Ed1s0nZ
5feea8d3c3
fix(headers): isolate credentials across audit, redirects and probes
2026-11-02 17:18:12 +08:00
Ed1s0nZ
585c95a0e2
Merge commit '0340c07363720e356b4cd7adafe343cbee804764' into codex/pr379-header-boundaries
2026-11-02 17:13:25 +08:00
公明
0340c07363
Merge pull request #378 from Sycun/codex/issue-365-word-reports
...
feat(vulnerabilities): 单条漏洞下载支持选择 Markdown 或 Word
2026-11-02 15:47:37 +08:00
Ed1s0nZ
02b295d738
Merge main and preserve both changelog additions for #378
2026-11-02 15:38:16 +08:00
公明
d227396e74
Merge pull request #376 from muhannadalhariri/i18n/ar-SA-ui
...
i18n: add Arabic (ar-SA) UI locale with RTL support
2026-11-02 14:57:23 +08:00
Ed1s0nZ
697e875fa4
feat: make agent task timeout configurable
2026-10-31 16:43:25 +08:00
Ed1s0nZ
6ad8d47c74
fix: restore WebShell batch probe completion
2026-10-31 02:26:46 +08:00
nightslient
691dbd0107
test(headers): 覆盖自定义请求头注入与测试连接链路
...
- applyCustomHeaders：覆盖内置头、跳过空值、无配置时保持原行为
- headersRoundTripper：经 Eino 传输链端到端验证头已下发
- %session_id%：有会话时替换、无会话时跳过该头
- TestOpenAI：测试连接会携带静态头，%session_id% 填充探测值，
未配置 headers 时仍使用 Bearer <api_key>
2026-10-30 20:16:27 +08:00
root
d6b0aed1de
feat(headers): 支持为 AI 渠道配置自定义 HTTP 请求头
...
部分 OpenAI 兼容供应商（如 opencode）要求私有鉴权头或会话头，
而非标准的 Authorization: Bearer，导致无法接入。
- config: OpenAIConfig / AIChannelConfig 新增 headers 字段，
值支持 ${ENV_VAR}、${ENV_VAR:-default} 与 %session_id% 占位符
- openai: 新增 headersRoundTripper 接入 Eino ChatModel 传输链，
同名的内置头（Authorization/User-Agent 等）可被覆盖
- openai: 内置 Client 的 4 处出站请求同样注入自定义头
- handler: 任务开始时把对话 ID 注入 ctx，供 %session_id% 替换；
连接测试没有真实会话，使用探测值 connect-test
- web: 渠道设置页新增“自定义请求头”编辑区（每行 KEY=VALUE）
- 占位符使用 %session_id% 而非 {{session_id}}，因为 index.html
由 Go html/template 渲染，双花括号会被当作模板函数解析
2026-10-30 20:13:56 +08:00
Ed1s0nZ
bc0b288d40
Fix audit model thinking compatibility
2026-10-30 16:11:07 +08:00
Sycun
baa1d02cd4
feat(vulnerabilities): offer Markdown and Word report downloads
2026-10-30 09:29:44 +08:00
muhannadalhariri and Claude Opus 4.8
caa7700345
i18n: add Arabic (ar-SA) UI locale with RTL support
...
Add Modern Standard Arabic (ar-SA) as a selectable UI language alongside
the existing zh-CN, en-US and ru-RU locales.
- web/static/i18n/ar-SA.json: new Arabic locale (4272 leaf strings,
full key/placeholder parity with en-US). The `c2` and `webshell`
sections are intentionally omitted and fall back to English via the
i18next fallback chain (ar-SA -> en-US -> zh-CN).
- web/static/js/i18n.js: register ar-SA, detect `ar*` navigator language,
preload en-US as fallback, set document dir="rtl" for Arabic, and add
the ar-SA language label handling.
- web/static/i18n/{zh-CN,en-US,ru-RU}.json: add the `lang.arSA` label.
- web/templates/{index,api-docs}.html: add the العربية option to the
language dropdown.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-10-29 10:42:55 +03:00
公明
5affb4df1b
Merge pull request #370 from GQingL/main
...
Enhance RBAC UI with scrolling, spacing, and layout fixes
2026-10-28 09:45:04 +08:00
lgq
0a6dc6f872
fix: use floating pagination selects across pages for Chrome compatibility
2026-10-27 23:59:47 +08:00
lgq
0dea628e89
fix: open project pagination dropdown upward
2026-10-27 23:23:44 +08:00
lgq
816abfb841
fix: prevent external MCP stats and card controls from overlapping
2026-10-27 23:09:13 +08:00
lgq
9cb6922a88
fix: add spacing below RBAC assignment filters
2026-10-27 20:23:36 +08:00
lgq
07346ca002
fix: allow horizontal scrolling in RBAC resource filter bar
2026-10-27 20:15:57 +08:00
lgq
cf98c8bd36
Merge branch 'codex/backup-before-sync-20261027-f0f93283'
2026-10-27 19:40:54 +08:00
lgq
f0f93283ee
fix: contain RBAC role catalog scrolling within workspace
2026-10-27 19:15:49 +08:00
lgq
4aeb296a98
fix: prevent RBAC member list from shrinking header controls
2026-10-27 19:03:33 +08:00
公明
0993dd8aad
Merge pull request #369 from GQingL/main
...
