Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
94 commits
Select commit Hold shift + click to select a range
cf9848a
🧪 modify test_model_managment_db.py
ljy65535 Aug 14, 2025
c152338
🧪 modify test_model_managment_db.py
ljy65535 Aug 14, 2025
266ae3d
🧪 modify test_model_managment_db.py
liutao12138 Aug 14, 2025
cd49a8d
🐛 fix bug: MCP status indicator stays green when mcp server is unavai…
liutao12138 Aug 14, 2025
b20f44a
🐛 Fix bug: memory unavailable in speed deployment
liutao12138 Aug 14, 2025
3553661
🐛 Fix bug: login modal not automatically pop up when login session is…
Jasonxia007 Aug 15, 2025
bdd9a8d
✨ Model access supports modification access - bugs fix
liutao12138 Aug 15, 2025
6795d6b
Update AgentConfigurationSection.tsx
Mermaid97 Aug 15, 2025
81868d6
Merge remote-tracking branch 'origin/develop' into bwq/0813_model_con…
Bavichi Aug 15, 2025
2fd55e1
🐛 Fix bug: login modal unexpectedly shows up in speed mode
Jasonxia007 Aug 15, 2025
226b71f
🐛 Fix bug: login modal unexpectedly shows up in speed mode
liutao12138 Aug 15, 2025
bd1c9ea
Merge remote-tracking branch 'origin/develop' into bwq/0813_model_con…
Bavichi Aug 18, 2025
b9303bb
✨ Replace the terminal service base image and support mounting local …
WMC001 Aug 15, 2025
510e16b
memory user guide
Summer-Si Aug 18, 2025
5be7311
memory user guide
Summer-Si Aug 18, 2025
c4feb11
✨ Delete duplicate image building logic
WMC001 Aug 18, 2025
263b866
Missing tag styles in model config page (EN mode)
Summer-Si Aug 18, 2025
4dce85d
✨ Replace the terminal service base image and support mounting local …
liutao12138 Aug 18, 2025
0e91ce0
Frontend citation ground color coordinate with search tools
Summer-Si Aug 18, 2025
1341263
✨ When importing/exporting an agent, include MCP server information
ljy65535 Aug 18, 2025
1913f85
♻️ Refactor: ModelConnectStatusEnum using chinese value, should be i…
WMC001 Aug 14, 2025
959bb5d
🐛 Fix bug: login modal unexpectedly shows up in speed mode, even if t…
Jasonxia007 Aug 18, 2025
18b9c71
🐛 Agent generation should not overwrite the existing agent metadata, …
Aug 18, 2025
cfc8d88
✨ When importing/exporting an agent, include MCP server information
ljy65535 Aug 18, 2025
ada3cff
Update AgentConfigurationSection.tsx
Mermaid97 Aug 18, 2025
3f245bb
✨ When importing/exporting an agent, include display name
ljy65535 Aug 18, 2025
78cb7b8
🧪 modify test_agent_service.py
ljy65535 Aug 18, 2025
7d136bc
🧪 modify test_agent_app.py
ljy65535 Aug 18, 2025
dedd30a
🐛 Agent generation should not overwrite the existing agent metadata, …
Aug 18, 2025
4cedbfe
🐛 Fix login modal unexpectedly shows up in speed mode, even if the co…
Phinease Aug 18, 2025
619a4f8
enable time-based question answering
Summer-Si Aug 18, 2025
fe9985c
