✨ Add several northbound apis#3223
Merged
Merged
Conversation
Jasonxia007
force-pushed
the
xyc/lianyong_northbound
branch
from
0a801c4 to
376b573
Compare
# Conflicts: # test/backend/agents/test_create_agent_info.py
WMC001
added a commit
that referenced
this pull request
Jun 18, 2026
* add_greeting_fields_to_agent-develop * feat(knowledge-base): add preserve_source_file and post-index source cleanup Let knowledge bases opt out of keeping uploaded MinIO copies after indexing while retaining Elasticsearch chunks for retrieval. Default behavior remains preserve_source_file=true for backward compatibility. - Add preserve_source_file column (init.sql + v2.2.0_0601 migration) - Accept preserve_source_file on create/update and northbound/vector APIs - Support document DELETE scope=source_only and source_available in listings - Run cleanup_source Celery task when preserve_source_file is false - UI: create-KB toggle, list tag, knowledge-base preview when copy is missing - Update vector-database SDK docs and backend tests * test(data_process): stub knowledge_db, redis_service, and redis in test_worker Align setup_mocks_for_worker with test_tasks so importing backend.data_process.worker loads package __init__ without real DB/redis deps. * test(data_process): shim cleanup_source for submit_process_forward_chain tests * remove duplicate import * fix: update unit tests for greeting_message and example_questions fields * add init.sql to sonar.properites * ♻️ Improvement: API to MCP conversion service supports configuring headers. (#3194) * ♻️ Improvement: API to MCP conversion service supports configuring headers. [Specification Details] 1. Front-end and back-end modifications * ♻️ Improvement: API to MCP conversion service supports configuring headers. [Specification Details] 1. Modify the frontend, after adding, set the HTTP headers to empty. 2. Modify test cases. * ♻️ Improvement: Enhance processing of ES index names in memory banks. (#3196) [Specification Details] 1. Replace all symbols in the index name that do not meet the rules with "_". 2. Modify test cases. * feat: add active memory tools (StoreMemoryTool, SearchMemoryTool) (#3197) - Implement StoreMemoryTool for explicit memory storage during agent reasoning - Implement SearchMemoryTool for on-demand memory retrieval during conversations - Integrate tools into agent creation flow (create_agent_info.py) - Register tools in nexent_agent.py and tools/__init__.py - Add MEMORY_OPERATION tool sign for proper categorization - Fix memory_core.py cache key to include event loop ID (prevents cross-loop conflicts) - Add comprehensive test coverage for both tools - Add procedural memory verification documentation Tools follow existing patterns: lazy imports, observer integration, error handling, and respect user memory preferences (agent_share_option, disabled_agent_ids). Co-authored-by: Dallas98 <40557804+Dallas98@users.noreply.github.com> * 🐛 Bugfix: skill names and descriptions never load to context (#3205) * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: official skills not copied to target directory * 🐛 Bugfix: official skills not copied to target directory * Feat: add selected count badges to tool/skill pool labels (#3206) Co-authored-by: chase <byzhangxin11@126.com> * 🐛 Bugfix: Fix attribution error when tool calling error (#3208) * ✨ Feat: Add support for Word document generation, preview, and download (#3191) * Feat: Add support for Word document generation, preview, and download * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Restrict uploads to a known safe workspace/output directory * 修改单元测试 * 修复单元测试 * Bugfix: Store uploaded files in Minio for conversation messages to enable file visibility in history --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * ✨Feat:Enhance prompt optimization by integrating openjiuwen and fix related bugs (#3190) * ✨Feat：add prompt optimization * 🐛Bugfix: dockerbuild failed when running pipefail in python3_11 * 🔨Optimize： Optimize prompt optimization display page and interaction methods * 🐛Bugfix: fix dependencies replication * 🎨:Optimize frontend prompts and loading interface * 🔧 Refactor: Update imports and remove redundant ENABLE_JIUWEN_SDK import in prompt_service.py * 🔧 Refactor: Correct import path for NexentCapabilityError and enhance test coverage for prompt optimization service * 🔧 Refactor: Update import paths for exception handling and improve logging formatting in prompt_service.py * 🔧 Refactor: Simplify lazy imports in jiuwen_sdk_adapter.py and update import paths in prompt_service.py * 🔧 Refactor: Enhance Jiuwen SDK adapter handling and improve test stubs in prompt_service.py and related test files * 🧪test:Pydantic model for PromptTemplateRequest in test_prompt_template_app.py * 🔧 Refactor: Remove unnecessary dependency exclusions from pyproject.toml * 🔧 Update: Upgrade huggingface_hub dependency version in pyproject.toml * 🔧 Update: Exclude unnecessary transitive dependencies and adjust huggingface_hub version in pyproject.toml * 🔧 Test: Add mock modules for unstructured inference and set up package paths in test files * 🔧 Test: Enhance test setup by adding optional SDK mocks and cleaning up module imports in data processing tests * 🔧 Test: Consolidate mock module setup for unstructured inference across multiple test files * 🔧 Test: Remove unused optional SDK mocks from test configuration * 🔧 Refactor: Clean up imports and enhance dynamic loading of fastmcp components in Docker client * 📦update:sdk dependence update * Add CAS SSO integration and improve logout handling (#3072) * feat: add CAS SSO integration * Skip CAS logout when CAS_LOGOUT_URL is unset * 取消转义 * Improve CAS logout handling