AI assistant (was hidden in mock mode):
- Intercept /api/v3/agentic/chat/completions via a fetch mock (src/mock/fetch.ts); the assistant streams over raw fetch, not the axios adapter
- Keyword-aware scripted replies (temperature/energy/driver/point) emitting reasoning traces, text deltas and visualizations (line/area/column/bar/donut/stat/scatter)
- Show the assistant in mock builds (drop the isMock gate in Layout)
- Seed 4 multi-turn sessions (12 messages) with chart-bearing assistant replies + reasoning
Dashboard enrichment (home cards were sparse):
- Register the 8 insight endpoints the cards call (stream/device-stats/driver-stats/top/alert-aging/silent-sources/latency/activity) with realistic seed data so LiveDataFeed/AnalyticsTabs/SlaBadge/LatencyChart/ActivityHeatmap render content
Entity data (was thin):
- Drivers 8 -> 17, profiles 6 -> 14, points 18 -> 59, devices ~15 -> 65
Verification: vue-tsc green / 158 unit tests pass / build:mock succeeds
Realistic mock:
- Generic CRUD registrar (crud.ts) + mutable in-memory db: full create/update/delete persistence for all entities
- Four structured seeds (auth/manager/data/agentic): real business data for 27 modules replacing the generic fallback stubs, with consistent relations
- Point-value 24h history curve (timeseries) + alarm/event/command history
- settings/business/agentic handlers covering all settings modules and special endpoints (tree/join queries)
Login page + header icons:
- Drop mock-mode pre-seeded token in main.ts and mock/index.ts so the demo starts at the login page (previously landed straight on home)
- Add Setting icon to the settings top-level menu (menuTree) and render icons on Layout dropdown sub-items (previously text-only)
Types: add [key:string]:unknown index signatures on entity interfaces in agentic.ts/common.ts (matches the existing DriverRecord convention)
Verification: vue-tsc green / 158 unit tests pass / build:mock succeeds / no internal address leaked in dist
The first deploy after enabling the demo.dc3.site custom domain landed in
deployment_queued and was cancelled by the Pages backend. Bump error_count
(10→20) and timeout (10m→15m) so transient queue stalls can ride through
instead of aborting.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): complete static mock demo for GitHub Pages
- register core/dashboard/dictionary handlers + seed data (driver/device/
profile/point, dictionaries, dashboard stats/topology/alerts)
- fix router-guard timing: pre-seed auth at main.ts top level before router
install, since the initial navigation runs as a microtask ahead of the
async mock-chunk import
- hide agentic assistant in mock mode (its chat streams over raw fetch and
bypasses the axios adapter)
- assetUrl helper for subpath-safe public assets
- GitHub Pages deploy workflow + public/CNAME (demo.dc3.site)
- unit tests covering the mock adapter
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(web): commit mock core handler skipped by core.* gitignore
The repo-root `core.*` rule (meant for JVM crash dumps) silently skipped
dc3-web/src/mock/handlers/core.ts during `git add`, so the PR build failed
type-check with "Cannot find module './handlers/core'". Force-add the file
and add a negation exception so it can't be dropped again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(web): drop `as never` cast in mock-adapter test
The AI guardrail forbids double-assertion / never-cast type laundering.
Use the real AxiosRequestConfig type and a single boundary cast to R
(the interceptor unwraps the envelope) instead of `request(config as never)`.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
grant_type in GrpcMcpIntrospectDTO was a free-form string. Introduce
GrpcOAuthGrantType (GRPC_OAUTH_GRANT_TYPE_UNSPECIFIED / AUTHORIZATION_CODE
/ CLIENT_CREDENTIALS / REFRESH_TOKEN). Enum names are upper-case (Java
enum constants must be); the boundary converts to/from the lowercase
OAuth spec form (authorization_code) via toUpperCase / toLowerCase.
BO, DB and OAuth form parameter stay lowercase string.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
audit status in GrpcMcpAuditCommand was a free-form string. Introduce
GrpcMcpAuditStatus (MCP_AUDIT_STATUS_UNSPECIFIED / SUCCESS / DENIED /
POLICY_DENIED / ERROR / UNKNOWN) — names match McpAuditStatusEnum values.
