From e4f5ede8d7ca7efc113d6600ebfca04b4fbc57e0 Mon Sep 17 00:00:00 2001 From: pikastech Date: Sun, 19 Jul 2026 19:44:14 +0200 Subject: [PATCH] fix: stop blocking Artificer on task reference formats --- .agents/skills/unidesk-subagent/SKILL.md | 5 +++++ docs/reference/devops-hygiene.md | 5 +++++ scripts/src/agentrun.test.ts | 4 ++-- scripts/src/agentrun/entry.ts | 6 +++--- scripts/src/agentrun/target-task.ts | 9 +-------- 5 files changed, 16 insertions(+), 13 deletions(-) diff --git a/.agents/skills/unidesk-subagent/SKILL.md b/.agents/skills/unidesk-subagent/SKILL.md index f59f327a..0330426c 100644 --- a/.agents/skills/unidesk-subagent/SKILL.md +++ b/.agents/skills/unidesk-subagent/SKILL.md @@ -12,6 +12,11 @@ description: UniDesk 主代理调度子代理的必读技能。用户提到子 - 涉及 PK01 的派单默认只允许只读调查： - 只有用户在当前请求中明确要求修改 PK01，子 issue、TaskTree Task 或代理 prompt 才能授权修改其版本、配置、Secret 绑定、边缘路由、容器或运行面； - 泛化的修复、恢复、部署和排障目标不构成 PK01 变更授权。 +- 派单元数据不得使用白名单式阻塞校验： + - issue、TaskTree、遗留 MDTODO、标题、仓库标签和其他治理字段只作为关联与可见性元数据； + - CLI 可以记录缺失、未知或非推荐格式并输出非阻塞 warning，但不得按允许值、前缀、正则或枚举白名单拒绝核心派单； + - 只有用户明确要求某个白名单成为门禁，或认证、权限、目标唯一性与不可逆损害预防确实要求时，才允许阻断； + - 新增白名单式阻塞前必须取得用户对该具体门禁的明确授权，禁止以治理便利、历史格式或测试断言自行扩大。 - 主代理与子代理必须按用户明确目标控制实现范围： - 未经用户明确要求，禁止新增或扩展通用合同、租约、安全机制、围栏及其配套门禁； - 既有权限、Secret 脱敏、不可逆操作和损害预防边界继续生效，本规则不授权绕过既有安全底线； diff --git a/docs/reference/devops-hygiene.md b/docs/reference/devops-hygiene.md index 8baacb0f..6a41f153 100644 --- a/docs/reference/devops-hygiene.md +++ b/docs/reference/devops-hygiene.md @@ -35,6 +35,11 @@ The following practices are not acceptable as the long-term or hidden source of - 只有业务数据本身无法解释、违反安全/权限边界或会造成不可逆损害时才允许拒绝，并返回与具体业务字段相关的 typed error； - 禁止把版本、commit 或契约漂移包装成 `schema-invalid`、`503` 或其他用户阻塞错误； - CI/CD、status 和 observability 可以报告版本漂移，但只能作为修复提示，不能压过真实业务成功证据。 +- 白名单式校验默认不得阻塞核心业务： + - 未经用户对具体门禁的明确要求，不得按名称、前缀、正则、枚举、标签、issue、TaskTree、遗留 MDTODO 或其他治理元数据白名单拒绝请求、派单、发布或验收； + - 既有白名单校验应降级为结构化 warning，并保留实际值、建议格式和继续执行结果； + - 认证、权限、目标无法唯一确定和不可逆损害预防仍可阻断，但不得伪装成治理白名单； + - 新增阻塞白名单必须说明保护的真实损害、授权来源、作用范围和退出条件，不能只因实现方便或历史测试存在而加入。 - Hand editing D601 runtime files, k3s manifests, ConfigMaps, Deployments or container env values and treating the live result as source of truth. - Rebuilding backend-core, frontend, k3sctl-adapter or other managed services from a dirty worktree on the master server, D601 or an operator machine. diff --git a/scripts/src/agentrun.test.ts b/scripts/src/agentrun.test.ts index b227eb58..bbfe4377 100644 --- a/scripts/src/agentrun.test.ts +++ b/scripts/src/agentrun.test.ts @@ -222,7 +222,7 @@ describe("Artificer Target one-command dispatch", () => { "--target-workspace", "relative/workspace", "--repo", "pikasTech/unidesk", "--ref", "fix/path-check", - "--mdtodo-id", "R5.2", + "--mdtodo-id", "tt_example-tasktree-id", ])).toThrow("--target-workspace 必须是 Target 上的绝对路径"); const request = targetTaskRequestFromArgs([ @@ -231,7 +231,7 @@ describe("Artificer Target one-command dispatch", () => { "--target-workspace", "/definitely/missing/agentrun-workspace", "--repo", "pikasTech/unidesk", "--ref", "fix/path-check", - "--mdtodo-id", "R5.2", + "--mdtodo-id", "tt_example-tasktree-id", ]); if (request === null) throw new Error("expected Target request"); expect(() => preflightTargetTask(request)).toThrow("Target 工作区不存在或不是目录"); diff --git a/scripts/src/agentrun/entry.ts