🐛 Fix On the Agent page, the button shows an inappropriate border col…
Phinease Aug 18, 2025
34d4563
🐛 Agent generation should not overwrite the existing agent metadata, …
Aug 18, 2025
3498743
✨ When importing/exporting an agent, include MCP server information a…
Phinease Aug 18, 2025
40db874
♻️ Refactor ModelConnectStatusEnum using chinese value, should be in …
Phinease Aug 18, 2025
94815d3
🐛 Fix missing tag styles in model config page (EN mode)
Phinease Aug 18, 2025
5e14437
✨ Acquire time in system prompt
Phinease Aug 18, 2025
b734b39
🐛 Fix On the Agent page, the button shows an inappropriate border col…
Phinease Aug 18, 2025
d812744
🐛 Agent generation should not overwrite the existing agent metadata, …
Aug 18, 2025
650254b
🐛 Agent generation should not overwrite the existing agent metadata, …
Phinease Aug 18, 2025
3eaad01
Update opensource-memorial-wall.md
FrancesPlus Aug 18, 2025
bc5e1f4
Update opensource-memorial-wall.md
Phinease Aug 18, 2025
40816d2
Merge remote-tracking branch 'origin/develop' into bwq/0813_model_con…
Bavichi Aug 19, 2025
6479e39
🔨 push terminal images when running GitHub action
ljy65535 Aug 19, 2025
ef93c8e
🔨 push terminal images when running GitHub action
ljy65535 Aug 19, 2025
320a1e0
🔨 delete redundant params
ljy65535 Aug 19, 2025
48c57c5
🐛 Only get agent list once when entering the page of agent setup
ljy65535 Aug 19, 2025
9c8a92d
🐛 Annotations in English and delete redundant function
ljy65535 Aug 19, 2025
d8836cc
🔨 push terminal images when running GitHub action
ljy65535 Aug 19, 2025
7508378
♻️ add healthcheck bottom in mcp modal
ljy65535 Aug 19, 2025
fe9c577
memory guide
Summer-Si Aug 19, 2025
3dbdf17
coding style
Summer-Si Aug 19, 2025
a4a25bc
🔨 Download correct miniconda software package when building terminal …
ljy65535 Aug 19, 2025
0fc21fa
🔨 Download correct miniconda software package when building terminal …
ljy65535 Aug 19, 2025
45a070a
🐛 Only get agent list once when entering the page of agent setup
Phinease Aug 19, 2025
9197ad3
🔨 push terminal images when running GitHub action
Phinease Aug 19, 2025
c7eb303
🔨 Download correct miniconda software package when building terminal …
Phinease Aug 19, 2025
3cff130
♻️ add healthcheck bottom in mcp modal
Phinease Aug 19, 2025
0830577
📝 Add memory management user guide in Chinese and English
Phinease Aug 19, 2025
3ab9225
🐛 Add translation key
ljy65535 Aug 19, 2025
8334ce7
🐛 Remove redundant tips
ljy65535 Aug 19, 2025
77ca577
🐛 Optimize agent name display
ljy65535 Aug 19, 2025
450f107
refactor toolSign
Summer-Si Aug 19, 2025
7f6e8d4
refactor toolSign
Summer-Si Aug 19, 2025
e062cf9
🐛 Frontend Improvement
Phinease Aug 20, 2025
ec868ad
✨ Frontend citation ground color coordinate with search tools
Phinease Aug 20, 2025