Server maps proto->DTO via name(); facade maps BO string->proto via
toGrpcAuditStatus. BO and DB stay string.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
principal_type was a free-form string in GrpcMcpIntrospectDTO and
GrpcMcpAuditCommand. Introduce GrpcMcpPrincipalType
(MCP_PRINCIPAL_TYPE_UNSPECIFIED / USER / SERVICE_ACCOUNT / SYSTEM) —
names match PrincipalTypeEnum values, so the mapping is a direct
valueOf / name(). Server + facade convert at the proto boundary; BO,
gateway and HTTP header layer stay string.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
risk_level was a free-form string across GrpcMcpToolMetadataDTO,
GrpcMcpToolResolveDTO, GrpcMcpToolAuthorizeDTO and GrpcMcpAuditCommand.
Introduce GrpcMcpRiskLevel (MCP_RISK_LEVEL_UNSPECIFIED / LOW / MEDIUM /
HIGH) — names match McpRiskLevelEnum values, so the mapping is a direct
valueOf / name(). Server + facade convert at the proto boundary; the BO
and DB layer stay string.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(api): correct inverted enable_flag comment and document time unit
- tenant.proto enable_flag comment said "1 enabled, 0 disabled" but the
actual EnableFlagEnum is ENABLE=0, DISABLE=1 — callers reading the
comment would invert the flag. Correct it.
- base.proto create_time/operate_time are epoch milliseconds
(LocalDateTimeUtil/Instant.toEpochMilli); document the unit so callers
don't guess seconds vs millis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(api): carry timestamp in point-value history; explicit bool presence
#5 Point-value history: the whole chain (proto -> gRPC server ->
PointValueService -> repository -> facades -> controller -> agentic tool)
returned List<String> and dropped create_time even though the DB row
already carried it. Switch to PointValueBO / FacadePointValueBO end to
end so callers receive each value with its timestamp.
#6 Field presence: GrpcR.ok and McpIntrospectDTO.active are now optional
bool, so "unset" is distinguishable from false on the wire.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): unify JWT signing key, drop salt/password from token contract
The JWT signing key was per-principal — securityKey + ":" + salt, where
salt was the credential salt also carried through the gateway and the
token RPC. That makes the JWT key weak and widens salt exposure to every
gateway hop. Sign with the single configured securityKey (HS256) instead
and remove salt from the JWT path entirely:
- KeyUtil.generateToken/parserToken drop the salt parameter; the HMAC
key is now just securityKey (must be >= 32 bytes for HS256).
- TokenService.generateToken/checkValid drop the salt parameter.
- token.proto GrpcLoginQuery drops salt and password — CheckValid only
ever needed tenant, name and token.
- gateway FilterService, TokenGrpcFacade, TokenController adapted; the
request header no longer feeds salt into validation.
The login-handshake salt (POST /token/salt, used to salt the password
client-side before verifyPassword) is unchanged — only the JWT signing
salt is removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(api): type MCP authorize decision as proto enum
The authorize-tool-call decision was a free-form string, so callers
could only compare it against literals with no compile-time check.
Introduce GrpcMcpDecision (MCP_DECISION_UNSPECIFIED / AUTHORIZED /
CONFIRM_REQUIRED / REJECTED) and type GrpcMcpToolAuthorizeDTO.decision
with it. Enum names match the existing auth-side literals, so the
mapping is a direct valueOf / name().
- McpRuntimeServer builds the enum via toGrpcDecision (unknown -> UNSPECIFIED).
- McpRuntimeGrpcFacade maps enum -> BO string via name().
- gateway unchanged: it receives the BO (string decision) through the facade.
The other string MCP fields (risk_level, status, grant_type,
principal_type) stay strings for now — their value sets are wider and
partly lowercase (OAuth grant_type), so they are a follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(facade): align TokenLocalFacade with 3-arg checkValid (CI compile fix)
TokenLocalFacade (local impl) was missed when TokenFacade.checkValid
dropped salt; CI compiles facade-local-auth independently and caught
it. Align it + its test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* chore(docs): move docs site to standalone pnoker/iot-dc3-docs repo
The VitePress docs site now lives in pnoker/iot-dc3-docs and serves docs.dc3.site from there. Remove the in-repo docs/ and all docs-only build/deploy wiring so nothing dangles.
