets are published per platform as `cce-acp-connector-{darwin,linux}-{arm64,amd64}` by the `release-connector` workflow): @@ -84,7 +84,7 @@ Install — download the prebuilt binary from the project's os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector ~/.cheers/bin/cce-acp-connector --help # add ~/.cheers/bin to PATH for convenience ``` @@ -97,7 +97,7 @@ chmod +x ~/.cheers/bin/cce-acp-connector > (`gh auth login` once, and repo access required): > > ```bash -> gh release download connector-v0.1.22 -R haowei2000/Cheers \ +> gh release download connector-v0.1.22 -R ElePerson/Cheers \ > -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector > chmod +x ~/.cheers/bin/cce-acp-connector > ``` diff --git "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" index 674b7ec9..311157a7 100644 --- "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" +++ "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" @@ -244,7 +244,7 @@ ACP Connector 适合把本机 stdio ACP agent 接到 Cheers。它本身负责： ### 4.1 安装 Rust ACP Connector -推荐直接下载 [GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +推荐直接下载 [GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) 上的预编译二进制（无需 Rust 工具链；`release-connector` workflow 会按平台发布 `cce-acp-connector-{darwin,linux}-{arm64,amd64}` 四个产物）： @@ -252,7 +252,7 @@ ACP Connector 适合把本机 stdio ACP agent 接到 Cheers。它本身负责： os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector ~/.cheers/bin/cce-acp-connector --help # 建议把 ~/.cheers/bin 加进 PATH ``` @@ -264,7 +264,7 @@ chmod +x ~/.cheers/bin/cce-acp-connector > GitHub CLI 认证下载（先 `gh auth login`）： > > ```bash -> gh release download connector-v0.1.22 -R haowei2000/Cheers \ +> gh release download connector-v0.1.22 -R ElePerson/Cheers \ > -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector > chmod +x ~/.cheers/bin/cce-acp-connector > ``` diff --git a/docs/help/deployment.md b/docs/help/deployment.md index 104031c7..dca4e742 100644 --- a/docs/help/deployment.md +++ b/docs/help/deployment.md @@ -128,7 +128,7 @@ helm upgrade --install cheers deploy/helm/cheers -n cheers --create-namespace \ - UI: frontend NodePort → `http://localhost:30080` (sign in `admin` / `admin12345`, the dev default — change it for anything real). - Prefer not to build? Prebuilt public images are on GHCR - (`ghcr.io/haowei2000/cheers-gateway`, `ghcr.io/haowei2000/cheers-frontend`; + (`ghcr.io/eleperson/cheers-gateway`, `ghcr.io/eleperson/cheers-frontend`; tag `main` or a release version) — see the chart README for the `--set *.image.repository/tag` overrides. - Enable the OpenCode agent bot with `--set bot.enabled=true` plus its token / diff --git a/docs/help/deployment.zh-CN.md b/docs/help/deployment.zh-CN.md index c6b35e78..f7a3a664 100644 --- a/docs/help/deployment.zh-CN.md +++ b/docs/help/deployment.zh-CN.md @@ -119,7 +119,7 @@ helm upgrade --install cheers deploy/helm/cheers -n cheers --create-namespace \ - UI：前端 NodePort → `http://localhost:30080`（登录 `admin` / `admin12345`， 开发默认值，正式环境务必修改）。 - 不想本地构建？GHCR 上有预构建的公开镜像 - （`ghcr.io/haowei2000/cheers-gateway`、`ghcr.io/haowei2000/cheers-frontend`； + （`ghcr.io/eleperson/cheers-gateway`、`ghcr.io/eleperson/cheers-frontend`； tag 用 `main` 或某个发布版本）—— `--set *.image.repository/tag` 覆盖方式见 chart README。 - 启用 OpenCode 智能体 bot：`--set bot.enabled=true`，并提供其 token / API-key secret。 diff --git "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" index 2e89c3ba..0158b124 100644 --- "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" +++ "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" @@ -40,7 +40,7 @@ Three rules: ### 1.1 Get the connector binary (prebuilt release) Download the platform binary from the project's -[GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) — no Rust +[GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) — no Rust toolchain needed (`release-connector` publishes `cce-acp-connector-{darwin,linux}-{arm64,amd64}` per tag): @@ -48,7 +48,7 @@ toolchain needed (`release-connector` publishes os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector export PATH="$HOME/.cheers/bin:$PATH" # add to your shell profile to keep it cce-acp-connector --help @@ -57,7 +57,7 @@ cce-acp-connector --help To pin a version, replace `latest/download` with `download/connector-v` (e.g. `download/connector-v0.1.22`). While the repository is **private**, plain curl returns 404 — download with the authenticated GitHub CLI instead: -`gh release download connector-v0.1.22 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`. +`gh release download connector-v0.1.22 -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`. Developers hacking on the connector itself can keep using the source build (`cargo build` → `target/debug/cce-acp-connector`); the commands below assume `cce-acp-connector` is on `PATH` either way. diff --git "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" index fd712d29..41e2a0e4 100644 --- "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" +++ "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" @@ -38,7 +38,7 @@ ### 1.1 获取连接器二进制（预编译 Release） -直接从项目的 [GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +直接从项目的 [GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) 下载对应平台的二进制，无需 Rust 工具链（`release-connector` workflow 按 tag 发布 `cce-acp-connector-{darwin,linux}-{arm64,amd64}` 四个产物）： @@ -46,7 +46,7 @@ os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector export PATH="$HOME/.cheers/bin:$PATH" # 写进 shell profile 长期生效 cce-acp-connector --help @@ -55,7 +55,7 @@ cce-acp-connector --help 需要固定版本时，把 `latest/download` 换成 `download/connector-v<版本号>` （例如 `download/connector-v0.1.22`）。仓库还是**私有**时匿名 curl 会 404， 有权限的用户改用 GitHub CLI 认证下载： -`gh release download connector-v0.1.22 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`。 +`gh release download connector-v0.1.22 -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`。 开发连接器本身的同学仍可用源码构建 （`cargo build` → `target/debug/cce-acp-connector`）；下文命令默认 `cce-acp-connector` 已在 `PATH` 上，两种方式均可。 diff --git a/frontend/src/features/bots/BotOnboardingWizard.tsx b/frontend/src/features/bots/BotOnboardingWizard.tsx index a6e88216..56e4c895 100644 --- a/frontend/src/features/bots/BotOnboardingWizard.tsx +++ b/frontend/src/features/bots/BotOnboardingWizard.tsx @@ -38,7 +38,7 @@ type Mode = "manual" | "script" | "agent"; /** Where prebuilt connector binaries are published (release-connector workflow). * Keep in sync with the default in server/assets/install.sh. */ -const CONNECTOR_RELEASES_REPO = "haowei2000/Cheers"; +const CONNECTOR_RELEASES_REPO = "ElePerson/Cheers"; /** Same-origin download (gateway proxies the GitHub release): works from hosts * that can reach this server but not GitHub. GitHub stays the fallback. */ const CONNECTOR_DOWNLOAD_CMD = `os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') diff --git a/server/assets/install.sh b/server/assets/install.sh index 80445dec..afe10f82 100644 --- a/server/assets/install.sh +++ b/server/assets/install.sh @@ -15,7 +15,7 @@ # CHEERS_API_BASE gateway API base; default injected at serve time # CHEERS_CONNECTOR_BIN path to cce-acp-connector (else found on PATH, else a # prebuilt release binary is downloaded for this platform) -# CHEERS_CONNECTOR_REPO GitHub owner/repo for releases (default haowei2000/Cheers) +# CHEERS_CONNECTOR_REPO GitHub owner/repo for releases (default ElePerson/Cheers) # CHEERS_CONNECTOR_VERSION connector version, e.g. 0.1.22 (default: latest) # CHEERS_INSTALL_DAEMON=0 skip the launchd/systemd unit (just write + start) # CHEERS_AUTO_UPDATE=1 enable signed self-update in the written config @@ -93,7 +93,7 @@ fi # against a newer glibc "downloads fine" and then crash-loops the keep-alive # service (seen in the wild: GLIBC_2.39 binary on Ubuntu 22.04 / glibc 2.35). if [ -z "$BIN" ]; then - REPO="${CHEERS_CONNECTOR_REPO:-haowei2000/Cheers}" + REPO="${CHEERS_CONNECTOR_REPO:-ElePerson/Cheers}" VER="${CHEERS_CONNECTOR_VERSION:-latest}" os="$(uname -s)"; arch="$(uname -m)" case "$os" in Darwin) os=darwin ;; Linux) os=linux ;; *) os="" ;; esac @@ -186,7 +186,7 @@ if [ -z "$BIN" ]; then Config and token are in place, but no connector binary was found and none could be downloaded for this platform. Build it once: - git clone https://github.com/haowei2000/Cheers && cd Cheers/packages/cheers-acp-connector-rs + git clone https://github.com/ElePerson/Cheers && cd Cheers/packages/cheers-acp-connector-rs cargo build --release # → target/release/cce-acp-connector then re-run with CHEERS_CONNECTOR_BIN=/path/to/cce-acp-connector, or start by hand: cce-acp-connector start --config "$CONFIG_FILE" --name "$ACCOUNT_ID" diff --git a/server/src/api/enrollment.rs b/server/src/api/enrollment.rs index 6dd8fc22..d9ebcb3c 100644 --- a/server/src/api/enrollment.rs +++ b/server/src/api/enrollment.rs @@ -525,7 +525,7 @@ const GUIDANCE_TEMPLATE: &str = r#"You are being connected to a Cheers chat work CHEERS_ENROLL_CODE='{ENROLL_CODE}' bash <(curl -fsSL {INSTALL_URL}) -2. The script finds `cce-acp-connector` on PATH, or downloads the prebuilt binary — first from this Cheers server itself (no GitHub access needed), then from the GitHub release (https://github.com/haowei2000/Cheers/releases). Only if no downloaded binary runs on this platform, build it once from the Cheers repo (packages/cheers-acp-connector-rs: `cargo build --release`), then re-run with CHEERS_CONNECTOR_BIN=/path/to/target/release/cce-acp-connector. +2. The script finds `cce-acp-connector` on PATH, or downloads the prebuilt binary — first from this Cheers server itself (no GitHub access needed), then from the GitHub release (https://github.com/ElePerson/Cheers/releases). Only if no downloaded binary runs on this platform, build it once from the Cheers repo (packages/cheers-acp-connector-rs: `cargo build --release`), then re-run with CHEERS_CONNECTOR_BIN=/path/to/target/release/cce-acp-connector. 3. The bot's agent adapter (e.g. `claude-agent-acp` for Claude) must be installed too — the script auto-installs it via npm when missing (needs node/npm). If the script reports the adapter missing, install it (`npm install -g @agentclientprotocol/claude-agent-acp`) and run the finish command the script printed — do NOT re-run the one-liner, the code is single-use. diff --git a/server/src/config.rs b/server/src/config.rs index 136ebb99..fd914fe8 100644 --- a/server/src/config.rs +++ b/server/src/config.rs @@ -176,7 +176,7 @@ impl Config { connector_release_repo: env::var("CHEERS_CONNECTOR_RELEASE_REPO") .ok() .filter(|v| !v.trim().is_empty()) - .unwrap_or_else(|| "haowei2000/Cheers".into()), + .unwrap_or_else(|| "ElePerson/Cheers".into()), connector_release_version: env::var("CHEERS_CONNECTOR_RELEASE_VERSION") .ok() .filter(|v| !v.trim().is_empty()), diff --git a/website/README.md b/website/README.md index a572c787..075c3c03 100644 --- a/website/README.md +++ b/website/README.md @@ -30,7 +30,7 @@ python3 -m http.server -d website 8080 # → http://localhost:8080 [`.github/workflows/pages.yml`](../.github/workflows/pages.yml) publishes `website/` on every push to `main` that touches it (or on manual `workflow_dispatch`). One-time setup: repo Settings → Pages → Source = -**"GitHub Actions"**. Live site: +**"GitHub Actions"**. Live site: Any other static host also works — the site is a handful of self-contained HTML files plus the `imgs/` screenshots, with no build step. @@ -39,7 +39,7 @@ HTML files plus the `imgs/` screenshots, with no build step. - Light/dark theme follows the OS by default; the ◐ button cycles auto → light → dark and remembers the choice. -- Documentation and repo links point at `https://github.com/haowei2000/Cheers` +- Documentation and repo links point at `https://github.com/ElePerson/Cheers` — update them if the canonical repo URL changes. - Content is intentionally kept in sync with `README.md` (and `README.zh-CN.md` for the Chinese page); when features or the stack change, diff --git a/website/index.html b/website/index.html index 925c1692..2a0faccf 100644 --- a/website/index.html +++ b/website/index.html @@ -252,7 +252,7 @@
中文 - GitHub + GitHub
@@ -414,7 +414,7 @@

Get productive in minutes

  • 3Add a botUse the member list to add an agent to the channel.
  • 4Ask it@bot your first question and see it reply.
    • -

    Read the full user guide →

    +

    Read the full user guide →

    @@ -463,15 +463,15 @@

    How it fits together

    - + Architecture Overview → Why the two-tier split and how data flows end to end. - + Wire Protocol → The real-time protocol between browser and gateway. - + Agent Bridge Guide → Register bots and connect local ACP-capable agents. @@ -515,7 +515,7 @@

    Run Cheers your way

    # 3. bring up the core stack docker compose up -d # UI → http://localhost · API → http://localhost:8000/health -

    Full Docker Compose guide →

    +

    Full Docker Compose guide →

    @@ -559,13 +559,13 @@

    Go deeper

    English is the default; most guides have a Chinese mirror (.zh-CN.md).

