自建项目管理：新需求先 Intake 分诊再进待办；可自定义工作项类型 / 工作流 / 自动化；AI 嵌在 Issue·Intake·Cycle，数据在自己机器上。

文件	最后提交记录	最后更新时间
.arts	feat: dev issue list & kankan	4 个月前
.github	ci: remove the one-shot package cleanup workflow Co-authored-by: Cursor <cursoragent@cursor.com>	6 天前
backend	ci: pin the runner image and refresh the backend base image Two small pieces of drift, both of which CI had been reporting on every run: - Every job used `ubuntu-latest`, and GitHub now annotates each one because the label is migrating to Ubuntu 26. Pin to `ubuntu-24.04`, the LTS the suite is known to pass on: a silent base-image swap under the E2E job is precisely what would break the Playwright browser deps. The comment says when to move it back. - `alpine:3.20` in the backend runtime stage had not been rebuilt since April 2026 and no longer receives packages, while the builder stage already pulls Alpine 3.24 (`golang:1.25-alpine` resolves to `1.25.14-alpine3.24`). Move the runtime to 3.24 so both stages are on the same release and the image gets base-layer fixes again. The binary is CGO_ENABLED=0, so nothing links against the base image beyond ca-certificates and tzdata. The Go minor is left at 1.25 on purpose: the Dockerfile now states that it must track the `go` directive and CI's GO_VERSION, and that the floating patch tag is how both pick up CVE fixes. Bumping the Go major is a separate migration. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
docs	docs: record the GitCode announcement update Co-authored-by: Cursor <cursoragent@cursor.com>	6 天前
frontend	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
scripts	feat(security): make demo and E2E seed accounts opt-in The server seeded 25 demo users, a demo login and a qa_tester superuser on every boot, in every environment. Every password was published in the repository, so any internet-reachable deployment shipped a known admin credential. - SEED_DEMO / SEED_E2E gate the demo dataset and the test fixtures; both default to false. .env.example opts the local demo in, Compose and the backend default to off. - When no superuser exists, bootstrap one from ADMIN_EMAIL/ADMIN_PASSWORD or a random password printed once; never promote a pre-registered account. - Print a warning whenever demo data is seeded. - CI sets SEED_DEMO=true for the E2E and tenancy-audit jobs. - Add SECURITY.md and docs/deploy/production.md (secrets, network exposure, TLS/SSE proxying, backups, upgrades), plus docs/security.md §13. - Unit tests for the bootstrap paths and the seed flags; gitleaks over all 641 commits finds no leaked credentials. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
sdk	feat(ai-connect): one-click Cursor/Claude Code setup, PR write-back and link_pull_request MCP tool - Workspace settings: create a PAT, copy MCP snippets or install via Cursor deeplink, test the connection, token usage status and revoke - GitHub PR webhooks link issues by key in title/branch/body, complete them on merge (idempotent) and comment deep links back on the PR - Manual PR linking from the issue Git tab and the new link_pull_request MCP tool - resolveIssueCode looks up by sequence_id first so KEY-N resolves reliably Co-authored-by: Cursor <cursoragent@cursor.com>	1 个月前
tests	test(intake): cover submission and triage in CI e2e suite Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	25 天前
.dockerignore	feat: 全面测试 + 多特性完善测试: - 新增 Go 后端单元测试: common (100%覆盖), i18n (94%覆盖) - 新增前端 Vitest 测试: auth store (11), API 模块 (14) - 修复 Bug: ErrAlreadyAssigned/ErrAlreadyLabelled 返回 500 改为 409 - 修复 vitest.config.ts 配置,不再包含 Playwright 测试 - API 集成冒烟测试 51/53 通过 (96%) - 全面测试报告 TEST_REPORT.md 特性: - Agent/MCP/GitHub/Slack 集成 - AI Sprint Planning + SSE 实时通知 - 前后端多语言 (i18n) - 自动化规则 (Automation Rule) - Initiatives 高层级目标 - Project Page Tabs 配置 - Dark Mode 暗色模式基础设施: - Docker 容器化部署 - MCP Server (14 tools) - E2E Playwright 测试 (5 specs) Co-Authored-By: vinthuy@qq.com	4 个月前
