From b706b7e0ba4e87a22086a6caef64b1524d8cd60c Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Fri, 7 Aug 2026 17:17:31 +0800 Subject: [PATCH 1/2] =?UTF-8?q?chore(docs):=20v0.6.0=20=E5=8F=91=E5=B8=83?= =?UTF-8?q?=E6=94=B6=E5=B0=BE=20=E2=80=94=20CHANGELOG=20=E8=A1=A5=E5=8F=91?= =?UTF-8?q?=E5=B8=83=E4=BF=AE=E5=A4=8D=E3=80=81MASTER=20=E8=AE=B0=20DONE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit neat-freak 收尾： - CHANGELOG v0.6.0 条目补 macOS 发布链路与 release job 6 项修复（#1643-#1648） - MASTER Active 表新增 v0.6.0 正式发布 DONE 行（rc.1-rc.4 tag 已清理，rc.5 保留） - MASTER Last updated 刷新至 2026-08-07 --- CHANGELOG.md | 1 + docs/progress/MASTER.md | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a897a31e..c203ca5c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ - 修复部署：根 `docker-compose.yml` 的 hub-server build context 改为仓库根（此前 `./hub-server` 与 Dockerfile 的 `COPY go.work/pkg/edge-server` 冲突，`docker compose up --build` 必然失败）。 - 新增 `scripts/e2e/verify-wsl-full-stack-e2e.py`：WSL 容器形态全栈 E2E（tokendance-id + hub-server + PG16 + Redis7），真实 OIDC PKCE 登录流 18 项断言 + integration 级证据 manifest（`real_tokendance_id_login=true`）。 - 测试基建：偿还 golangci-lint v2.12.2 对测试文件的 gosec G101/G306 与 staticcheck QF1008/QF1002 finding（master 基线漂移修复）。 +- 修复桌面 macOS 发布链路（自 v0.5.0 起 macOS DMG 从未构建成功，v0.6.0 验证过程逐层修复）：恢复 `apple-native-keyring-store` 的 `keychain` feature（#1643）；修正 `keychain::Store` 模块路径（#1644）；macOS 构建改用 `--bundles dmg` 覆盖仅含 nsis 的 bundle targets（#1645）；应用图标 PNG 16-bit → 8-bit RGBA（#1646）；release job 放行 skipped 依赖（#1647）；`mobile-artifacts` 条件下载（#1648）。 - 上一版（v0.5.0 及更早）的完整历史见 [docs/history.md](docs/history.md)。 ## 历史 diff --git a/docs/progress/MASTER.md b/docs/progress/MASTER.md index 1c08a9e1..e11bedae 100644 --- a/docs/progress/MASTER.md +++ b/docs/progress/MASTER.md @@ -1,6 +1,6 @@ # AgentHub Progress Tracker -> **Last updated**: 2026-08-05 +> **Last updated**: 2026-08-07 > **Mode**: `GITHUB_FULL` > **Authority**: current source and tests > this tracker > historical analysis. Use `git status`, `git log`, and live GitHub state before acting. @@ -37,6 +37,7 @@ Restore a trustworthy green main branch, then reduce maintenance cost through si | WebSocket incremental sync | SPEC merged；issue 已归档，实施 tracker 以 docs/plan/proposal-ws-incremental-sync.md 为准 | docs/plan/proposal-ws-incremental-sync.md | | IM bridge (Feishu first) | SPEC merged；issue 已归档，实施 tracker 以 docs/plan/proposal-im-bridge.md 为准 | docs/plan/proposal-im-bridge.md | | WSL 全栈 E2E（真实 OIDC 登录） | SPEC merged + 已跑通（2026-08-06）：容器形态全栈（tokendance-id + hub-server + PG16 + Redis7）真实 OIDC PKCE 登录流 18 项断言全过，证据 `real_tokendance_id_login=true`（integration 级）；顺带修复 hub Timeout 中间件 WS upgrade 挂起、未认证请求审计 user_id 空串 PG 报错、compose hub build context 损坏、release build-mobile 无 EXPO_TOKEN 阻塞 | docs/plan/proposal-wsl-full-stack-e2e.md | +| v0.6.0 正式发布 | **DONE 2026-08-06**：release 全链路（tag-guard → build-go 6 平台 → build-desktop NSIS/portable → build-desktop-macos DMG → release job）通过并发布，10 个资产（无 APK，RELEASE_MOBILE_ENABLED 未启用）；发布验证过程修复 macOS 桌面链路 4 项（keyring feature / keychain::Store / --bundles dmg / 图标 8-bit）与 release job 2 项（skipped 依赖放行 / mobile-artifacts 条件下载，#1643–#1648）；rc.1–rc.4 中间 tag 已清理，rc.5 保留为验证里程碑 | release: v0.6.0（2026-08-06） | | Automations and session import | Product backlog | backlog：SPEC 待写 | | @提及=派单交互 | Product backlog | backlog：SPEC 待写 | From 3bae5d03e454176b9b0c966df1f8553522adaf50 Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Fri, 7 Aug 2026 17:20:47 +0800 Subject: [PATCH 2/2] =?UTF-8?q?fix(deps):=20pnpm=20audit=20=E5=85=A8?