    - 📚 Documentation HomeIndex of user, admin, and operations guides. - 🐳 Docker Compose DeploySingle-host stack, JWT keys, bot setup, TLS, ops. - ☸️ Helm ChartKubernetes deployment, values, secrets, ingress. - 🏗️ ArchitectureSystem design, data flow, and protocols. + 📚 Documentation HomeIndex of user, admin, and operations guides. + 🐳 Docker Compose DeploySingle-host stack, JWT keys, bot setup, TLS, ops. + ☸️ Helm ChartKubernetes deployment, values, secrets, ingress. + 🏗️ ArchitectureSystem design, data flow, and protocols. 🧩 Plugin DevelopmentBuild workbench renderer plugins and environment templates. - 🛠️ Admin GuideWorkspaces, channels, members, bots, Agent Bridge. - 🔎 TroubleshootingHealth checks, logs, bot no-response, preview issues. + 🛠️ Admin GuideWorkspaces, channels, members, bots, Agent Bridge. + 🔎 TroubleshootingHealth checks, logs, bot no-response, preview issues.
    @@ -575,10 +575,10 @@

    Go deeper

    🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
    - GitHub - README - License - Report a vulnerability + GitHub + README + License + Report a vulnerability
    diff --git a/website/index.zh-CN.html b/website/index.zh-CN.html index 1ffd6171..ff4016c6 100644 --- a/website/index.zh-CN.html +++ b/website/index.zh-CN.html @@ -251,7 +251,7 @@
    EN - GitHub + GitHub
    @@ -412,7 +412,7 @@

    几分钟即可上手

  • 3添加 Bot通过成员列表把一个智能体加入频道。
  • 4提问@bot 你的第一个问题，看它回复。
    • -

    阅读完整用户指南 →

    +

    阅读完整用户指南 →

    @@ -461,15 +461,15 @@

    整体结构

    - + 架构总览 → 为什么是两层架构，数据如何端到端流转。 - + 网关协议 → 浏览器与网关之间的实时协议。 - + Agent Bridge 接入指南 → 注册 bot 并接入本地 ACP 智能体。 @@ -509,7 +509,7 @@

    用你喜欢的方式运行 Cheers

    # 3. 启动核心栈 docker compose up -d # UI → http://localhost · API → http://localhost:8000/health -

    完整 Docker Compose 指南 →

    +

    完整 Docker Compose 指南 →

    @@ -553,13 +553,13 @@

    深入了解

    英文是默认文档语言；多数指南都有中文镜像（.zh-CN.md）。

    - 📚 文档主页用户、管理员与运维指南索引。 - 🐳 Docker Compose 部署单机全栈、JWT 密钥、bot 配置、TLS、运维。 - ☸️ Helm ChartKubernetes 部署、values、密钥、ingress。（英文） - 🏗️ 架构系统设计、数据流与协议。（英文） + 📚 文档主页用户、管理员与运维指南索引。 + 🐳 Docker Compose 部署单机全栈、JWT 密钥、bot 配置、TLS、运维。 + ☸️ Helm ChartKubernetes 部署、values、密钥、ingress。（英文） + 🏗️ 架构系统设计、数据流与协议。（英文） 🧩 插件开发开发 Workbench 渲染器插件与环境模板。（英文） - 🛠️ 系统管理说明书工作区、频道、成员、bot、Agent Bridge。 - 🔎 技术排查 Q&A健康检查、日志、bot 无响应、预览问题。 + 🛠️ 系统管理说明书工作区、频道、成员、bot、Agent Bridge。 + 🔎 技术排查 Q&A健康检查、日志、bot 无响应、预览问题。
    @@ -570,10 +570,10 @@

    深入了解

    🍻 Cheers —— 人类与 AI 智能体的开源协作平台。MIT 许可。
    English - GitHub - README - 许可证 - 报告安全漏洞 + GitHub + README + 许可证 + 报告安全漏洞
    diff --git a/website/mcp.html b/website/mcp.html index 3b589bb1..04f9b474 100644 --- a/website/mcp.html +++ b/website/mcp.html @@ -159,7 +159,7 @@
    - GitHub + GitHub
    @@ -278,15 +278,15 @@

    Where a post_message spends its time

    Read more

    - + 📦 cheers-mcp-server The MCP server source — one file mapping tools to resource verbs. - + 📐 Architecture overview The external-agent-first design: gateway, frontend, and how agents connect. - + 🔌 ACP connector The bridge that carries resource calls between the agent and the gateway. @@ -300,8 +300,8 @@

    Read more

    Home Plugins - GitHub - License + GitHub + License
    diff --git a/website/plugin-dev.html b/website/plugin-dev.html index 0123f1ac..97ea3d20 100644 --- a/website/plugin-dev.html +++ b/website/plugin-dev.html @@ -145,7 +145,7 @@
    - GitHub + GitHub
    @@ -256,24 +256,24 @@

    4. Minimal skeleton

    5. Working examples

    Ready to upload as-is (Settings → Workbench extensions → upload the .html):

    - + ✅ md-checklist Markdown todos → interactive checklist; checking writes back to the file. - + 🔬 lit-review Paper-tracker table over {"papers": []} JSON — status dropdown, star ratings. - + 🧑‍💻 code-review Markdown review findings with P0/P1/P2 severity badges and progress bar.

    Matching environment templates (Workbench drawer → upload the .json): - md-demo · - lit-review · - code-project. - Full index: examples README.

    + md-demo · + lit-review · + code-project. + Full index: examples README.

    6. Security model

      @@ -295,15 +295,15 @@

      7. Install & bind

      Read more

      - + 📖 Full guide (English) This guide in the repo, kept in sync with the code. - + 📐 Design original (中文) The renderer-plugin design doc with full rationale. - + 🗂️ Workbench architecture Files, views, templates, and how renderers fit in. @@ -316,8 +316,8 @@