and confirm user logout * Disable account deletion for CAS users * Add CAS session init SQL and k8s config * clean code * Remove agent guardrails design doc from tracking * 补充文档 --------- Co-authored-by: hhhhsc <name> * 🐛Bugfix: Remove unnecessary dependency exclusions and upgrade huggingface_hub version in pyproject.toml (#3211) * refactor: move current time from system prompt to user message for prompt cache stability (#3203) Remove {{time}} from all 4 prompt YAML templates (manager/managed × en/zh) and strip time_str from the context_utils pipeline (_format_app_context, build_skeleton_header_component, build_context_components, build_app_context_string). Also remove time from create_agent_info render kwargs and build_context_components call. In CoreAgent.run, prepend [Current time: ...] to self.task so the timestamp travels with the user message instead of being baked into the system prompt. This makes the rendered system prompt fully deterministic per (agent_id, tenant_id, version_no, language) — enabling prompt/KV cache hits across requests for the same agent config. Sync test_context_utils.py: drop time_str= from 3 test cases. Remove unused datetime imports from context_utils.py and create_agent_info.py. * 🐛 Bugfix: Fixed the issue of being unable to add MCP services via containerization. (#3213) [Specification Details] 1. Modify the DEFAULT_NETWORK_NAME when starting the MCP service in the container to match the name in docker-compose. 2. Modify the parameters passed to the add_mcp_service method; custom_headers defaults to None. * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. (#3219) * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. [Specification Details] 1. The return parameter of the file_process method has changed and needs to be unpacked. * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. [Specification Details] 1. Modify test case. * 🐛 Bugfix: Fixed an issue where the MCP service could not be added correctly after updating the FastMCP version. (#3222) [Specification Details] 1. Add `kwargs` to the `create_httpx_client` function to accept all additional parameters. * 🐛 Bugfix: Fix incomplete display of tenant resources page after window resize (#3215) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Add agent marketplace repository and version pinning for sub-agents (#3239) * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat(agent): add verification configuration for agents and update related components (#3174) * feat(agent): add verification configuration for agents and update related components * feat(model): update model type labels and add monitoring dashboard translations * 🐛 Bugfix: Fix inability to select agent from agent space to edit (#3240) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix inability to select agent from agent space to edit * Bugfix: Display correct version info when viewing agent details * Update data agent and ME CAS integration documentation (#3242) * 补充dataagent对接文档 * 补充ME cas对接文档 * 补充ME cas对接文档 --------- Co-authored-by: hhhhsc <name> * ✨ Add several northbound apis (#3223) * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * refactor: simplify deployment script by removing unused variables and functions (#3245) * feat(agent): add verification configuration for agents and update related components * feat(model): update model type labels and add monitoring dashboard translations * refactor(build_offline_package): simplify deployment script by removing unused variables and functions * 🐛 Bugfix: Adjust agent detail UI layout to accommodate newly added "self-verification" field (#3246) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix inability to select agent from agent space to edit * Bugfix: Display correct version info when viewing agent details * Bugfix: Adjust agent detail UI layout to accommodate newly added "self-verification" field * 补充sql (#3248) * 补充sql * 扩大limit限制 * 🐛 Bugfix: Fixed an issue where the MCP service failed to start in a Kubernetes container. (#3254) [Specification Details] 1. Modify the pod naming logic to convert all non-compliant characters to -. 2. Modify test cases. * 🐛 Bugfix: knowledge_base_search_tool called with TypeError: argument of type 'FieldInfo' is not iterable (#3259) * 🐛 Bugfix: Fixed an issue where the one-click rename function failed after importing an agent. (#3258) [Specification Details] 1. The frontend does not pass `agent_id` when calling the `regenerate_name` API. * Bugfix: Exclude attachments from assistant when saving conversation history (#3261) * Bump APP_VERSION from v2.2.0 to v2.2.1 (#3268) The default setting for client-side self-validation is "False". --------- Co-authored-by: chase <byzhangxin11@126.com> Co-authored-by: Chenlifeng <174292121+Lifeng-Chen@users.noreply.github.com> Co-authored-by: Dallas98 <40557804+Dallas98@users.noreply.github.com> Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com> Co-authored-by: Xia Yichen <iamjasonxia@126.com> Co-authored-by: JeffWu <45140512+jeffwu-1999@users.noreply.github.com> Co-authored-by: WMC001 <46217886+WMC001@users.noreply.github.com> Co-authored-by: xuyaqi <xuyaqist@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: DongJiBao2001 <120021235+DongJiBao2001@users.noreply.github.com> Co-authored-by: hhhhsc701 <56435672+hhhhsc701@users.noreply.github.com> Co-authored-by: Dallas98 <990259227@qq.com> Co-authored-by: frr <64584192+wuyuanfr@users.noreply.github.com>
YehongPan
reviewed
Jun 24, 2026
| raise ValidationError("tool_params must be an object.") | ||
| try: | ||
| return ToolParamsRequest.model_validate(tool_params) | ||
| except Exception as exc: |
Contributor
There was a problem hiding this comment.
