自建项目管理：新需求先 Intake 分诊再进待办；可自定义工作项类型 / 工作流 / 自动化；AI 嵌在 Issue·Intake·Cycle，数据在自己机器上。
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat: dev issue list & kankan | 4 个月前 | |
ci: pin the runner image and refresh the backend base image Two small pieces of drift, both of which CI had been reporting on every run: - Every job used ubuntu-latest, and GitHub now annotates each one because the label is migrating to Ubuntu 26. Pin to ubuntu-24.04, the LTS the suite is known to pass on: a silent base-image swap under the E2E job is precisely what would break the Playwright browser deps. The comment says when to move it back. - alpine:3.20 in the backend runtime stage had not been rebuilt since April 2026 and no longer receives packages, while the builder stage already pulls Alpine 3.24 (golang:1.25-alpine resolves to 1.25.14-alpine3.24). Move the runtime to 3.24 so both stages are on the same release and the image gets base-layer fixes again. The binary is CGO_ENABLED=0, so nothing links against the base image beyond ca-certificates and tzdata. The Go minor is left at 1.25 on purpose: the Dockerfile now states that it must track the go directive and CI's GO_VERSION, and that the floating patch tag is how both pick up CVE fixes. Bumping the Go major is a separate migration. Co-authored-by: Cursor <cursoragent@cursor.com> | 3 小时前 | |
ci: pin the runner image and refresh the backend base image Two small pieces of drift, both of which CI had been reporting on every run: - Every job used ubuntu-latest, and GitHub now annotates each one because the label is migrating to Ubuntu 26. Pin to ubuntu-24.04, the LTS the suite is known to pass on: a silent base-image swap under the E2E job is precisely what would break the Playwright browser deps. The comment says when to move it back. - alpine:3.20 in the backend runtime stage had not been rebuilt since April 2026 and no longer receives packages, while the builder stage already pulls Alpine 3.24 (golang:1.25-alpine resolves to 1.25.14-alpine3.24). Move the runtime to 3.24 so both stages are on the same release and the image gets base-layer fixes again. The binary is CGO_ENABLED=0, so nothing links against the base image beyond ca-certificates and tzdata. The Go minor is left at 1.25 on purpose: the Dockerfile now states that it must track the go directive and CI's GO_VERSION, and that the floating patch tag is how both pick up CVE fixes. Bumping the Go major is a separate migration. Co-authored-by: Cursor <cursoragent@cursor.com> | 3 小时前 | |
docs(kb): correct stale facts and drop brittle inventory counts The published knowledge base had drifted from the code in ways that would mislead a reader, not just in ways that were out of date. Facts corrected against the source: - backend-go.md: PORT defaults to 8000, not 8080; config comes from .env plus environment variables, not config.yaml (deleted); DEBUG defaults to true; AI_BASE_URL keeps its /v1 suffix; LANGUAGE does not exist. The roles routes are nested under a workspace, and /permissions is a single endpoint. - API.md: login returns access_token / token_type / expires_at with no user object (call /auth/me instead); the error body is error_code / message / detail. - project-layout.md: the runtime image is Alpine, not distroless; removed backend/config/, backend/test_api.sh and .private/, none of which exist. - kb/architecture/README.md: a truncated line rendered as a bare m_advanced_agents=1 on the site; Go is 1.25, not 1.24. - tech-stack.md: added the runtime table (Go 1.25, Node 24) and stopped transcribing patch versions. Inventory counts were removed rather than refreshed. File, module and route counts disagreed with each other across four documents and with the code (41+/75 api modules, 5/12/35 composables, 3/11 stores, 80+/580+/660 endpoints). Each page now points at the directory or internal/router/router.go as the authority, which is what stops the same drift recurring. Also translated PRD.en.md in full: it was an abridged 266-line copy of a 601-line Chinese original. It is now a complete 24-section translation. Verified with mkdocs build --clean --strict. Co-authored-by: Cursor <cursoragent@cursor.com> | 2 小时前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
feat(security): make demo and E2E seed accounts opt-in The server seeded 25 demo users, a demo login and a qa_tester superuser on every boot, in every environment. Every password was published in the repository, so any internet-reachable deployment shipped a known admin credential. - SEED_DEMO / SEED_E2E gate the demo dataset and the test fixtures; both default to false. .env.example opts the local demo in, Compose and the backend default to off. - When no superuser exists, bootstrap one from ADMIN_EMAIL/ADMIN_PASSWORD or a random password printed once; never promote a pre-registered account. - Print a warning whenever demo data is seeded. - CI sets SEED_DEMO=true for the E2E and tenancy-audit jobs. - Add SECURITY.md and docs/deploy/production.md (secrets, network exposure, TLS/SSE proxying, backups, upgrades), plus docs/security.md §13. - Unit tests for the bootstrap paths and the seed flags; gitleaks over all 641 commits finds no leaked credentials. Co-authored-by: Cursor <cursoragent@cursor.com> | 20 小时前 | |