      Read more

      🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
      Home - GitHub - License + GitHub + License
      From cb894eecdfa039711ef5fdd62bf491f764c238b5 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:25:04 +0800 Subject: [PATCH 21/28] chore: point repo references at ElePerson/Cheers after transfer The GitHub repo moved from haowei2000/Cheers to ElePerson/Cheers on 2026-07-16. Old links only work via GitHub's transfer redirect (and the old GitHub Pages URL is already dead), so update the hardcoded owner in user-facing surfaces: website pages, READMEs, docs/help guides, the connector-download fallbacks (BotOnboardingWizard, gateway config default, install.sh), the enrollment help text, and the Helm chart home URL. Every rewritten URL was verified to resolve, including the releases/latest connector asset download. ghcr.io/haowei2000/* image references are left as-is: GHCR packages do not transfer with the repo, and no public images exist under eleperson yet. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 4 +-- README.md | 6 ++-- README.zh-CN.md | 6 ++-- deploy/helm/cheers/Chart.yaml | 2 +- ...45\345\205\245\346\214\207\345\215\227.md" | 6 ++-- ...\205\245\346\214\207\345\215\227.zh-CN.md" | 6 ++-- ...15\347\275\256\346\214\207\345\215\227.md" | 6 ++-- ...\275\256\346\214\207\345\215\227.zh-CN.md" | 6 ++-- .../src/features/bots/BotOnboardingWizard.tsx | 2 +- server/assets/install.sh | 6 ++-- server/src/api/enrollment.rs | 2 +- server/src/config.rs | 2 +- website/README.md | 4 +-- website/index.html | 36 +++++++++---------- website/index.zh-CN.html | 36 +++++++++---------- website/mcp.html | 12 +++---- website/plugin-dev.html | 26 +++++++------- 17 files changed, 84 insertions(+), 84 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3e674b57..9f8e6944 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -101,5 +101,5 @@ First tagged public-preview release. - Status: early public preview. Deployment hardening, permission boundaries, and wider agent-ecosystem integration are still evolving. -[Unreleased]: https://github.com/haowei2000/Cheers/compare/v0.1.0...HEAD -[0.1.0]: https://github.com/haowei2000/Cheers/releases/tag/v0.1.0 +[Unreleased]: https://github.com/ElePerson/Cheers/compare/v0.1.0...HEAD +[0.1.0]: https://github.com/ElePerson/Cheers/releases/tag/v0.1.0 diff --git a/README.md b/README.md index c7d0cfa6..c6b5fde0 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,11 @@ > **Language**: English | [中文](README.zh-CN.md) -[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml) -[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases) +[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml) +[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) -🌐 **Live overview:** +🌐 **Live overview:** 🚀 **Try it live:** — public sign-up is open. Create an account (with email verification), then start a channel and `@`-mention an AI agent. diff --git a/README.zh-CN.md b/README.zh-CN.md index 3cd7458d..c33cdc19 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -2,11 +2,11 @@ > **语言**：中文 | [English](README.md) -[![CI](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/haowei2000/Cheers/actions/workflows/ci.yml) -[![Release](https://img.shields.io/github/v/release/haowei2000/Cheers)](https://github.com/haowei2000/Cheers/releases) +[![CI](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/ElePerson/Cheers/actions/workflows/ci.yml) +[![Release](https://img.shields.io/github/v/release/ElePerson/Cheers)](https://github.com/ElePerson/Cheers/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) -🌐 **在线介绍页：** +🌐 **在线介绍页：** 🚀 **在线体验：** —— 已开放公开注册。用邮箱验证码注册一个账号，然后创建频道并 `@` 提及 AI 智能体开始体验。 diff --git a/deploy/helm/cheers/Chart.yaml b/deploy/helm/cheers/Chart.yaml index d1653913..6b7913d3 100644 --- a/deploy/helm/cheers/Chart.yaml +++ b/deploy/helm/cheers/Chart.yaml @@ -13,6 +13,6 @@ keywords: - cheers - acp - gateway -home: https://github.com/haowei2000/Cheers +home: https://github.com/ElePerson/Cheers maintainers: - name: Cheers diff --git "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" index a3aa0833..c07b9586 100644 --- "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" +++ "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.md" @@ -76,7 +76,7 @@ ACP-capable agent; new deployments must not use the old OpenClaw package path. ## ACP / OpenCode ACP Provider Install — download the prebuilt binary from the project's -[GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +[GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) (no Rust toolchain needed; assets are published per platform as `cce-acp-connector-{darwin,linux}-{arm64,amd64}` by the `release-connector` workflow): @@ -84,7 +84,7 @@ Install — download the prebuilt binary from the project's os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector ~/.cheers/bin/cce-acp-connector --help # add ~/.cheers/bin to PATH for convenience ``` @@ -97,7 +97,7 @@ chmod +x ~/.cheers/bin/cce-acp-connector > (`gh auth login` once, and repo access required): > > ```bash -> gh release download connector-v0.1.22 -R haowei2000/Cheers \ +> gh release download connector-v0.1.22 -R ElePerson/Cheers \ > -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector > chmod +x ~/.cheers/bin/cce-acp-connector > ``` diff --git "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" index 674b7ec9..311157a7 100644 --- "a/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" +++ "b/docs/help/AgentBridge\346\216\245\345\205\245\346\214\207\345\215\227.zh-CN.md" @@ -244,7 +244,7 @@ ACP Connector 适合把本机 stdio ACP agent 接到 Cheers。它本身负责： ### 4.1 安装 Rust ACP Connector -推荐直接下载 [GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +推荐直接下载 [GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) 上的预编译二进制（无需 Rust 工具链；`release-connector` workflow 会按平台发布 `cce-acp-connector-{darwin,linux}-{arm64,amd64}` 四个产物）： @@ -252,7 +252,7 @@ ACP Connector 适合把本机 stdio ACP agent 接到 Cheers。它本身负责： os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector ~/.cheers/bin/cce-acp-connector --help # 建议把 ~/.cheers/bin 加进 PATH ``` @@ -264,7 +264,7 @@ chmod +x ~/.cheers/bin/cce-acp-connector > GitHub CLI 认证下载（先 `gh auth login`）： > > ```bash -> gh release download connector-v0.1.22 -R haowei2000/Cheers \ +> gh release download connector-v0.1.22 -R ElePerson/Cheers \ > -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector > chmod +x ~/.cheers/bin/cce-acp-connector > ``` diff --git "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" index 2e89c3ba..0158b124 100644 --- "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" +++ "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.md" @@ -40,7 +40,7 @@ Three rules: ### 1.1 Get the connector binary (prebuilt release) Download the platform binary from the project's -[GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) — no Rust +[GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) — no Rust toolchain needed (`release-connector` publishes `cce-acp-connector-{darwin,linux}-{arm64,amd64}` per tag): @@ -48,7 +48,7 @@ toolchain needed (`release-connector` publishes os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector export PATH="$HOME/.cheers/bin:$PATH" # add to your shell profile to keep it cce-acp-connector --help @@ -57,7 +57,7 @@ cce-acp-connector --help To pin a version, replace `latest/download` with `download/connector-v` (e.g. `download/connector-v0.1.22`). While the repository is **private**, plain curl returns 404 — download with the authenticated GitHub CLI instead: -`gh release download connector-v0.1.22 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`. +`gh release download connector-v0.1.22 -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`. Developers hacking on the connector itself can keep using the source build (`cargo build` → `target/debug/cce-acp-connector`); the commands below assume `cce-acp-connector` is on `PATH` either way. diff --git "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" index fd712d29..41e2a0e4 100644 --- "a/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" +++ "b/docs/help/\346\234\254\345\234\260Bot\351\205\215\347\275\256\346\214\207\345\215\227.zh-CN.md" @@ -38,7 +38,7 @@ ### 1.1 获取连接器二进制（预编译 Release） -直接从项目的 [GitHub Releases](https://github.com/haowei2000/Cheers/releases/latest) +直接从项目的 [GitHub Releases](https://github.com/ElePerson/Cheers/releases/latest) 下载对应平台的二进制，无需 Rust 工具链（`release-connector` workflow 按 tag 发布 `cce-acp-connector-{darwin,linux}-{arm64,amd64}` 四个产物）： @@ -46,7 +46,7 @@ os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') mkdir -p ~/.cheers/bin curl -fsSL -o ~/.cheers/bin/cce-acp-connector \ - "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" + "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch" chmod +x ~/.cheers/bin/cce-acp-connector export PATH="$HOME/.cheers/bin:$PATH" # 写进 shell profile 长期生效 cce-acp-connector --help @@ -55,7 +55,7 @@ cce-acp-connector --help 需要固定版本时，把 `latest/download` 换成 `download/connector-v<版本号>` （例如 `download/connector-v0.1.22`）。仓库还是**私有**时匿名 curl 会 404， 有权限的用户改用 GitHub CLI 认证下载： -`gh release download connector-v0.1.22 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`。 +`gh release download connector-v0.1.22 -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector`。 开发连接器本身的同学仍可用源码构建 （`cargo build` → `target/debug/cce-acp-connector`）；下文命令默认 `cce-acp-connector` 已在 `PATH` 上，两种方式均可。 diff --git a/frontend/src/features/bots/BotOnboardingWizard.tsx b/frontend/src/features/bots/BotOnboardingWizard.tsx index a6e88216..56e4c895 100644 --- a/frontend/src/features/bots/BotOnboardingWizard.tsx +++ b/frontend/src/features/bots/BotOnboardingWizard.tsx @@ -38,7 +38,7 @@ type Mode = "manual" | "script" | "agent"; /** Where prebuilt connector binaries are published (release-connector workflow). * Keep in sync with the default in server/assets/install.sh. */ -const CONNECTOR_RELEASES_REPO = "haowei2000/Cheers"; +const CONNECTOR_RELEASES_REPO = "ElePerson/Cheers"; /** Same-origin download (gateway proxies the GitHub release): works from hosts * that can reach this server but not GitHub. GitHub stays the fallback. */ const CONNECTOR_DOWNLOAD_CMD = `os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/') diff --git a/server/assets/install.sh b/server/assets/install.sh index 80445dec..afe10f82 100644 --- a/server/assets/install.sh +++ b/server/assets/install.sh @@ -15,7 +15,7 @@ # CHEERS_API_BASE gateway API base; default injected at serve time # CHEERS_CONNECTOR_BIN path to cce-acp-connector (else found on PATH, else a # prebuilt release binary is downloaded for this platform) -# CHEERS_CONNECTOR_REPO GitHub owner/repo for releases (default haowei2000/Cheers) +# CHEERS_CONNECTOR_REPO GitHub owner/repo for releases (default ElePerson/Cheers) # CHEERS_CONNECTOR_VERSION connector version, e.g. 0.1.22 (default: latest) # CHEERS_INSTALL_DAEMON=0 skip the launchd/systemd unit (just write + start) # CHEERS_AUTO_UPDATE=1 enable signed self-update in the written config @@ -93,7 +93,7 @@ fi # against a newer glibc "downloads fine" and then crash-loops the keep-alive # service (seen in the wild: GLIBC_2.39 binary on Ubuntu 22.04 / glibc 2.35). if [ -z "$BIN" ]; then - REPO="${CHEERS_CONNECTOR_REPO:-haowei2000/Cheers}" + REPO="${CHEERS_CONNECTOR_REPO:-ElePerson/Cheers}" VER="${CHEERS_CONNECTOR_VERSION:-latest}" os="$(uname -s)"; arch="$(uname -m)" case "$os" in Darwin) os=darwin ;; Linux) os=linux ;; *) os="" ;; esac @@ -186,7 +186,7 @@ if [ -z "$BIN" ]; then Config and token are in place, but no connector binary was found and none could be downloaded for this platform. Build it once: - git clone https://github.com/haowei2000/Cheers && cd Cheers/packages/cheers-acp-connector-rs + git clone https://github.com/ElePerson/Cheers && cd Cheers/packages/cheers-acp-connector-rs cargo build --release # → target/release/cce-acp-connector then re-run with CHEERS_CONNECTOR_BIN=/path/to/cce-acp-connector, or start by hand: cce-acp-connector start --config "$CONFIG_FILE" --name "$ACCOUNT_ID" diff --git a/server/src/api/enrollment.rs b/server/src/api/enrollment.rs index 6dd8fc22..d9ebcb3c 100644 --- a/server/src/api/enrollment.rs +++ b/server/src/api/enrollment.rs @@ -525,7 +525,7 @@ const GUIDANCE_TEMPLATE: &str = r#"You are being connected to a Cheers chat work CHEERS_ENROLL_CODE='{ENROLL_CODE}' bash <(curl -fsSL {INSTALL_URL}) -2. The script finds `cce-acp-connector` on PATH, or downloads the prebuilt binary — first from this Cheers server itself (no GitHub access needed), then from the GitHub release (https://github.com/haowei2000/Cheers/releases). Only if no downloaded binary runs on this platform, build it once from the Cheers repo (packages/cheers-acp-connector-rs: `cargo build --release`), then re-run with CHEERS_CONNECTOR_BIN=/path/to/target/release/cce-acp-connector. +2. The script finds `cce-acp-connector` on PATH, or downloads the prebuilt binary — first from this Cheers server itself (no GitHub access needed), then from the GitHub release (https://github.com/ElePerson/Cheers/releases). Only if no downloaded binary runs on this platform, build it once from the Cheers repo (packages/cheers-acp-connector-rs: `cargo build --release`), then re-run with CHEERS_CONNECTOR_BIN=/path/to/target/release/cce-acp-connector. 3. The bot's agent adapter (e.g. `claude-agent-acp` for Claude) must be installed too — the script auto-installs it via npm when missing (needs node/npm). If the script reports the adapter missing, install it (`npm install -g @agentclientprotocol/claude-agent-acp`) and run the finish command the script printed — do NOT re-run the one-liner, the code is single-use. diff --git a/server/src/config.rs b/server/src/config.rs index 136ebb99..fd914fe8 100644 --- a/server/src/config.rs +++ b/server/src/config.rs @@ -176,7 +176,7 @@ impl Config { connector_release_repo: env::var("CHEERS_CONNECTOR_RELEASE_REPO") .ok() .filter(|v| !v.trim().is_empty()) - .unwrap_or_else(|| "haowei2000/Cheers".into()), + .unwrap_or_else(|| "ElePerson/Cheers".into()), connector_release_version: env::var("CHEERS_CONNECTOR_RELEASE_VERSION") .ok() .filter(|v| !v.trim().is_empty()), diff --git a/website/README.md b/website/README.md index a572c787..075c3c03 100644 --- a/website/README.md +++ b/website/README.md @@ -30,7 +30,7 @@ python3 -m http.server -d website 8080 # → http://localhost:8080 [`.github/workflows/pages.yml`](../.github/workflows/pages.yml) publishes `website/` on every push to `main` that touches it (or on manual `workflow_dispatch`). One-time setup: repo Settings → Pages → Source = -**"GitHub Actions"**. Live site: +**"GitHub Actions"**. Live site: Any other static host also works — the site is a handful of self-contained HTML files plus the `imgs/` screenshots, with no build step. @@ -39,7 +39,7 @@ HTML files plus the `imgs/` screenshots, with no build step. - Light/dark theme follows the OS by default; the ◐ button cycles auto → light → dark and remembers the choice. -- Documentation and repo links point at `https://github.com/haowei2000/Cheers` +- Documentation and repo links point at `https://github.com/ElePerson/Cheers` — update them if the canonical repo URL changes. - Content is intentionally kept in sync with `README.md` (and `README.zh-CN.md` for the Chinese page); when features or the stack change, diff --git a/website/index.html b/website/index.html index 925c1692..2a0faccf 100644 --- a/website/index.html +++ b/website/index.html @@ -252,7 +252,7 @@
      中文 - GitHub + GitHub
      @@ -414,7 +414,7 @@

      Get productive in minutes

    1. 3Add a botUse the member list to add an agent to the channel.
    2. 4Ask it@bot your first question and see it reply.
      3. -

      Read the full user guide →

      +

      Read the full user guide →

      @@ -463,15 +463,15 @@

      How it fits together

      - + Architecture Overview → Why the two-tier split and how data flows end to end. - + Wire Protocol → The real-time protocol between browser and gateway. - + Agent Bridge Guide → Register bots and connect local ACP-capable agents. @@ -515,7 +515,7 @@

      Run Cheers your way

      # 3. bring up the core stack docker compose up -d # UI → http://localhost · API → http://localhost:8000/health -

      Full Docker Compose guide →

      +

      Full Docker Compose guide →

      @@ -559,13 +559,13 @@

      Go deeper

      English is the default; most guides have a Chinese mirror (.zh-CN.md).