[代码规范] except Exception: 过于宽泛，建议捕获更具体的异常类型，避免掩盖潜在错误。
YehongPan
reviewed
Jun 24, 2026
| raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail=str(e)) | ||
| except HTTPException as e: | ||
| raise e | ||
| except Exception as e: |
Contributor
There was a problem hiding this comment.
[代码规范] except Exception: 过于宽泛，建议捕获更具体的异常类型，避免掩盖潜在错误。
YehongPan
reviewed
Jun 24, 2026
| presigned_result = get_file_url(object_name=normalized_file["object_name"], expires=86400) | ||
| if presigned_result.get("success") and presigned_result.get("url"): | ||
| normalized_file["presigned_url"] = _build_mcp_presigned_url(presigned_result["url"]) | ||
| except Exception: |
Contributor
There was a problem hiding this comment.
[代码规范] except Exception: 过于宽泛，建议捕获更具体的异常类型，避免掩盖潜在错误。
JasonW404
reviewed
Jun 24, 2026
|
|
||
| logger = logging.getLogger("create_agent_info") | ||
| logger.setLevel(logging.DEBUG) | ||
|
|
Member
There was a problem hiding this comment.
_normalize_tool_params_request 使用 ToolParamsRequest.model_validate 验证输入，但如果 tool_params 包含未知的 tool name，不会报错。建议在 _get_agent_tool_overrides 中添加验证，确保 agent name 存在于当前 agent 列表中，避免无效覆盖。
Jasonxia007
commented
Jun 24, 2026
| @@ -1367,7 +1367,7 @@ main_deploy() { | |||
| echo "--------------------------------" | |||
Contributor
Author
There was a problem hiding this comment.
🔴 Critical: APP_VERSION="$(get_app_version)" 被硬编码改为 APP_VERSION="latest"，缺少环境变量覆盖与回退机制。
原因: 强制使用 latest 标签会绕过 const.py 中的 APP_VERSION 配置，导致生产回滚、灰度发布、A/B 验证全部失效。
建议: 改为 APP_VERSION="${APP_VERSION:-$(get_app_version)}"，让 CI/CD 注入的版本号优先。
xuyaqist
reviewed
Jun 25, 2026
| "Successful uploads return reusable `s3_url` references." | ||
| ), | ||
| ) | ||
| async def upload_chat_attachments( |
Contributor
There was a problem hiding this comment.
upload_chat_attachments 端点接受 list[UploadFile] 但没有文件大小限制验证。恶意用户可以上传超大文件耗尽服务器磁盘空间或内存。建议：(1) 在 FastAPI 层面配置 max_upload_size；(2) 或在处理前检查每个文件的 file.size 属性并拒绝超限文件。
xuyaqist
reviewed
Jun 25, 2026
| __all__ = ["router", "_get_northbound_context"] | ||
|
|
||
|
|
||
| def _resolve_proxy_download_filename(presigned_url: str, content_disposition: str) -> str: |
Contributor
There was a problem hiding this comment.
_resolve_proxy_download_filename 使用正则从 Content-Disposition 和 presigned URL 中提取文件名，但 presigned URL 的 path 可能包含编码的特殊字符（如 %2F）。unquote 后 split("/")[-1] 可能得到意外的结果。建议增加对提取结果的合法性校验（如不包含路径分隔符），并在无法提取时返回安全的默认文件名。
xuyaqist
reviewed
Jun 25, 2026
| "through the `attachments` field." | ||
| ), | ||
| ) | ||
| async def run_chat( |
Contributor
There was a problem hiding this comment.
attachments 参数声明为 Optional[list]，类型过于宽泛。应该使用更具体的类型注解（如 Optional[List[str]] 或 Optional[List[Dict[str, Any]]]），以便 FastAPI 自动生成准确的 OpenAPI 文档，并在请求验证阶段拦截格式错误的输入。
hhhhsc701
reviewed
Jun 25, 2026
| } | ||
| presigned_url = upload_result.get("presigned_url") | ||
| if presigned_url: | ||
| descriptor["presigned_url"] = presigned_url |
Contributor
There was a problem hiding this comment.
