wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,739 Commits 190 Branches 2 Tags
bddf99a00262392af5985e5b492425e8654f4d7d
Commit Graph

14 Commits

Author SHA1 Message Date
Your Name
d0591c54b0 fix(security): 體健修復 — 7項 Critical/Major 安全問題全修
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 35s
Details 
## Critical 修復 (C1-C5)
- C1: git rm --cached 03-secrets.yaml（CHANGE_ME 模板不再追蹤）
- C2: git rm --cached awoooi.db + .gitignore 加 *.db（SQLite HARD_RULES 違規）
- C3: sentry-tunnel SENTRY_HOST 改為 process.env fallback
- C4: config.py DATABASE_URL 移除 changeme default，改為必填
- C5: run_migration.py 改為 os.environ["DATABASE_URL"]

## Major 修復 (M1-M4)
- M1: auto_repair /execute 加 CSRF 保護 + AutoRepairPanel.tsx 同步
- M2: drift /rollback /adopt 加 CSRF 保護（/internal/scan 保持無 CSRF）
- M3: terminal /intent 加 CSRF 保護 + terminal.store.ts 同步
- M4: live-dashboard HOST_IPS + host-grid VIP 改為 env var

## 其他
- 新增 apps/web/.env.example（6 個 env var 說明）
- K8s deployment-web 補入 3 個新 env var
- 整合測試：新增 aider_event_repository + ai_router_feedback 真實 DB 測試
- test_terminal.py CSRF dependency override 修復

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-22 01:27:39 +08:00
OG T
c6edfb5614 fix(flywheel): 四階段系統性修復 AUTO_REPAIR NO_MATCH 斷層
Some checks failed
CD Pipeline / build-and-deploy (push) Has been cancelled
Details 
Phase 1 — affected_services 污染根治
  - webhooks.py: _extract_affected_services() 從 labels 精準萃取服務名
    (component > job > pod deployment name > clean target_resource > [])
  - create_incident_for_approval: alert_labels 完整保留進 Signal
  - alert_name 從 alertname 取，不再用 "custom"

Phase 2 — Playbook alertname 變體擴充
  - alert_rules.yaml: 5 條規則新增 HostHighCpuLoad、KubePodCrashLooping 等變體
  - scripts/update_playbook_alert_variants.py: Redis index 已執行更新 ✅

Phase 3 — Jaccard 通用型 Playbook 豁免
  - similarity.py: affected_services=[] → 1.0 豁免（基礎設施 Playbook 不針對特定服務）
  - severity_range=[] → 1.0 豁免（適用所有嚴重度）

Phase 4 — Playbook Embedding 持久化（冷啟動修復）
  - migrations/flywheel_playbook_embeddings.sql: pgvector 持久化表
  - services/playbook_embedding_service.py: 啟動時重建 Redis 向量快取 + 同步 DB
  - main.py: lifespan 啟動時 asyncio.create_task 非阻塞執行

2026-04-10 Asia/Taipei — Claude Sonnet 4.6
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-10 11:04:56 +08:00
OG T
6416f56748 fix(e2e): 修正 HMAC Header 名稱 X-Webhook-Signature → X-Signature-256 
- API 期望 X-Signature-256，E2E 腳本使用錯誤的 Header 名稱
- 修復後 Daily E2E Health Check 應能通過

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 21:16:50 +08:00
OG T
8bd51ea7c8 fix(e2e): 新增 HMAC 簽名支援 
E2E 腳本現在會：
- 讀取 WEBHOOK_HMAC_SECRET 環境變數
- 計算 HMAC-SHA256 簽名
- 加入 X-Webhook-Signature header

修復生產環境 401 驗證失敗問題

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 20:54:28 +08:00
OG T
2c79cba629 fix(api): 修復最後 2 個 bare except 錯誤 
- scripts/test_nemotron_tool_calling.py: except -> except Exception