293f805
Merge remote-tracking branch 'origin/develop' into bwq/0813_model_con…
Bavichi Aug 20, 2025
44fe5f2
🔨 Download correct miniconda software package when building terminal …
ljy65535 Aug 20, 2025
20c436d
🐛 Fixed the issue where the default max_tokens for newly added models…
Bavichi Aug 20, 2025
5534686
🐛 Fixed the issue where the default max_tokens for newly added models…
Phinease Aug 20, 2025
cf42bb4
♻️ Clean refactor note
Phinease Aug 20, 2025
f338cfb
🐛 Throws an exception when there are more tokens available #954
WMC001 Aug 20, 2025
062f5a7
🐛 Unit test: throws an exception when there are more tokens available…
WMC001 Aug 20, 2025
665fef8
♻️ Refactor: move business logic from agent_app.py to agent_service.p…
Jasonxia007 Aug 20, 2025
a4c8e62
♻️ Clean frontend code Phase 1 (mainly focused on component)
Phinease Aug 20, 2025
1eb4928
🔨 Download correct miniconda software package when building terminal …
Phinease Aug 21, 2025
bae8504
♻️ Clean frontend code Phase 1 (mainly focused on component)
Phinease Aug 21, 2025
da32c0c
♻️ Refactor move some business logic from agent_app.py to agent_servi…
Phinease Aug 21, 2025
8fdceeb
🐛 Throws an exception when there are no more tokens available #954
Phinease Aug 21, 2025
958df0e
🐛 The trial environment on the official website cannot stream out the…
WMC001 Aug 21, 2025
24bdec2
Merge branch 'develop' into ljy/main_0821_gitcode
Phinease Aug 21, 2025
d1acb06
🔨 Add gitcode workflows
Phinease Aug 21, 2025
71bee2b
🐛 fix bug: Agent Information Display Error During Creation/Viewing
ljy65535 Aug 21, 2025
50200b6
🐛 fix bug: Unable to run agent when switched to English environment.
ljy65535 Aug 21, 2025
811fc6a
📝 Update architecture
Phinease Aug 21, 2025
f76d5e6
🐛 fix when the trial environment on the official website cannot strea…
Phinease Aug 21, 2025
e77c6e2
🐛 fix when Agent Information Display Error During Creation/Viewing
Phinease Aug 21, 2025
a61a821
🐛 fix bug of unable to run agent when switched to English environment.
Phinease Aug 21, 2025
e92cc2f
🐛 Fixed the issue where adding an embedding model with a timeout woul…
Bavichi Aug 22, 2025
ca99406
🐛 Fixed the issue where adding an embedding model with a timeout woul…
Bavichi Aug 22, 2025
15c6ecb
📝 update mcp doc
ljy65535 Aug 22, 2025
fd405d6
📝 update mcp doc
ljy65535 Aug 22, 2025
cf73736
🐛 Fixed the issue where adding an embedding model with a timeout woul…
ljy65535 Aug 22, 2025
83038aa
📝 update mcp doc
Phinease Aug 22, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 56 additions & 1 deletion .github/workflows/docker-build-push-beta.yml
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,47 @@
- name: Push web image (arm64) to DockerHub
run: docker push nexent/nexent-web:beta-arm64