[P1] 上传返回里直接暴露 presigned_url，会让调用方拿到可复用的对象访问 URL。北向 API 应返回 object_name/相对路径，下载时再按权限短期签发，避免 URL 被日志或客户端持久化。
| } | ||
| # Add presigned_url if available, or generate one if we have object_name | ||
| if "presigned_url" in attachment: | ||
| normalized_file["presigned_url"] = attachment["presigned_url"] |
Contributor
There was a problem hiding this comment.
[P1] dict 附件如果自带 presigned_url 会被直接信任并传入内部 minio_files，完全绕过下面 string 分支的 validate_urls_access。调用方可以把任意 URL 注入给模型/工具。
| normalized_file["presigned_url"] = attachment["presigned_url"] | ||
| elif normalized_file.get("object_name"): | ||
| try: | ||
| presigned_result = get_file_url(object_name=normalized_file["object_name"], expires=86400) |
Contributor
There was a problem hiding this comment.
[P2] 这里生成 86400 秒的 presigned URL，聊天请求中的附件 URL 会在一天内可复用。北向场景建议使用更短 TTL，并在每次下载时重新鉴权签发。
| merged_params[param["name"]] = param.get("default") | ||
|
|
||
| if override_params: | ||
| merged_params.update(override_params) |
Contributor
There was a problem hiding this comment.
[P1] tool_params 的 override_params 直接 update 到工具参数，没有校验 key 是否属于该工具 schema。北向调用者可以注入隐藏参数或覆盖内部字段；需要按工具声明白名单过滤。
| if override_params and "document_paths" in override_params: | ||
| document_paths = override_params.get("document_paths") | ||
| # Also check using the tool name as key | ||
| if not document_paths: |
Contributor
There was a problem hiding this comment.
[P1] if not document_paths 会把空列表当成“没有限制”，然后继续回退到 knowledge_base_search 覆盖或不加过滤。对访问控制来说空列表应表示不允许任何文档，不能等同 None。
hhhhsc701
reviewed
Jun 26, 2026
| } | ||
| presigned_url = upload_result.get("presigned_url") | ||
| if presigned_url: | ||
| descriptor["presigned_url"] = presigned_url |
Contributor
There was a problem hiding this comment.
[P1] 上传返回里直接暴露 presigned_url，会让调用方拿到可复用的对象访问 URL。北向 API 应返回 object_name/相对路径，下载时再按权限短期签发，避免 URL 被日志或客户端持久化。
hhhhsc701
reviewed
Jun 26, 2026
| } | ||
| # Add presigned_url if available, or generate one if we have object_name | ||
| if "presigned_url" in attachment: | ||
| normalized_file["presigned_url"] = attachment["presigned_url"] |
Contributor
There was a problem hiding this comment.
[P1] dict 附件如果自带 presigned_url 会被直接信任并传入内部 minio_files，完全绕过下面 string 分支的 validate_urls_access。调用方可以把任意 URL 注入给模型/工具。
hhhhsc701
reviewed
Jun 26, 2026
| normalized_file["presigned_url"] = attachment["presigned_url"] | ||
| elif normalized_file.get("object_name"): | ||
| try: | ||
| presigned_result = get_file_url(object_name=normalized_file["object_name"], expires=86400) |
Contributor
There was a problem hiding this comment.
[P2] 这里生成 86400 秒的 presigned URL，聊天请求中的附件 URL 会在一天内可复用。北向场景建议使用更短 TTL，并在每次下载时重新鉴权签发。
hhhhsc701
reviewed
Jun 26, 2026
| merged_params[param["name"]] = param.get("default") | ||
|
|
||
| if override_params: | ||
| merged_params.update(override_params) |
Contributor
There was a problem hiding this comment.
[P1] tool_params 的 override_params 直接 update 到工具参数，没有校验 key 是否属于该工具 schema。北向调用者可以注入隐藏参数或覆盖内部字段；需要按工具声明白名单过滤。
hhhhsc701
reviewed
Jun 26, 2026
| if override_params and "document_paths" in override_params: | ||
| document_paths = override_params.get("document_paths") | ||
| # Also check using the tool name as key | ||
| if not document_paths: |
Contributor
There was a problem hiding this comment.