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 15:37:02 +08:00
OG T
d89f0520f9 fix(api): 修復 34 個 Ruff lint 錯誤 
- 自動修復 import 排序、unused imports
- 手動修復 raise from、isinstance union、unused variable
- scripts/ 暫時保留 (非 CI 阻擋)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 15:27:49 +08:00
OG T
d9a6f9d066 feat(api): Sentry Session Replay UX 自動監控 
Phase 19 UX 監控 - 善用 Sentry Session Replay:
- SentryService: 新增 list_replays, get_ux_audit_summary
- 偵測: 憤怒點擊 (Rage Clicks) + 死亡點擊 (Dead Clicks)
- 偵測: 有錯誤的 Session Replay
- 偵測: UI 相關錯誤 (TypeError/render)
- API: GET /api/v1/errors/ux-audit 端點
- 腳本: audit_ux_sentry.py CLI 工具

統帥回饋: "AI都要全自動化！" ✅

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 01:48:59 +08:00
OG T
179e659f14 chore: 清理 Playwright 產物 + kube-state-metrics 告警擴充 
清理工作:
- .gitignore 新增 playwright-report/ 和 test-results/ 排除
- 保留 phase19/ 參考截圖目錄

kube-state-metrics 告警擴充 (P3):
- CronJobLastRunFailed: Job 執行失敗
- DaemonSetMissingPods: DaemonSet 缺少 Pod
- StatefulSetReplicasMismatch: StatefulSet 副本不足
- ContainerWaiting: ImagePullBackOff/CrashLoopBackOff 偵測
- PDBViolation: PDB 健康 Pod 數不足
- NodeUnschedulable: 節點標記為不可排程

新增:
- apps/api/scripts/test_nemotron_tool_calling.py (E2E 比較測試)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 01:28:35 +08:00
OG T
fb643eb645 feat(ai): ADR-036 Nemotron E2E 驗證腳本 
新增 verify_nemotron_e2e.py:
- 測試 NVIDIA API 連線
- 測試 AIRouter 整合
- 測試高風險 Tool 檢測
- 測試繁體中文 Tool Calling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-29 00:11:40 +08:00
OG T
30153496d1 fix(api): 修復全部 lint 錯誤 (ruff --fix) 
- Import sorting (I001)
- Unused imports (F401)
- f-string without placeholders (F541)
- Loop variable unused (B007)
- zip() strict parameter (B905)
- Exception chaining (B904)
- collections.abc imports (UP035)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-26 16:06:20 +08:00
OG T
96c3ddd8c4 feat(api): Phase 18.1 K8s 資源名稱驗證 (ADR-016) 
三層防禦架構確保 kubectl 指令有效:
1. Webhook 入口正規化 (webhooks.py)
2. OpenClaw 產生指令前驗證 (openclaw.py)
3. 靜態映射表 + 模糊匹配 (k8s_naming.py, resource_resolver.py)

新增:
- src/utils/k8s_naming.py: RFC 1123 正規化 + 靜態映射
- src/services/resource_resolver.py: MCP K8s Tool 動態驗證
- docs/adr/ADR-016-k8s-resource-naming.md: 契約文檔
- scripts/e2e_tool_call_verification.py: E2E 驗證腳本 v2.0

修改:
- webhooks.py: Phase 18.1.7 入口正規化
- openclaw.py: Phase 18.1.6 產生指令前驗證
- Skill 03 v1.4: 新增 K8s 資源驗證章節

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-26 11:22:47 +08:00
OG T
4f1c8ae473 fix(ci): Resolve Python and TypeScript lint errors 
- Fix 35 Python ruff errors (B904, F841, E722, E741, B007, B008)
- Add eslint config for lewooogo-core package
- Update pyproject.toml to new ruff lint config format
- Relax frontend eslint rules to warnings for unused vars
- Allow console.* for debugging (TODO: unified logger)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-24 09:20:56 +08:00
OG T
6f049877fc fix(lint): ruff auto-fix + lewooogo-core src 加入 git 
- Python: ruff --fix 修復 280 個 lint 錯誤
- lewooogo-core: src/ 目錄未追蹤，導致 CI eslint 失敗

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-03-23 23:51:37 +08:00
OG T
196d269b92 feat: add all application source code 
- apps/api: FastAPI backend with Dockerfile
- apps/web: Next.js frontend with Dockerfile
- apps/sensor: Signal collection agent
- packages: shared packages

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-03-22 18:57:44 +08:00