ba5785036a
feat: 设备鉴权迁移至客户端 + 插件卸载保护
...
安全修复(客户端鉴权):
- remotedevice 服务端移除授权状态存储(authorized map/SetAuthorized/handleDeviceAuth)
- DeviceMeta.Authorized 改为设备 hello 自报,服务端仅透传展示
- device_ctl_* 工具移除服务端授权检查,无条件转发,设备端自行决定是否执行
- 共享设备桥库 Bridge 新增本地 authorized 状态,未授权收到 cmd 直接拒绝
- waiter: --device-authorized / device_authorized 配置控制本地授权
- GUI: 授权存 gui-prefs 本地文件;设备页仅本机可切换开关
- webui /device/auth 旧路径返回 410 Gone
- 根因:agent 可经 config_set 篡改服务端授权配置自行授权设备
插件管理强化:
- 内置插件禁止卸载(IsBuiltinPlugin + 409),外部插件卸载即时生效
- 卸载不存在插件返回 404;移除误导性 reload_required 提示
- webui 插件路由:名称白名单校验防路径穿越、保留字路径保护
2026-08-24 19:26:11 +08:00
5163ce51a7
feat: SSE Last-Event-ID 断线重放 + GUI 表单防刷新
...
- webui handler: 新增 sseEventRing 环状缓冲区(200条),断线重连按 Last-Event-ID 重放遗漏事件
- GUI app.js: doRenderAll 检测连接表单打开时改走 refreshDataOnly,修复 15s 定时器擦掉用户输入的 bug
- 附带 dashboard.html/index.html 前端调整 + handler_sse_test.go 单测
2026-08-24 16:22:28 +08:00
8d368913a9
feat: webui 消息重放双重防护(client_msg_id 去重 + agent 内容级去重)
...
回应群聊 08-19 消息轰炸诊断(GUI SSE 重连导致消息重放):
1. webui 层 client_msg_id 单飞去重(与 GUI c29abe9 配套):
- /api/v1/chat 解析 client_msg_id, 同 ID 重放等待首次结果直接复用
- 响应带 deduplicated=true 标记; 无 ID 旧客户端完全兼容
- FIFO 缓存上限 256 条防泄漏
2. agent 核心层内容级短窗口去重(兜底无 ID 客户端):
- isDuplicateInput: source+content 为 key, 10s 窗口内重复丢弃
- 持续轰炸时刷新时间戳保持拦截; 过期项自动清理
测试: webui 去重三场景 + agent 核心去重行为验证, 全项目 go test 通过
2026-08-21 10:23:38 +08:00
768c73889e
feat: webui chat 接口支持设备身份(device_id/device_name)
...
- handleChat body 增加 device_id/device_name 可选字段
- 来源编码: 带设备时 webui/{device_id}(agent 可见来源), 无设备保持 webui(兼容)
- injectSourceContext: 检测 device_id 时注入「当前输入来自设备[名](id)」上下文
- 验证: 带 device_id=gui-pc-002 消息 agent 正确回答来源客厅电脑; 无 device_id 兼容
2026-08-18 11:49:57 +08:00
707a01a2dd
fix: SSE 心跳直接写 w+flush(事件密集/队列满仍保活长连接)
...
- 原心跳经 writeCh 发送, 事件密集时队列满被 drop, 远程 nginx 网关长时间无字节导致 504/半开
- 改为主循环直接 Fprintf(w, ": heartbeat\n\n") + Flush, 绕过 writeCh, 保证 15s 恒有心跳
- 对应 pi-desktop: GUI 回复丢失(SSE 3分钟被 ERR_INCOMPLETE_CHUNKED_ENCODING 切断)
2026-08-18 09:12:52 +08:00
b2156a0987
fix: webui 设备网关 WS 反代改用 net.Dial 手动升级握手
...