feat(ai-connect): one-click Cursor/Claude Code setup, PR write-back and link_pull_request MCP tool - Workspace settings: create a PAT, copy MCP snippets or install via Cursor deeplink, test the connection, token usage status and revoke - GitHub PR webhooks link issues by key in title/branch/body, complete them on merge (idempotent) and comment deep links back on the PR - Manual PR linking from the issue Git tab and the new link_pull_request MCP tool - resolveIssueCode looks up by sequence_id first so KEY-N resolves reliably Co-authored-by: Cursor <cursoragent@cursor.com> | 27 天前 | |
test(intake): cover submission and triage in CI e2e suite Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> | 13 天前 | |
feat: 全面测试 + 多特性完善 测试: - 新增 Go 后端单元测试: common (100%覆盖), i18n (94%覆盖) - 新增前端 Vitest 测试: auth store (11), API 模块 (14) - 修复 Bug: ErrAlreadyAssigned/ErrAlreadyLabelled 返回 500 改为 409 - 修复 vitest.config.ts 配置,不再包含 Playwright 测试 - API 集成冒烟测试 51/53 通过 (96%) - 全面测试报告 TEST_REPORT.md 特性: - Agent/MCP/GitHub/Slack 集成 - AI Sprint Planning + SSE 实时通知 - 前后端多语言 (i18n) - 自动化规则 (Automation Rule) - Initiatives 高层级目标 - Project Page Tabs 配置 - Dark Mode 暗色模式 基础设施: - Docker 容器化部署 - MCP Server (14 tools) - E2E Playwright 测试 (5 specs) Co-Authored-By: vinthuy@qq.com | 3 个月前 | |
fix(compose): forward logging and rate-limit env vars to the backend DB_LOG_LEVEL, SLOW_REQUEST_MS, RATE_LIMIT_REQUESTS and RATE_LIMIT_WINDOW_SEC are read from the process environment. Compose only passes variables it lists explicitly, so setting them in .env silently did nothing and the code defaults always won. Documented next to the other knobs in .env.example. Co-authored-by: Cursor <cursoragent@cursor.com> | 16 小时前 | |
fix: final review wave — warn on plaintext remote MCP HTTP, e2e hardening, repo hygiene | 1 个月前 | |
docs: publish the knowledge base as a MkDocs site The docs were only readable as loose Markdown in the repo. mkdocs.yml builds them with Material, and mkdocs-static-i18n reuses the existing *.en.md suffix convention so Chinese is the default and English pages sit under /en/. - docs/index.md, docs/index.en.md: landing pages instead of the repo README - docs/configuration.md: every backend and Compose environment variable, with defaults, including the ones just wired through Compose - internal notes (superpowers, superseded, dev/active, acceptance reports) are excluded; architecture notes stay built but out of the sidebar - .github/workflows/docs.yml builds with --strict and deploys to GitHub Pages - relative links that pointed outside docs_dir now go to the repository, and the language footers point at the published counterpart page, so the strict build has nothing to warn about Co-authored-by: Cursor <cursoragent@cursor.com> | 16 小时前 | |
security(go): enable gosec, close token-leak paths, fix CI; all frontend/e2e green Security (backend) - Enable gosec + bodyclose via .golangci.yml; migrate to golangci-lint v2.13.2 (v1.x refuses to analyse a go 1.25 module). 355 lint findings -> 0. - Tokens can no longer leak through code: * access log no longer writes SSE ?token= query values (RedactQuery, with a middleware-level regression test) * webhook URLs (Slack/GitHub embed credentials in the path) and response bodies are masked/truncated before logging * SECRET_KEY no longer falls back to the public "change-me-in-production": a random per-process key is generated with a loud warning; docs/compose/env example require a real value, and the unreferenced config.yaml was deleted * RQL executor no longer prints SQL + arguments on every query * uploads dir 0750 + sanitized extension, worktree names validated, Slack webhook restricted to https://hooks.slack.com - Fix vulnerabilities reachable from this module (govulncheck 3 -> 0): golang-jwt/jwt v5.2.2, jackc/pgx v5.9.2 (SQL injection GO-2026-5004), golang.org/x/text v0.39.0. Real bugs found by the new linters - skill_executor: regexes used Perl lookahead (unsupported by RE2) -> MustCompile panicked, so SKILL.md parsing was broken - conditional fields: numeric ids were converted with string(rune(id)), so type/state/assignee/label conditions could never match - workflow_service: Delete/DeleteNode/DeleteEdge used Delete(&struct{}{}), which produced DELETE FROM "" (SQLSTATE 42601) -> every workflow delete returned 500 - seed release indexing, budget alert message, swallowed JSON bind