[P1] if not document_paths 会把空列表当成“没有限制”，然后继续回退到 knowledge_base_search 覆盖或不加过滤。对访问控制来说空列表应表示不允许任何文档，不能等同 None。
WMC001
added a commit
that referenced
this pull request
Jun 26, 2026
* Release/v2.2.1 (#3269) * add_greeting_fields_to_agent-develop * feat(knowledge-base): add preserve_source_file and post-index source cleanup Let knowledge bases opt out of keeping uploaded MinIO copies after indexing while retaining Elasticsearch chunks for retrieval. Default behavior remains preserve_source_file=true for backward compatibility. - Add preserve_source_file column (init.sql + v2.2.0_0601 migration) - Accept preserve_source_file on create/update and northbound/vector APIs - Support document DELETE scope=source_only and source_available in listings - Run cleanup_source Celery task when preserve_source_file is false - UI: create-KB toggle, list tag, knowledge-base preview when copy is missing - Update vector-database SDK docs and backend tests * test(data_process): stub knowledge_db, redis_service, and redis in test_worker Align setup_mocks_for_worker with test_tasks so importing backend.data_process.worker loads package __init__ without real DB/redis deps. * test(data_process): shim cleanup_source for submit_process_forward_chain tests * remove duplicate import * fix: update unit tests for greeting_message and example_questions fields * add init.sql to sonar.properites * ♻️ Improvement: API to MCP conversion service supports configuring headers. (#3194) * ♻️ Improvement: API to MCP conversion service supports configuring headers. [Specification Details] 1. Front-end and back-end modifications * ♻️ Improvement: API to MCP conversion service supports configuring headers. [Specification Details] 1. Modify the frontend, after adding, set the HTTP headers to empty. 2. Modify test cases. * ♻️ Improvement: Enhance processing of ES index names in memory banks. (#3196) [Specification Details] 1. Replace all symbols in the index name that do not meet the rules with "_". 2. Modify test cases. * feat: add active memory tools (StoreMemoryTool, SearchMemoryTool) (#3197) - Implement StoreMemoryTool for explicit memory storage during agent reasoning - Implement SearchMemoryTool for on-demand memory retrieval during conversations - Integrate tools into agent creation flow (create_agent_info.py) - Register tools in nexent_agent.py and tools/__init__.py - Add MEMORY_OPERATION tool sign for proper categorization - Fix memory_core.py cache key to include event loop ID (prevents cross-loop conflicts) - Add comprehensive test coverage for both tools - Add procedural memory verification documentation Tools follow existing patterns: lazy imports, observer integration, error handling, and respect user memory preferences (agent_share_option, disabled_agent_ids). Co-authored-by: Dallas98 <40557804+Dallas98@users.noreply.github.com> * 🐛 Bugfix: skill names and descriptions never load to context (#3205) * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: skill names and descriptions never load to context * 🐛 Bugfix: official skills not copied to target directory * 🐛 Bugfix: official skills not copied to target directory * Feat: add selected count badges to tool/skill pool labels (#3206) Co-authored-by: chase <byzhangxin11@126.com> * 🐛 Bugfix: Fix attribution error when tool calling error (#3208) * ✨ Feat: Add support for Word document generation, preview, and download (#3191) * Feat: Add support for Word document generation, preview, and download * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Restrict uploads to a known safe workspace/output directory * 修改单元测试 * 修复单元测试 * Bugfix: Store uploaded files in Minio for conversation messages to enable file visibility in history --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * ✨Feat:Enhance prompt optimization by integrating openjiuwen and fix related bugs (#3190) * ✨Feat：add prompt optimization * 🐛Bugfix: dockerbuild failed when running pipefail in python3_11 * 🔨Optimize： Optimize prompt optimization display page and interaction methods * 🐛Bugfix: fix dependencies replication * 🎨:Optimize frontend prompts and loading interface * 🔧 Refactor: Update imports and remove redundant ENABLE_JIUWEN_SDK import in prompt_service.py * 🔧 Refactor: Correct import path for NexentCapabilityError and enhance test coverage for prompt optimization service * 🔧 Refactor: Update import paths for exception handling and improve logging formatting in prompt_service.py * 🔧 Refactor: Simplify lazy imports in jiuwen_sdk_adapter.py and update import paths in prompt_service.py * 🔧 Refactor: Enhance Jiuwen SDK adapter handling and improve test stubs in prompt_service.py and related test files * 🧪test:Pydantic model for PromptTemplateRequest in test_prompt_template_app.py * 🔧 Refactor: Remove unnecessary dependency exclusions from pyproject.toml * 🔧 Update: Upgrade huggingface_hub dependency version in pyproject.toml * 🔧 Update: Exclude unnecessary transitive dependencies and adjust huggingface_hub version in pyproject.toml * 🔧 Test: Add mock modules for unstructured inference and set up package paths in test files * 🔧 Test: Enhance test setup by adding optional SDK mocks and cleaning