- 之前 http.DefaultClient/Transport 不支持 ws:// scheme 与 101 升级, WS 经反代返回 502
- 改为 net.Dial 直连网关 + 手动构造 WS 升级请求(X-API-Key 注入) + http.ReadResponse 读 101
- hijack 后双向字节透传(WS 帧不动), 客户端->上游/上游->客户端
- 实测: 经 webui:8080/api/v1/device/ws 反代, 101 握手成功, 网关 Sec-Websocket-Accept 正确
- 对应 pi-desktop 排查记录: 远程 WS 设备通道现在可经远程 homed 使用
2026-08-17 18:16:57 +08:00
dd60f41aa1
feat: webui 设备网关 WS 反代(hijack 双向透传) + GUI 设备页本机卡片始终显示
...
- handleDeviceGatewayProxy: 识别 Upgrade:websocket 请求, 用 http.Transport(保留升级连接)
+ hijack 双向字节透传, 支持远程 homed 的 WS 设备通道(REST 已可用, WS 之前被 DefaultClient 卡死)
- renderDevices: 本机 GUI 设备卡片不再被 conn.type!=='device' 挡住,
由 gui-prefs 的 deviceBridge 驱动(独立于连接), renderInit 从 device-bridge:get 拉取本机身份
- 对应 pi-desktop 排查记录(WS 反代不可用/本机卡片被挡)修复
2026-08-17 18:02:16 +08:00
ef5f010e87
device gateway: remotedevice 插件(设备接入网关) + GUI/waiter 受控设备桥 + 设备页/授权开关/托盘/退出进托盘 + 白屏修复(惰性Tray) + deviceinfo 工具
2026-08-17 09:34:25 +08:00
c52331cd5e
gui+webui: 聊天界面升级(PiDeck风格思考/工具卡片+滴入动画) & 流式卡顿修复(防抖局部增量渲染) & 主题系统修复(启动恢复色板/弹窗溢出wrap)
2026-08-16 09:57:29 +08:00
1bc2bf5d8d
fix: WebUI 配置数字科学计数法 + 增强输出通道引导提示词
...
- webui settings PUT: 整数型 float64(如 QQ 号)规范化为 int64 存储,
避免 fmt.Sprint 以科学计数法(2.198972886e+09)存库导致读取解析失败
- 系统提示词【输出规则】重写: 明确消息不会自动路由,
区分同步通道(直接返回文本)与异步通道(必须调用 output_send__{通道}),
引导模型优先回复当前输入通道并带正确 meta(user_id/group_id)
2026-08-15 17:24:14 +08:00
c820280f16
webui: 多色板主题与外观弹层(主题色/背景图/模糊)
2026-08-14 16:15:24 +08:00
76d86d4dba
fix: webui 聊天面板打开时定位到最新消息(switchTab/渲染签名命中分支/图片加载后均强制滚底)
2026-08-14 12:38:24 +08:00
d3bd4c2fe6
fix: output_send 气泡时序(chatFinalIdx 插入)与 channel_output 后流式丢失
2026-08-14 00:58:41 +08:00
147d0baaf9
fix: LLM 工具循环 400、中断消息注入、ConPTY 终端支持
...
- agent: 工具轮请求尾部补 user 占位(zen 网关强制),tool 消息正确配对
- agent: 工具提醒/中断以 system 角色注入并带 [中断消息] 前缀,不进用户履历;系统提示词说明中断消息格式
- agentcli: 基于 ConPTY 的交互式终端(ptywin fork),terminal_create/read/write/resize/close/watch
- webui: server 输出通道适配器(保留 reasoning_content/disable_thinking)
- GUI: 沉浸式标题栏、icon 圆角重制、mascot 等打磨
2026-08-14 00:48:40 +08:00
816597caac
fix: WebUI and handler bug fixes
...
