b6bfa120fc
feat(core): implement app profile lifecycle dispatcher and wire cli commands
2026-08-28 00:02:30 +08:00
a4c3f70f0b
feat(plugins): migrate auth, user, message_gateway, risk_control, admin to domain plugins
2026-08-27 23:59:38 +08:00
75f226cfbf
docs(agents): update AGENTS.md and development skills for cordis architecture
2026-08-27 23:56:16 +08:00
94c5aa4cd3
docs: publish WAVELET architecture white paper and official developer guide
2026-08-27 23:51:37 +08:00
a25bf7a4f9
feat(plugins): package database, cache, logger, and storage as infra plugins
2026-08-27 23:51:10 +08:00
4efc2c92b7
feat(plugins): implement runtime drivers for http, asynq worker, and cron
2026-08-27 23:48:18 +08:00
ef6296bd22
feat(core): add typed eventbus and domain extension points
2026-08-27 23:47:58 +08:00
c53a5461ab
feat(core): add typed eventbus and domain extension points
2026-08-27 23:47:57 +08:00
d853a41eae
docs: initialize WAVELET white paper and developer guide
2026-08-27 23:43:06 +08:00
a6ab158855
feat(core): implement context service hub and generic ioc container
2026-08-27 23:41:12 +08:00
3792313797
docs: add cordis plugin architecture implementation plan
2026-08-27 23:38:02 +08:00
40de54fe5b
docs: add cordis downstream developer guide and cookbook
2026-08-27 23:33:12 +08:00
360f4f432c
docs: add cordis microkernel and plugin architecture design spec
2026-08-27 23:24:34 +08:00
ae3b792e16
feat(core): sync framework security hardening and accessibility improvements
...
- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md
2026-08-27 23:01:28 +08:00
b66cf3ae9c
feat(log): PG 分区清理与 logstore import-lint
...
CleanupExpired 先按月 DROP 过期分区，再删边界行并清理空分区；apps 禁止直连 analytics。
2026-08-16 16:48:15 +08:00
a8fcf6087a
chore(message-gateway): swagger and format
2026-08-16 12:27:03 +08:00
30acdb91e8
feat(message-gateway): add profile bot pairing card
2026-08-16 12:23:44 +08:00
124ce9bebb
feat(message-gateway): add admin channel cards and per-type forms
2026-08-16 12:22:28 +08:00
635c1760ad
feat(message-gateway): add user bind and unbind APIs
2026-08-16 12:19:32 +08:00
69d39d906f
feat(message-gateway): add admin channel CRUD APIs
2026-08-16 12:17:05 +08:00
09ec9d0af3
feat(message-gateway): run adapters on worker and handle pairing inbound
2026-08-16 12:14:17 +08:00
7ca6dbe272
feat(message-gateway): add QQ official C2C botgo adapter
...
Pin github.com/tencent-connect/botgo v0.2.1. Connect uses C2C intent
only via the official WebSocket session manager.
2026-08-16 12:10:15 +08:00
ef97ca5c7e
feat(message-gateway): add Telegram private-chat telebot adapter
2026-08-16 12:06:03 +08:00
cc86370e50
feat(message-gateway): emit message_gateway.inbound domain events
2026-08-16 12:04:55 +08:00
60afdf7c7b
feat(message-gateway): add channel, binding, and pairing repositories
2026-08-16 12:04:14 +08:00
9b1ef1cf7f
feat(message-gateway): add w_message_* models and goose migrations
2026-08-16 12:03:23 +08:00
8ea4c7e13e
feat(message-gateway): add channel types, registry, and pairing codes
2026-08-16 12:01:52 +08:00
a4db79e9bd
chore: ignore local git worktrees directory
2026-08-16 12:00:42 +08:00
8b1eb9ca0d
docs(message-gateway): add Wavelet message gateway implementation plan
2026-08-16 11:59:59 +08:00
e36db8a56c
docs(message-gateway): add Wavelet inbound channel gateway design spec
2026-08-16 11:55:57 +08:00
37d5a87c9b
chore: docs
2026-08-16 11:32:46 +08:00
e52592b16d
feat(log): 解耦用户访问日志存储，支持切换日志主库
...