      - 📚 Documentation HomeIndex of user, admin, and operations guides. - 🐳 Docker Compose DeploySingle-host stack, JWT keys, bot setup, TLS, ops. - ☸️ Helm ChartKubernetes deployment, values, secrets, ingress. - 🏗️ ArchitectureSystem design, data flow, and protocols. + 📚 Documentation HomeIndex of user, admin, and operations guides. + 🐳 Docker Compose DeploySingle-host stack, JWT keys, bot setup, TLS, ops. + ☸️ Helm ChartKubernetes deployment, values, secrets, ingress. + 🏗️ ArchitectureSystem design, data flow, and protocols. 🧩 Plugin DevelopmentBuild workbench renderer plugins and environment templates. - 🛠️ Admin GuideWorkspaces, channels, members, bots, Agent Bridge. - 🔎 TroubleshootingHealth checks, logs, bot no-response, preview issues. + 🛠️ Admin GuideWorkspaces, channels, members, bots, Agent Bridge. + 🔎 TroubleshootingHealth checks, logs, bot no-response, preview issues.
      @@ -575,10 +575,10 @@

      Go deeper

      🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
      - GitHub - README - License - Report a vulnerability + GitHub + README + License + Report a vulnerability
      diff --git a/website/index.zh-CN.html b/website/index.zh-CN.html index 1ffd6171..ff4016c6 100644 --- a/website/index.zh-CN.html +++ b/website/index.zh-CN.html @@ -251,7 +251,7 @@
      EN - GitHub + GitHub
      @@ -412,7 +412,7 @@

      几分钟即可上手

    3. 3添加 Bot通过成员列表把一个智能体加入频道。
    4. 4提问@bot 你的第一个问题，看它回复。
      5. -

      阅读完整用户指南 →

      +

      阅读完整用户指南 →

      @@ -461,15 +461,15 @@

      整体结构

      - + 架构总览 → 为什么是两层架构，数据如何端到端流转。 - + 网关协议 → 浏览器与网关之间的实时协议。 - + Agent Bridge 接入指南 → 注册 bot 并接入本地 ACP 智能体。 @@ -509,7 +509,7 @@

      用你喜欢的方式运行 Cheers

      # 3. 启动核心栈 docker compose up -d # UI → http://localhost · API → http://localhost:8000/health -

      完整 Docker Compose 指南 →

      +

      完整 Docker Compose 指南 →

      @@ -553,13 +553,13 @@

      深入了解

      英文是默认文档语言；多数指南都有中文镜像（.zh-CN.md）。

      - 📚 文档主页用户、管理员与运维指南索引。 - 🐳 Docker Compose 部署单机全栈、JWT 密钥、bot 配置、TLS、运维。 - ☸️ Helm ChartKubernetes 部署、values、密钥、ingress。（英文） - 🏗️ 架构系统设计、数据流与协议。（英文） + 📚 文档主页用户、管理员与运维指南索引。 + 🐳 Docker Compose 部署单机全栈、JWT 密钥、bot 配置、TLS、运维。 + ☸️ Helm ChartKubernetes 部署、values、密钥、ingress。（英文） + 🏗️ 架构系统设计、数据流与协议。（英文） 🧩 插件开发开发 Workbench 渲染器插件与环境模板。（英文） - 🛠️ 系统管理说明书工作区、频道、成员、bot、Agent Bridge。 - 🔎 技术排查 Q&A健康检查、日志、bot 无响应、预览问题。 + 🛠️ 系统管理说明书工作区、频道、成员、bot、Agent Bridge。 + 🔎 技术排查 Q&A健康检查、日志、bot 无响应、预览问题。
      @@ -570,10 +570,10 @@

      深入了解

      🍻 Cheers —— 人类与 AI 智能体的开源协作平台。MIT 许可。
      English - GitHub - README - 许可证 - 报告安全漏洞 + GitHub + README + 许可证 + 报告安全漏洞
      diff --git a/website/mcp.html b/website/mcp.html index 3b589bb1..04f9b474 100644 --- a/website/mcp.html +++ b/website/mcp.html @@ -159,7 +159,7 @@
      - GitHub + GitHub
      @@ -278,15 +278,15 @@

      Where a post_message spends its time

      Read more

      - + 📦 cheers-mcp-server The MCP server source — one file mapping tools to resource verbs. - + 📐 Architecture overview The external-agent-first design: gateway, frontend, and how agents connect. - + 🔌 ACP connector The bridge that carries resource calls between the agent and the gateway. @@ -300,8 +300,8 @@

      Read more

      Home Plugins - GitHub - License + GitHub + License
      diff --git a/website/plugin-dev.html b/website/plugin-dev.html index 0123f1ac..97ea3d20 100644 --- a/website/plugin-dev.html +++ b/website/plugin-dev.html @@ -145,7 +145,7 @@
      - GitHub + GitHub
      @@ -256,24 +256,24 @@

      4. Minimal skeleton

      5. Working examples

      Ready to upload as-is (Settings → Workbench extensions → upload the .html):

      - + ✅ md-checklist Markdown todos → interactive checklist; checking writes back to the file. - + 🔬 lit-review Paper-tracker table over {"papers": []} JSON — status dropdown, star ratings. - + 🧑‍💻 code-review Markdown review findings with P0/P1/P2 severity badges and progress bar.

      Matching environment templates (Workbench drawer → upload the .json): - md-demo · - lit-review · - code-project. - Full index: examples README.

      + md-demo · + lit-review · + code-project. + Full index: examples README.

      6. Security model

        @@ -295,15 +295,15 @@

        7. Install & bind

        Read more

        - + 📖 Full guide (English) This guide in the repo, kept in sync with the code. - + 📐 Design original (中文) The renderer-plugin design doc with full rationale. - + 🗂️ Workbench architecture Files, views, templates, and how renderers fit in. @@ -316,8 +316,8 @@

        Read more

        🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
        Home - GitHub - License + GitHub + License
        From cb796b847fe74e71f05a22662ddbd6e55875e350 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:29:57 +0800 Subject: [PATCH 22/28] fix(connector): migrate to rand 0.10 API thread_rng() -> rng(), Rng::gen_range -> RngExt::random_range Co-Authored-By: Claude Fable 5 --- packages/cheers-acp-connector-rs/src/bridge.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/cheers-acp-connector-rs/src/bridge.rs b/packages/cheers-acp-connector-rs/src/bridge.rs index bcda1cbd..72fdea5e 100644 --- a/packages/cheers-acp-connector-rs/src/bridge.rs +++ b/packages/cheers-acp-connector-rs/src/bridge.rs @@ -4,7 +4,7 @@ use std::time::Duration; use anyhow::{anyhow, Context}; use futures_util::{SinkExt, StreamExt}; -use rand::Rng; +use rand::RngExt; use serde::Serialize; use serde_json::Value; use tokio::net::TcpStream; @@ -436,7 +436,7 @@ pub fn compute_backoff(attempt: u32, opts: ReconnectOptions) -> Duration { .base_ms .saturating_mul(2_u64.saturating_pow(attempt.saturating_sub(1))); let capped = exp.min(opts.max_ms); - let jitter = rand::thread_rng().gen_range(0.5..=1.0); + let jitter = rand::rng().random_range(0.5..=1.0); Duration::from_millis((capped as f64 * jitter).round() as u64) } From 90167f2199937d3baf4e918bf61c354a3228a4a4 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:31:20 +0800 Subject: [PATCH 23/28] docs(website): connector guide fixes from review - create ~/.cheers/workspace in setup (connector requires allowed_roots to exist) - add troubleshooting row for allowed_roots does not exist - point all links at ElePerson/Cheers after the repo transfer - escape & in Q&A hrefs; unpin release tag in gh download callout Co-Authored-By: Claude Fable 5 --- website/connector.html | 22 ++++++++++++---------- website/connector.zh-CN.html | 22 ++++++++++++---------- 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/website/connector.html b/website/connector.html index d49cb85e..8a99e454 100644 --- a/website/connector.html +++ b/website/connector.html @@ -156,7 +156,7 @@
        中文 - GitHub + GitHub
        @@ -202,15 +202,16 @@

        3. Install the connector

        Download the prebuilt binary for your OS — no toolchain required. Paste this into a terminal:

        # pick the right file for your OS/CPU, download it, make it runnable
 os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
-mkdir -p ~/.cheers/bin
+mkdir -p ~/.cheers/bin ~/.cheers/workspace   # workspace = where the agent works — must exist, or the connector refuses to start
 curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
-  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+  "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
 chmod +x ~/.cheers/bin/cce-acp-connector
 export PATH="$HOME/.cheers/bin:$PATH"   # add this line to your ~/.zshrc so it sticks
 cce-acp-connector --help                # prints help = success
        If the repo is private, plain curl returns a 404. Download with the GitHub CLI instead, e.g. - gh release download connector-v0.1.28 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector.
        + gh release download -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector + (with no tag, gh fetches the latest release).

        4. Create the bot and get its token

        A token is the connector's password to log in to the gateway as your bot. Get one in the UI:

        @@ -309,7 +310,7 @@

        Option B — update by hand

        Re-run the download from step 3 (it overwrites the old binary), then restart:

        os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
 curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
-  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+  "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
 chmod +x ~/.cheers/bin/cce-acp-connector
 cce-acp-connector restart --name claude

        Auto-update is off by default on purpose — updating runs downloaded code, so the owner of the @@ -332,6 +333,7 @@

        8. Troubleshooting

        What you seeLikely causeFix Bot ignores files you attached — asks you to upload them or give a path, even though the chips are on your messageThe connector is older than the version that renders attached context into the promptUpdate the connector (≥ 0.1.28), then restart. Also confirm allow_attachments = true. start exits right away, log mentions the tokenThe token file is missing or emptyRe-do step 4; check ~/.cheers/secrets/<name>.token exists and isn't empty + start exits right away, log: allowed_roots does not existThe folder your config points at (allowed_roots / default_cwd) hasn't been created — it must exist before startupmkdir -p ~/.cheers/workspace (or whichever directory your config names), then start again log: command not foundWrong path to your agentcommand -v claude-agent-acp and put the absolute path in adapter.command Agent starts but never replies / auth failsThe agent can't read your subscription loginMake sure policy.env.allow includes HOME Keeps reconnecting / never connectsWrong gateway address, or gateway downCheck the two ws://… URLs with your admin; confirm the server is up @@ -341,15 +343,15 @@

        8. Troubleshooting

        Read more

        - + 📖 Local Bot Setup Guide The full reference: every config field, multiple bots, token strategy, all options. - + 🔌 Agent Bridge Guide Concepts, creating a bot in the UI, and the containerized bot path. - + 🔎 Troubleshooting Q&A Health checks, logs, and what to do when a bot goes quiet. @@ -362,8 +364,8 @@

        Read more

        🍻 Cheers — open-source collaboration for humans & AI agents. MIT licensed.
        Home - GitHub - License + GitHub + License
        diff --git a/website/connector.zh-CN.html b/website/connector.zh-CN.html index d0eb57d3..25eee4d3 100644 --- a/website/connector.zh-CN.html +++ b/website/connector.zh-CN.html @@ -156,7 +156,7 @@
        EN - GitHub + GitHub
        @@ -198,14 +198,15 @@

        3. 安装连接器

        下载对应你系统的预编译二进制，无需任何工具链。把下面这段粘进终端：

        # 自动挑选对应系统/CPU 的文件、下载、赋予可执行权限
 os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
-mkdir -p ~/.cheers/bin
+mkdir -p ~/.cheers/bin ~/.cheers/workspace   # workspace 是智能体的工作目录——必须存在，否则连接器会拒绝启动
 curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
-  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+  "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
 chmod +x ~/.cheers/bin/cce-acp-connector
 export PATH="$HOME/.cheers/bin:$PATH"   # 把这行加进 ~/.zshrc 就能长期生效
 cce-acp-connector --help                # 打印出帮助 = 成功
        如果仓库是私有的，直接 curl 会返回 404。改用 GitHub CLI 下载，例如 - gh release download connector-v0.1.28 -R haowei2000/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector。
        + gh release download -R ElePerson/Cheers -p "cce-acp-connector-$os-$arch" -O ~/.cheers/bin/cce-acp-connector + （不带 tag 时 gh 会取最新的 release）。