.env.example	fix(compose): forward logging and rate-limit env vars to the backend DB_LOG_LEVEL, SLOW_REQUEST_MS, RATE_LIMIT_REQUESTS and RATE_LIMIT_WINDOW_SEC are read from the process environment. Compose only passes variables it lists explicitly, so setting them in .env silently did nothing and the code defaults always won. Documented next to the other knobs in .env.example. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
.gitattributes	fix: final review wave — warn on plaintext remote MCP HTTP, e2e hardening, repo hygiene	1 个月前
.gitignore	docs: publish the knowledge base as a MkDocs site The docs were only readable as loose Markdown in the repo. mkdocs.yml builds them with Material, and mkdocs-static-i18n reuses the existing *.en.md suffix convention so Chinese is the default and English pages sit under /en/. - docs/index.md, docs/index.en.md: landing pages instead of the repo README - docs/configuration.md: every backend and Compose environment variable, with defaults, including the ones just wired through Compose - internal notes (superpowers, superseded, dev/active, acceptance reports) are excluded; architecture notes stay built but out of the sidebar - .github/workflows/docs.yml builds with --strict and deploys to GitHub Pages - relative links that pointed outside docs_dir now go to the repository, and the language footers point at the published counterpart page, so the strict build has nothing to warn about Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
.gitleaks.toml	security(go): enable gosec, close token-leak paths, fix CI; all frontend/e2e green Security (backend) - Enable gosec + bodyclose via .golangci.yml; migrate to golangci-lint v2.13.2 (v1.x refuses to analyse a go 1.25 module). 355 lint findings -> 0. - Tokens can no longer leak through code: * access log no longer writes SSE `?token=` query values (RedactQuery, with a middleware-level regression test) * webhook URLs (Slack/GitHub embed credentials in the path) and response bodies are masked/truncated before logging * SECRET_KEY no longer falls back to the public "change-me-in-production": a random per-process key is generated with a loud warning; docs/compose/env example require a real value, and the unreferenced config.yaml was deleted * RQL executor no longer prints SQL + arguments on every query * uploads dir 0750 + sanitized extension, worktree names validated, Slack webhook restricted to https://hooks.slack.com - Fix vulnerabilities reachable from this module (govulncheck 3 -> 0): golang-jwt/jwt v5.2.2, jackc/pgx v5.9.2 (SQL injection GO-2026-5004), golang.org/x/text v0.39.0. Real bugs found by the new linters - skill_executor: regexes used Perl lookahead (unsupported by RE2) -> MustCompile panicked, so SKILL.md parsing was broken - conditional fields: numeric ids were converted with string(rune(id)), so type/state/assignee/label conditions could never match - workflow_service: Delete/DeleteNode/DeleteEdge used Delete(&struct{}{}), which produced `DELETE FROM ""` (SQLSTATE 42601) -> every workflow delete returned 500 - seed release indexing, budget alert message, swallowed JSON bind error, dead code CI - golangci-lint-action@v9 (pinned linter v2.13.2), GO_VERSION 1.25 (+ Dockerfile), @vitest/coverage-v8 added so `vitest run --coverage` works, ESLint step replaced by a real `vue-tsc --noEmit` check, new Security job: gitleaks (blocking, .gitleaks.toml) + govulncheck (advisory) frontend/e2e: 91 failures -> 0 - automation specs rewritten against the real AutomationRuleBuilder and the dot-notation event names the bus actually subscribes to - chat: inject token+user_id, wait for the SSE connection before sending (messages were silently dropped before the chat id resolved) - issue-detail: 8 tabs, label-based navigation, sub-issues asserted on the relations tab; pages/plugin specs declared serial (they share one project's state); dark-mode preset via storage; i18n title bilingual; copilot tab by title - root causes of the "mass failure" runs: backend rate limit (1880x HTTP 429) raised for E2E runs, and a local worker count of 12 starving the dev servers (now fixed at 2) docs: bug-list.md BUG-50..BUG-59, E2E_COVERAGE_REPORT.md section 11	1 个月前
