# Release Notes

## v1.3.1 — 2026-06-13

**发行与源码保护** —— 三档分发方式 + 多平台二进制 CI，外加一个潜在 bug 修复。

### 源码保护三档（`setup.sh`）

代码要在用户机器上跑，Python 无法做到绝对不可逆；本版把"现实可达的最强保护"补齐：

| 命令 | 产物 | 防护 | 用户需 Python |
|---|---|---|---|
| `--build` | 普通 wheel | 不混淆（止泄露仓库/测试/内部文档） | 是 |
| `--build-secure` | `.so` wheel | Nuitka 编译，**逻辑不可反编译** | 是 |
| `--build-binary` | 单文件二进制 | 机器码 + 内嵌一切（前端/内置包） | **否，双击即用** |

- `--package` 自动优先用编译版组装「不含源码」的 `release/`。
- 实测：`.so` wheel 与单文件二进制均在干净/无 Python 环境启动服务、加载内嵌 Web UI、
  首启自动安装全部 10 个内置包；docstring 已剥离。
- **诚实边界**：开源版 Nuitka 不加密字符串常量（日志/prompt 仍可 `strings` 提取）；
  编译产物绑定平台+架构；chromadb/PDF 外部工具未内嵌。详见手册「源码保护」。

### 多平台二进制 CI

- `.github/workflows/build-binary.yml`：打 `v*` tag 自动构建 macOS arm64 / macOS Intel /
  Linux / Windows* 二进制并附到 GitHub Release；也可 `workflow_dispatch` 手动。
- 已验证：Linux x86_64 ✓、macOS arm64 ✓（Windows 为实验性，*nix 脚本待 Windows 适配）。

### Bug 修复

- **`secrets` 子包撞名（latent bug）**：`agentpaas.secrets`（AES 加密 vault，全仓零引用的
  死代码）与 stdlib `secrets` 同名。CPython 绝对导入下 stdlib 胜出故线上正常，但会在
  Nuitka 打包等场景遮蔽 stdlib，导致 `from secrets import token_hex` 失败。重命名为
  `agentpaas.secretvault`。
- **Web UI 路径解析**：`_resolve_webui_dist` 增加 frozen/打包布局候选（源码与 dev 模式不变）。
- **editable 安装 bug**：`setup.sh` 原 `pip install -e ".[all]"` 指向无 pyproject 的根目录，
  改为 `./lambdagent`；并新增「发行/源码」双模式自动识别。

回归 334 + 566 全绿；CI 6 job 绿。

## v1.3.0 — 2026-06-13

**从「能跑」到「好用」的工作台升级** — 智能体有了记忆、有了统一入口、能接外部工具
和能力插件。全程每块功能都经 codex 评审 + 测试 + live 验证 + CI 绿。
848+ 测试通过（Python 3.10/3.11/3.12 矩阵 + webui 构建）。

### Highlights

- **今日工作台（首页重构）**：AI 助手输入框成为主入口 —— 自然语言描述任务，
  一次轻量 LLM 意图分类自动分发给合适的智能体并预填，拿不准则回退手动选择
  （永不卡死）。配「继续上次的工作」最近运行列表 + 常用场景卡片（点击直达，
  无实例则从内置包自动创建）。统计降为页脚。

- **五层记忆系统**（全本地、跨运行持久，按 codex 评审 20 条实现）：
  - **会话记忆**：同一对话线程自动注入前情（最近几轮 + 滚动摘要），连续追问
    不用重复背景；前情带不可信边界包裹 + 注入清洗，失败轮不注入错误文本。
  - **情景记忆**：跨会话按当前问题 CJK 语义召回相关历史（修了一个 `import json`
    缺失导致 recall 一直返回空的隐藏 bug，外加 recall 跨 run 持久性修复）。
  - **核心记忆**：run 后自动提炼用户事实/偏好进**待确认区**，人工确认才转正；
    敏感信息（身份证/手机/成绩/健康）prompt + 正则双层拦截，绝不自动记录。
  - 对话页「新会话 / 历史」管理线程；记忆面板「待确认」tab 逐条确认。