        4. 创建机器人并拿到令牌

        令牌（token）是连接器以你的机器人身份登录网关用的"密码"。在界面里获取：

        @@ -301,7 +302,7 @@

        方式 B —— 手动更新

        重新跑一遍第 3 步的下载（会覆盖旧二进制），然后重启：

        os=$(uname -s | tr 'A-Z' 'a-z'); arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
 curl -fsSL -o ~/.cheers/bin/cce-acp-connector \
-  "https://github.com/haowei2000/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
+  "https://github.com/ElePerson/Cheers/releases/latest/download/cce-acp-connector-$os-$arch"
 chmod +x ~/.cheers/bin/cce-acp-connector
 cce-acp-connector restart --name claude

        自动更新默认关闭是有意为之——更新意味着执行下载来的代码，所以由机器主人自己选择开启。 @@ -322,6 +323,7 @@

        8. 排障

        你看到的现象可能原因处理 机器人无视你附加的文件——让你上传或给路径，尽管消息上明明有小标签连接器版本旧于"把附加 context 渲染进 prompt"的那一版更新连接器（≥ 0.1.28）后 restart；同时确认 allow_attachments = true。 start 立刻退出，日志提到 token令牌文件缺失或为空重做第 4 步；确认 ~/.cheers/secrets/<名字>.token 存在且非空 + start 立刻退出，日志：allowed_roots does not exist配置里 allowed_roots / default_cwd 指向的目录还没创建——启动前它必须存在mkdir -p ~/.cheers/workspace（或你配置里写的那个目录），再重新 start 日志：command not found智能体路径不对command -v claude-agent-acp，把绝对路径填进 adapter.command 智能体启动了但从不回复 / 鉴权失败智能体读不到你的订阅登录确保 policy.env.allow 里包含 HOME 反复重连 / 一直连不上网关地址不对，或网关没起找管理员核对两个 ws://… URL；确认服务器在线 @@ -331,15 +333,15 @@

        8. 排障

        延伸阅读

        - + 📖 本地 Bot 配置指南 完整参考：每个配置字段、多机器人、令牌策略、全部选项。 - + 🔌 Agent Bridge 接入指南 概念、在界面里创建机器人、容器化机器人路径。 - + 🔎 技术排查 Q&A 健康检查、日志，以及机器人不吭声时怎么办。 @@ -352,8 +354,8 @@