.nvmrc	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
CHANGELOG.md	docs(kb): correct the PRD against the running process The requirements still described UUID keys, Redis, object storage, and SSO connectors the server does not have. Co-authored-by: Cursor <cursoragent@cursor.com>	6 天前
CODE_OF_CONDUCT.md	docs(community): governance files, dependabot and a public roadmap Add the files a stranger needs before they open their first issue: - CODE_OF_CONDUCT.md (Contributor Covenant 2.1) with a private reporting address, replacing the one-line behavioural note in CONTRIBUTING. - SUPPORT.md routing questions to Discussions, bugs to the issue templates, vulnerabilities to SECURITY.md only. - ROADMAP.md stating what is being built now (docs site, i18n, screenshots, community automation), the next Plane gaps, and explicit non-goals. - Dependabot for gomod (backend, sdk, tests), npm (frontend, sdk/node, tests), GitHub Actions and both Dockerfiles, grouped so weekly noise is one PR per ecosystem instead of one per module. - Issue template chooser links to the support and security docs. - README/README-zh and CONTRIBUTING link the new files. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
CONTRIBUTING-zh.md	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
CONTRIBUTING.md	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
LICENSE	refactor: rename reqmanpy to reqmango across entire codebase - Go modules: github.com/reqmanpy/backend to github.com/reqmango/backend - Docker: container names, DB name/user/password defaults updated - Frontend: localStorage keys (reqmango-dark-mode, reqmango:rql:history) - UI brand: Reqman/ReqManPy to ReqMango (Login, Register, Sidebar) - Configs: .env, docker-compose, Makefile, config.yaml - Docs: renamed reqmanpy-.md to reqmango-.md, all references updated - Tests: full-api-test.js, e2e tests - package.json: reqman-frontend to reqmango-frontend - Fix: RQLHistory.vue imports HISTORY_KEY from useRQL.ts (dedup) - All unit tests (Go + Vitest) and API integration tests pass	4 个月前
Makefile	docs: update SDK README with Python/Node quickstart; add test-python/test-node to Makefile	1 个月前
README-zh.md	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
README.md	build: move the frontend toolchain to Node.js 24 Node 20 reached end-of-life in April 2026, but CI, the image builder and the README still pinned it while every action now runs on Node 24 anyway. - CI: setup-node 20 -> 24 in all four jobs that build or test the frontend - frontend/Dockerfile: node:20-alpine -> node:24-alpine - frontend/package.json: engines.node >= 24, @types/node ^20 -> ^24 - .nvmrc: 24 - README/CONTRIBUTING (en + zh): Node.js 20+ -> 24+ Verified locally on Node 24.15.0: npm ci against the regenerated lockfile, vue-tsc --noEmit, the i18n key scan, and the full vitest suite (948 tests) all pass; `vite build` succeeds (see below). Note: the plain `vite build` fails on this Windows machine inside esbuild's temp-file cleanup ("remove ...: Access is denied"), and it fails identically on the pre-change tree, so it is local Defender/file-locking noise rather than the Node bump. The esnext build bundles cleanly, and CI proves the real command on Linux. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
ROADMAP.md	docs: refresh the screenshots and show the product in the READMEs The README led with a month-old GIF of one flow, and nothing showed issues, cycles or analytics. Replace it with seven current screenshots (intake form, triage queue, issue list, issue detail, cycles, analytics, workspace) captured from the demo seed, and lay five of them out as a two-column grid under the quickstart in both READMEs and both docs landing pages. The GIF stays: the promo drafts in docs/dev/ link to it by raw URL. Its provenance and the new set are written down in docs/assets/README.md. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
