Commit Graph

64 Commits

Author SHA1 Message Date
朱潮
b8e57b2f51 feat(skills): add security hardening to skill upload endpoint
- Add ZipSlip path traversal protection (validate all file paths)
- Add file size limits (50MB upload, 500MB extracted)
- Add zip bomb protection (max 100:1 compression ratio, 1000 entries)
- Add async I/O using aiofiles to avoid blocking event loop
- Add bot_id validation to prevent path traversal attacks
- Add proper error cleanup on upload failures

Security improvements:
- P1-001: ZipSlip path traversal防护
- P1-004: File size limits (50MB)
- P1-005: Zip bomb防护 (compression ratio check)
- P1-008: Async I/O improvements

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 20:25:37 +08:00
朱潮
b3303ef8e6 refactor(sse): simplify error handling and remove __debug__ security issue
- Remove __debug__ conditional that exposed tracebacks in production
- Simplify error response structure to {"error": str(e)}
- Remove redundant exception handling in init_agent()
- Remove unnecessary traceback logging
- Reduce code from ~30 lines to ~10 lines

Fixes security vulnerability where __debug__ is always True
unless Python runs with -O flag, causing full tracebacks
to be sent to clients in production.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 20:24:30 +08:00
朱潮
342932030f feat(skills): add skill management API module
- Create new skill_manager.py with list and upload endpoints
- Add GET /api/v1/skill/list to retrieve official and user skills
- Add POST /api/v1/skill/upload for skill file upload
- Parse SKILL.md frontmatter to extract name and description
- Move skill upload endpoint from files.py to skill_manager.py
- Add SKILLS_DIR configuration to settings.py
- Register skill_manager router in fastapi_app.py

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 19:45:04 +08:00
朱潮
8a85e9025e fix(sse): properly handle MCP tool errors and send error responses to client
- Enhance exception handling in agent_task() to capture and send structured error messages via SSE stream
- Add [DONE] marker to outer exception handler to ensure proper stream termination
- Improve MCP tool loading error handling in init_agent() to prevent cascading failures
- Add detailed error logging with traceback for debugging

Fixes RemoteProtocolError that occurred when MCP tool calls failed,
which previously caused incomplete chunked read errors and connection drops.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 19:24:28 +08:00
朱潮
92c82c24a4 feat(skills): add skill file upload API endpoint
Add new POST endpoint /api/v1/skills/upload for uploading skill zip files.
The endpoint:
- Accepts zip files with bot_id parameter
- Validates file format (must be .zip)
- Saves zip to projects/uploads/{bot_id}/skill_zip/
- Automatically extracts to projects/uploads/{bot_id}/skills/{skill_name}/
- Returns success response with file and extract paths

This enables programmatic skill deployment for specific bots.
2026-01-07 14:47:25 +08:00
朱潮
fbbf0c0653 fix(file-manager): fix create-folder API to accept JSON request body
The create_folder endpoint was incorrectly defined to accept query
parameters instead of JSON request body, causing 400 errors when
called from the frontend.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-31 16:52:07 +08:00
朱潮
766b9becda feat(deep-agent): add skills support and improve project structure
- Add skills parameter to ChatRequest for skill file processing
- Extract and unzip skill files to robot project skills directory
- Add robot_config.json with bot_id and environment variables
- Update symlink setup to skip if ~/.deepagents already exists
- Enhance system prompt with directory access restrictions
- Refactor _get_robot_dir to handle symlink paths correctly

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-31 13:21:58 +08:00
朱潮
c808517f02 fix(file-manager): preserve project/prompt prefix in nested directories
修复文件管理 API 中路径计算问题。当点击第三级目录时,由于
PROJECTS_DIR 是相对路径而 item 是绝对路径,导致 relative_to()
失败返回绝对路径,从而使前端丢失前缀。