build-and-push-terminal-amd64:
runs-on: ubuntu-latest
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (amd64) and load locally
run: |
docker buildx build --platform linux/amd64 -t nexent/nexent-ubuntu-terminal:beta-amd64 --load -f make/terminal/Dockerfile .
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Push terminal image (amd64) to DockerHub
run: docker push nexent/nexent-ubuntu-terminal:beta-amd64

build-and-push-terminal-arm64:
Comment on lines +154 to +173

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 5 months ago

To fix the issue, you should explicitly set the permissions key either at the top/root of the workflow or for each job (if jobs require differing permissions). In this case, the safest and simplest fix is to set the root-level permissions: block, since all jobs simply check out code (requiring only contents: read) and do not interact with issues or pull requests. This change should be made at the top of the workflow file, after the name: and before the first key (concurrency:). No additional imports, methods, or code changes are necessary, just a YAML block specifying minimal permissions.


Suggested changeset 1
.github/workflows/docker-build-push-beta.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-beta.yml b/.github/workflows/docker-build-push-beta.yml
--- a/.github/workflows/docker-build-push-beta.yml
+++ b/.github/workflows/docker-build-push-beta.yml
@@ -1,5 +1,8 @@
 name: Docker Build and Push All Images (Beta Version)
 
+permissions:
+  contents: read
+
 concurrency:
   group: docker-build-push-beta-${{ github.ref }}
   cancel-in-progress: true
EOF
@@ -1,5 +1,8 @@
name: Docker Build and Push All Images (Beta Version)

permissions:
contents: read

concurrency:
group: docker-build-push-beta-${{ github.ref }}
cancel-in-progress: true
Copilot is powered by AI and may make mistakes. Always verify output.
runs-on: ubuntu-latest
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (arm64) and load locally
run: |
docker buildx build --platform linux/arm64 -t nexent/nexent-ubuntu-terminal:beta-arm64 --load -f make/terminal/Dockerfile .
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Push terminal image (arm64) to DockerHub
run: docker push nexent/nexent-ubuntu-terminal:beta-arm64

manifest-push-main:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-latest
needs:
- build-and-push-main-amd64
Expand Down Expand Up @@ -193,4 +233,19 @@
docker manifest create nexent/nexent-web:beta \
nexent/nexent-web:beta-amd64 \
nexent/nexent-web:beta-arm64
docker manifest push nexent/nexent-web:beta
docker manifest push nexent/nexent-web:beta

manifest-push-terminal:
runs-on: ubuntu-latest
needs:
- build-and-push-terminal-amd64
- build-and-push-terminal-arm64
steps:
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Create and push manifest for terminal (DockerHub)
run: |
docker manifest create nexent/nexent-ubuntu-terminal:beta \
nexent/nexent-ubuntu-terminal:beta-amd64 \
nexent/nexent-ubuntu-terminal:beta-arm64
docker manifest push nexent/nexent-ubuntu-terminal:beta
Comment on lines +239 to +251

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 5 months ago

To fix the problem, add a permissions block to the workflow to explicitly restrict the GITHUB_TOKEN to the minimum required privileges. Since all jobs appear only to build Docker images and push them to DockerHub (using secrets for authentication), and do not interact with issues, PRs, or write to repo contents, the best practice is to set the overall workflow permissions to read-only or, most restrictively, to {} (which disables all default permissions for the workflow). This block should be placed near the top of the workflow file—immediately after name: and before concurrency:. No other changes are needed in the workflow as no job appears to require escalation from the minimum. This change confines the GITHUB_TOKEN to the minimum privileges, hardening CI security.


Suggested changeset 1
.github/workflows/docker-build-push-beta.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-beta.yml b/.github/workflows/docker-build-push-beta.yml
--- a/.github/workflows/docker-build-push-beta.yml
+++ b/.github/workflows/docker-build-push-beta.yml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Docker Build and Push All Images (Beta Version)
 
 concurrency:
EOF
@@ -1,3 +1,5 @@
permissions:
contents: read
name: Docker Build and Push All Images (Beta Version)

concurrency:
Copilot is powered by AI and may make mistakes. Always verify output.
57 changes: 56 additions & 1 deletion .github/workflows/docker-build-push-mainland.yml
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,47 @@
- name: Push web image (arm64) to Tencent Cloud
run: docker push ccr.ccs.tencentyun.com/nexent-hub/nexent-web:arm64

build-and-push-terminal-amd64:
runs-on: ${{ fromJson(inputs.runner_label_json) }}
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (amd64) and load locally
run: |
docker buildx build --platform linux/amd64 --load -t ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:amd64 -f make/terminal/Dockerfile .
- name: Login to Tencent Cloud
run: echo ${{ secrets.TCR_PASSWORD }} | docker login ccr.ccs.tencentyun.com --username=${{ secrets.TCR_USERNAME }} --password-stdin
- name: Push terminal image (amd64) to Tencent Cloud
run: docker push ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:amd64

build-and-push-terminal-arm64:
Comment on lines +151 to +170

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 5 months ago

To fix this problem, explicitly set a permissions: key at the workflow root, just below the name: or on: sections. This ensures that all jobs in the workflow only receive the minimal required repository privileges. For this workflow, the only repository interaction needed is checking out code, which requires contents: read. Other steps interact solely with Docker registry using secrets, not the repository. Thus, add permissions:\n contents: read below the name: (or on: if present).

Specifically:

  • Edit .github/workflows/docker-build-push-mainland.yml.
  • Add the following lines after the name: (line 1) or after the on: block for clarity:
    permissions:
      contents: read
  • This grants read-only access and ensures the GITHUB_TOKEN in all jobs cannot be used for write access or privileged operations in the repository.