SECURITY.md	feat(security): make demo and E2E seed accounts opt-in The server seeded 25 demo users, a demo login and a qa_tester superuser on every boot, in every environment. Every password was published in the repository, so any internet-reachable deployment shipped a known admin credential. - SEED_DEMO / SEED_E2E gate the demo dataset and the test fixtures; both default to false. .env.example opts the local demo in, Compose and the backend default to off. - When no superuser exists, bootstrap one from ADMIN_EMAIL/ADMIN_PASSWORD or a random password printed once; never promote a pre-registered account. - Print a warning whenever demo data is seeded. - CI sets SEED_DEMO=true for the E2E and tenancy-audit jobs. - Add SECURITY.md and docs/deploy/production.md (secrets, network exposure, TLS/SSE proxying, backups, upgrades), plus docs/security.md §13. - Unit tests for the bootstrap paths and the seed flags; gitleaks over all 641 commits finds no leaked credentials. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
SUPPORT.md	docs(community): governance files, dependabot and a public roadmap Add the files a stranger needs before they open their first issue: - CODE_OF_CONDUCT.md (Contributor Covenant 2.1) with a private reporting address, replacing the one-line behavioural note in CONTRIBUTING. - SUPPORT.md routing questions to Discussions, bugs to the issue templates, vulnerabilities to SECURITY.md only. - ROADMAP.md stating what is being built now (docs site, i18n, screenshots, community automation), the next Plane gaps, and explicit non-goals. - Dependabot for gomod (backend, sdk, tests), npm (frontend, sdk/node, tests), GitHub Actions and both Dockerfiles, grouped so weekly noise is one PR per ecosystem instead of one per module. - Issue template chooser links to the support and security docs. - README/README-zh and CONTRIBUTING link the new files. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
docker-compose.yml	fix(compose): forward logging and rate-limit env vars to the backend DB_LOG_LEVEL, SLOW_REQUEST_MS, RATE_LIMIT_REQUESTS and RATE_LIMIT_WINDOW_SEC are read from the process environment. Compose only passes variables it lists explicitly, so setting them in .env silently did nothing and the code defaults always won. Documented next to the other knobs in .env.example. Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前
mkdocs.yml	docs(kb): align design notes with the code and drop the retired Python page The design notes still described the July drafts, and the knowledge base still linked a Python backend that is no longer in use. Co-authored-by: Cursor <cursoragent@cursor.com>	11 天前
requirements-docs.txt	docs: publish the knowledge base as a MkDocs site The docs were only readable as loose Markdown in the repo. mkdocs.yml builds them with Material, and mkdocs-static-i18n reuses the existing *.en.md suffix convention so Chinese is the default and English pages sit under /en/. - docs/index.md, docs/index.en.md: landing pages instead of the repo README - docs/configuration.md: every backend and Compose environment variable, with defaults, including the ones just wired through Compose - internal notes (superpowers, superseded, dev/active, acceptance reports) are excluded; architecture notes stay built but out of the sidebar - .github/workflows/docs.yml builds with --strict and deploys to GitHub Pages - relative links that pointed outside docs_dir now go to the repository, and the language footers point at the published counterpart page, so the strict build has nothing to warn about Co-authored-by: Cursor <cursoragent@cursor.com>	12 天前