- **MCP 工具注册中心**：「工具与连接」页接入外部 MCP 服务（http/sse/stdio）。
  json 单一权威源 + 文件锁、凭证只存环境变量名（值不回显）、stdio 命令走
  allowlist、工具风险预分级（删除/发送类升 HIGH 触发人工确认 —— 同时修了
  ToolGateway 把 MCP 一律判 LOW 的老漏洞）、连接测试拉工具清单。

- **能力插件（prompt skill）**：可复用的「提示词 + 工具依赖」，挂载到智能体即
  扩充能力。系统规则永远优先于插件、含可疑指令的插件被拒、高风险工具不自动
  授予。「工具与连接」页可视化管理。

- **模型显示与切换**：模型页一览各智能体当前模型，下拉一键切换（新版本可回滚）；
  Ollama 选项实时探测本机已装模型。

- **工作目录与产物**：创建智能体自动开辟 `Workspace/<名>/{data,workspace}` 标准
  布局，产物不再藏进安装目录。包 zip 更新可让基于它创建的智能体自动跟进最新配置。

- **产物 Gate 流水线 human-gate resume + simple agent token 透传**（P3 收尾）：
  「导师在环」可插进自动化流水线、打回只重跑单阶段；单轮智能体成本不再恒为 0。

- **示例知识库**：桌面首启自动创建「示例知识库（数据结构课程）」，开箱即可
  搜索/问答/挂接体验。

- 文档：[Desktop 使用手册](docs/DESKTOP_MANUAL_zh.md) 更新到 v1.3.0（新增记忆系统、
  工具与连接、工作台、模型切换等章节）；记忆与 MCP/Skill 两份设计稿含完整
  codex 评审修订记录。

## v1.2.0 — 2026-06-11

**面向高校教师的完整工作台** — 内置包从 3 个扩到 10 个，知识库调用链修通，
全面审计修复 15 项，CI 恢复全绿。848 个测试通过（tests/ 282 + lambdagent 566），
Python 3.10/3.11/3.12 三版本矩阵 + webui 构建全过。

### Highlights

- **10 个内置智能体包**，覆盖科研-教学-学术服务全场景：新增论文润色投稿、
  审稿回复（rebuttal）、研究生论文指导、课程设计（OBE 大纲四件套）、
  试卷题库（双向细目表 + A/B 平行卷）、学术信函（推荐信/邀请函/提名），
  以及多视角审稿编排器（4 位专科子审稿人）。全部 local-first、预设 guard、
  enforceLoop 强制产物分文件落盘（防"嘴上写文件"）。

- **包 zip 更新**：`POST /agentpacks/{id}/update-upload` — 上传新版 zip，
  由该包创建的所有智能体自动切换到最新配置（生成新版本，可回滚）；
  包 id 校验防误传，webui 包卡片一键「更新」。

- **知识库调用链修通**：KBSearch/KBList 工具此前查的是另一套互不相通的
  本地库（agent 永远查不到页面上挂接的资料库）—— 现在注入平台版实现，
  agent 推理中途可多次主动检索挂接的知识库（租户隔离）。
  中文检索修复（CJK bigram 分词，原整句中文恒 0 分）。

- **示例知识库**：desktop 首启自动创建「示例知识库（数据结构课程）」——
  使用指南 + 迷你讲义，索引随建随用，开箱即可搜索/问答/挂接体验。

- **工作目录自动开辟**：创建智能体实例自动建
  `Workspace/<名>/{data, workspace}` 标准布局（可配 AGENTPAAS_WORKSPACE_BASE），
  产物不再藏进安装目录；重名加后缀、显式路径优先。

- **模型显示与切换**：模型页新增「使用中的模型」—— 各智能体当前
  provider/model 一览 + 下拉一键切换（新版本可回滚）；ollama 选项
  实时探测本机已装模型。

- **HIGH-risk 工具确认闭环**（SEC-12/30 收尾）：`confirm_required` SSE
  事件 + `GET/POST /traces/{run_id}/confirm`，5 分钟超时拒绝（fail-closed）。