fix(settings): allow desktop sidebar to scroll
2026-10-27 17:04:06 +08:00
lgq
6daac86e06
fix(settings): allow desktop sidebar to scroll
2026-10-27 16:55:18 +08:00
Ed1s0nZ
c0d5c8460b
feat(api): add durable asynchronous conversation runs
2026-10-23 11:45:15 +08:00
Ed1s0nZ
5c5c5e199d
fix(openai): preserve provider-specific reasoning disable intent ( #366 )
2026-10-21 15:43:53 +08:00
Ed1s0nZ
be2c8c04e5
fix(rbac): protect built-in administrator from losing access
2026-10-19 16:44:14 +08:00
Ed1s0nZ
e6121e83eb
docs: translate four remaining guides and align bilingual navigation
2026-10-16 17:07:02 +08:00
Ed1s0nZ
63955c4d30
docs: remove internal process journals and organize public guides
2026-10-16 16:59:01 +08:00
Ed1s0nZ
3eecedb2af
docs: remove internal FOFA repair process record
2026-10-16 16:56:29 +08:00
Ed1s0nZ
a032fec0f6
docs: record main integration verification for FOFA repair
2026-10-16 16:17:42 +08:00
Ed1s0nZ
ee5e4dd7c7
Merge remote-tracking branch 'origin/main' into codex/fix-fofa-region
2026-10-16 16:17:04 +08:00
Ed1s0nZ
229cbdc548
docs: finalize FOFA region repair and changelog
2026-10-16 16:15:05 +08:00
Ed1s0nZ
945627e91a
docs: record FOFA field regression verification
2026-10-16 16:14:53 +08:00
Ed1s0nZ
0c0d4a53e8
fix: use supported FOFA region return field and preserve asset location
2026-10-16 16:14:39 +08:00
Ed1s0nZ
a7e483cbd5
docs: record FOFA repair plan
2026-10-16 16:12:56 +08:00
Ed1s0nZ
a5a881503a
docs: record FOFA repair design
2026-10-16 16:12:54 +08:00
Ed1s0nZ
abd22fba90
docs: record FOFA repair requirements
2026-10-16 16:12:50 +08:00
Ed1s0nZ
76bd3959ce
docs: record FOFA field repair intake
2026-10-16 16:12:26 +08:00
公明
4ca8b7d336
Update config.example.yaml
2026-10-16 13:51:26 +08:00
公明
f8cbb5efe8
Merge pull request #362 from Sycun/codex/fix-328-sqlite-asset-lock
...
fix: serialize SQLite asset writes without multiplying busy waits
2026-10-16 13:38:56 +08:00
公明
064360f4ec
Merge pull request #361 from Sycun/codex/project-resume-reuse
...
fix: restore project artifacts and test outcomes when resuming tasks
2026-10-16 13:38:07 +08:00
公明
1da911fb10
Merge pull request #360 from Sycun/codex/fix-mobile-project-ui
...
fix: restore mobile project layout, scrolling, and table readability
2026-10-16 13:37:27 +08:00
Sycun
51d78fda91
fix: bound SQLite lock waits and strengthen PR 329 coverage
2026-10-16 12:22:42 +08:00
Ordinary
9891b04215
fix: wait out SQLite busy on concurrent asset upserts
...
Deep mode fires many create_asset calls at once. UpsertAssets used a
DEFERRED transaction (SELECT then INSERT) on a 25-connection pool, so
writers hit SQLITE_BUSY immediately and returned "database is locked"
in a few milliseconds instead of waiting.
Open SQLite with _txlock=immediate and a 30s busy timeout, shrink the
pool, and retry locked upserts. Add a 32-way concurrent upsert test.
2026-10-16 12:20:21 +08:00
Sycun
e21ac52b62
test: make workspace inventory fixtures portable on Windows
2026-10-16 12:09:32 +08:00
Sycun
7bf9eb8511
Merge main and reconcile project resume with checkpoint index limits
2026-10-16 11:15:11 +08:00
Sycun
136b62deb5
Merge remote-tracking branch 'origin/main' into codex/fix-mobile-project-ui
2026-10-16 11:12:37 +08:00
Sycun
b8d65aa1e3
Merge upstream main and preserve mobile stylesheet cache version
2026-10-16 11:12:11 +08:00
Sycun
ac42b925da
Merge remote-tracking branch 'origin/main' into codex/project-resume-reuse
2026-10-16 11:11:04 +08:00
公明
3c0d57fe91
Merge pull request #355 from Sycun/codex/blackboard-context-memory
...
feat: retain compaction memory and evidence in the project blackboard
2026-10-16 11:10:29 +08:00
Ed1s0nZ