Backend:
- handleChat/handleOpenAICompletions: added 60s timeout via context.WithTimeout
- handleAgents POST: added config.Put() to persist agent config
- handleKnowledge GET: fixed error handling (was swallowing Search errors)
- addChatMsg: reduced persistence to latest 50 messages (was 200)
- SSE: added Last-Event-ID parsing for reconnection support
Frontend:
- api(): added HTTP status code checking (throw on non-ok responses)
- setInterval(renderAll, 15000): replaced with smartRefresh() that only refreshes data and redraws active non-form tabs
- Added btn-warning/btn-success CSS classes
- SSE: fixed reconnection防叠加 in onerror handler
Tests: all passing
2026-08-13 10:18:53 +08:00
cd2a27a8cc
webui: 修复 '删除源/服务器' 只置 <nil> 不真删的问题
...
前端 deleteSource/deleteMCPServer 通过 PUT value:null 删除,但后端 handleSettings
PUT 只 SetCore/SetPlugin(fmt.Sprint(nil) → 字面 '<nil>'),导致 core.llm.sources.<name>.*
等键残留不可达的 <nil> 行,污染 LLM 源与探活。
- SettingsAPI 新增 RemoveCore/RemovePlugin;settingsImpl 接入 ConfigRegistry.Delete
- webui handleSettings PUT:body.Value==null 时改走删除分支(核心表/插件表均适配)
- 现状验证:mocktest.* 残留已从本机 config.db 清除,sources=3,无无效源
2026-08-10 09:35:29 +08:00
da1a3cc1fa
webui 测试修复:先 RegisterDef 建插件配置表再 Set,修复 AuthMiddleware 全 503
2026-08-05 10:00:05 +08:00
c7ee45d6e1
refactor: remove core skill direct loading, skills owned by clawhubadapter only
...
- Drop skill.NewManager from homed bootstrap; skills dir no longer core-managed
- Remove GetInjectedPrompt system-prompt injection (skills are not first-class)
- Delete internal/skill package, SkillAPI, webui /api/v1/skills, status skills block
- ConfigRegistry: plugin config tables now created only via RegisterDef; arbitrary
scope Set/Get no longer implicitly creates config_<name> tables (fixes stray
config_today_task table from SKILL directory name being used as a scope)
2026-08-02 11:40:13 +08:00
1013aa0aa9
feat(sdk): add RegisterStopHandler/RunStopHandlers and wire stop cleanup into registry lifecycle
...
- SDK PluginSDK gains RegisterStopHandler(fn func()) + RunStopHandlers()
(LIFO, idempotent, cleared after running); synced to third_party copy
- Registry keeps per-plugin SDK refs (sdkRefs); StopAll/ReloadOne/
DisablePlugin run handlers before calling Stop()
- timer built-in plugin demonstrates handler-based shutdown cleanup
- z_bridge (linux/windows templates) runs handlers before plugin.Stop()
2026-08-02 10:23:40 +08:00
94312d714a
fix(webui): capture all-channel chat history and correct input source
...
- handleChat now injects with source=webui so the LLM no longer sees
cli as the input channel
- subscribe to EventRawInput/EventAgentOutput to persist every
conversation turn from all channels (cli/qq/webui), replacing the
manual webui-only addChatMsg to avoid duplicates
- ChatMsg gains a source field; GUI shows a channel badge for
non-webui messages
2026-08-01 14:06:18 +08:00
dbbd73b930
refactor: migrate built-in plugins to SDK-only interface
...
- Six-phase plan complete: webui/cli/healthcheck/pluginmgr/clawhubadapter
now interact with the kernel exclusively via internal/sdk interfaces;
all Configure() calls and package-level global injection removed
- buildSDK in internal/plugin/registry.go is the single assembly point
- Add internal/sdk/events.go exporting event types/constants
- Fix ProviderManager cooldown sharing: LuaAdaptedProvider.Name() now
returns the source name instead of lua_<adapter>, so multiple sources
sharing an adapter (single script load via shared VM AdapterCache) no
longer share failure-cooldown state
- Verified: build/vet/tests green, deployed to homeagent.service with
full plugin capability testing via local OpenAI-compatible mock
2026-08-01 12:17:17 +08:00
796a48dae5
plugin disable system: kernel→SDK PluginManager + WebUI/CLI
...