- **全面审计（docs/AUDIT_2026-06-11.md）**：修复 AGENTPAAS_TESTING=0
  误判、测试环境泄漏机器配置与真实 API key、run 失败判定结构化
  （Context.provider_errors，LLM 输出含错误字样不再误判）、限流加锁、
  estimate_cost 认 ConversationLam、孤儿 run 前端兜底、FIX-10 循环引用
  检测（编译期死代码修复 + 运行期在飞栈）、Pydantic v2 / lifespan 清理。

- **CI 修复**：补 python-multipart 主依赖（自 06-07 全红的根因）；
  lambdagent 566 测试首次进 CI；collected 数下限防测试静默蒸发。

- **中文安装使用手册**：docs/DESKTOP_MANUAL_zh.md（13 章，面向非技术
  科研用户），已入 mkdocs 导航。

## v1.1.0-rc1 — 2026-06-07

**M1 Desktop runtime + M2 AgentPack ecosystem** — two milestones delivered
ahead of schedule. 189 tests green on Python 3.10/3.11/3.12.

### Highlights

- **Three-mode deployment** (`desktop` | `lab` | `paas`) — flip one env var, same
  codebase. Desktop mode defaults to `127.0.0.1`, auto-bootstraps a tenant +
  API key on first launch, and hides `/admin` + `/billing` routes (oracle
  defense, 404 not 403). Lab/PaaS modes unchanged.

- **Desktop webui** — mode chip in sidebar, SR-002 cloud-privacy modal (first
  use of a cloud model discloses what is/isn't sent), mode-aware nav labels
  (scientists see "今日工作/资料库/模型与隐私" instead of platform-operator terms),
  branded title per mode.

- **FR-002 data directory** — Desktop: `~/LambdAgentDesktop` (user-visible in
  Finder/Explorer). Lab/PaaS: `~/.agentpaas/data`. Wizard-persisted override
  via `GET/PUT /setup/data-dir` (loopback-only).

- **AgentPack ecosystem** — install/list/uninstall AgentPacks from local zips.
  Manifest validates id, semver, entrypoint path escape, shell permission (SR-003
  deny-by-default). Store: zip-slip defense, yaml.safe_load, per-version dirs.

- **3 built-in research packs** — `research.top-journal-reviewer` (论文审稿报告
  + 中稿概率 + 修改清单), `research.literature-mapper` (文献地图 + 方法谱系),
  `research.grant-planner` (立项依据 + 技术路线 + 风险). All local-first
  (no shell, no network), compile cleanly via `from_config`.

- **Citation-aware PDF ingestion** — `lambdagent/ingest.py`: pdfplumber page-
  number-preserving chunker, `[Source N | file.pdf p.12]` citation format,
  Obsidian `[[wiki]]` link expansion.

- **Pack→Agent one-click** — `POST /agentpacks/{id}/create-agent` creates an
  agent backed by an installed pack. `agent_dir=pack.path`, `_config_dir=pack.path`
  so sub-agent `./agents/x.yml` references resolve inside the pack root.

- **AgentPacks webui page** — `/agentpacks` route: install from local zip path,
  list installed packs with permission chips, uninstall, "从此包创建智能体" modal.
  Safety banner highlights local-first constraints.

- **E2E dogfood tests** — `tests/test_agentpack_e2e.py` (11 tests): full HTTP
  path install→list→get→create-agent→GET agent→`from_config()` compile→uninstall
  (no cascade delete). `scripts/dogfood_agentpack.py`: manual LLM run script.

### New routes

```
GET    /api/v1/setup/mode              — mode + bootstrapped flag (unauthenticated)
GET    /api/v1/setup/data-dir          — current data dir (loopback)
PUT    /api/v1/setup/data-dir          — change data dir (loopback)
GET    /api/v1/agentpacks              — list installed packs
GET    /api/v1/agentpacks/{id}         — pack detail + permission summary
POST   /api/v1/agentpacks/install      — install from local zip (loopback)
DELETE /api/v1/agentpacks/{id}         — uninstall
POST   /api/v1/agentpacks/{id}/create-agent — create agent from pack
```

### Stats

| | v1.0.0-rc2 | v1.1.0-rc1 |
|---|---|---|
| Python tests | 184 | 189 (+5 e2e) |
| lambdagent exports | 81 | 197 |
| Python lines | ~11,300 | ~13,500 |
| Routes | 79 | 87 |

### Migration from v1.0.0-rc2

No DB schema changes. Restart the server after `git pull`.