No other areas of the YAML file or code need modification.


Suggested changeset 1
.github/workflows/docker-build-push-mainland.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-mainland.yml b/.github/workflows/docker-build-push-mainland.yml
--- a/.github/workflows/docker-build-push-mainland.yml
+++ b/.github/workflows/docker-build-push-mainland.yml
@@ -1,5 +1,8 @@
 name: Docker Build and Push All Images to tencentyun
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
EOF
@@ -1,5 +1,8 @@
name: Docker Build and Push All Images to tencentyun

permissions:
contents: read

on:
workflow_dispatch:
inputs:
Copilot is powered by AI and may make mistakes. Always verify output.
runs-on: ${{ fromJson(inputs.runner_label_json) }}
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (arm64) and load locally
run: |
docker buildx build --platform linux/arm64 --load -t ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:arm64 -f make/terminal/Dockerfile .
- name: Login to Tencent Cloud
run: echo ${{ secrets.TCR_PASSWORD }} | docker login ccr.ccs.tencentyun.com --username=${{ secrets.TCR_USERNAME }} --password-stdin
- name: Push terminal image (arm64) to Tencent Cloud
run: docker push ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:arm64

manifest-push-main:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-latest
needs:
- build-and-push-main-amd64
Expand Down Expand Up @@ -190,4 +230,19 @@
docker manifest create ccr.ccs.tencentyun.com/nexent-hub/nexent-web:latest \
ccr.ccs.tencentyun.com/nexent-hub/nexent-web:amd64 \
ccr.ccs.tencentyun.com/nexent-hub/nexent-web:arm64
docker manifest push ccr.ccs.tencentyun.com/nexent-hub/nexent-web:latest
docker manifest push ccr.ccs.tencentyun.com/nexent-hub/nexent-web:latest

manifest-push-terminal:
runs-on: ubuntu-latest
needs:
- build-and-push-terminal-amd64
- build-and-push-terminal-arm64
steps:
- name: Login to Tencent Cloud
run: echo ${{ secrets.TCR_PASSWORD }} | docker login ccr.ccs.tencentyun.com --username=${{ secrets.TCR_USERNAME }} --password-stdin
- name: Create and push manifest for terminal (Tencent Cloud)
run: |
docker manifest create ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:latest \
ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:amd64 \
ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:arm64
docker manifest push ccr.ccs.tencentyun.com/nexent-hub/nexent-ubuntu-terminal:latest
Comment on lines +236 to +248

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 5 months ago

The best way to fix this problem is to explicitly add a permissions block at the root of the workflow (.github/workflows/docker-build-push-mainland.yml), so that all jobs will inherit the least privilege needed unless overridden locally. For workflows whose jobs do not interact with the repo (e.g., only using docker and external secrets), the recommended minimal permissions are typically contents: read, which allows jobs to clone the repo if needed but does not enable write operations. If a particular job really does need to write (for example, to create a release or interact with issues/pull requests), selectively grant those permissions only to that job. In this case, as all jobs appear to only be pushing docker images and do not interact with the repo or issues, the global workflow permission of contents: read is correct. Edit the top of .github/workflows/docker-build-push-mainland.yml to add:

permissions:
  contents: read

directly below the workflow name (and before on:).

Suggested changeset 1
.github/workflows/docker-build-push-mainland.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-mainland.yml b/.github/workflows/docker-build-push-mainland.yml
--- a/.github/workflows/docker-build-push-mainland.yml
+++ b/.github/workflows/docker-build-push-mainland.yml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Docker Build and Push All Images to tencentyun
 
 on:
EOF
@@ -1,3 +1,5 @@
permissions:
contents: read
name: Docker Build and Push All Images to tencentyun

on:
Copilot is powered by AI and may make mistakes. Always verify output.
57 changes: 56 additions & 1 deletion .github/workflows/docker-build-push-overseas.yml
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,47 @@
- name: Push web image (arm64) to DockerHub
run: docker push nexent/nexent-web:arm64

