| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(release): one-line install, self-update, AI review, share/import, inline shell Round 7 closes the distribution and collaboration gaps in docs/competitive-comparison.md that were still marked as missing: Distribution - scripts/install.sh + install.ps1: resolve latest release, verify SHA256SUMS (abort on mismatch or missing), install to a user dir, no sudo, supports SPARK_VERSION / SPARK_MIRROR / SPARK_INSTALL_DIR - src/spark/updater.py + spark update [--check|--force]: https-only download, SHA256 verification, atomic replace with *.old rollback, 24h cached check in spark doctor, [updater] mode = "off" opt-out - release.yml now emits SHA256SUMS and the desktop bundle, and smoke-tests the built binary; ci.yml gains a packaging job (installer syntax, version, assets) Workflow - spark exec --json: NDJSON event stream, final line {"type":"final"} - spark review: AI diff review in a forced read-only sandbox turn, severity ranked, --json for CI, exit 2 on high findings - !cmd inline shell in the web composer, rendered as a local card; output never enters the model context - session share as a self-contained HTML file (escaped, no local paths or ids) and session import from the exported JSON - desktop notifications for turn end / pending approval (opt-in) - Ctrl+Alt+M cycles model profiles; small_model now drives title generation Fixes found by live testing - SettingsModal declared hooks after if (!cfg) return -> React #310 white screen on first paint; hoisted - Header responsive hidden lost to IconButton's own inline-flex -> all nine buttons rendered at 390px, title collapsed to 0 width; wrapped in spans - review diff_stats parsed git diff --shortstat by suffix, crashing on the word "insertions"; now regex based - review JSON parsing now skips model preamble instead of degrading to summary - share export leaked the absolute workdir and session id - archive extraction now rejects traversal and symlink members (bandit B202) Docs: README/README_zh rewritten around the six surfaces and the new workflow, INSTALL covers one-line install and update, the competitive matrix is synced, and docs/reviews/2026-10-22-full-audit.md records round 7 with honest limits. Duplicate docs/CONFIGURATION.md merged into docs/CONFIG.md and removed. Gates: 1086 passed / 5 skipped, coverage 78% (floor 75%), ruff, mypy (102 files), bandit 0/0, import-linter 5 kept, tsc + vite build, OpenAPI snapshot fresh. Live-verified against a real endpoint: exec --json and review. AQG ledger: .aqg/code-construction/round7-distribution-benchmark.md | 22 天前 | |
docs: 收官归档——三张架构图表 + 评估报告 PDF + 密钥运维手册 + 锚点终态 - docs/assets/diagrams/: 分层架构 / 五平台发布矩阵 / P0-P5 路线图（SVG，可视图） - docs/reviews/2026-10-17-architecture-review-report.pdf: 全量走查评估报告归档 - docs/diagrams-ops.md: 密钥安放说明（Actions Secrets）+ 流水线清单 + 发版 SOP + 镜像纪律 - mkdocs.yml/README_zh: 图表与运维页接入导航 - session-digest: 终态更新（v0.9.6 基线 + 接续清单） | 28 天前 | |
docs(reviews): 全量采纳决议 + 横向扩展地图 H1-H18 + 里程碑扩为 P0-P5 - master plan §5.5: 18 项已有功能的横向扩展地图（先例已核实，每项标注我们改什么） - master plan §10: P3=信任链+AEF 标准，P4=横向扩展全量（含 IM 网关/Creator mode/ MCP 沙箱运行时/团队记忆 MR 化/上下文火焰图/工作流影子重放），P5=AEF 推广+合规包 - 方向文档 §6: 全量采纳决议 + 扩展≠照抄原则 + 真空白清单 | 28 天前 | |
docs(plan): 回写 P0-P5 执行现状，标记未做项不粉饰 只标记本地已验证完成的项；P3/P4/P5 明确写「未开始」，不把规划当成果。 附四条本轮踩到的关键事实：LiteLLM/mcp 版本门、测试有效性必须靠变异测试、 分层防护会让单测失去分辨力、状态接口不能联网。 | 25 天前 | |
docs: 收官归档——三张架构图表 + 评估报告 PDF + 密钥运维手册 + 锚点终态 - docs/assets/diagrams/: 分层架构 / 五平台发布矩阵 / P0-P5 路线图（SVG，可视图） - docs/reviews/2026-10-17-architecture-review-report.pdf: 全量走查评估报告归档 - docs/diagrams-ops.md: 密钥安放说明（Actions Secrets）+ 流水线清单 + 发版 SOP + 镜像纪律 - mkdocs.yml/README_zh: 图表与运维页接入导航 - session-digest: 终态更新（v0.9.6 基线 + 接续清单） | 28 天前 | |