New env vars (all optional, sensible defaults):
- `AGENTPAAS_DEPLOYMENT_MODE` — `desktop` (default) | `lab` | `paas`
- `AGENTPAAS_AGENTPACKS_DIR` — override agentpacks install dir
- `AGENTPAAS_TESTING=1` — disable auto-bootstrap in test harnesses

### Known limitations (carried from rc2)

The 8 `test_authenticate` failures (pre-existing) are a test harness issue —
the `authenticate()` function works at runtime but the test fixtures do not
fully wire the new PBKDF2 path. Fix targeted at v1.1.0.

---

## v1.0.0-rc2 — 2026-06-07

Second release candidate. Five post-rc1 commits closing **14 more audit
findings** ([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md))
without changing the v1.0 surface or behavior contract. No migration
needed from `v1.0.0-rc1` — `git pull` + restart.

### Highlights

- **Security batch (8 high)** — closed 8 attack surfaces with 1-10 line
  fixes, each with a regression test in the new integration suite.
- **Test coverage (3 high)** — added 25 tests across authenticate(),
  rag.py, and instance-DB persistence; total tests at root `tests/`
  now 132 (was 96), all green on Python 3.10 / 3.11 / 3.12.
- **physics67 escape fix** — prevents the agent-write-to-repo-root
  pattern uncovered in user audit; .gitignore defense in depth.
- **Doc/spec alignment (2 high)** — `agentpaas/SPEC.md` stream URL +
  response schema now match code; `docs/agentpaas.md` architecture
  diagram corrected for the src-layout move.

### Audit findings closed in rc2

- `5e4688b` — `docs/agentpaas.md` architecture path (post src-layout)
  + `agentpaas/SPEC.md` §3.3.1 response schema (#74 #75)
- `c764d11` — physics67 sub-agent prompts forced to absolute paths
  + .gitignore defense for stage-name escape patterns (root cause for
  the `03_analysis/` and `nh_qgt/` write-escape bugs)
- `c641f34` — **security batch**:
    - `#14` `rollback_agent` RBAC + audit_log + tenant scope on version SELECT
    - `#24` dev `docker-compose.yml` master-key fail-fast (was static
      `dev_auto_generated` fallback)
    - `#25` rate-limit middleware: unauth → per-IP bucket (was silent
      bypass `if not api_key: return await call_next(request)`)
    - `#26` `/analyze/*` router: `Depends(get_tenant)` + 256 KB body
      cap (closes audit low `#90` billion-laughs DoS for free)
    - `#27` `/knowledge/{kb_id}/files`: `kb_root` containment check
      via resolved-path `startswith(kb_root + os.sep)`
    - `#28` `/jobs/{job_id}` IDOR: tenant ownership check; 404 not 403
      to defeat the id oracle
    - `#30` `_build_kb_context`: per-kb SELECT now scoped by tenant_id
      so runtime can't fan out over another tenant's KBs
    - `#32` Dockerfile: `USER appuser` (UID 10001) instead of root
- `e2332cd` — **test gap batch**:
    - `#34` `tests/test_authenticate.py` (NEW, 9 tests including the
      headline SEC-01 legacy→PBKDF2 auto-migration assertion)
    - `#35` `tests/test_rag.py` (NEW, 8 tests; covers
      SimpleVectorStore + RAGTool + create_rag deterministic ranking)
    - `#36` `tests/test_instance.py +3` tests covering the
      `agents.agent_template` / `agents.instance_dir` DB columns

### Side fixes

- `agentpaas/db/models.py` migration loop now skips ALTERs against
  tables that don't yet exist (caught when running against fresh
  `:memory:` SQLite — silently broken in `_init_tables` order
  pre-rc2; production hid this because the DB persists across boots).
- `Chat.tsx` rate-limit-aware: `/cancel` POST is now permanently
  exempt from rate limiting (user-flagged: clicking Stop on a
  runaway iterate run would get 429'd through the polling burst).