build-and-push-terminal-amd64:
runs-on: ${{ fromJson(inputs.runner_label_json) }}
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (amd64) and load locally
run: |
docker buildx build --platform linux/amd64 -t nexent/nexent-ubuntu-terminal:amd64 --load -f make/terminal/Dockerfile .
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Push terminal image (amd64) to DockerHub
run: docker push nexent/nexent-ubuntu-terminal:amd64

build-and-push-terminal-arm64:
Comment on lines +151 to +170

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 5 months ago

To fix the problem and adhere to least privilege best practices, add a permissions key set to contents: read at the top (root) of the workflow file, right after the name (or on block) but before jobs. This ensures all jobs in this workflow only have read access to repository contents by default. If a specific job needs additional write privileges (for instance, for PR status updates), these can be added at the job level. This change does not affect the functionality of this workflow (which only checks out code and pushes to DockerHub using external credentials).

Implementation Steps:

  • Edit .github/workflows/docker-build-push-overseas.yml
  • Insert the block:
    permissions:
      contents: read
    right after the name (or immediately before or after the on block, per YAML semantics).

Suggested changeset 1
.github/workflows/docker-build-push-overseas.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-overseas.yml b/.github/workflows/docker-build-push-overseas.yml
--- a/.github/workflows/docker-build-push-overseas.yml
+++ b/.github/workflows/docker-build-push-overseas.yml
@@ -1,5 +1,8 @@
 name: Docker Build and Push All Images to DockerHub
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
EOF
@@ -1,5 +1,8 @@
name: Docker Build and Push All Images to DockerHub

permissions:
contents: read

on:
workflow_dispatch:
inputs:
Copilot is powered by AI and may make mistakes. Always verify output.
runs-on: ${{ fromJson(inputs.runner_label_json) }}
steps:
- name: Set up Docker Buildx
run: |
if ! docker buildx inspect nexent_builder > /dev/null 2>&1; then
docker buildx create --name nexent_builder --use
else
docker buildx use nexent_builder
fi
- name: Checkout code
uses: actions/checkout@v4
- name: Build terminal image (arm64) and load locally
run: |
docker buildx build --platform linux/arm64 -t nexent/nexent-ubuntu-terminal:arm64 --load -f make/terminal/Dockerfile .
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Push terminal image (arm64) to DockerHub
run: docker push nexent/nexent-ubuntu-terminal:arm64

manifest-push-main:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-latest
needs:
- build-and-push-main-amd64
Expand Down Expand Up @@ -190,4 +230,19 @@
docker manifest create nexent/nexent-web:latest \
nexent/nexent-web:amd64 \
nexent/nexent-web:arm64
docker manifest push nexent/nexent-web:latest
docker manifest push nexent/nexent-web:latest

manifest-push-terminal:
runs-on: ubuntu-latest
needs:
- build-and-push-terminal-amd64
- build-and-push-terminal-arm64
steps:
- name: Login to DockerHub
run: echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login -u nexent --password-stdin
- name: Create and push manifest for terminal (DockerHub)
run: |
docker manifest create nexent/nexent-ubuntu-terminal:latest \
nexent/nexent-ubuntu-terminal:amd64 \
nexent/nexent-ubuntu-terminal:arm64
docker manifest push nexent/nexent-ubuntu-terminal:latest
Comment on lines +236 to +248

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 5 months ago

To address this problem, you should add an explicit permissions block to limit the permissions granted to the GITHUB_TOKEN for this workflow. Since the workflow only checks out repository code (which needs contents: read) and otherwise interacts with DockerHub via a secret, you can safely limit permissions to the minimum. The recommended approach is to specify the permissions block at the workflow root, so it applies to all jobs unless overridden, or you can set it individually for jobs if granular control is desired. The best practice is to use:

permissions:
  contents: read

unless some step or future edit truly requires additional scopes. You should place this block immediately after the name: key, before the on: key, at the top of .github/workflows/docker-build-push-overseas.yml.