error, dead code CI - golangci-lint-action@v9 (pinned linter v2.13.2), GO_VERSION 1.25 (+ Dockerfile), @vitest/coverage-v8 added so vitest run --coverage works, ESLint step replaced by a real vue-tsc --noEmit check, new Security job: gitleaks (blocking, .gitleaks.toml) + govulncheck (advisory) frontend/e2e: 91 failures -> 0 - automation specs rewritten against the real AutomationRuleBuilder and the dot-notation event names the bus actually subscribes to - chat: inject token+user_id, wait for the SSE connection before sending (messages were silently dropped before the chat id resolved) - issue-detail: 8 tabs, label-based navigation, sub-issues asserted on the relations tab; pages/plugin specs declared serial (they share one project's state); dark-mode preset via storage; i18n title bilingual; copilot tab by title - root causes of the "mass failure" runs: backend rate limit (1880x HTTP 429) raised for E2E runs, and a local worker count of 12 starving the dev servers (now fixed at 2) docs: bug-list.md BUG-50..BUG-59, E2E_COVERAGE_REPORT.md section 11 | 1 个月前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
docs(kb): correct stale facts and drop brittle inventory counts The published knowledge base had drifted from the code in ways that would mislead a reader, not just in ways that were out of date. Facts corrected against the source: - backend-go.md: PORT defaults to 8000, not 8080; config comes from .env plus environment variables, not config.yaml (deleted); DEBUG defaults to true; AI_BASE_URL keeps its /v1 suffix; LANGUAGE does not exist. The roles routes are nested under a workspace, and /permissions is a single endpoint. - API.md: login returns access_token / token_type / expires_at with no user object (call /auth/me instead); the error body is error_code / message / detail. - project-layout.md: the runtime image is Alpine, not distroless; removed backend/config/, backend/test_api.sh and .private/, none of which exist. - kb/architecture/README.md: a truncated line rendered as a bare m_advanced_agents=1 on the site; Go is 1.25, not 1.24. - tech-stack.md: added the runtime table (Go 1.25, Node 24) and stopped transcribing patch versions. Inventory counts were removed rather than refreshed. File, module and route counts disagreed with each other across four documents and with the code (41+/75 api modules, 5/12/35 composables, 3/11 stores, 80+/580+/660 endpoints). Each page now points at the directory or internal/router/router.go as the authority, which is what stops the same drift recurring. Also translated PRD.en.md in full: it was an abridged 266-line copy of a 601-line Chinese original. It is now a complete 24-section translation. Verified with mkdocs build --clean --strict. Co-authored-by: Cursor <cursoragent@cursor.com> | 2 小时前 | |
docs(community): governance files, dependabot and a public roadmap Add the files a stranger needs before they open their first issue: - CODE_OF_CONDUCT.md (Contributor Covenant 2.1) with a private reporting address, replacing the one-line behavioural note in CONTRIBUTING. - SUPPORT.md routing questions to Discussions, bugs to the issue templates, vulnerabilities to SECURITY.md only. - ROADMAP.md stating what is being built now (docs site, i18n, screenshots, community automation), the next Plane gaps, and explicit non-goals. - Dependabot for gomod (backend, sdk, tests), npm (frontend, sdk/node, tests), GitHub Actions and both Dockerfiles, grouped so weekly noise is one PR per ecosystem instead of one per module. - Issue template chooser links to the support and security docs. - README/README-zh and CONTRIBUTING link the new files. Co-authored-by: Cursor <cursoragent@cursor.com> | 19 小时前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
refactor: rename reqmanpy to reqmango across entire codebase - Go modules: github.com/reqmanpy/backend to github.com/reqmango/backend - Docker: container names, DB name/user/password defaults updated - Frontend: localStorage keys (reqmango-dark-mode, reqmango:rql:history) - UI brand: Reqman/ReqManPy to ReqMango (Login, Register, Sidebar) - Configs: .env, docker-compose, Makefile, config.yaml - Docs: renamed reqmanpy-*.md to reqmango-*.md, all references updated - Tests: full-api-test.js, e2e tests - package.json: reqman-frontend to reqmango-frontend - Fix: RQLHistory.vue imports HISTORY_KEY from useRQL.ts (dedup) - All unit tests (Go + Vitest) and API integration tests pass | 3 个月前 | |
docs: update SDK README with Python/Node quickstart; add test-python/test-node to Makefile | 1 个月前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; vite build succeeds (see below). Note: the plain vite build fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com> | 4 小时前 | |
