senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete audit security and frontend gaps

Browse Source
This commit is contained in:
yanweidong
2026-07-18 18:02:29 +08:00
parent 79feb20688
commit b7a84d31ea
28 changed files with 576 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
AGENTS.md
View File

@@ -26,6 +26,11 @@ The product is a private-deployment, project-centered workbench for individual k
- Keep task sharing conservative: assignees see the task and only explicitly shared linked objects.
- AI must not create official objects without user confirmation.
- AI calls must record provider, key type, action, status, and errors.
- Auth session tokens must be signed, expiring bearer tokens; do not accept forgeable `user:<id>` strings.
- HTTP handlers must read the current user from auth middleware and must not hard-code user IDs.
- Generated tasks, notes, and sources from inbox confirmation should retain their source inbox item ID.
- Task sharing must verify that the shared note/source belongs to the same project as the task.
- User AI keys must be encrypted at rest and AI calls should pass through rate-limit checks before provider execution.
## Frontend Rules