### Cumulative audit progress

```
critical: 7/7   ✓ (100%)
high:     22/33    (67%)
medium:    1/29
low:       1/15
─────────────
TOTAL:    28/84 = 33% closed
```

### Out of scope for rc2 (and rc-line in general)

The remaining 11 high findings cluster into multi-week refactors —
not fit for rc patches:

- 4 parallel beta-reduction interpreters (audit `#20`)
- `compiler.py` god-module 1654 LOC split (audit `#21`)
- Compiler → Runtime layer violation (audit `#19`)
- Module-global `_shell_set_cwd` concurrency race (audit `#11`)
- Single shared SQLite connection (audit `#13`)
- `qaagent67lambda` template hardcoded `/home/67/...` (audit `#16`)
- `qaagent67lambda` `pickle.load` on shared knowledge dir (audit `#17`)
- React error boundary missing (audit `#22`)
- Chat history setState race (audit `#23`)
- README "11 constructs" vs YAML supporting 5 (audit `#40`)
- `lambdagent_guard` MIT vs lambdagent BUSL license conflict (audit `#44`)

These move to GitHub issues and target `v1.1`. The release-candidate
line is closed for new feature work.

### Migration from rc1

None. Same SQLite schema, same routes, same wire format. Restart the
service after `git pull` to pick up the rate-limit + auth changes.

---

## v1.0.0-rc1 — 2026-06-06

First public release candidate of **lambdagentpaas** — a full-stack platform
for building, deploying, and serving AI agents defined in a Lambda-calculus
DSL. The release follows a structured audit
([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md)) and 4 focused fix
phases tagged in the git history.

### Highlights

- **lambdagent DSL kernel** — 152 exports, 11 Lambda-calculus constructs,
  CEK machine, cost vectors, algebraic-law proofs (Paper II), instance
  mechanism, run-workspace isolation. 175 kernel tests passing.
- **agentpaas PaaS layer** — REST API for agent CRUD / run / streaming SSE /
  cancellation / knowledge bases, with auth + multi-tenant data model.
  83 mounted routes. **+7 new HTTP-level integration tests** in this rc1
  (auth dependency, cross-tenant isolation, loopback `/bootstrap` guard).
- **webui** — React + Vite frontend covering chat, agent editor, run
  inspector, knowledge-base UI, agent workspace browser. Builds clean
  under `tsc --noEmit`.
- **agentexample** — `agent67`, `physics67` (12-step research pipeline
  with artifact gates), `qaagent67*` (RAG QA), `travelagent67`,
  `pptagent67`, `research67`.
- **CI** — `gitleaks` secret scan with 6 China-side provider rules + dev
  doc placeholders allowlist; pytest matrix on Python 3.10/3.11/3.12;
  Node 20 webui build; package-surface smoke import.

### Audit-driven security & robustness improvements

Of 84 audit findings (7 critical / 33 high / 29 medium / 15 low), this rc1
closes **5 critical and 6 high** in 4 commits:

- `9a3f22b` **Phase 0** — Delete unsafe surface, harden `/bootstrap`
  - **Audit critical #2** — Removed unauthenticated Feishu bot integration
    (`agentpaas/api/v1/feishu.py` + `agentpaas/services/feishu.py`); had no
    signature verification and process-wide bot rebind.
  - **Audit critical #3 + #7** — Removed `agentexample/agent67/tools/shell_executor.py`
    (LLM-controlled `shell=True` with bypassable substring blocklist).
  - **Audit critical #1** — `POST /api/v1/setup/bootstrap` now refuses
    non-loopback callers (returns 404). For production deploys behind a
    reverse proxy, use the `agentpaas` CLI to bootstrap the initial tenant.

- `a942525` **Phase 1** — `agentpaas` src-layout + declare `lambdagent` dep
  - **Audit critical #4 + high #18** — `agentpaas/pyproject.toml` previously
    used `where = [".."]` which empirically shipped a 1.2 KB metadata-only
    wheel. Migrated to src-layout (`agentpaas/src/agentpaas/`), declared
    `lambdagent>=0.1.0` as a real dependency. `python -m build --wheel`
    now produces a 144 KB wheel containing all source.