        延伸阅读

        🍻 Cheers —— 面向人类与 AI 智能体的开源协作。MIT 许可。
        首页 - GitHub - 许可证 + GitHub + 许可证
        From 06566ce2befa342556645d9a38567bddabc8a02e Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:31:51 +0800 Subject: [PATCH 24/28] fix(workbench): align plugin docs and temp-load caps with actual behavior - PLUGIN_DEVELOPMENT.md: cheers:render is sent on ready and after a conflicted save; external edits do not push a re-render - pluginManifest.ts: correct the bundle-cap comment (server cap lands with install validation) - WorkbenchDrawer: measure the 2 MiB cap in UTF-8 bytes; accept .htm and uppercase extensions on drop Co-Authored-By: Claude Fable 5 --- docs/developer/PLUGIN_DEVELOPMENT.md | 16 ++++++++++++---- .../features/chat/workbench/WorkbenchDrawer.tsx | 12 +++++++----- .../chat/workbench/sandbox/pluginManifest.ts | 5 +++-- 3 files changed, 22 insertions(+), 11 deletions(-) diff --git a/docs/developer/PLUGIN_DEVELOPMENT.md b/docs/developer/PLUGIN_DEVELOPMENT.md index 82242561..70329e4e 100644 --- a/docs/developer/PLUGIN_DEVELOPMENT.md +++ b/docs/developer/PLUGIN_DEVELOPMENT.md @@ -108,7 +108,7 @@ a specific origin; the host, in turn, only accepts messages from your iframe). | Direction | `type` | Payload | When | |---|---|---|---| | plugin → host | `cheers:ready` | — | iframe loaded; "assign me work". Send it **after** your message listener is wired. | -| host → plugin | `cheers:render` | `{ path, format, content, version, rendererId }` | Assigns **one** file. Re-sent when the file changes externally and after a save conflict. `rendererId` says which of your manifest's renderers was picked. | +| host → plugin | `cheers:render` | `{ path, format, content, version, rendererId }` | Assigns **one** file. Sent in reply to your `cheers:ready`, and re-sent after a conflicted save — those are the only triggers (§5.2). `rendererId` says which of your manifest's renderers was picked. | | plugin → host | `cheers:unsupported` | `{ reason? }` | Runtime verdict: you inspected `content` and can't render it. The host hides your iframe and shows the reason. | | plugin → host | `cheers:save` | `{ content }` | Write the assigned file back (whole-content replace). | | host → plugin | `cheers:saved` | `{ ok, version, error? }` | Result of your save. On `ok`, adopt the new `version`. | @@ -127,9 +127,15 @@ user edits in your UI ──▶ plugin: cheers:save {content} ├─ ok → host: cheers:saved {ok:true, version} (adopt version) └─ conflict → host: cheers:saved {ok:false, error} host: cheers:render {…fresh content/version} (re-render) -file changed by someone else (bot / another member) ──▶ host: cheers:render {…} ``` +Those are the **only** two `cheers:render` triggers: your `cheers:ready` and a +conflicted save. A file changed by someone else (bot / another member) does **not** +push a new render into an open iframe — you see the fresh content when the user +reopens the file (remount → `ready` → `render`), or via the re-render that follows +your own conflicted save. There is no way to re-read the assigned file yourself: +the §5.4 resource whitelist covers channel data only, not file content. + ### 5.3 Rules - **Single-file capability.** One `cheers:render` = one file. You can only render and @@ -230,8 +236,10 @@ Recipes in words: `JSON.parse` in try/catch and verify shapes, `cheers:unsupported` when they don't hold; save with `JSON.stringify(data, null, 2)`. - **Use channel context** — call the §5.4 resource helper, e.g. `channel.members` to - resolve author ids to names in your UI. Data may be stale seconds later; re-fetch on - each `cheers:render` rather than caching across renders. + resolve author ids to names in your UI. Data may be stale seconds later, and renders + are rare (§5.2: on `ready` and after a conflicted save — never on external edits), so + re-fetch via the resource helper when freshness matters rather than counting on a new + `cheers:render` to refresh it for you. ## 8. Install & bind diff --git a/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx b/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx index bbda0565..33420ed0 100644 --- a/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx +++ b/frontend/src/features/chat/workbench/WorkbenchDrawer.tsx @@ -245,7 +245,8 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi // same-id session plugin shadows the installed one for this session, so existing // bindings transparently resolve to the fresh bundle while you iterate. const loadTemporaryPlugin = useCallback((html: string) => { - if (html.length > MAX_PLUGIN_BUNDLE_BYTES) { + const byteLength = new TextEncoder().encode(html).length; + if (byteLength > MAX_PLUGIN_BUNDLE_BYTES) { setNotice("Plugin bundle too large (max 2 MiB)"); return; } @@ -266,9 +267,10 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi // One extension entry point, routed by extension: .json => template, .html => plugin. const loadExtensionFile = useCallback( (file: File) => { - if (file.name.endsWith(".json")) void file.text().then(loadTemporary); - else if (file.name.endsWith(".html")) void file.text().then(loadTemporaryPlugin); - else setNotice("Drop a .json template or a .html renderer plugin"); + const name = file.name.toLowerCase(); + if (name.endsWith(".json")) void file.text().then(loadTemporary); + else if (name.endsWith(".html") || name.endsWith(".htm")) void file.text().then(loadTemporaryPlugin); + else setNotice("Drop a .json template or a .html/.htm renderer plugin"); }, [loadTemporary, loadTemporaryPlugin] ); @@ -507,7 +509,7 @@ function WorkbenchDrawerImpl({ open, onClose, channelId, sendResourceReq, openFi diff --git a/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts index 586b5b04..f4e04595 100644 --- a/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts +++ b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts @@ -34,8 +34,9 @@ export interface PluginMeta { transient?: boolean; } -/** Upper bound for a plugin bundle. Guards the session (temporary) load path; the - * server enforces the same cap on install. Also the sane ceiling for iframe srcDoc. */ +/** Upper bound for a plugin bundle, in UTF-8 bytes. Client-side cap for session + * (temporary) loads, matching the cap the server will enforce at install (lands with + * server-side install validation). Also the sane ceiling for iframe srcDoc. */ export const MAX_PLUGIN_BUNDLE_BYTES = 2 * 1024 * 1024; /** Shape-check a parsed plugin manifest. Returns an error message, or null when valid. */ From ab0f935775b53efb56502349b21c6266bbb69b22 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:48:22 +0800 Subject: [PATCH 25/28] =?UTF-8?q?fix(workbench):=20protocol-1=20review=20f?= =?UTF-8?q?ixes=20=E2=80=94=20SDK=20save=20rule,=20text-safe=20registry,?= =?UTF-8?q?=20validator=20parity?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - SDK: enforce single-in-flight save (host does not correlate saves); document the rule as normative in PLUGIN_DEVELOPMENT.md - registry.ts: replace literal NUL glob placeholders with \u0000 escapes so the file diffs as text on GitHub - pluginManifest.ts: mirror the server's per-key manifest validation so session loads and installs accept the same manifests - server: accept protocol 1.0 (JSON number equal to 1) — the frontend cannot distinguish 1.0 from 1 after JSON.parse - examples: lit-review uses dataHas instead of deprecated jsonHas Co-Authored-By: Claude Fable 5 --- docs/arch/examples/README.md | 2 +- docs/arch/examples/cheers-plugin-sdk.js | 20 ++++- docs/arch/examples/lit-review.plugin.html | 2 +- docs/developer/PLUGIN_DEVELOPMENT.md | 21 +++-- .../chat/workbench/renderers/registry.test.ts | 14 ++++ .../chat/workbench/renderers/registry.ts | Bin 7699 -> 7709 bytes .../sandbox/examples/lit-review.html | 2 +- .../workbench/sandbox/pluginManifest.test.ts | 57 ++++++++++++++ .../chat/workbench/sandbox/pluginManifest.ts | 54 +++++++++++-- server/src/domain/workbench_plugins.rs | 73 ++++++++++++++---- 10 files changed, 208 insertions(+), 37 deletions(-) diff --git a/docs/arch/examples/README.md b/docs/arch/examples/README.md index 16d0ab2c..87e9ca6e 100644 --- a/docs/arch/examples/README.md +++ b/docs/arch/examples/README.md @@ -10,7 +10,7 @@ | 文件 | 场景 | 说明 | |---|---|---| | [`md-checklist.plugin.html`](./md-checklist.plugin.html) | 通用 | 把 Markdown 待办(`- [ ]` / `- [x]`)渲染成可勾选清单,勾选写回 md。声明了**接受判断**(`match.requireAny` + 运行期 `cheers:unsupported`),只接受含待办行的 markdown。 | -| [`lit-review.plugin.html`](./lit-review.plugin.html) | **科研** | 论文追踪表:把 `{ "papers": [...] }` 结构的 JSON 渲染成可编辑表格(标题/作者/期刊/年份/笔记 + 阅读状态下拉 + 星级评分),编辑写回 JSON。`match.jsonHas: ["papers"]` 预筛,运行期再验证 `papers` 是数组。 | +| [`lit-review.plugin.html`](./lit-review.plugin.html) | **科研** | 论文追踪表:把 `{ "papers": [...] }` 结构的 JSON 渲染成可编辑表格(标题/作者/期刊/年份/笔记 + 阅读状态下拉 + 星级评分),编辑写回 JSON。`match.dataHas: ["papers"]` 预筛,运行期再验证 `papers` 是数组。 | | [`code-review.plugin.html`](./code-review.plugin.html) | **代码** | 代码评审清单:渲染 `## 文件路径` 分节、`- [ ] [P0/P1/P2] 描述` 的 markdown 评审记录,severity 徽章 + 顶部进度条,勾选就地改写该行并写回。`match.requireAny: ["[P0]","[P1]","[P2]"]`。 | ## 环境模板(数据) diff --git a/docs/arch/examples/cheers-plugin-sdk.js b/docs/arch/examples/cheers-plugin-sdk.js index 7afd8141..0b67f09c 100644 --- a/docs/arch/examples/cheers-plugin-sdk.js +++ b/docs/arch/examples/cheers-plugin-sdk.js @@ -7,13 +7,18 @@ * * var host = cheersPlugin({ * onRender: function (file) { - * // { path, format, content, version, rendererId } — also re-sent when the - * // file changes externally and after a save conflict: always re-draw here. + * // { path, format, content, version, rendererId } — sent in reply to your + * // cheers:ready and re-sent after a conflicted save (the only two triggers, + * // §5.2 — external edits do NOT re-render): always re-draw here. * } * }); * host.save(content) // -> Promise<{version}>; rejects on failure (on a * // version conflict a fresh onRender follows — let - * // the user reapply, don't blind-retry) + * // the user reapply, don't blind-retry). At most ONE + * // save may be in flight: the host does not correlate + * // saves (cheers:saved carries no reqId), so calling + * // save() again before the previous one settles + * // rejects immediately. * host.resource(name, params) // -> Promise for the read-only channel.* * // whitelist (channel.info / members / messages …) * host.unsupported(reason) // -> final verdict: this content can't be rendered @@ -23,7 +28,7 @@ function cheersPlugin(opts) { var reqId = 0; var pendingRes = {}; // reqId -> {resolve, reject} - var pendingSave = null; // single in-flight save; the host answers in order + var pendingSave = null; // the ONE allowed in-flight save (hosts do not correlate saves) window.addEventListener("message", function (e) { var m = e.data; if (!m || typeof m !== "object") return; @@ -43,6 +48,13 @@ function cheersPlugin(opts) { var api = { save: function (content) { return new Promise(function (resolve, reject) { + if (pendingSave) { + // cheers:saved carries no correlation id, so overlapping saves could adopt + // each other's results. Reject loudly instead of queueing silently — await + // the previous save() before issuing the next one. + reject(new Error("save already in flight — await the previous save() first")); + return; + } pendingSave = { resolve: resolve, reject: reject }; parent.postMessage({ type: "cheers:save", content: content }, "*"); }); diff --git a/docs/arch/examples/lit-review.plugin.html b/docs/arch/examples/lit-review.plugin.html index da88c017..b653da8c 100644 --- a/docs/arch/examples/lit-review.plugin.html +++ b/docs/arch/examples/lit-review.plugin.html @@ -9,7 +9,7 @@ "protocol": 1, "title": "Literature review", "renderers": [ - { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "jsonHas": ["papers"] } } + { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "dataHas": ["papers"] } } ] } diff --git a/docs/developer/PLUGIN_DEVELOPMENT.md b/docs/developer/PLUGIN_DEVELOPMENT.md index 485989c8..40da5d68 100644 --- a/docs/developer/PLUGIN_DEVELOPMENT.md +++ b/docs/developer/PLUGIN_DEVELOPMENT.md @@ -120,8 +120,8 @@ a specific origin; the host, in turn, only accepts messages from your iframe). | plugin → host | `cheers:ready` | — | iframe loaded; "assign me work". Send it **after** your message listener is wired. | | host → plugin | `cheers:render` | `{ path, format, content, version, rendererId }` | Assigns **one** file. Sent in reply to your `cheers:ready`, and re-sent after a conflicted save — those are the only triggers (§5.2). `rendererId` says which of your manifest's renderers was picked. | | plugin → host | `cheers:unsupported` | `{ reason? }` | Runtime verdict: you inspected `content` and can't render it. The host hides your iframe and shows the reason. | -| plugin → host | `cheers:save` | `{ content }` | Write the assigned file back (whole-content replace). | -| host → plugin | `cheers:saved` | `{ ok, version, error? }` | Result of your save. On `ok`, adopt the new `version`. | +| plugin → host | `cheers:save` | `{ content }` | Write the assigned file back (whole-content replace). At most **one** save in flight (§5.3). | +| host → plugin | `cheers:saved` | `{ ok, version, error? }` | Result of your save. On `ok`, adopt the new `version`. Carries **no correlation id** — it answers "the" pending save, which is why only one may be in flight. | | plugin → host | `cheers:resource` | `{ reqId, resource, params }` | Read-only channel info (whitelist, §5.4). `reqId` is your correlation number. | | host → plugin | `cheers:resource:result` | `{ reqId, ok, data\|error }` | Resource read result. | @@ -155,6 +155,10 @@ the §5.4 resource whitelist covers channel data only, not file content. it last sent you. On conflict you get `cheers:saved {ok:false}` **followed by a fresh `cheers:render`** — re-render from the new content and let the user reapply. Do not retry the save blindly. +- **One save in flight.** Hosts do **not** correlate saves: each `cheers:save` is + answered by an independent `cheers:saved` with no request id, and completion order is + not guaranteed. Plugins MUST wait for `cheers:saved` before sending the next + `cheers:save` (the SDK enforces this — an overlapping `save()` rejects). - **Safe rendering.