- New disabled_plugins table (name, disabled_at, disabled_by)
- SDK.PluginManager interface: DisablePlugin/EnablePlugin/ListDisabledPlugins
- Registry implements PluginManager, wired into PluginSDK
- WebUI: POST /api/v1/plugins/<name>/disable|enable + plugins page with toggle
- Disabling webui shows confirmation dialog
- CLI: /plugin disable <name> / /plugin enable <name>
- pluginmgr removePlugin sync-cleanup from disabled_plugins table
2026-07-29 15:07:32 +08:00
a899d777c3
sdk: embed non-toolchain SDK in third_party, add NoMemory/Cleaner support
...
- Embed sdk/, example/, meta/, go.mod from homeagent-sdk (no .git)
- Core .gitignore excludes SDK toolchain: bin/, tools/, package/
- RegisterInputChannel + ChannelDef(NoMemory, Cleaner) in SDK
- IOManager input channel registry with GetInputChannelDef
- eventloop: apply channel Cleaner/NoMemory to interrupt text
- context engine: channelDefLookup applied in textForVector
- document store: ChannelCleaner param for archive functions
- All callers/adapters updated with ChannelDef{} default
2026-07-29 14:48:23 +08:00
f91b20ee16
v0.7.3: 重构 Provider 层 + 计算层隔离 + Cleaner/NoMemory 架构
...
- 删除 OpenAIProvider/OllamaProvider 死代码,LuaAdaptedProvider 独存
- DisableThinking 从 ExtraBody 移到 CompletionRequest 顶层字段
- ContextWindow 从 Provider 签名移到 BaseConfig/ModelContextWindow() 统管
- 确认 CleanText 仅做基本空白 trim,QQ 模板剥离归插件 Cleaner
- Cleaner/NoMemory 仅作用于向量计算和 jieba 分词层,原文不变
- context.ContextEvent/Doc.Content 始终保存原文
- 删除 nlp/download.go 死代码
- media.go: context.Background() -> a.ctx 级联
- clawhubadapter: HTTP 超时
- cut.go: 跨平台 mod cache 路径 (GOMODCACHE->GOPATH->HomeDir)
- bridge_e2e_test: 移除未用 runtime import
- lua 适配器: disable_thinking 传参
2026-07-28 11:42:29 +08:00
1cb3e87dde
feat: 完整实现 NLP 三元组提取系统 + token budget 上下文分配
...
- 重写 extractor.go: 分句、17条 POS 模板、依存模板 + COO 链、ATT合并
- parser.go: 分句循环 + TransE 向量验证(h+r≈t)
- fallback.go: jieba POS 降级解析器
- bridge.go: nlp.Triple ↔ memory.Triple 转换
- pipeline.go: extractKeyTriples 改用 NLP 提取器, 删除5条旧前缀规则
- distill.go: docToTriples 改用 NLP 提取器
- reorgGraph: 语义相似度增强检测, 保持纯 LLM 决断
- Provider 接口加 MaxContextTokens() + 模型窗口映射表
- tokenbudget.go: 中文 token 估算器 + budget 分配(80%利用率)
- process.go/buildSystemPrompt: 按 token 预算截断 memory+timeline
2026-07-27 15:26:23 +08:00
634c3ff4ad
fix: doc_query chronological insert, register cli/webui output channels
...
- context.go: add InsertByTimestamp for chronological context insertion
- toolcall.go: doc_query uses InsertByTimestamp instead of Append
- agent_tools_test.go: update tests to use payload/type keys
- cli/plugin.go: register output_send__cli channel
- webui/plugin.go: register output_send__webui channel
2026-07-25 16:25:06 +08:00
7609c39191
fix(webui,gui): terminal/cmd count badge ID mismatch
2026-07-19 14:52:17 +08:00
24698e7c82
fix: include openclaw manager/pysimulator sources, remove from gitignore
...
manager/main.js, pysimulator/main.py, and simulator/main.js are
production source files for the OpenClaw sidecar system, not build
artifacts. Remove them from .gitignore so fresh clones can make build
without manual stub creation.