Suggested changeset 1
.github/workflows/docker-build-push-overseas.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build-push-overseas.yml b/.github/workflows/docker-build-push-overseas.yml
--- a/.github/workflows/docker-build-push-overseas.yml
+++ b/.github/workflows/docker-build-push-overseas.yml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Docker Build and Push All Images to DockerHub
 
 on:
EOF
@@ -1,3 +1,5 @@
permissions:
contents: read
name: Docker Build and Push All Images to DockerHub

on:
Copilot is powered by AI and may make mistakes. Always verify output.
11 changes: 10 additions & 1 deletion .github/workflows/docker-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,4 +41,13 @@
uses: actions/checkout@v4

- name: Build web frontend image
run: docker build --build-arg MIRROR=https://pypi.tuna.tsinghua.edu.cn/simple --progress=plain -t nexent/nexent-web -f make/web/Dockerfile .
run: docker build --build-arg MIRROR=https://pypi.tuna.tsinghua.edu.cn/simple --progress=plain -t nexent/nexent-web -f make/web/Dockerfile .

build-terminal:
runs-on: ${{ fromJson(inputs.runner_label_json) }}
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Build terminal image
run: docker build --progress=plain -t nexent/nexent-ubuntu-terminal -f make/terminal/Dockerfile .
Comment on lines +47 to +53

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 5 months ago

To fix this problem, add a permissions key at the root of the workflow file .github/workflows/docker-build.yml, immediately following the workflow's name and before the on block. Assign contents: read as the minimal permission needed. This ensures GITHUB_TOKEN is restricted to only being able to read repository contents, thus reducing risk if a workflow step or dependency is compromised, while not affecting workflow functionality since none of the jobs require write access.

Suggested changeset 1
.github/workflows/docker-build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Docker Build All Images
 
 on:
EOF
@@ -1,3 +1,5 @@
permissions:
contents: read
name: Docker Build All Images

on:
Copilot is powered by AI and may make mistakes. Always verify output.
14 changes: 14 additions & 0 deletions MAINTENANCE.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ server {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# 流式响应支持
proxy_buffering off;
proxy_cache off;
proxy_set_header Connection '';
proxy_http_version 1.1;
chunked_transfer_encoding off;
}
}