= =?UTF-8?q?=E6=B8=85=20=E2=80=94=20js-yaml=204.3.1=20/=20mermaid=2011.16.1?= =?UTF-8?q?=20overrides?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm 新公告（2026-08-07 起 CI pnpm audit 失败）： - mermaid <11.16.1 5 项（@lobehub/ui 间接依赖：CSS 注入/原型污染/XY 图无限循环等） - js-yaml@4 <4.3.1 1 项 high（CVE-2026-59870，expo CLI 链） overrides 下限提高并本地验证 audit 0 漏洞。 --- app/package.json | 3 ++- app/pnpm-lock.yaml | 23 ++++++++++++----------- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/app/package.json b/app/package.json index 12a3df31..7f70e4ac 100644 --- a/app/package.json +++ b/app/package.json @@ -36,7 +36,8 @@ "brace-expansion@1": ">=1.1.16 <2", "brace-expansion@2": ">=2.1.2 <3", "brace-expansion@5": ">=5.0.9 <6", - "js-yaml@4": ">=4.3.0 <5", + "js-yaml@4": ">=4.3.1 <5", + "mermaid": ">=11.16.1 <12", "shell-quote": ">=1.9.0", "postcss": ">=8.5.18 <9", "@babel/core": ">=7.29.6 <8", diff --git a/app/pnpm-lock.yaml b/app/pnpm-lock.yaml index 22abefc0..d4c7c0da 100644 --- a/app/pnpm-lock.yaml +++ b/app/pnpm-lock.yaml @@ -10,7 +10,8 @@ overrides: brace-expansion@1: '>=1.1.16 <2' brace-expansion@2: '>=2.1.2 <3' brace-expansion@5: '>=5.0.9 <6' - js-yaml@4: '>=4.3.0 <5' + js-yaml@4: '>=4.3.1 <5' + mermaid: '>=11.16.1 <12' shell-quote: '>=1.9.0' postcss: '>=8.5.18 <9' '@babel/core': '>=7.29.6 <8' @@ -5207,8 +5208,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsc-safe-url@0.2.4: @@ -5630,8 +5631,8 @@ packages: resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==} engines: {node: '>= 8'} - mermaid@11.16.0: - resolution: {integrity: sha512-Zvm3kbstgdpvIJPPItlL7fppIZ3kibvc1oZIGxdvk9t6UFz6flv+Jw7FtRGKwfcI8OckmH04LqG6LlS6X4B1pA==} + mermaid@11.16.1: + resolution: {integrity: sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==} metro-babel-transformer@0.84.4: resolution: {integrity: sha512-rvCfz8snl9h20VcvpOHxZuHP1SlAkv4HXbzw7nyyVwu6Eqo5PRerbakQ9XmUCOsRy70spJ37O+G1TK8oMzo48g==} @@ -9128,7 +9129,7 @@ snapshots: dependencies: '@babel/code-frame': 7.29.7 chalk: 4.1.2 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@floating-ui/core@1.8.0': dependencies: @@ -9375,7 +9376,7 @@ snapshots: leva: 0.10.1(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) lucide-react: 1.28.0(react@19.2.7) marked: 17.0.6 - mermaid: 11.16.0 + mermaid: 11.16.1 motion: 12.40.0(@emotion/is-prop-valid@1.4.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) numeral: 2.0.6 polished: 4.3.1 @@ -9464,7 +9465,7 @@ snapshots: leva: 0.10.1(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) lucide-react: 1.28.0(react@19.2.8) marked: 17.0.6 - mermaid: 11.16.0 + mermaid: 11.16.1 motion: 12.40.0(@emotion/is-prop-valid@1.4.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) numeral: 2.0.6 polished: 4.3.1 @@ -12608,7 +12609,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 parse-json: 5.2.0 optionalDependencies: typescript: 6.0.3 @@ -14340,7 +14341,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -14901,7 +14902,7 @@ snapshots: merge2@1.4.1: {} - mermaid@11.16.0: + mermaid@11.16.1: dependencies: '@braintree/sanitize-url': 7.1.2 '@iconify/utils': 3.1.4