#37 shipped the telemetry retention task + model.DeleteTelemetryEventsBefore but
lacked a test for the deletion itself. Add TestDeleteTelemetryEventsBefore
(strict-< cutoff, retains at/after, idempotent) and migrate TelemetryEvent in the
model TestMain so it has a table.
Closes the "测试覆盖过期清理" DoD item of #43. Test-only; no behavior change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bring docs/integration/heicode-desktop-client-api.md in lock-step with merged
endpoints:
- §3.1 /api/heicode/available-models: logged-in user model list is the single
source of truth (no local presets / no CodeGW channel backend); exposes only
model_id/display_name/default; forbidden fields enumerated.
- §5.1 /api/heicode/agents/{id}/usage: token-name aggregation, time window,
empty-data semantics, relation to billing logs. Includes the #30 hidden agent
model token billing-collection semantics: UnlimitedQuota only waives the
token's own remaining-quota cap, it does NOT bypass user.Quota — HM still
checks user quota and settles to wallet/subscription via the billing
expression; token revoked on stop/delete; hidden from user UI but auditable.
- §7.1 /api/heicode/config: telemetry enabled/endpoint/max_batch/flush/retention_days.
- §7.2 /api/heicode/telemetry/events: default-off 410 kill switch, V2 device
signature, top-level array 1-20 / <=256KB, server redaction, context field
whitelist (#32), 4xx-drop/5xx-retry, retention; production enable-gate note.
- Updated §10 endpoint inventory.
Docs-only; no code change. heicodeDocs org-level sync tracked in #34.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Telemetry up-gating hardening (code portion of #32):
- Context field whitelist: telemetry `context` is filtered to a small set of
non-content diagnostic keys (route/retryable/phase/exit_code/duration_ms/
attempt) before persistence. Unknown keys — including potentially identifying
ones (email, full file path, prompt, raw IP) — are dropped, so a client
regression cannot land arbitrary JSON in the store. Empty/unparseable/no-allowed-key
context is dropped to "".
- Per-field size cap: stack_top and context are truncated to 8KiB after
redaction (backstop against unbounded blobs within batch limits).
- Retention: daily master-only task deletes telemetry rows older than
HEICODE_TELEMETRY_RETENTION_DAYS (default 30; <=0 disables).
HEICODE_TELEMETRY_RETENTION_INTERVAL_HOURS (default 24) sets cadence.
model.DeleteTelemetryEventsBefore(cutoff) + controller.StartTelemetryRetentionTask()
wired into main.go under IsMasterNode.
- GET /api/heicode/config telemetry block now surfaces retention_days for
client/admin transparency.
Tests: whitelist drop/keep, size cap, redaction-within-allowed-key. go build/vet
clean; controller telemetry tests pass.
Affects: Manager only (telemetry ingest + retention). No billing/consume-log
change (telemetry still never bills). Privacy-doc disclosure + production
enable-checklist portions of #32 tracked in heicodeDocs sync (#34) / desktop
client API docs (#35).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
#31: HeicodeDeployAgent now refuses to deploy unless CRYPTO_SECRET is explicitly
configured, so the per-agent access_token is sealed with a key that survives a
container restart. common.CryptoSecret is never literally "" (defaults to
uuid/SessionSecret), so the sealAgentToken plaintext fallback was effectively
unreachable; the real hazard is an ephemeral random seal key making tokens
undecryptable after restart. Dev-only override: HEICODE_ALLOW_PLAINTEXT_AGENT_TOKEN_IN_DEV=true.
Verified prod container has CRYPTO_SECRET set (64 chars) -> deploy stays allowed.
#33: StartSecretPurgeTask refuses to start a whole-vault purge when
HEICODE_SECRET_PURGE_NAME_PREFIX is empty unless HEICODE_SECRET_PURGE_VAULT_EXCLUSIVE=true,
so HM never permanently purges another tenant's soft-deleted secrets in a shared
vault. Logs the resolved purge scope at startup.
Both gates extracted into pure, unit-tested helpers (agentTokenSealKeyConfigured,
secretPurgeScopeAllowed). Affects: Manager only (Agent deploy + Secret lifecycle).