用户访问日志可在 ClickHouse、PostgreSQL、SQLite 之间切换。
关闭 ClickHouse 时由主库承接写入与查询；切换任务会冻结写入、复制数据后翻转主库。
启动时校验日志主库与运行配置一致，定期清理按各库保留天数删除过期记录。
2026-08-16 11:17:55 +08:00
6a53619dd2
feat(framework): 回灌 OpenFlare 分层、安全与运行时改进
...
将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。
2026-08-16 11:07:20 +08:00
b9b42e3174
ci: make canary
2026-08-16 10:13:39 +08:00
20830d31bd
chore: guideline
2026-08-16 10:01:56 +08:00
284eec54f7
chore: guideline
2026-08-12 12:40:06 +08:00
a3ad0d2c97
chore: rename .agent to .agents and update skill path references
2026-08-12 12:39:15 +08:00
92322c7a22
feat(push): log upstream webhook response in task history
...
Pusher.Send now returns the upstream response body alongside the error,
so the push task handler can print what the webhook actually replied
(custom channel e.g. {"errcode":0,"errmsg":"ok"} or a rejection
like {"errcode":93000,...}) into the task log on both success and
failure. Other pushers (lark/telegram/email) return an empty string,
keeping their behavior unchanged.
fix(push): surface webhook business errors in custom channel audit
CustomPusher.Send only checked the HTTP status code. WeChat Work /
DingTalk webhooks return HTTP 200 with a non-zero errcode in the body
even when the message is rejected (e.g. template_card requires
card_action.url when type=1), so rejected pushes were recorded as
'success' in the notification history. Parse the response body and
return an error when errcode is non-zero, matching the Lark pusher.
2026-08-12 12:32:23 +08:00
f499645cdc
chore: guideline
2026-08-12 12:02:14 +08:00
776c6b397c
ci: canary
2026-08-03 21:54:08 +08:00
db17965b1a
chore: docker-compose
2026-08-03 21:48:34 +08:00
ae35b4e733
ci: docker hub
2026-08-03 21:45:50 +08:00
c6d22549ce
ci: canary
2026-08-03 21:32:42 +08:00
9f15f42b47
fix(frontend): keep browser API on same-origin rewrites in dev
...
Document that NEXT_PUBLIC_WAVELET_BACKEND_URL must stay unset for local
next dev so axios hits /api/* and Next rewrites proxy to the backend.
2026-08-03 21:25:22 +08:00
a4588b05e0
fix(frontend): suppress body hydration warning from extensions
...
Browser extensions can inject classes like vc-init onto body before
React hydrates; ignore attribute mismatches on body.
2026-07-24 16:30:49 +08:00
1625cfb2fb
feat(frontend): add next-intl bilingual i18n for core paths
...
Wire next-intl without locale routes, add zh-CN/en catalogs, language
switcher, and migrate layout/auth/settings UI copy. Document i18n rules
in AGENTS.md and keep static export builds working.
2026-07-24 16:25:41 +08:00
9c1369186f
docs(i18n): add frontend bilingual i18n design spec
...
Capture the approved next-intl non-routing approach for zh-CN/en,
locale resolution, static-export constraints, and phase-1 core-path scope.
2026-07-24 16:08:45 +08:00
fbbb75095f
refactor(structure): group platform, infra, and shared packages
...
Move process wiring, technical adapters, and cross-cutting contracts out of flat internal/ packages so new code has a clear home without changing business layout.
2026-07-24 15:28:39 +08:00
290427d5fa
chore: remove
2026-07-24 14:29:07 +08:00
72dbfac3fc
chore: update pg version
2026-07-24 11:18:01 +08:00
ryan