up module imports in data processing tests * 🔧 Test: Consolidate mock module setup for unstructured inference across multiple test files * 🔧 Test: Remove unused optional SDK mocks from test configuration * 🔧 Refactor: Clean up imports and enhance dynamic loading of fastmcp components in Docker client * 📦update:sdk dependence update * Add CAS SSO integration and improve logout handling (#3072) * feat: add CAS SSO integration * Skip CAS logout when CAS_LOGOUT_URL is unset * 取消转义 * Improve CAS logout handling and confirm user logout * Disable account deletion for CAS users * Add CAS session init SQL and k8s config * clean code * Remove agent guardrails design doc from tracking * 补充文档 --------- Co-authored-by: hhhhsc <name> * 🐛Bugfix: Remove unnecessary dependency exclusions and upgrade huggingface_hub version in pyproject.toml (#3211) * refactor: move current time from system prompt to user message for prompt cache stability (#3203) Remove {{time}} from all 4 prompt YAML templates (manager/managed × en/zh) and strip time_str from the context_utils pipeline (_format_app_context, build_skeleton_header_component, build_context_components, build_app_context_string). Also remove time from create_agent_info render kwargs and build_context_components call. In CoreAgent.run, prepend [Current time: ...] to self.task so the timestamp travels with the user message instead of being baked into the system prompt. This makes the rendered system prompt fully deterministic per (agent_id, tenant_id, version_no, language) — enabling prompt/KV cache hits across requests for the same agent config. Sync test_context_utils.py: drop time_str= from 3 test cases. Remove unused datetime imports from context_utils.py and create_agent_info.py. * 🐛 Bugfix: Fixed the issue of being unable to add MCP services via containerization. (#3213) [Specification Details] 1. Modify the DEFAULT_NETWORK_NAME when starting the MCP service in the container to match the name in docker-compose. 2. Modify the parameters passed to the add_mcp_service method; custom_headers defaults to None. * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. (#3219) * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. [Specification Details] 1. The return parameter of the file_process method has changed and needs to be unpacked. * 🐛 Bugfix: Fixed the issue where uploaded text files could not be parsed during a session. [Specification Details] 1. Modify test case. * 🐛 Bugfix: Fixed an issue where the MCP service could not be added correctly after updating the FastMCP version. (#3222) [Specification Details] 1. Add `kwargs` to the `create_httpx_client` function to accept all additional parameters. * 🐛 Bugfix: Fix incomplete display of tenant resources page after window resize (#3215) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Add agent marketplace repository and version pinning for sub-agents (#3239) * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat: add agent marketplace repository and pin sub-agent versions at publish Introduce ag_agent_repository_t with list/status/publish/import APIs for frozen agent snapshots. Pin selected_agent_version_no on agent relations when publishing so sub-agents resolve to a fixed version at runtime. Extend agent export/import to bundle skills in ZIP payloads and add embedding model fallback when no model name is provided. * feat(agent): add verification configuration for agents and update related components (#3174) * feat(agent): add verification configuration for agents and update related components * feat(model): update model type labels and add monitoring dashboard translations * 🐛 Bugfix: Fix inability to select agent from agent space to edit (#3240) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix inability to select agent from agent space to edit * Bugfix: Display correct version info when viewing agent details * Update data agent and ME CAS integration documentation (#3242) * 补充dataagent对接文档 * 补充ME cas对接文档 * 补充ME cas对接文档 --------- Co-authored-by: hhhhsc <name> * ✨ Add several northbound apis (#3223) * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * ✨ Add several northbound apis * refactor: simplify deployment script by removing unused variables and functions (#3245) * feat(agent): add verification configuration for agents and update related components * feat(model): update model type labels and add monitoring dashboard translations * refactor(build_offline_package): simplify deployment script by removing unused variables and functions * 🐛 Bugfix: Adjust agent detail UI layout to accommodate newly added "self-verification" field (#3246) * Move non-shadcn ui component to other folder * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix incomplete display of tenant resources page after window resize * Bugfix: Fix inability to select agent from agent space to edit * Bugfix: Display correct version info when viewing agent details * Bugfix: Adjust agent detail UI layout to accommodate newly added "self-verification" field * 补充sql (#3248) * 补充sql * 扩大limit限制 * 🐛 Bugfix: Fixed an issue where the MCP service failed to start in a Kubernetes container. (#3254) [Specification Details] 1. Modify the pod naming logic to convert all non-compliant characters to -. 