使用 PROJECTS_DIR.resolve() 作为基准确保正确计算相对路径。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-31 09:37:54 +08:00
朱潮
0e6b2f1511 add CHECKPOINT_DB_URL 2025-12-24 20:43:10 +08:00
朱潮
b86a8364e9 db 2025-12-24 11:05:10 +08:00
朱潮
d8dc973b95 sqlite pool and change agent cache to tools cache 2025-12-23 22:18:18 +08:00
朱潮
a92bea5b58 删除一些环境变量 2025-12-18 09:41:43 +08:00
朱潮
6bad1743b3 warm_up 2025-12-18 00:38:04 +08:00
朱潮
47f1d1c7eb cache 2025-12-17 23:05:42 +08:00
朱潮
b78b178c03 删除agent manager 2025-12-17 20:27:06 +08:00
朱潮
e36787fb63 修改agent_config 2025-12-16 21:26:20 +08:00
朱潮
de72321875 add safe_print 2025-12-16 16:28:11 +08:00
朱潮
9525c0f883 add AgentConfig 2025-12-16 16:06:47 +08:00
朱潮
77c8f5e501 settings 2025-12-15 21:58:54 +08:00
朱潮
9ada70eb58 session_id 2025-12-15 21:38:09 +08:00
朱潮
0d50cd8e9f session_id 2025-12-15 21:36:13 +08:00
朱潮
d9ee1edf8a 修复none值的问题 2025-12-15 17:38:27 +08:00
朱潮
c391c97b24 llm log 2025-12-15 13:29:38 +08:00
朱潮
a97ff5a185 优化思考 2025-12-15 11:57:31 +08:00
朱潮
c32ecdfeb6 tool_response 2025-12-14 21:37:35 +08:00
朱潮
5d70177549 tool_response 2025-12-14 21:28:55 +08:00
朱潮
edb895bbf9 tool_call_chunks 2025-12-14 21:21:00 +08:00
朱潮
559040f7ce tool_call 2025-12-14 18:48:48 +08:00
朱潮
671569026e tool_id 2025-12-14 09:43:24 +08:00
朱潮
367e292854 merge 2025-12-14 09:30:34 +08:00
朱潮
89f5b721ab muti tool_call 2025-12-14 09:29:19 +08:00
朱潮
945ab060d6 think增加流式输出模式 2025-12-14 07:54:03 +08:00
朱潮
ab68c4309d think增加流式输出模式 2025-12-14 07:53:24 +08:00
朱潮
25b4d9a87d add default transport 2025-12-13 03:09:25 +08:00
朱潮
ec9558fd4c update guidline 2025-12-13 02:52:01 +08:00
朱潮
720db80ae9 add deep_agent 2025-12-12 18:41:52 +08:00
朱潮
ee41279569 add last_message 2025-12-08 22:15:49 +08:00
朱潮
c58b20e56f 修改guideline_prompt:只需要列出详细的工具调用步骤即可,不需要考虑回复用户的话术,步骤数量根据实际需求调整。 2025-12-04 13:50:25 +08:00
朱潮
cf33da310d 修改general_agent提示词 2025-12-03 17:53:18 +08:00
朱潮
a7f27fe33b 修改guideline提示词 2025-12-03 14:13:39 +08:00
朱潮
4d995ac990 优化Guidelines指令遵循 2025-12-02 11:00:31 +08:00
朱潮
bb640e6d6e 优化guideline提示词,新增admin后台修改prompt功能 2025-12-02 10:10:00 +08:00
朱潮
154662ac6e 只传输执行计划给agent 2025-12-01 23:20:09 +08:00
朱潮
08b7d0e2b8 add cot 2025-12-01 21:52:14 +08:00
朱潮
8be1acb9f2 增加PREAMBLE标签 2025-12-01 19:22:59 +08:00
朱潮
13e2ba56a7 language 2025-11-28 17:42:58 +08:00
朱潮
5e26d88d18 优化推理逻辑,提升推理i速度 2025-11-28 14:26:37 +08:00
朱潮
af29716571 custom preamble 2025-11-28 12:06:23 +08:00
朱潮
fb34d45735 preamble 2025-11-28 09:04:01 +08:00
朱潮
dfe0439894 preamble 2025-11-28 00:58:03 +08:00