b/scripts/src/agentrun/entry.ts index 56941a3c..6984ed05 100644 --- a/scripts/src/agentrun/entry.ts +++ b/scripts/src/agentrun/entry.ts @@ -69,7 +69,7 @@ export function agentRunHelp(): unknown { "bun scripts/cli.ts agentrun get attempts --task --limit 20", "bun scripts/cli.ts agentrun dispatch task/", "bun scripts/cli.ts agentrun create task --aipod Artificer --title \"修复 HWLAB 的 cicd\" --prompt-stdin --idempotency-key ", - "bun scripts/cli.ts agentrun create task --aipod Artificer --title \"修复 HWLAB 的 cicd\" --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin [--dry-run]", + "bun scripts/cli.ts agentrun create task --aipod Artificer --title \"修复 HWLAB 的 cicd\" --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin [--dry-run]", "bun scripts/cli.ts agentrun apply -f - --dry-run", "bun scripts/cli.ts agentrun send session/ --aipod Artificer --prompt-stdin", "bun scripts/cli.ts agentrun explain task", @@ -318,7 +318,7 @@ export function agentRunHelpText(args: string[]): string { return "Usage: bun scripts/cli.ts agentrun dispatch task/"; } if (verb === "create") { - return "Usage: bun scripts/cli.ts agentrun create task --aipod Artificer --title <中文短标题> --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin [--idempotency-key ] [--dry-run]"; + return "Usage: bun scripts/cli.ts agentrun create task --aipod Artificer --title <中文短标题> --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin [--idempotency-key ] [--dry-run]"; } if (verb === "apply") { return "Usage: bun scripts/cli.ts agentrun apply -f task.yaml|json|- [--dry-run]\nTask manifests use kind: Task and spec: ."; @@ -413,7 +413,7 @@ export function agentRunHelpText(args: string[]): string { " bun scripts/cli.ts agentrun logs session/ --tail 100", " bun scripts/cli.ts agentrun retry task/ --idempotency-key --reason --dry-run", " bun scripts/cli.ts agentrun get attempts --task --limit 20", - " bun scripts/cli.ts agentrun create task --aipod Artificer --title \"修复 HWLAB 的 cicd\" --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin", + " bun scripts/cli.ts agentrun create task --aipod Artificer --title \"修复 HWLAB 的 cicd\" --target --target-workspace --repo --ref --mdtodo-id --prompt-stdin", "", "Machine/debug output:", " -o json|yaml emits a stable UniDesk resource object without the global JSON envelope.", diff --git a/scripts/src/agentrun/target-task.ts b/scripts/src/agentrun/target-task.ts index 94efdb6e..50f4600d 100644 --- a/scripts/src/agentrun/target-task.ts +++ b/scripts/src/agentrun/target-task.ts @@ -84,7 +84,7 @@ export function targetTaskRequestFromArgs(args: string[]): AgentRunTargetTaskReq targetWorkspace: validateTargetWorkspace(raw.targetWorkspace as string), repository: normalizeRepository(raw.repository as string), ref: validateRef(raw.ref as string), - mdtodoId: validateMdtodoId(raw.mdtodoId as string), + mdtodoId: raw.mdtodoId as string, }; } @@ -345,13 +345,6 @@ function validateRef(value: string): string { return value; } -function validateMdtodoId(value: string): string { - if (!/^R[1-9][0-9]*(?:\.[1-9][0-9]*)*$/u.test(value)) { - throw new AgentRunTargetTaskPreflightError("target-context", "--mdtodo-id 必须使用 R1 或 R1.1 这类 MDTODO ID"); - } - return value; -} - function sha256(value: string): string { return `sha256:${sha256Hex(value)}`; }