2. Modify test cases. * 🐛 Bugfix: knowledge_base_search_tool called with TypeError: argument of type 'FieldInfo' is not iterable (#3259) * 🐛 Bugfix: Fixed an issue where the one-click rename function failed after importing an agent. (#3258) [Specification Details] 1. The frontend does not pass `agent_id` when calling the `regenerate_name` API. * Bugfix: Exclude attachments from assistant when saving conversation history (#3261) * Bump APP_VERSION from v2.2.0 to v2.2.1 (#3268) The default setting for client-side self-validation is "False". --------- Co-authored-by: chase <byzhangxin11@126.com> Co-authored-by: Chenlifeng <174292121+Lifeng-Chen@users.noreply.github.com> Co-authored-by: Dallas98 <40557804+Dallas98@users.noreply.github.com> Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com> Co-authored-by: Xia Yichen <iamjasonxia@126.com> Co-authored-by: JeffWu <45140512+jeffwu-1999@users.noreply.github.com> Co-authored-by: WMC001 <46217886+WMC001@users.noreply.github.com> Co-authored-by: xuyaqi <xuyaqist@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: DongJiBao2001 <120021235+DongJiBao2001@users.noreply.github.com> Co-authored-by: hhhhsc701 <56435672+hhhhsc701@users.noreply.github.com> Co-authored-by: Dallas98 <990259227@qq.com> Co-authored-by: frr <64584192+wuyuanfr@users.noreply.github.com> * Revert "Release/v2.2.1 (#3269)" (#3272) This reverts commit 9ff420e. * ✨ Feature: add agent repository page and APIs Introduce Agent Repository backend APIs, database/service support, frontend views, client services, and tests. Migrate Agent Space navigation and permissions to /agent-repository with updated SQL and localization. * ✨ Feature: add agent repository page and APIs Introduce Agent Repository backend APIs, database/service support, frontend views, client services, and tests. Migrate Agent Space navigation and permissions to /agent-repository with updated SQL and localization. * ✨ Feature: add agent repository page and APIs Introduce Agent Repository backend APIs, database/service support, frontend views, client services, and tests. Migrate Agent Space navigation and permissions to /agent-repository with updated SQL and localization. * ✨ Feature: add agent repository page and APIs Introduce Agent Repository backend APIs, database/service support, frontend views, client services, and tests. Migrate Agent Space navigation and permissions to /agent-repository with updated SQL and localization. * ✨ Feature: add agent repository page and APIs Introduce Agent Repository backend APIs, database/service support, frontend views, client services, and tests. Migrate Agent Space navigation and permissions to /agent-repository with updated SQL and localization. --------- Co-authored-by: panyehong <91180085+YehongPan@users.noreply.github.com> Co-authored-by: chase <byzhangxin11@126.com> Co-authored-by: Dallas98 <40557804+Dallas98@users.noreply.github.com> Co-authored-by: Jason Wang <56037774+JasonW404@users.noreply.github.com> Co-authored-by: Xia Yichen <iamjasonxia@126.com> Co-authored-by: JeffWu <45140512+jeffwu-1999@users.noreply.github.com> Co-authored-by: WMC001 <46217886+WMC001@users.noreply.github.com> Co-authored-by: xuyaqi <xuyaqist@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: DongJiBao2001 <120021235+DongJiBao2001@users.noreply.github.com> Co-authored-by: hhhhsc701 <56435672+hhhhsc701@users.noreply.github.com> Co-authored-by: Dallas98 <990259227@qq.com> Co-authored-by: frr <64584192+wuyuanfr@users.noreply.github.com>
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
事后审查补充：按已合入 diff 补充 5 条可行动 inline review comments。
| } | ||
| presigned_url = upload_result.get("presigned_url") | ||
| if presigned_url: | ||
| descriptor["presigned_url"] = presigned_url |
Member
There was a problem hiding this comment.
事后审查补充：[P1] 上传返回里直接暴露 presigned_url，会让调用方拿到可复用的对象访问 URL。北向 API 应返回 object_name/相对路径，下载时再按权限短期签发，避免 URL 被日志或客户端持久化。
影响：这个问题合入后会在对应部署、运行或权限场景中留下真实故障/安全风险，后续排查成本较高。
建议：沿着上述风险点补齐校验、配置来源、权限边界或回归测试，避免同类问题再次出现。
| } | ||
| # Add presigned_url if available, or generate one if we have object_name | ||
| if "presigned_url" in attachment: | ||
| normalized_file["presigned_url"] = attachment["presigned_url"] |
Member
There was a problem hiding this comment.
事后审查补充：[P1] dict 附件如果自带 presigned_url 会被直接信任并传入内部 minio_files，完全绕过下面 string 分支的 validate_urls_access。调用方可以把任意 URL 注入给模型/工具。
影响：这个问题合入后会在对应部署、运行或权限场景中留下真实故障/安全风险，后续排查成本较高。
建议：沿着上述风险点补齐校验、配置来源、权限边界或回归测试，避免同类问题再次出现。
| normalized_file["presigned_url"] = attachment["presigned_url"] | ||
| elif normalized_file.get("object_name"): | ||
| try: | ||
| presigned_result = get_file_url(object_name=normalized_file["object_name"], expires=86400) |
Member
There was a problem hiding this comment.
事后审查补充：[P2] 这里生成 86400 秒的 presigned URL，聊天请求中的附件 URL 会在一天内可复用。北向场景建议使用更短 TTL，并在每次下载时重新鉴权签发。
影响：这个问题合入后会在对应部署、运行或权限场景中留下真实故障/安全风险，后续排查成本较高。
建议：沿着上述风险点补齐校验、配置来源、权限边界或回归测试，避免同类问题再次出现。
| merged_params[param["name"]] = param.get("default") | ||
|
|
||
| if override_params: | ||
| merged_params.update(override_params) |
Member
There was a problem hiding this comment.