- `63ea55b` **Phase 2** — Robustness fixes
  - **Audit high #8** — `lambdagent.agentruntime.async_executor` now forks
    Context per parallel branch (mirroring the sync `multiagent.py:681`
    path). Restores Paper II Prop 30 confluence on the async path.
  - **Audit high #9** — sub-agent caller in `lambdagent.fromconfig.compiler`
    no longer swallows `CancelledRun`; the host's `/cancel` endpoint can
    now actually stop a sub-agent.
  - **Audit high #10** — both `/api/v1/agents/run` and the in-process
    sandbox path offload sync `term.apply()` to `run_in_executor`,
    unblocking the FastAPI event loop. Per-worker concurrency restored.
  - **Audit high #15** — `Chat.tsx` adds an unmount-only `useEffect` that
    POSTs `/cancel`, stopping backend claude subprocess money-burn when
    a user navigates away mid-stream.
  - Carry-over WIP folded in: `_FAILURE_KEYWORDS` substring fail markers
    in agents.py; `_compile_react` capability gate; claude-code provider
    `_StallError` + idle-timeout helper.

- `7d629b1` **Phase 3** — HTTP integration test skeleton
  - **Audit critical #6** — Added 7 integration tests using
    `fastapi.testclient.TestClient` + isolated `sqlite:///:memory:` DB.
    Covers auth dependency (401 paths + happy path), Phase 0 loopback
    guard verification, cross-tenant isolation on GET-by-id and LIST.
  - Side fix: `agentpaas/db/models.py` migration loop now skips
    migrations whose target table doesn't yet exist (caught when running
    against a fresh `:memory:` DB).

### Documentation

- `README.md` — new **v1.0 scope** section listing deliberate non-goals;
  Quick Start examples fixed (Loop `max_steps` + `condition(result, step)`,
  Memory `store=`, nl2agent at `experiments/`); repository layout table
  corrected for `deploy/` (native scripts, not Docker Compose).
- `CONTRIBUTING.md` — license corrected from MIT to BUSL-1.1.
- `docs/AUDIT_2026-06-05.md` — 84-finding audit report (Chinese), kept
  local-only; use as a roadmap for v1.1+ work.

### Installation

```bash
git clone https://github.com/kenny67nju/lambdagentpaas
cd lambdagentpaas

# Editable installs against the local source
pip install -e ./lambdagent/
pip install -e ./agentpaas/[dev]

# Run the API server
python -m agentpaas serve

# (Optional) build the web UI
cd webui && npm install && npm run build
```

### Known limitations

These remain on the **post-rc1 backlog** ([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md)
for the full list):

- **Multi-tenancy** — data model and most queries scope by `tenant_id`,
  but only GET-by-id and LIST endpoints are integration-tested for
  isolation. v1.0 is **intended for single-tenant deployments**.
- **Four parallel beta-reduction interpreters** (`Term.apply`,
  `async_core` monkey-patch, `executor`, `cek_machine`) — audit #20.
  Adding a new constructor requires touching 4 files. Refactor deferred
  to v1.1.
- **`compiler.py` is a 1654-LOC god module** (audit #21); the 474-line
  `_compile_react` closure should split into `agentruntime/react_loop.py`.
- **`secrets/vault.py`** uses unsalted SHA-256 as the KDF (audit #12);
  works but should be PBKDF2/scrypt before any non-trivial production use.
- **`POST /run` sync path is functional but capped at 1 concurrent run
  per FastAPI worker** until the event-loop offload (Phase 2 fix #10)
  is verified under load.
- **Feishu integration removed**; will be re-added in v2 with proper
  X-Lark-Signature verification.

### Migration

This is the first release — nothing to migrate from. Internal users on
the `gogs.seec.seecoder.cn` mirror should switch to the GitHub remote;
the git history was rewritten with `git filter-repo` to scrub two leaked
API keys (`docs/AUDIT_2026-06-05.md` critical #5), so commit hashes
differ from the gogs history.

### License

[Business Source License 1.1](LICENSE) — non-production use (development,
testing, personal projects, academic research) is always permitted.
Production use is free for organizations with ≤10 individual users or
employees. On **2031-04-05** (the Change Date), the license automatically
converts to Apache License 2.0.

---

🤖 This release was prepared with [Claude Code](https://claude.com/claude-code).