feat(web): unify confirm dialogs, honest execution graph, and hermetic tests Frontend - Add ConfirmDialog (uiStore.requestConfirm) replacing three native window.confirm calls (delete message / command / skill): consistent styling on mobile and WebView, controllable keyboard focus, Esc to cancel. - ExecutionGraph: drop the static sample-data fallback and the stale 'no structured events yet' comment; show an honest empty state when no live turn exists. Remove unused graph.sample.* / graph.edge.delegate keys. - Fix the broken lint toolchain: eslint was missing from devDependencies, had no config, and the script used the --ext flag removed in eslint 9. Add eslint 9 flat config (typescript-eslint + react-hooks), fix the one real exhaustive-deps issue found, lint now runs clean. - Add a frontend job to CI: install, lint, tsc+vite build, and byte-compare the committed dist against a fresh build (guards silent dist drift). Backend & tests - Make the SSRF whitelist tests hermetic: stub getaddrinfo with fixed public A records instead of live DNS, which failed on any network with DNS interception (VPN / corporate proxy / domestic GitHub access). - Await the 12 *_conn.close() calls in test_acp_server.py (both acp Connection.close methods are coroutines; previously the sockets leaked and pytest emitted RuntimeWarnings). - Finish LF normalization: README / CHANGELOG / review docs / build_promo.py and dist html/svg were committed with CRLF, making the tree permanently dirty after any build; convert them to LF, dist is now byte-identical after rebuild. Verification: 1087 passed, 5 skipped, coverage 78.32% (gate 75%); ruff/mypy/lint-imports/bandit clean; web lint/tsc/build clean. | 21 天前 | |
feat(a2a): speak the agent-to-agent standard; ecosystem audit 2026-11-04 spark now covers every valuable boundary protocol: * MCP client+server (agent-to-tool) — existing * ACP (editor-to-agent, Zed) — existing * A2A server (agent-to-agent, Linux Foundation) — NEW: spark a2a-serve serves the Agent Card (/.well-known/agent-card.json), message/send (non-streaming turn + text artifact), tasks/get and ping over JSON-RPC 2.0/HTTP. Per-contextId sessions (LRU 64), undeclared capabilities rejected per spec so clients fall back to message/send. AG-UI is a documented non-goal: our own SSE web protocol already carries the same semantics. Also in here: * docs/reviews/2026-11-04-ecosystem-audit.md — end-to-end verification log (CLI 16 / Web 4 / MCP handshake / A2A 9 / local onefile EXE), protocol landscape (MCP/A2A/AG-UI/ANP), learnings mapped from 12 peer projects (opencode, codex, Claude Code, aider, gemini-cli, goose, cline, kilocode, Zed, Warp, Muse, Continue), and 7 critical findings with evidence (one retracted after re-check). * README/README_zh: seven surfaces, scoop badge, protocol wording; version 0.11.0; uv.lock resync (langgraph-sdk refresh). | 11 天前 | |
docs+release: v0.13.0 — record the ecosystem audit, gate version drift - New docs/reviews/2026-11-07-ecosystem-audit.md: what 11 comparable coding agents actually ship, split into already-have / added-this-round / deliberately-not-doing with the reason for each refusal. The refusals matter: browser control, LSP subprocesses, cloud sandboxes and PR workflows are positioning decisions, not backlog, and should not be re-litigated. - REMAINING + competitive matrix close out Repo Wiki; FEATURES gains its row. - Version bumped to 0.13.0 across pyproject and the VS Code extension. - New tests/test_version_consistency.py: pyproject, installed metadata, the VSIX manifest, the CHANGELOG and the MCP serverInfo must agree. Without it a stale editable install silently reported 0.12.0 from a 0.13.0 tree. | 8 天前 |