docs: refresh the screenshots and show the product in the READMEs The README led with a month-old GIF of one flow, and nothing showed issues, cycles or analytics. Replace it with seven current screenshots (intake form, triage queue, issue list, issue detail, cycles, analytics, workspace) captured from the demo seed, and lay five of them out as a two-column grid under the quickstart in both READMEs and both docs landing pages. The GIF stays: the promo drafts in docs/dev/ link to it by raw URL. Its provenance and the new set are written down in docs/assets/README.md. Co-authored-by: Cursor <cursoragent@cursor.com> | 14 小时前 | |
feat(security): make demo and E2E seed accounts opt-in The server seeded 25 demo users, a demo login and a qa_tester superuser on every boot, in every environment. Every password was published in the repository, so any internet-reachable deployment shipped a known admin credential. - SEED_DEMO / SEED_E2E gate the demo dataset and the test fixtures; both default to false. .env.example opts the local demo in, Compose and the backend default to off. - When no superuser exists, bootstrap one from ADMIN_EMAIL/ADMIN_PASSWORD or a random password printed once; never promote a pre-registered account. - Print a warning whenever demo data is seeded. - CI sets SEED_DEMO=true for the E2E and tenancy-audit jobs. - Add SECURITY.md and docs/deploy/production.md (secrets, network exposure, TLS/SSE proxying, backups, upgrades), plus docs/security.md §13. - Unit tests for the bootstrap paths and the seed flags; gitleaks over all 641 commits finds no leaked credentials. Co-authored-by: Cursor <cursoragent@cursor.com> | 20 小时前 | |
docs(community): governance files, dependabot and a public roadmap Add the files a stranger needs before they open their first issue: - CODE_OF_CONDUCT.md (Contributor Covenant 2.1) with a private reporting address, replacing the one-line behavioural note in CONTRIBUTING. - SUPPORT.md routing questions to Discussions, bugs to the issue templates, vulnerabilities to SECURITY.md only. - ROADMAP.md stating what is being built now (docs site, i18n, screenshots, community automation), the next Plane gaps, and explicit non-goals. - Dependabot for gomod (backend, sdk, tests), npm (frontend, sdk/node, tests), GitHub Actions and both Dockerfiles, grouped so weekly noise is one PR per ecosystem instead of one per module. - Issue template chooser links to the support and security docs. - README/README-zh and CONTRIBUTING link the new files. Co-authored-by: Cursor <cursoragent@cursor.com> | 19 小时前 | |
fix(compose): forward logging and rate-limit env vars to the backend DB_LOG_LEVEL, SLOW_REQUEST_MS, RATE_LIMIT_REQUESTS and RATE_LIMIT_WINDOW_SEC are read from the process environment. Compose only passes variables it lists explicitly, so setting them in .env silently did nothing and the code defaults always won. Documented next to the other knobs in .env.example. Co-authored-by: Cursor <cursoragent@cursor.com> | 16 小时前 | |
docs: publish the knowledge base as a MkDocs site The docs were only readable as loose Markdown in the repo. mkdocs.yml builds them with Material, and mkdocs-static-i18n reuses the existing *.en.md suffix convention so Chinese is the default and English pages sit under /en/. - docs/index.md, docs/index.en.md: landing pages instead of the repo README - docs/configuration.md: every backend and Compose environment variable, with defaults, including the ones just wired through Compose - internal notes (superpowers, superseded, dev/active, acceptance reports) are excluded; architecture notes stay built but out of the sidebar - .github/workflows/docs.yml builds with --strict and deploys to GitHub Pages - relative links that pointed outside docs_dir now go to the repository, and the language footers point at the published counterpart page, so the strict build has nothing to warn about Co-authored-by: Cursor <cursoragent@cursor.com> | 16 小时前 | |
docs: publish the knowledge base as a MkDocs site The docs were only readable as loose Markdown in the repo. mkdocs.yml builds them with Material, and mkdocs-static-i18n reuses the existing *.en.md suffix convention so Chinese is the default and English pages sit under /en/. - docs/index.md, docs/index.en.md: landing pages instead of the repo README - docs/configuration.md: every backend and Compose environment variable, with defaults, including the ones just wired through Compose - internal notes (superpowers, superseded, dev/active, acceptance reports) are excluded; architecture notes stay built but out of the sidebar - .github/workflows/docs.yml builds with --strict and deploys to GitHub Pages - relative links that pointed outside docs_dir now go to the repository, and the language footers point at the published counterpart page, so the strict build has nothing to warn about Co-authored-by: Cursor <cursoragent@cursor.com> | 16 小时前 |
加载中