2026-07-19 11:07:18 +08:00
10638f1308
feat: mascot integration - WebUI/GUI icons, chat avatar, system prompt, docs
2026-07-17 21:41:03 +08:00
7f28b997e6
feat: output channel redesign - per-channel output gates, LLM chain events, SDKConfig
...
- Output channels generate per-channel tools: output_send__{name} (type=output) + output_send__{name}_help
- content is JSON string transparently passed to plugin handler for routing
- EventAgentLLMChain: full LLM response forwarded after each turn for webui/logs
- sdk.New refactored to SDKConfig struct (no more 13 positional args)
- RegisterOutputChannel adds desc param for JSON format documentation
- channelDevice simplified (no Tools method), desc field added
- Child agent permission updated for output_send__ prefix
- System prompt: output gates, multi-call, long messages split
- WebUI: subscribes to EventAgentLLMChain in SSE, no output channel
- Tests updated for new naming convention
2026-07-16 12:11:16 +08:00
c7e22fbe30
refactor: move webui.listen_addr from core.daemon to webui category
2026-07-14 11:22:46 +08:00
950090959f
feat: restructure plugin system, add Lua plugin support, update docs
2026-07-13 21:48:13 +08:00
1f1233b823
refactor: P0-P3 fixes, C1 cleanup, architecture diagrams, go.work upgrade
...
- P0-1: ProviderError type + ReportStatus for precise 401/403 detection
- P0-2: Remove -config flag from deploy/homeagent.service
- P2-1: 5s debounce on context.go Save()
- P2-2→C1: Delete output_set_channel entirely
- P2-3: Extract mediaDataURL/mediaChat helpers
- P2-4: Dedup defaultSources var
- P3: Delete dead packages (embed/tokenizer/container/snapshot)
- P3: Delete dead functions (messagesToMap, RunStageAll)
- CL: Update .gitignore, docs, Makefile, gojieba removal
- Config: Delete config/config.yaml, update docs
- Arch: Remove EmitOutputTo from emitResponse
- CL-1: go.work 1.19→1.21
- Docs: Add Mermaid architecture diagrams to README
- Docs: Add kernel-rebuild requires plugin-rebuild note to PLUGIN_DEV.md
2026-07-12 11:42:56 +08:00
b664360f61
test: cover WebUI auth flows and bootstrap credentials
...
- add auth middleware tests for API key, login, and root redirect
- auto-bootstrap admin username/password and API key when unset
- add logout control to dashboard and cookie-aware client behavior
2026-07-06 21:43:49 +08:00
3513912290
feat: add API key and login authentication to WebUI
...
- protect API routes with API key or authenticated session
- add /login page and /api/v1/login, /api/v1/logout endpoints
- gate dashboard behind session cookie
- auto-bootstrap webui username/password/api_key if unset
- add logout action to dashboard and cookie-aware API client
2026-07-06 21:40:44 +08:00
eb55a8fb98
feat: expand local operator controls across CLI and WebUI
...
- Add structured CLI commands for status/kernel/settings/plugins/memory/knowledge/agents
- Inject core dependencies directly into CLI plugin for non-HTTP operator workflows
- Add plugin management panel and API proxy endpoints to WebUI
- Let cmd_run inherit default workdir from core.agent.workdir
- Use fixed loopback address for pluginmgr API
- Remove stale MaxToolTurns config usage from homed wiring
2026-07-06 20:32:04 +08:00
8cec92d947
feat: 路径配置化 + 裸二进制启动 + pluginmgr 内置插件
...
- types.go: 新增 PluginDirConfig 结构体嵌入 Config
- config/registry.go: 新增7个路径配置项 (core.plugin.dir 等) + ConfigDef 元数据
- cmd/homed/main.go: -data 默认自动检测二进制同级目录,使用 cfg.Plugin.Dir
- internal/plugins/pluginmgr/: 内置插件实现 (4工具 + HTTP API + 包校验)
- all.go: 注册 pluginmgr
- manifest.go: 扩展 PluginManifest 字段
- sdk/settings.go: RegisterDef / Defs 接口
- webui: 设置页自动发现 ConfigDef 元数据
- config/config.go, config/config.yaml: 清理 YAML 死代码
- sdk/plugin.go: IO 通道泛型化支持非文本类型
- waiter: CLI 支持 socket 发现和交互模式
2026-07-04 16:56:32 +08:00
fab58e709a
feat: complete P0/P1/P2 — WebUI SPA, OpenClaw sidecar+simulator, healthcheck auto-sched+perf
...