Reqmango

自建项目管理：新需求先分诊，再进待办。
提交后先给出类型、优先级与疑似重复建议，拿不准的才由人决定。

English · 文档站 · 贡献指南 · GitCode 国内主场 · GitHub 国际镜像

快速试用

预构建多架构镜像（linux/amd64、linux/arm64），最快：

# 国内推荐 GitCode 主场
git clone https://gitcode.com/yongfeng9m-/reqmanpy.git reqmango
# 国际镜像: git clone https://github.com/vinthuy/reqmango.git
cd reqmango
cp .env.example .env
docker compose pull
docker compose up -d

或者在本地构建两个镜像（冷缓存需要几分钟）：

docker compose up --build

首次启动： 请等两个服务都就绪后再打开页面；前端镜像启动期间页面短暂空白并不代表启动失败。curl localhost/version 可以确认当前运行的版本。

浏览器打开 http://localhost，登录：


邮箱	`demo@example.com`
密码	`demo1234`

可选 AI（Intake 分诊 / 分析 / 标签建议）：在 .env 中设置 AI_API_KEY 后重启。

需求分诊队列

_{需求入口 — 一个公开链接，收没有账号的人提的需求}	_{工作项 — 列表 / 看板 / 树形 / 日历 / 甘特，共用同一套筛选}
_{工作项详情 — 属性、关联、动态与 AI 面板在一屏内}	_{周期 — Sprint 范围、进度和延期项一目了然}
_{分析 — 优先级分布、工作量与完成趋势}	_{工作空间 — 多个项目、一个团队、一次登录}

界面首次访问会跟随浏览器语言（中文 / English），任何页面右上角都能切换。

一分钟走查

使用演示账号登录。
打开 Demo 项目 → 项目设置 → 请求分诊（Intake）。
打开 Intake 表单链接，提交一条简短需求（例如「手机端登录偶尔失败」）。
回到分诊队列：接受 / 拒绝；配置了 AI_API_KEY 时可对工作项做 AI 分析与标签建议。

能力一览

方向	能力
工作流里的 AI	Intake 分诊、Issue 分析、标签建议、Cycle / Sprint 总结、Ask / Build Copilot（写入前先预览）
工作项	列表 + 看板、状态流转、最多 6 层层级
自定义字段与模板	文本 / 数字 / 下拉 / 布尔 / 日期 / 成员 / URL；工作区类型蓝图；项目模板
工作流与自动化	状态转换、审批、角色限制；触发器 → 条件 → 动作
关联与搜索	Blocks / Relates / Duplicates；RQL 与多字段筛选
通知与安全	未读计数；XSS 清洗（bluemonday）；JWT + RBAC
API	100+ REST 接口

AI 是项目管理上的一层能力，默认叙事不是独立的 Agent 控制台。代码里可能仍有高级 Agent 路由；日常路径是 Issue、Cycle、Intake 与 Pages。

环境要求

方式	需要
Docker（推荐）	Docker + Docker Compose
本地开发	Go 1.25+、PostgreSQL 16+、Node.js 24+

版本与 CI、docker-compose.yml 一致（postgres:16，Go 1.25 / Node 24 构建镜像）。

本地开发（不用 Docker）

# 数据库
psql -U postgres -c "CREATE DATABASE reqmango;"

# 后端
cd backend
cat > .env << EOF
DATABASE_URL=postgres://postgres:postgres@localhost:5432/reqmango?sslmode=disable
SECRET_KEY=$(openssl rand -hex 32)
ACCESS_TOKEN_EXPIRE_MINUTES=10080
PORT=8000
DEBUG=true
SEED_DEMO=true
EOF
go run ./cmd/server/

服务启动时会自动迁移并写入种子数据，因此新建环境只需这一步。SEED_DEMO=true 会创建演示账号；不需要演示数据时删掉这一行，首次启动会创建一个管理员并把随机密码打印在日志里（见生产部署）。

数据库迁移

若希望把建表作为一个独立、可审阅的步骤，用 cmd/migrate：

cd backend
go run ./cmd/migrate up      # 应用基线
go run ./cmd/migrate version # 1, dirty=false

migrations/000001_baseline.up.sql 是单一幂等基线，空库和「已由服务 AutoMigrate 建好的库」都能直接跑。压缩基线之前建好的旧库需要一次性 go run ./cmd/migrate force 1，详见债务说明。

种子数据含 demo@example.com / demo1234、工作区 reqmango-dev（项目 CORE / MOBILE / AI / OPENAPI），以及示例 Sprint / 模块 / 工作项。演示账号的密码是公开的，只适合本地试用。

# 前端（API 在 :8000）
cd frontend
npm install
npm run dev

打开 http://localhost:5173。

本地生产构建

cd backend && go build -o server ./cmd/server/
cd frontend && npm run build

目录结构

reqmango/
├── backend/     # Go + Gin + GORM API
├── frontend/    # Vue 3 + TypeScript + Vite
├── sdk/         # MCP / CLI（可选，非默认产品叙事）
├── docs/        # API、架构、产品规格
└── docker-compose.yml