事后审查补充：[P1] tool_params 的 override_params 直接 update 到工具参数，没有校验 key 是否属于该工具 schema。北向调用者可以注入隐藏参数或覆盖内部字段；需要按工具声明白名单过滤。
影响：这个问题合入后会在对应部署、运行或权限场景中留下真实故障/安全风险，后续排查成本较高。
建议：沿着上述风险点补齐校验、配置来源、权限边界或回归测试，避免同类问题再次出现。
| if override_params and "document_paths" in override_params: | ||
| document_paths = override_params.get("document_paths") | ||
| # Also check using the tool name as key | ||
| if not document_paths: |
Member
There was a problem hiding this comment.
事后审查补充：[P1] if not document_paths 会把空列表当成“没有限制”，然后继续回退到 knowledge_base_search 覆盖或不加过滤。对访问控制来说空列表应表示不允许任何文档，不能等同 None。
影响：这个问题合入后会在对应部署、运行或权限场景中留下真实故障/安全风险，后续排查成本较高。
建议：沿着上述风险点补齐校验、配置来源、权限边界或回归测试，避免同类问题再次出现。
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
二次事后审查补充 1/5：单条独立 review submission。
| } | ||
| presigned_url = upload_result.get("presigned_url") | ||
| if presigned_url: | ||
| descriptor["presigned_url"] = presigned_url |
Member
There was a problem hiding this comment.
二次事后审查补充：[P1] 上传返回里直接暴露 presigned_url，会让调用方拿到可复用的对象访问 URL。北向 API 应返回 object_name/相对路径，下载时再按权限短期签发，避免 URL 被日志或客户端持久化。
影响：该问题合入后仍可能在真实部署、运行、权限或测试场景中形成回归风险。
建议：后续按这个风险点补齐边界校验、配置来源收敛、权限约束或针对性回归测试。
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
二次事后审查补充 2/5：单条独立 review submission。
| } | ||
| # Add presigned_url if available, or generate one if we have object_name | ||
| if "presigned_url" in attachment: | ||
| normalized_file["presigned_url"] = attachment["presigned_url"] |
Member
There was a problem hiding this comment.
二次事后审查补充：[P1] dict 附件如果自带 presigned_url 会被直接信任并传入内部 minio_files，完全绕过下面 string 分支的 validate_urls_access。调用方可以把任意 URL 注入给模型/工具。
影响：该问题合入后仍可能在真实部署、运行、权限或测试场景中形成回归风险。
建议：后续按这个风险点补齐边界校验、配置来源收敛、权限约束或针对性回归测试。
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
二次事后审查补充 3/5：单条独立 review submission。
| normalized_file["presigned_url"] = attachment["presigned_url"] | ||
| elif normalized_file.get("object_name"): | ||
| try: | ||
| presigned_result = get_file_url(object_name=normalized_file["object_name"], expires=86400) |
Member
There was a problem hiding this comment.
二次事后审查补充：[P2] 这里生成 86400 秒的 presigned URL，聊天请求中的附件 URL 会在一天内可复用。北向场景建议使用更短 TTL，并在每次下载时重新鉴权签发。
影响：该问题合入后仍可能在真实部署、运行、权限或测试场景中形成回归风险。
建议：后续按这个风险点补齐边界校验、配置来源收敛、权限约束或针对性回归测试。
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
二次事后审查补充 4/5：单条独立 review submission。
| merged_params[param["name"]] = param.get("default") | ||
|
|
||
| if override_params: | ||
| merged_params.update(override_params) |
Member
There was a problem hiding this comment.
二次事后审查补充：[P1] tool_params 的 override_params 直接 update 到工具参数，没有校验 key 是否属于该工具 schema。北向调用者可以注入隐藏参数或覆盖内部字段；需要按工具声明白名单过滤。
影响：该问题合入后仍可能在真实部署、运行、权限或测试场景中形成回归风险。
建议：后续按这个风险点补齐边界校验、配置来源收敛、权限约束或针对性回归测试。
Dallas98
reviewed
Jun 29, 2026
Dallas98
left a comment
Dallas98
left a comment
Member
There was a problem hiding this comment.
二次事后审查补充 5/5：单条独立 review submission。
| if override_params and "document_paths" in override_params: | ||
| document_paths = override_params.get("document_paths") | ||
| # Also check using the tool name as key | ||
| if not document_paths: |
Member
There was a problem hiding this comment.
二次事后审查补充：[P1] if not document_paths 会把空列表当成“没有限制”，然后继续回退到 knowledge_base_search 覆盖或不加过滤。对访问控制来说空列表应表示不允许任何文档，不能等同 None。
影响：该问题合入后仍可能在真实部署、运行、权限或测试场景中形成回归风险。
建议：后续按这个风险点补齐边界校验、配置来源收敛、权限约束或针对性回归测试。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ Add several northbound apis