Expand All @@ -37,6 +44,13 @@ server {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# 流式响应支持
proxy_buffering off;
proxy_cache off;
proxy_set_header Connection '';
proxy_http_version 1.1;
chunked_transfer_encoding off;
}
}
```
Expand Down
4 changes: 3 additions & 1 deletion backend/agents/create_agent_info.py
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
from smolagents.utils import BASE_BUILTIN_MODULES
from services.memory_config_service import build_memory_context
from jinja2 import Template, StrictUndefined
from datetime import datetime

from nexent.memory.memory_service import search_memory_in_levels

Expand Down Expand Up @@ -128,7 +129,8 @@ async def create_agent_config(agent_id, tenant_id, user_id, language: str = 'zh'
"APP_NAME": app_name,
"APP_DESCRIPTION": app_description,
"memory_list": memory_list,
"knowledge_base_summary": knowledge_base_summary
"knowledge_base_summary": knowledge_base_summary,
"time" : datetime.now().strftime("%Y-%m-%d %H:%M:%S")
})
else:
system_prompt = agent_info.get("prompt", "")
Expand Down
75 changes: 10 additions & 65 deletions backend/apps/agent_app.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,22 +2,13 @@
from typing import Optional

from fastapi import HTTPException, APIRouter, Header, Request, Body
from fastapi.responses import StreamingResponse, JSONResponse
from nexent.core.agents.run_agent import agent_run

from database.agent_db import delete_related_agent
from utils.auth_utils import get_current_user_info, get_current_user_id
from agents.create_agent_info import create_agent_run_info
from fastapi.responses import JSONResponse
from consts.model import AgentRequest, AgentInfoRequest, AgentIDRequest, ConversationResponse, AgentImportRequest
from services.agent_service import get_agent_info_impl, \
get_creating_sub_agent_info_impl, update_agent_info_impl, delete_agent_impl, export_agent_impl, import_agent_impl, \
list_all_agent_info_impl, insert_related_agent_impl
from services.conversation_management_service import save_conversation_user, save_conversation_assistant
from services.memory_config_service import build_memory_context
from utils.config_utils import config_manager
from utils.thread_utils import submit
from agents.agent_run_manager import agent_run_manager
from agents.preprocess_manager import preprocess_manager
list_all_agent_info_impl, insert_related_agent_impl, run_agent_stream, stop_agent_tasks
from database.agent_db import delete_related_agent
from utils.auth_utils import get_current_user_info, get_current_user_id


router = APIRouter(prefix="/agent")
Expand All @@ -30,43 +21,10 @@ async def agent_run_api(agent_request: AgentRequest, http_request: Request, auth
"""
Agent execution API endpoint
"""
user_id, tenant_id, language = get_current_user_info(authorization, http_request)
memory_context = build_memory_context(user_id, tenant_id, agent_request.agent_id)

agent_run_info = await create_agent_run_info(agent_id=agent_request.agent_id,
minio_files=agent_request.minio_files,
query=agent_request.query,
history=agent_request.history,
authorization=authorization,
language=language)

agent_run_manager.register_agent_run(agent_request.conversation_id, agent_run_info)
# Save user message only if not in debug mode
if not agent_request.is_debug:
submit(save_conversation_user, agent_request, authorization)

async def generate():
messages = []
try:
async for chunk in agent_run(agent_run_info, memory_context):
messages.append(chunk)
yield f"data: {chunk}\n\n"
except Exception as e:
raise HTTPException(status_code=500, detail=f"Agent run error: {str(e)}")
finally:
# Save assistant message only if not in debug mode
if not agent_request.is_debug:
submit(save_conversation_assistant, agent_request, messages, authorization)
# Unregister agent run instance for both debug and non-debug modes
agent_run_manager.unregister_agent_run(agent_request.conversation_id)

return StreamingResponse(
generate(),
media_type="text/event-stream",
headers={
"Cache-Control": "no-cache",
"Connection": "keep-alive"
}
return await run_agent_stream(
agent_request=agent_request,
http_request=http_request,
authorization=authorization
)


Expand All @@ -75,21 +33,8 @@ async def agent_stop_api(conversation_id: int):
"""
stop agent run and preprocess tasks for specified conversation_id
"""
# Stop agent run
agent_stopped = agent_run_manager.stop_agent_run(conversation_id)

# Stop preprocess tasks
preprocess_stopped = preprocess_manager.stop_preprocess_tasks(conversation_id)

if agent_stopped or preprocess_stopped:
message_parts = []
if agent_stopped:
message_parts.append("agent run")
if preprocess_stopped:
message_parts.append("preprocess tasks")

message = f"successfully stopped {' and '.join(message_parts)} for conversation_id {conversation_id}"
return {"status": "success", "message": message}
if stop_agent_tasks(conversation_id).get("status") == "success":
return {"status": "success", "message": "agent run and preprocess tasks stopped successfully"}
else:
raise HTTPException(status_code=404, detail=f"no running agent or preprocess tasks found for conversation_id {conversation_id}")

Expand Down
2 changes: 0 additions & 2 deletions backend/apps/conversation_management_app.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,6 @@
from typing import Dict, Any, Optional

from fastapi import HTTPException, APIRouter, Header, Request
from fastapi.encoders import jsonable_encoder
from pydantic import BaseModel

from consts.model import ConversationResponse, ConversationRequest, RenameRequest, GenerateTitleRequest, OpinionRequest, MessageIdRequest
from services.conversation_management_service import (
Expand Down
Loading
Loading