| refactor(web): redesign assistant management UI (#1816) * refactor(web): redesign assistant management UI * fix(web): treat permission control preference as optional * feat(web): make assistant avatars editable * fix(desktop): keep assistant identity writes local * feat(web): add panda wink hover animation | 2 个月前 |
| fix(git): recover untrusted repositories via trust consent Git (since 2.35.2) and libgit2 refuse to operate on a repository whose directory owner differs from the current user unless its root is listed in safe.directory. BitFun surfaced that guard as an opaque command failure, so read-only flows such as Review looked indistinguishable from "not a repository" and blocked operations had no recovery path. Repository ownership trust now lives in one platform-neutral module: owner rejections are classified into a typed Git error, trust state is reported without side effects, and safe.directory is written only after explicit user confirmation, followed by a check that Git accepts the repository. The confirmation flow works on local, remote, and peer surfaces: trust is applied on the machine the user is on, while controllers receive the diagnosis and the manual git command. The Git scene gains an authorization entry, Deep Review target reads are serialized around a single trust decision, and prompt dedupe keys are normalized per platform. | 1 个月前 |
| fix(acp): make legacy permission migration explicitly saveable Track persisted automatic-rejection settings separately from edited values and show a warning with a Save and apply action across ACP settings views. Keep the action available after a failed save and clear it only after successful persistence. Exercise legacy configuration saving, unchanged Ask selection, cross-view actions, and retry behavior with the real Select component. | 23 天前 |
| refactor(runtime): move permission planning to runtime owner Keep product-specific scope, hooks, request lifecycle, and tool execution in Core while moving provider-neutral policy evaluation into Agent Runtime. Preserve narrow feature checks and refresh the dependency-governance roadmap. | 1 个月前 |
| feat(web-ui): polish interaction motion and presence | 1 个月前 |
| refactor(observability): unify timing instrumentation | 5 个月前 |
| feat(web-ui): polish interaction motion and presence | 1 个月前 |
| feat(web-ui): polish interaction motion and presence | 1 个月前 |
| docs: clean up README and AGENTS links | 5 个月前 |
| refactor(web): fence flow_chat from dispatch internals behind session-drivers - SessionModule's three remaining transport checks (activity touch, fork refusal, ensure-backend guard) resolve through the driver registry. - DispatchJobObserver installation routes through a session-drivers/dispatch shim so FlowChatManager no longer imports the feature module. - eslint no-restricted-imports fence: flow_chat/** may not import @/features/dispatch/* outside session-drivers, with four documented exceptions (type-only config fields, FlowChatStore's snapshot mutations, and the two components rendering the dispatch target-picker feature chip — all queued for the config.dispatch collapse follow-up). Remaining dispatch references in flow_chat outside the fence exceptions: 0. Decision points inside the exceptions: ChatInput's target-picker chip memo and FlowChatStore's cursor-guarded mutations, both feature machinery rather than transport branches. | 1 个月前 |
| fix(web-ui): release startup overlay focus and mark it inert while hiding Blur focused startup window controls before hiding the overlay, set inert during the exit animation so it cannot reclaim focus, and keep the splash screen exposed to assistive technology while it is visible. | 1 个月前 |
| Merge remote-tracking branch 'upstream/main' into wc | 4 个月前 |
| Merge remote-tracking branch 'upstream/main' into wc/rebase | 1 个月前 |
| Init | 7 个月前 |
| feat(app-server) add app server | 1 个月前 |
| Init | 7 个月前 |
| feat(control-hub): UX hardening for IM flows + ObjC exception safety (#444) * feat(control-hub): update * feat(control-hub): UX hardening for IM flows + ObjC exception safety Two independent rounds of fixes on top of the unified ControlHub: 1. Smoother IM-message flow (WeChat / iMessage / Slack / Lark / ...) - New desktop.paste action: clipboard + cmd/ctrl+v + optional submit chord in one tool call. The only robust way to enter CJK / emoji / multi-line text (avoids every IME failure mode of the per-character type_text path). Internally clears the requires_fresh_screenshot_before_enter guard between paste and submit so the bundled return is not rejected. - New im_send_message builtin playbook: deterministic send recipe with an initial escape state-reset, mid-flow window screenshot verification of the chat header, and a final verification capture. Re-invoking it for each new recipient guarantees cmd+f always hits global contact search instead of stale in-chat find. - claw_mode prompt updated with a HARD RULE that strongly prefers the playbook for every IM send and forbids reusing cmd+f from an open chat when sending to a different contact. - Bash tool now hard-rejects osascript keystroke for non-ASCII payloads and soft-rejects it for known IM apps, pointing the model at desktop.paste / the playbook instead. Stops the classic "AAA..." garbage when AppleScript Keystroke meets CJK input. - Screenshot policy simplified to "focused window OR full display": all historical mouse-centered crop / quadrant-drill / implicit confirmation crop modes are removed at the entry point. screenshot_window: true (default) gives the model the full app window via macOS Accessibility; falls back to full display when AX is unavailable. 2. ObjC foreign-exception safety (fix __rust_foreign_exception SIGABRT crash on macOS) - Enable objc2/exception and add a macos::catch_objc helper that wraps a closure in an Objective-C @try/@catch and converts NSException into BitFunError::tool("Objective-C exception: ...") instead of letting it cross the FFI boundary and abort the process via Rust's foreign-exception path. - run_on_main_for_enigo now returns BitFunResult<T> and runs every TSM / HIToolbox / AppKit input job (key chords, type text, mouse events) under catch_objc. This is the highest-frequency FFI boundary in computer-use and was the most likely SIGABRT source. - AX frontmost_window_bounds_global (called on every screenshot for window-aware crop) is wrapped: failures now degrade to a full-display capture instead of crashing. - AX SoM enumeration (enumerate_interactive_elements) is wrapped: a misbehaving frontmost app degrades to an empty SoM list. - Vision OCR (VNRecognizeTextRequest in screen_ocr) is wrapped: malformed image / OOM during recognition surfaces as a normal BitFunError rather than aborting. After this change, any remaining ObjC exception path will surface as a tool result error containing the NSException name + reason instead of a silent process termination, which makes diagnostics tractable. Compile + clippy + tests pass; no new warnings introduced. * fix(desktop): use re-exported DisplayInfo for cross-platform build screenshots::DisplayInfo is private on linux/windows; switch to the already-imported screenshots::display_info::DisplayInfo to fix CI. --------- Co-authored-by: bowen628 <bowen628@noreply.gitcode.com> | 5 个月前 |
| feat(canvas): add web runtime and panel | 2 个月前 |
| Init | 7 个月前 |
| Merge remote-tracking branch 'upstream/main' into wc/rebase | 1 个月前 |
| Init | 7 个月前 |