P0: WebUI重构
- 完整 SPA 仪表盘 (7标签页), //go:embed dashboard.html
P1: OpenClaw兼容 (三通道: SKILL.md / sidecar / simulator)
- Node.js 模拟进程统一加载任意 OpenClaw 插件
- JSON-RPC 2.0 over stdio 协议, go:embed 内嵌
P2: Healthcheck 优化
- 定时自动执行 (startAutoCheck, 30min)
- healthcheck_perf 性能监控工具
其他: agentcli/cmd 插件, integration_test, status.go,
test_deepseek 清理, 多项 bug 修复
2026-07-04 12:51:32 +08:00
d4956c23f0
feat: OpenAI 兼容端点完整实现 + reasoning_content 输出通道
...
- StageContext 新增 ReasoningContent + TokenUsage 字段
- emitResponse 将 reasoning_content / usage 传入 Payload
- /v1/chat/completions:
- 非流式返回 reasoning_content + token_usage
- 流式 (stream=true) SSE 分块返回 reasoning/content/finish chunk
- token_usage 来自精确 LLM 回报而非估算
2026-07-03 20:49:43 +08:00
239a22899b
fix: 模型思考模式配置 + Unicode 截断 + 审计修复 (13 files)
...
模型模式:
- 新增 LLMConfig/Source.ThinkingEnabled 配置,通过 ExtraBody
控制 DeepSeek thinking mode,默认关闭
- SeedDefaults/ToConfig 读写 core.llm.thinking_enabled
- deepseek.lua 移除硬编码 temperature=0
Unicode 截断:
- truncateStr 改按 rune 计数,修复中文截断乱码
审计修复 (Critical):
- graph.go: defer rows.Close 在 for 循环 → 显式 Close (连接池泄漏)
- cli/openclaw/plugin.go: bare type assertion → comma-ok (panic)
- channel.go: payload["type"].(string) → comma-ok (panic)
- webui/handler.go: .(string) → fmt.Sprint (panic)
- agent.go: 添加 nil provider 错误返回
审计修复 (High):
- events/bus.go: copy handler slice under RLock (data race)
- webui/handler.go: SSE 通过 channel 串行化写入 (data race)
- timer/plugin.go: time.Sleep → select with stopCh (Stop 阻塞)
- provider.go: stream ch <- 添加 select ctx.Done (goroutine 泄漏)
- main.go: outputCh goroutine 添加 ctx.Done 退出路径
2026-07-03 20:46:04 +08:00
2d314b3e9c
重构: 插件自注册 + .so 动态加载 + 中断打断机制
...
- 所有内置插件 init() 自注册 (plugin.RegisterFactory), 移除 main.go 硬编码
- 新增 .so 动态加载器 (internal/plugin/dynamic.go), 插件可编译为 plugin.so
- 新增 plugin.json 元数据 (internal/plugin/manifest.go)
- 新增 interceptLoop 独立 goroutine:
(a) cancelLLM() 取消进行中的 HTTP 请求
(b) interceptCh → drainInterrupt() 注入 [打断消息] 到 LLM 上下文
(c) InjectInput 空闲时触发新处理循环
- 新增 internal/plugins/all.go 空白导入触发所有内置插件 init()
- internal/sdk/ 作为 PluginSDK 正式 Go API
- internal/api/ → internal/plugins/webui/ 迁移
- 删除旧 cmd/cli/, 使用 cmd/waiter/ 替代
- 更新 PLAN.md / ARCHITECTURE.md / README.md 文档
2026-07-03 16:53:34 +08:00