No Client/Swarm/billing/audit schema change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Returns raw quota + the full conversion params (quota_per_unit, quota_display_type,
usd_exchange_rate) AND server-computed display_quota / display_used_quota, so the
desktop client renders correctly in USD / CNY / tokens without a ×500000 hack or a
missing-exchange-rate bug. Contract of record (server applies it):
USD : raw / quota_per_unit
CNY : raw / quota_per_unit * usd_exchange_rate
tokens : raw (no division)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verified against code.claude.com/docs/en/permission-modes and fixed 6 points:
1. acceptEdits: add PowerShell tool auto-approvals (Set-Content/Add-Content/
Clear-Content/Remove-Item + aliases) and env-prefix/process-wrapper note.
2. Protected paths: .claude exception is ONLY .claude/worktrees (was wrongly
widened to commands/agents/skills); add per-mode protected-write table.
3. defaultMode:"auto" ignored from project files since v2.1.142+.
4. dontAsk: read-only Bash commands also run without allow rules; explicit ask
rules are denied (not prompted).
5. auto conversational boundary: stays in force until user lifts it; Claude's own
judgment doesn't lift it; lost on context compaction; use deny rule for hard.
6. auto consecutive-failure fallback: 3-in-a-row / 20-total pauses & re-prompts;
-p non-interactive aborts the session. Plus dropped broad allow-rules on entry.
Co-authored-by: chenchen <chenchen@xinghanlab.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Per Fasthei's CHANGES_REQUESTED on #15: deleting all sub/swarm docs left no
tracking entry for the still-in-development swarm capability. Adds
docs/integration/heicode-swarm-deferred.md stating HM does not implement swarm
runtime, the old HM-orchestrated sub/swarm model is deprecated, new swarm work
lives on AM/Swarm side, and a per-file migration mapping (deprecated / deferred
/ superseded) for all 11 deleted docs. Links it from docs/README.md so deletion
no longer drops context.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a reading guide, the full 6 permission modes (incl. dontAsk) + auto-mode
admin enablement toggle, confirmed role facts (UsageView roles; full matrix is
external; iam pages 404), deep permission-rule syntax (Bash spacing, Read/Edit
anchors, MCP/Agent), real MCP credential mechanisms (headersHelper/${VAR}/OAuth),
expanded usage/cost/attribution/analytics, plus two big appendices: verbatim
config examples (A1–A10) and step-by-step end-to-end flows (managed-settings
lifecycle, MCP allow/deny worked example, auto-mode force-push decision, auth
credential selection). Sourced from re-fetching the 6 core docs + permission-
modes/permissions/mcp/costs/monitoring-usage/analytics.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Aligns HM's capabilities to three tiers mirroring Claude's proven split, grounded
in HM's existing primitives. Defines positioning + billing per tier, a capability
× tier matrix (use layer = Individual; manage/allocate = Teams; compliance/hard-
enforcement/private = Enterprise) with HM code landing points, the Teams-hook vs
Enterprise-moat rationale, HM's differentiators over Claude (gateway-side hard
cost control, signed per-org policy push, server-side hard enforcement, native
agent catalog), a P0–P3 rollout mapping, and the open pricing decisions to settle.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expands §1.2 into a proper three-tier section: positioning per tier, a
capability × tier table (with source + whether the doc is explicit), the
billing differences, and the documented contradiction (authentication lists
"managed policy settings" as Enterprise-only while the server-managed-settings
feature page says Teams+ can use it). Also flags that most controls hinge on
provider (Anthropic-direct + admin write access) rather than subscription tier.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Standalone reading reference faithfully consolidating the six official Claude
docs (admin-setup, authentication, server-managed-settings, settings,
managed-mcp, auto-mode-config): auth methods + precedence, roles/seats/admin,
settings scope precedence & merge rules, server-managed-settings mechanism,
full managed-only/permissions/model/sandbox/MCP key reference, managed-mcp
seven modes + allow/deny evaluation, auto-mode classifier, usage/audit, and
quick-reference tables. No HM design — pure Claude reference for study.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Backend:
- loadAgentTemplate now requires status='active' — a known template_key can no
longer deploy a template an admin deactivated (matches the client list).
- refreshAgentStatus no longer lets AM's eventually-consistent live status
resurrect a user-initiated "stopped" agent.
- HeicodeStopAgent persists via field-level Updates (not a stale full-row Save),
matching refreshAgentStatus discipline.
- Drop dead amStartResult.AccessToken field (AM's token is never used; HM mints
its own per-agent token).
Frontend:
- deploy-agent statusLabel: add the missing pending/starting → 启动中 branch so a
just-deployed agent isn't shown as raw English fallback.
- cockpit 最近部署: map template_id → Chinese template name (consistent with the
deploy/status pages) instead of showing the raw key.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chenchenandClaude Opus 4.8