Packages installed from the dashboard live in the image venv and disappear
when the container is recreated, while settings and indexes stay on the data
volume. Say so at startup, and bake the same extras into the manual FnOS
source image.
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply the remaining working-tree changes: connectors empty-state layout,
plus the knowledge, HITL, captcha, workspace, user-cache, and SSRF
adjustments with matching tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
files.document_path() keys the stored bytes on {doc_id}{suffix}, so a rename
that drops or swaps the extension moves the row off its own file: the
original-file route 404s, delete_document() unlinks the wrong key with
missing_ok=True and leaks the bytes, and re-saving an md/txt document
writes a second file. rename_document() now restores the document suffix
the way create_text_document() already normalises it; folders and names that
already carry the right extension are untouched.
Closes#1107
Co-authored-by: sxh313 <250161920+sxh313@users.noreply.github.com>
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Allow experts and skill packages to carry composer defaults so that
installed/created agents start with the author's chosen knowledge bases
and MCP servers. Defaults are persisted as agent profile columns and
validated against the installing user. Adds the per-user policy resource
table (migration 014) and wires the dashboard composer fields plus
locale strings.
- Add knowledge_base_ids and mcp_servers to the agent profile schema
- Validate KB/MCP ids on expert/skill-package install and create paths
- Persist defaults via migrate.py helper and 014_user_policy migration
- Surface composer default fields in the dashboard expert/skill UI
* feat(knowledge): include document path in citation markers
* feat(chat): in-chat preview for knowledge citations (#634)
Open Sources chips in a chat modal (rich with text fallback), show KB/path
in the tooltip, and deep-link View in knowledge base to the right folder.
* polish(chat): citation preview UX — tooltip, nav, download, path
Only show tooltip when nested path or truncation; match KB modal width
for markdown; hide download without original; prev/next + arrow keys;
scroll-to-top for long MD; resolve path/has_original from document list.
* polish(dashboard): open citation preview and expert file edit as right drawers
Align chat knowledge citation preview and expert workspace file edit with
the knowledge-base text editor: placement=right, shared width, footer actions.
* polish(chat): put knowledge base name inline in citation drawer title
Show filename · kbName on one line; keep nested folder path as the only subtitle.
* refactor(chat): open knowledge citations in the shared dock panel
Match “edited files” behavior: Sources chips open knowledge tabs in the
chat dock instead of a separate Ant Design drawer.
* fix(dashboard): keep nearby PDF pages mounted to avoid blank scroll canvases
Windowed react-pdf unmount/remount left blank pages while scrolling; keep
pages sticky around the current page and tighten citation dock flex height.
Parse more text and spreadsheet types, add optional local/remote OCR for images and scanned PDFs, and surface upload progress so indexing no longer appears stuck.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: minimal layout, user email, KB text docs, and remote desktop hub
Add classic/minimal chrome with a unified chat records host, optional user
email (invite/login), in-app markdown/txt knowledge editing, and a combined
remote desktop/phone control surface—plus host path and mobile setup hardening.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(host_dirs): don't jail host-root browse to home drive on Windows
The restrict_to_home=False case allows any absolute host path (no home
jail). On POSIX everything sits under '/'; on Windows the denylist is
empty and windows_neutralize_host_root rewrites root_dir '/' at runtime,
so a drive-relative '/' must stay allowed. The new _path_within_base
containment incorrectly rejected root_dir '/' on Windows when the checkout
drive differed from the home drive, breaking from-expert/local_shell agent
creation.
Also mark test_install_published_expert_accepts_create_options posix_only:
it relies on local_shell workspace file writes unsupported on Windows.
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: workspace backend sandboxing, execute-env injection, and ephemeral image refs
Workspace file-I/O hardening across backend and dashboard:
- Host directory sandboxing via root_dir allow-list and denied prefixes
- Execute-environment defaults injected into harness backend specs
- Ephemeral workspace image rematerialization for model calls
- Attachment hint expansion and inbound store improvements
- Portable memory backend and skill workspace catalog updates
- Dashboard UI for agent backend fields and root-dir selection
- Bump harness-agent 0.9.23 / harness-memory 0.9.7; docs + install notes
* feat: add user invitation codes with admin management and redeem flow
- Add user_invites table (migration 009) plus SQLite/Postgres reconcile paths
- Add InviteRepo and InviteService for create/revoke/list/redeem
- Expose public validate/redeem endpoints and admin create/revoke/list routers
- Extract default-agent bootstrap into octop.infra.agents.default_agent
- Add invite error codes and en/zh i18n strings
- Dashboard: invite drawer, login redeem UI, users list, and locales
* fix: add Windows cross-platform guards for pre-existing sandbox/rootfs tests
- Guard POSIX/container-only tests (rootfs-absolute /.octop/... workspace
paths) with posix_only in test_thread_artifacts.py and test_agent_manager.py
- Normalize the rendered workspace path assertion in test_octop_builtin_skills.py
(forward slashes on Windows, not str(tmp_path) backslashes)
- Canonicalize ws_dir before the prefix check in attachment hint/path tests
(tempfile may yield an 8.3 short path on Windows while the resolved
attachment path uses the long form)
These failures predate the user-invites commit and are unrelated to it; the
product path logic is correct.
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
* fix: inject Admin env into running agents and sum turn token usage
Running shells and Docker sandboxes now pick up ~/.octop/env (and workspace .env) without a full reload; MCP stdio no longer inherits the entire host environment. Usage accounting adds every model call in the turn, and workspace I/O survives the harness rebuild window.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: schema v7 identity, expert profiles, chat artifacts, and KB citations (#346)
* feat: schema v7 identity, expert profiles, chat artifacts, and KB citations
Fold integer PKs plus public string ids, document folders, agent profile columns, and thread artifacts into v7 SQL (not only Python helpers). Experts get workspace avatars and a single welcome_message; chat keeps file changes across sessions, shows knowledge citations, and can drag workspace files.
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: drop cron JobDrawer UX from the schema v7 PR
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: prefer tool-arg paths when recording chat artifacts
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: add per-user module permissions (RBAC) with admin bypass
Introduce a module-level permission system so non-admin users can be
scoped to a subset of dashboard modules. Adds a `permissions` TEXT column
on the `users` table (migration 006, SQLite + PostgreSQL), a central
permission catalog in `infra/users/permissions.py`, backend ACL checks
across routers, and dashboard gating via `RequirePermission` /
`ForbiddenPage` keyed by nav module. `admin` always bypasses every gate;
read access and chat/agent use are never gated.
* fix: gate connector install-cli by connectors permission (not admin-only)
The host CLI installer is a connectors-module operation and should be
gated by the `connectors` module permission, consistent with the rest of
the connector routes, instead of being admin-only.
The earlier RBAC change demoted this route from `current_admin` but the
test `test_install_cli_forbidden_for_non_admin` still failed because the
`create_user` test helper grants `BASELINE_PERMISSIONS` (which includes
`connectors`) by default, so the "non-admin" user actually held the
permission. Gate the route with `require_permission("connectors")` and
create the test user with `permissions=[]` so it genuinely lacks the
key and is rejected with 403.
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Introduce document indexing, embedding (ONNX/remote), and chat/IM injection with default-open selection in the dashboard composer.
Co-authored-by: Cursor <cursoragent@cursor.com>