** `content` is untrusted text (it may come from a bot or another member). Write it to the DOM with `textContent` or controlled form values — **never concatenate into `innerHTML`**. @@ -229,8 +233,8 @@ files, there is no external loading in the sandbox: ```js var host = cheersPlugin({ onRender: function (file) { - // { path, format, content, version, rendererId } — re-sent on external change - // and after a save conflict: always re-draw here. + // { path, format, content, version, rendererId } — sent on your ready and + // re-sent after a conflicted save (the only triggers, §5.2): always re-draw here. }, }); host.save(next).then(function (r) { /* r.version */ }).catch(function (e) { /* show e */ }); @@ -248,7 +252,7 @@ Complete working examples (upload as-is, or drop on the drawer to try): todo list → interactive checklist. The canonical *"markdown convention + narrow `match` + line-preserving rewrite"* recipe. - [`lit-review.plugin.html`](../arch/examples/lit-review.plugin.html) — paper-tracker - table over `{ "papers": [...] }` JSON (`match.jsonHas` pre-filter + runtime array + table over `{ "papers": [...] }` JSON (`match.dataHas` pre-filter + runtime array check + form-driven JSON writeback). - [`code-review.plugin.html`](../arch/examples/code-review.plugin.html) — markdown review findings (`## file` sections, `- [ ] [P0|P1|P2]` items) with severity badges. @@ -263,9 +267,10 @@ Recipes in words: - **Claim a markdown convention** — declare `format:"markdown"` plus `requireAny` /`requireAll` markers for your convention; split content into lines on render, edit lines in place, `join("\n")` on save so non-convention lines survive byte-for-byte. -- **Claim a JSON structure** — declare `jsonHas` for your top-level keys; on render, - `JSON.parse` in try/catch and verify shapes, `cheers:unsupported` when they don't - hold; save with `JSON.stringify(data, null, 2)`. +- **Claim a JSON structure** — declare `dataHas` for your top-level keys (or + `dataKind:"array"` for a top-level array); on render, `JSON.parse` in try/catch and + verify shapes, `cheers:unsupported` when they don't hold; save with + `JSON.stringify(data, null, 2)`. - **Use channel context** — call the §5.4 resource helper, e.g. `channel.members` to resolve author ids to names in your UI. Data may be stale seconds later, and renders are rare (§5.2: on `ready` and after a conflicted save — never on external edits), so diff --git a/frontend/src/features/chat/workbench/renderers/registry.test.ts b/frontend/src/features/chat/workbench/renderers/registry.test.ts index ea0bf036..823e5aec 100644 --- a/frontend/src/features/chat/workbench/renderers/registry.test.ts +++ b/frontend/src/features/chat/workbench/renderers/registry.test.ts @@ -62,8 +62,22 @@ describe("accepts — declared acceptance", () => { }; const r = getRenderer("plugin:g:r", [p])!; expect(accepts(r, "reviews/a.md", "x")).toBe(true); + expect(accepts(r, "reviews/a/b.md", "x")).toBe(false); // * stops at "/" expect(accepts(r, "notes/a.md", "x")).toBe(false); }); + + it("** in a glob crosses path segments (the \\u0000 placeholder path)", () => { + const p: PluginMeta = { + plugin_id: "g2", + title: "g2", + manifest: { + renderers: [{ id: "r", title: "r", match: { format: "markdown", glob: "reviews/**/*.md" } }], + }, + }; + const r = getRenderer("plugin:g2:r", [p])!; + expect(accepts(r, "reviews/a/b/c.md", "x")).toBe(true); + expect(accepts(r, "notes/a/b.md", "x")).toBe(false); + }); }); describe("candidatesFor — content-aware, specificity-ordered", () => { diff --git a/frontend/src/features/chat/workbench/renderers/registry.ts b/frontend/src/features/chat/workbench/renderers/registry.ts index 500a1c12927f8eab13a9fbbdade41cfde21c4b4f..6378e794e1a6c9cdbc3dd5ea6de6df7523cf1c1f 100644 GIT binary patch delta 30 fcmbPiGuLK=CkIZ|NEHPDk?9Eo delta 20 bcmbPhGudW?CkG?LWPgriMuyEhI8sFcLk0!r diff --git a/frontend/src/features/chat/workbench/sandbox/examples/lit-review.html b/frontend/src/features/chat/workbench/sandbox/examples/lit-review.html index da88c017..b653da8c 100644 --- a/frontend/src/features/chat/workbench/sandbox/examples/lit-review.html +++ b/frontend/src/features/chat/workbench/sandbox/examples/lit-review.html @@ -9,7 +9,7 @@ "protocol": 1, "title": "Literature review", "renderers": [ - { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "jsonHas": ["papers"] } } + { "id": "papers", "title": "Paper tracker", "match": { "format": "json", "dataHas": ["papers"] } } ] } diff --git a/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts b/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts index ca525c7a..770bbefb 100644 --- a/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts +++ b/frontend/src/features/chat/workbench/sandbox/pluginManifest.test.ts @@ -90,4 +90,61 @@ describe("validatePluginManifest", () => { validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: ["markdown"] }] }) ).toMatch(/match/); }); + + // Parity with the server's validate_manifest (server/src/domain/workbench_plugins.rs): + // whatever session-loads here must also install there. + + it("rejects ids outside ^[a-z0-9][a-z0-9._-]{0,63}$ (server id charset)", () => { + expect(validatePluginManifest({ ...ok, id: "Bad_Upper" })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, id: "-leading-dash" })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, id: "has space" })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, id: "x".repeat(65) })).toMatch(/id/); + expect(validatePluginManifest({ ...ok, id: "x".repeat(64) })).toBeNull(); + }); + + it("rejects over-long titles and renderer ids (server byte caps)", () => { + expect(validatePluginManifest({ ...ok, title: "x".repeat(256) })).toMatch(/title/); + expect(validatePluginManifest({ ...ok, title: "x".repeat(255) })).toBeNull(); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r".repeat(65), title: "R" }] }) + ).toMatch(/id/); + }); + + it("type-checks known match keys but ignores unknown ones", () => { + expect( + validatePluginManifest({ + ...ok, + renderers: [ + { + id: "r", + title: "R", + match: { + format: ["json", "yaml"], + dataKind: "array", + dataHas: ["rows"], + futureKey: { anything: true }, + }, + }, + ], + }) + ).toBeNull(); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { dataKind: "tuple" } }] }) + ).toMatch(/dataKind/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { format: [] } }] }) + ).toMatch(/format/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { format: [1] } }] }) + ).toMatch(/format/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { requireAll: "x" } }] }) + ).toMatch(/requireAll/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { jsonHas: [1] } }] }) + ).toMatch(/jsonHas/); + expect( + validatePluginManifest({ ...ok, renderers: [{ id: "r", title: "R", match: { glob: 5 } }] }) + ).toMatch(/glob/); + }); }); diff --git a/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts index c9095a57..165298c4 100644 --- a/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts +++ b/frontend/src/features/chat/workbench/sandbox/pluginManifest.ts @@ -4,8 +4,8 @@ /** The protocol version this host implements (manifest `protocol` field). A manifest * without `protocol` defaults to 1 — the documented default covering every plugin - * installed before the field existed. Hosts skip plugins declaring a HIGHER protocol - * (they'd speak messages we don't) instead of half-rendering them. */ + * installed before the field existed. Hosts skip plugins declaring any protocol other + * than 1 (they'd speak messages we don't) instead of half-rendering them. */ export const PLUGIN_PROTOCOL = 1; // What a renderer ACCEPTS — declared by the renderer, evaluated cheaply by the host to @@ -58,12 +58,46 @@ export interface PluginMeta { * server-side install validation). Also the sane ceiling for iframe srcDoc. */ export const MAX_PLUGIN_BUNDLE_BYTES = 2 * 1024 * 1024; -/** Shape-check a parsed plugin manifest. Returns an error message, or null when valid. */ +const utf8Bytes = (s: string): number => new TextEncoder().encode(s).length; + +// Per-key match validation — mirrors the server's validate_match +// (server/src/domain/workbench_plugins.rs). Known keys are type-checked; UNKNOWN keys +// are allowed — hosts ignore them, which is what lets the vocabulary grow within +// protocol 1. Session load and install are the same dev loop, so the two hosts must +// accept exactly the same manifests. +function validateMatch(m: unknown): string | null { + if (!m || typeof m !== "object" || Array.isArray(m)) return "renderer match must be an object"; + const mo = m as Record; + const f = mo.format; + if (f !== undefined) { + const ok = + typeof f === "string" || + (Array.isArray(f) && f.length > 0 && f.every((x) => typeof x === "string")); + if (!ok) return "match.format must be a string or a non-empty array of strings"; + } + if (mo.glob !== undefined && typeof mo.glob !== "string") return "match.glob must be a string"; + for (const key of ["requireAll", "requireAny", "dataHas", "jsonHas"] as const) { + const v = mo[key]; + if (v !== undefined && !(Array.isArray(v) && v.every((x) => typeof x === "string"))) + return `match.${key} must be an array of strings`; + } + if (mo.dataKind !== undefined && mo.dataKind !== "object" && mo.dataKind !== "array") + return 'match.dataKind must be "object" or "array"'; + return null; +} + +/** Shape-check a parsed plugin manifest. Returns an error message, or null when valid. + * Kept check-for-check in sync with the server's validate_manifest + * (server/src/domain/workbench_plugins.rs): a manifest that session-loads here must + * also install there, and vice versa. */ export function validatePluginManifest(m: unknown): string | null { if (!m || typeof m !== "object" || Array.isArray(m)) return "manifest must be a JSON object"; const o = m as Record; if (typeof o.id !== "string" || !o.id.trim()) return "manifest.id must be a non-empty string"; - if (typeof o.title !== "string" || !o.title.trim()) return "manifest.title must be a non-empty string"; + if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(o.id)) + return "manifest.id must match ^[a-z0-9][a-z0-9._-]{0,63}$"; + if (typeof o.title !== "string" || !o.title.trim() || utf8Bytes(o.title) > 255) + return "manifest.title must be a non-empty string (max 255 bytes)"; if (o.protocol !== undefined && o.protocol !== PLUGIN_PROTOCOL) return `unsupported protocol ${JSON.stringify(o.protocol)} (this host implements protocol ${PLUGIN_PROTOCOL}; omit the field or set ${PLUGIN_PROTOCOL})`; if ("panels" in o) @@ -74,12 +108,16 @@ export function validatePluginManifest(m: unknown): string | null { for (const r of o.renderers as unknown[]) { if (!r || typeof r !== "object" || Array.isArray(r)) return "each renderer must be an object"; const rr = r as Record; - if (typeof rr.id !== "string" || !rr.id.trim()) return "each renderer needs a non-empty string id"; - if (typeof rr.title !== "string" || !rr.title.trim()) return "each renderer needs a non-empty string title"; + if (typeof rr.id !== "string" || !rr.id.trim() || utf8Bytes(rr.id) > 64) + return "each renderer needs a non-empty string id (max 64 bytes)"; if (seen.has(rr.id)) return `duplicate renderer id: ${rr.id}`; seen.add(rr.id); - if (rr.match !== undefined && (!rr.match || typeof rr.match !== "object" || Array.isArray(rr.match))) - return "renderer match must be an object when present"; + if (typeof rr.title !== "string" || !rr.title.trim()) + return "each renderer needs a non-empty string title"; + if (rr.match !== undefined) { + const err = validateMatch(rr.match); + if (err) return err; + } } return null; } diff --git a/server/src/domain/workbench_plugins.rs b/server/src/domain/workbench_plugins.rs index 2f9a9c04..7d406bda 100644 --- a/server/src/domain/workbench_plugins.rs +++ b/server/src/domain/workbench_plugins.rs @@ -24,8 +24,9 @@ fn plugin_id_ok(id: &str) -> bool { return false; } (b[0].is_ascii_lowercase() || b[0].is_ascii_digit()) - && b.iter() - .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, b'.' | b'_' | b'-')) + && b.iter().all(|c| { + c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, b'.' | b'_' | b'-') + }) } fn validate_match(m: &Value) -> Result<(), String> { @@ -78,7 +79,12 @@ pub fn validate_manifest(plugin_id: &str, manifest: &Value) -> Result<(), String return Err("manifest.title must be a non-empty string (max 255 bytes)".into()); } if let Some(p) = obj.get("protocol") { - if p.as_i64() != Some(PLUGIN_PROTOCOL) { + // Accept any JSON NUMBER equal to 1 (so `1.0` too): the frontend cannot be + // stricter — JSON.parse collapses 1.0 to 1 — and the two hosts must accept + // the same manifests. Strings ("1") are still not versions. + let is_v1 = + p.as_i64() == Some(PLUGIN_PROTOCOL) || p.as_f64() == Some(PLUGIN_PROTOCOL as f64); + if !is_v1 { return Err(format!( "unsupported protocol {p} (this server accepts protocol {PLUGIN_PROTOCOL}; omit the field or set {PLUGIN_PROTOCOL})" )); @@ -214,16 +220,39 @@ mod tests { fn rejects_unsupported_protocol() { let mut m = ok_manifest(); m["protocol"] = json!(2); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("protocol")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("protocol")); m["protocol"] = json!("1"); // strings are not versions - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("protocol")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("protocol")); + } + + #[test] + fn accepts_any_json_number_equal_to_1_as_protocol() { + // JSON.parse collapses 1.0 to 1, so the frontend cannot distinguish them — + // installs must not be stricter than session loads. + let mut m = ok_manifest(); + m["protocol"] = json!(1.0); + assert_eq!(validate_manifest("md-checklist", &m), Ok(())); + m["protocol"] = json!(1.5); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("protocol")); + m["protocol"] = json!("2"); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("protocol")); } #[test] fn rejects_legacy_panels_manifest() { let mut m = ok_manifest(); m["panels"] = json!([{ "id": "notes", "title": "Notes" }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("legacy")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("legacy")); } #[test] @@ -240,9 +269,13 @@ mod tests { fn rejects_missing_or_empty_renderers() { let mut m = ok_manifest(); m["renderers"] = json!([]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("renderers")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("renderers")); m.as_object_mut().unwrap().remove("renderers"); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("renderers")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("renderers")); } #[test] @@ -252,11 +285,17 @@ mod tests { { "id": "dup", "title": "One" }, { "id": "dup", "title": "Two" } ]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("duplicate")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("duplicate")); m["renderers"] = json!([{ "title": "no id" }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("id")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("id")); m["renderers"] = json!([{ "id": "r" }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("title")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("title")); } #[test] @@ -267,10 +306,16 @@ mod tests { "dataHas": ["rows"], "futureKey": { "anything": true } } }]); assert_eq!(validate_manifest("md-checklist", &m), Ok(())); m["renderers"] = json!([{ "id": "r", "title": "R", "match": { "dataKind": "tuple" } }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("dataKind")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("dataKind")); m["renderers"] = json!([{ "id": "r", "title": "R", "match": { "format": [] } }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("format")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("format")); m["renderers"] = json!([{ "id": "r", "title": "R", "match": { "requireAll": "x" } }]); - assert!(validate_manifest("md-checklist", &m).unwrap_err().contains("requireAll")); + assert!(validate_manifest("md-checklist", &m) + .unwrap_err() + .contains("requireAll")); } } From a311df95cab6227b7c330f77f46f23af97feb4ab Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:52:02 +0800 Subject: [PATCH 26/28] =?UTF-8?q?fix(workbench):=20registry.ts=20as=20plai?= =?UTF-8?q?n=20text=20=E2=80=94=20escape=20NUL=20glob=20placeholders?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Literal 0x00 bytes in globToRegExp made git classify the file as binary, hiding every diff of this file on GitHub. Same runtime value via \u0000 escapes. Co-Authored-By: Claude Fable 5 --- .../chat/workbench/renderers/registry.ts | Bin 5988 -> 5998 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/frontend/src/features/chat/workbench/renderers/registry.ts b/frontend/src/features/chat/workbench/renderers/registry.ts index aa0841f7f6ea9863d2d05ffc640482da5772f662..03d83c9271bcb57fe594383a45fa0807f9305294 100644 GIT binary patch delta 30 fcmaE&_fBtv6+2r@sR0m7wq{R;GB?j>KgtgPpD+ot delta 20 ccmaE-_e5`l6+0utWC!+SMuyER*^lxA089Y}mH+?% From 7fe32cf7c5e40c2d85e69daa76badf58e4f04224 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 21:58:44 +0800 Subject: [PATCH 27/28] fix(workbench): official-plugin review fixes - Dockerfile: make the asset cache-bust predicate actually match (relative find paths never matched */assets/*) - workbench_official: checked i32 conversion for manifest version; SkipAdminClaimed logs at info - checklist/kanban manifests: offer renderers for * [ ] bullets too - table plugin: Set-based column dedup (survives constructor/toString keys) Co-Authored-By: Claude Fable 5 --- server/Dockerfile | 6 ++-- .../cheers-checklist.plugin.html | 5 +++- .../cheers-kanban-md.plugin.html | 6 +++- .../cheers-table.plugin.html | 6 ++-- server/src/domain/workbench_official.rs | 28 +++++++++++++------ 5 files changed, 36 insertions(+), 15 deletions(-) diff --git a/server/Dockerfile b/server/Dockerfile index 398b671a..ac6939d1 100644 --- a/server/Dockerfile +++ b/server/Dockerfile @@ -39,8 +39,10 @@ COPY server/assets ./assets # the empty stub binary (exits 0 immediately → CrashLoopBackOff). Touch the real # sources so their mtime beats the stubs and both crates actually recompile. # assets too: include_str! deps are tracked via dep-info mtimes — an assets-only -# change would otherwise be skipped by the same stale-artifact check. -RUN find src assets /app/packages/cheers-acp-connector-rs/bridge-protocol/src \( -name '*.rs' -o -path '*/assets/*' \) -exec touch {} + \ +# change would otherwise be skipped by the same stale-artifact check. The find +# starts at the RELATIVE path `assets`, so entries print as `assets/...` — +# the pattern must be 'assets/*' (a '*/assets/*' pattern would never match). +RUN find src assets /app/packages/cheers-acp-connector-rs/bridge-protocol/src \( -name '*.rs' -o -path 'assets/*' \) -exec touch {} + \ && cargo build --release # ── runtime ────────────────────────────────────────────────────────────────── diff --git a/server/assets/workbench-plugins/cheers-checklist.plugin.html b/server/assets/workbench-plugins/cheers-checklist.plugin.html index 2c72a7c8..6ee785c4 100644 --- a/server/assets/workbench-plugins/cheers-checklist.plugin.html +++ b/server/assets/workbench-plugins/cheers-checklist.plugin.html @@ -14,7 +14,10 @@ { "id": "checklist", "title": "Checklist", - "match": { "format": "markdown", "requireAny": ["- [ ]", "- [x]", "- [X]"] } + "match": { + "format": "markdown", + "requireAny": ["- [ ]", "- [x]", "- [X]", "* [ ]", "* [x]", "* [X]"] + } } ] } diff --git a/server/assets/workbench-plugins/cheers-kanban-md.plugin.html b/server/assets/workbench-plugins/cheers-kanban-md.plugin.html index 3528477b..3e9d8822 100644 --- a/server/assets/workbench-plugins/cheers-kanban-md.plugin.html +++ b/server/assets/workbench-plugins/cheers-kanban-md.plugin.html @@ -15,7 +15,11 @@ { "id": "kanban", "title": "Kanban", - "match": { "format": "markdown", "requireAll": ["## "], "requireAny": ["- [ ]", "- [x]", "- [X]"] } + "match": { + "format": "markdown", + "requireAll": ["## "], + "requireAny": ["- [ ]", "- [x]", "- [X]", "* [ ]", "* [x]", "* [X]"] + } } ] } diff --git a/server/assets/workbench-plugins/cheers-table.plugin.html b/server/assets/workbench-plugins/cheers-table.plugin.html index b55852d4..44e12e90 100644 --- a/server/assets/workbench-plugins/cheers-table.plugin.html +++ b/server/assets/workbench-plugins/cheers-table.plugin.html @@ -109,9 +109,11 @@ // Columns = union of row keys, first-seen order. Empty file => one starter column. function columns() { - var cols = [], seen = {}; + // Set, not {}: a plain object inherits Object.prototype, so row keys like + // "constructor" or "toString" would look already-seen and lose their column. + var cols = [], seen = new Set(); rows.forEach(function (r) { - Object.keys(r).forEach(function (k) { if (!seen[k]) { seen[k] = 1; cols.push(k); } }); + Object.keys(r).forEach(function (k) { if (!seen.has(k)) { seen.add(k); cols.push(k); } }); }); return cols.length ? cols : ["value"]; } diff --git a/server/src/domain/workbench_official.rs b/server/src/domain/workbench_official.rs index e389ac32..56fdda0e 100644 --- a/server/src/domain/workbench_official.rs +++ b/server/src/domain/workbench_official.rs @@ -90,6 +90,12 @@ pub async fn seed(db: &PgPool) -> Result<(), sqlx::Error> { continue; } let version = manifest.get("version").and_then(Value::as_i64).unwrap_or(1); + // Stored in an INT column — a wrapping `as i32` on an out-of-range version would + // go negative and re-seed on every startup (resurrecting admin deletions). + let Ok(version_i32) = i32::try_from(version) else { + warn!(plugin = %id, version, "official plugin version does not fit i32; skipping"); + continue; + }; let seeded: Option = sqlx::query_scalar( "SELECT seeded_version FROM workbench_official_plugin_state WHERE plugin_id = $1", @@ -105,10 +111,7 @@ pub async fn seed(db: &PgPool) -> Result<(), sqlx::Error> { match decide(version, seeded.map(i64::from), origin.as_deref()) { Action::Install => { - let title = manifest - .get("title") - .and_then(Value::as_str) - .unwrap_or(&id); + let title = manifest.get("title").and_then(Value::as_str).unwrap_or(&id); workbench_plugins::install( db, &id, @@ -126,14 +129,15 @@ pub async fn seed(db: &PgPool) -> Result<(), sqlx::Error> { DO UPDATE SET seeded_version = $2, seeded_at = NOW()", ) .bind(&id) - .bind(version as i32) + .bind(version_i32) .execute(db) .await?; info!(plugin = %id, version, "official workbench plugin seeded"); } Action::Noop => {} Action::SkipAdminClaimed => { - warn!(plugin = %id, "official plugin id is admin-claimed; leaving their row alone"); + // Documented steady state (admin claimed the id), not a problem — info, not warn. + info!(plugin = %id, "official plugin id is admin-claimed; leaving their row alone"); } } } @@ -151,11 +155,17 @@ mod tests { for bundle in OFFICIAL { let m = extract_manifest(bundle).expect("manifest extracts"); let id = m.get("id").and_then(Value::as_str).expect("has id"); - assert!(id.starts_with("cheers-"), "official ids use the cheers- prefix: {id}"); + assert!( + id.starts_with("cheers-"), + "official ids use the cheers- prefix: {id}" + ); workbench_plugins::validate_manifest(id, &m).expect("manifest validates"); + let version = m.get("version").and_then(Value::as_i64).unwrap_or_else(|| { + panic!("official manifests carry an integer version (drives re-seeding): {id}") + }); assert!( - m.get("version").and_then(Value::as_i64).is_some(), - "official manifests carry an integer version (drives re-seeding): {id}" + i32::try_from(version).is_ok(), + "official manifest version must fit the INT seeded_version column: {id}" ); } } From 5c9f4e1929dd62013f16fb0060e5ebe1165d7c06 Mon Sep 17 00:00:00 2001 From: haowei Date: Thu, 16 Jul 2026 22:12:51 +0800 Subject: [PATCH 28/28] =?UTF-8?q?fix(workbench):=20yaml-boards=20review=20?= =?UTF-8?q?fixes=20=E2=80=94=20table=20safety,=20comment=20edge=20cases?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - builtin table: only offered for arrays of plain objects; render and update guard non-object rows so a null or scalar row can neither crash the app nor corrupt the file on save - yamlDoc: preserve header comments of comment-only files across the first save; disable lineWidth refolding of untouched scalars; align the array-replacement contract comment with the code and name the same-length-reorder comment hazard - docs: write-side YAML 1.1 ambiguity note (unquoted no/yes/on/off) - pluginManifest: yaml joins the documented format list Co-Authored-By: Claude Fable 5 --- docs/developer/PLUGIN_DEVELOPMENT.md | 8 +++- .../chat/workbench/lens/builtins.test.ts | 34 ++++++++++++++++ .../features/chat/workbench/lens/builtins.tsx | 39 +++++++++++++++---- .../chat/workbench/renderers/registry.test.ts | 16 ++++++++ .../chat/workbench/renderers/registry.ts | 19 ++++++--- .../chat/workbench/sandbox/pluginManifest.ts | 8 ++-- .../features/chat/workbench/yamlDoc.test.ts | 17 ++++++++ .../src/features/chat/workbench/yamlDoc.ts | 24 ++++++++---- 8 files changed, 139 insertions(+), 26 deletions(-) create mode 100644 frontend/src/features/chat/workbench/lens/builtins.test.ts diff --git a/docs/developer/PLUGIN_DEVELOPMENT.md b/docs/developer/PLUGIN_DEVELOPMENT.md index 1e0791a7..124f465f 100644 --- a/docs/developer/PLUGIN_DEVELOPMENT.md +++ b/docs/developer/PLUGIN_DEVELOPMENT.md @@ -109,7 +109,13 @@ cover YAML: the builtin table (arrays of objects) and chart (`series`) accept bo JSON and YAML, and their writes go through a comment-preserving round-trip — comments and blank lines in the file survive machine edits. Also remember YAML 1.2 semantics: `yes`/`no`/`on`/`off` are plain strings, not booleans — agents writing -1.1-style files will get strings back. +1.1-style files will get strings back. The same ambiguity exists on the **write +side**: when a lens saves a string cell whose value is a YAML 1.1 boolean literal +(`no`, `yes`, `on`, `off`, any case), it is written **unquoted** (`answer: no`). A +YAML 1.2 parser reads that back as the same string, but a YAML 1.1 consumer — e.g. +PyYAML's `safe_load`, common in agent stacks — reads it as a **boolean**. Boards +are YAML 1.2 documents; parse them with a 1.2 parser (JS `yaml`, `ruamel.yaml`) +rather than relying on 1.1 semantics. ## 5. Protocol reference (protocol 1) diff --git a/frontend/src/features/chat/workbench/lens/builtins.test.ts b/frontend/src/features/chat/workbench/lens/builtins.test.ts new file mode 100644 index 00000000..af4c93fd --- /dev/null +++ b/frontend/src/features/chat/workbench/lens/builtins.test.ts @@ -0,0 +1,34 @@ +import { describe, expect, it } from "vitest"; +import { inferColumns, updateRowCell } from "./builtins"; + +// The registry only OFFERS the table for arrays of plain objects, but the lens can +// still receive anything (template bindings, files edited after binding) — these are +// the lens's own last-line guards against crashing or corrupting the file. +describe("table lens row guards", () => { + it("inferColumns unions keys across plain-object rows, first-seen order", () => { + expect(inferColumns([{ a: 1 }, { b: 2, a: 3 }])).toEqual([ + { key: "a", label: "a" }, + { key: "b", label: "b" }, + ]); + }); + + it("inferColumns skips null/scalar/array rows instead of throwing or faking columns", () => { + // Object.keys(null) throws; Object.keys("alpha") yields "0","1",… index columns + expect(inferColumns([{ a: 1 }, null, "alpha", 7, ["x"]])).toEqual([{ key: "a", label: "a" }]); + expect(inferColumns([null, "alpha"])).toEqual([{ key: "value", label: "value" }]); + }); + + it("updateRowCell edits object rows immutably", () => { + const rows = [{ a: "1" }, { a: "2" }]; + expect(updateRowCell(rows, 1, "a", "3")).toEqual([{ a: "1" }, { a: "3" }]); + expect(rows[1]).toEqual({ a: "2" }); // input untouched + }); + + it("updateRowCell refuses non-object rows — a save can never corrupt the file", () => { + // {..."alpha"} would silently become {"0":"a","1":"l",…} and get written back + expect(updateRowCell(["alpha"], 0, "a", "x")).toBeNull(); + expect(updateRowCell([null], 0, "a", "x")).toBeNull(); + expect(updateRowCell([["x"]], 0, "a", "x")).toBeNull(); + expect(updateRowCell([{ a: 1 }], 5, "a", "x")).toBeNull(); // out of range + }); +}); diff --git a/frontend/src/features/chat/workbench/lens/builtins.tsx b/frontend/src/features/chat/workbench/lens/builtins.tsx index 7650778d..ef913b72 100644 --- a/frontend/src/features/chat/workbench/lens/builtins.tsx +++ b/frontend/src/features/chat/workbench/lens/builtins.tsx @@ -6,26 +6,45 @@ import { registerLens, type LensProps } from "./registry"; interface TableConfig { columns: { key: string; label: string; options?: string[] }[]; } +// A tabular row is a PLAIN OBJECT. YAML happily parses `- alpha` to a string row and a +// bare `-` to null; the registry no longer offers the table for those, but the lens +// still guards every row itself (a template binding or a file edited after binding can +// hand it anything) — Object.keys(null) throws to the root ErrorBoundary, and +// Object.keys("alpha") fabricates per-character index columns. +function isPlainRow(v: unknown): v is Record { + return v !== null && typeof v === "object" && !Array.isArray(v); +} // Without a template config (the pickable path — any JSON/YAML array), infer the -// columns from the union of row keys, first-seen order. `options` dropdowns remain a -// config-only feature. -function inferColumns(rows: Record[]): TableConfig["columns"] { +// columns from the union of row keys, first-seen order. Non-object rows contribute +// nothing. `options` dropdowns remain a config-only feature. Exported for tests. +export function inferColumns(rows: unknown[]): TableConfig["columns"] { const keys: string[] = []; const seen = new Set(); - for (const r of rows) + for (const r of rows) { + if (!isPlainRow(r)) continue; for (const k of Object.keys(r)) if (!seen.has(k)) { seen.add(k); keys.push(k); } + } return (keys.length ? keys : ["value"]).map((k) => ({ key: k, label: k })); } +// Pure cell edit, exported for tests. REFUSES to touch a non-object row: spreading a +// string ({..."alpha"}) silently becomes {"0":"a","1":"l",…} and Save would write that +// corruption into the user's file — null tells the caller to no-op instead. +export function updateRowCell(rows: unknown[], i: number, key: string, v: string): unknown[] | null { + if (!isPlainRow(rows[i])) return null; + return rows.map((r, j) => (j === i && isPlainRow(r) ? { ...r, [key]: v } : r)); +} function TableLens({ data, config, onChange }: LensProps) { - const rows = Array.isArray(data) ? (data as Record[]) : []; + const rows = Array.isArray(data) ? (data as unknown[]) : []; const configured = (config as TableConfig | undefined)?.columns; const columns = configured?.length ? configured : inferColumns(rows); - const update = (i: number, key: string, v: string) => - onChange(rows.map((r, j) => (j === i ? { ...r, [key]: v } : r))); + const update = (i: number, key: string, v: string) => { + const next = updateRowCell(rows, i, key, v); + if (next) onChange(next); + }; const add = () => onChange([...rows, Object.fromEntries(columns.map((c) => [c.key, c.options?.[0] ?? ""]))]); const del = (i: number) => onChange(rows.filter((_, j) => j !== i)); @@ -46,7 +65,11 @@ function TableLens({ data, config, onChange }: LensProps) { {columns.map((c) => ( - {c.options ? ( + {!isPlainRow(r) ? ( + // null/scalar row: read-only placeholder — an input would promise an + // edit that update() must refuse. Delete (index-based) still works. + — + ) : c.options ? (