- delete docs/ (source moved to pnoker/iot-dc3-docs)
- delete .github/workflows/docs.yml (deploy owned by iot-dc3-docs)
- drop npm /docs dependabot block; clean codeql/.gitignore docs paths
- remove Makefile docs-* targets
- relocate AI testing policy into dc3-web/tests/ so the required Web guardrail test is self-contained (was reading ../docs/...)
- rewire README image refs (7 READMEs) and in-repo doc links (README.ai.md, AGENTS.md, dc3/doc/README.md) to https://docs.dc3.site / the new repo
dc3/doc/{TITLE,CHANGE,USAGE}.md STAY - release tooling (make changelog, docker-ci) regenerates them; the docs repo snapshots them.
* fix(docs): repair pre-existing broken doc links found during migration
- 8 READMEs: /en|zh/introduction/technology-stack -> /en|zh/development/technology-stack (page lives under development/, not introduction/)
- dc3-web/tests/README.md: ../docs/test-debugging.md (missing) -> https://docs.dc3.site/en/frontend/test-debugging
DOMPurify does not strip <script>/on* handlers under happy-dom (the
default vitest environment), so the "strips <script> tags" assertion
has been failing on main since the sanitizer switched to DOMPurify.
Production is unaffected — real browsers sanitize correctly. Pin this
single test file to jsdom via a per-file environment annotation and add
jsdom as a devDependency; all other tests stay on happy-dom.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* style(backend): reformat and rearrange java/xml sources
Apply code cleanup across dc3-common and dc3-driver: whitespace and
indent normalization, import sorting, member rearrangement, and javadoc
normalization. No semantic changes; compilation verified.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* style(docs): reformat vitepress vue diagram components
Expand compact svg templates and normalize formatting across diagram
components, the seo module, and the theme stylesheet. No behavior
changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* style(docs): reformat markdown pages
Normalize markdown formatting. Restore the <script setup> component
imports that an earlier unused-import pass had wrongly stripped; every
<Diagram> tag now resolves to a backing import again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* style: reformat point view and trim pom whitespace
Normalize whitespace in the point view and drop trailing whitespace in
pom.xml. No behavior changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
pnpm/action-setup was pinned to a commit running on the deprecated Node.js 20 runtime (GitHub forces Node 24 and emits a warning). Bump to v6.0.10 (0977fd9) which runs natively on Node 24, removing the deprecation warning. Updates docs.yml (1) + ci-web.yml (2).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(docs): restore consolidated 5-pillar navigation
The promote-develop-to-main merge (6a4bef72c) fused main's consolidated 5-pillar nav with develop's flat 6-pillar layout into 7 scattered pillars, undoing the consolidation in 261af5721.
Restore the 5-pillar design: architecture absorbs the Overview pillar (project-overview group); operations merges into Develop (运营 + deploy-ops groups); AI stands alone; quickstart moves under Develop. Drop the now-unused pillar.overview/pillar.operations i18n keys, which also removes the overview/operations English fallback in the header.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(docs): position version switcher between lang and theme toggles
The version switcher is injected via the nav-bar-content-after slot and rendered after the social links at the far right. Add flex order on desktop (>=960px) so it sits between the language switcher and the appearance toggle.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(security): sanitize agentic assistant HTML with DOMPurify (XSS)
RenderedAssistantMessage rendered model output via v-html after a
hand-rolled regex sanitizer that CodeQL flagged 5 ways: bad-tag-filter,
incomplete-multi-character-sanitization (on* attributes, javascript:),
incomplete-url-scheme-check (data:/vbscript:). Replace with DOMPurify,
which covers all these plus mutation XSS. Fixes CodeQL #2146-2150.
* fix(security): harden log-injection + CAN command injection
log-injection (7): pass user-derived log args (conversationId, model,
candidate/fallback) through LogSanitizer.sanitize in AgenticChatServiceImpl,
ChatClientFactory, AgenticChatRequestPreparer — strips CR/LF that could
forge log lines.
relative-path-command / command injection (2, CanDriver): executeCommand
runs `sh -c` with a command built from driver config (interfaceName) and
request data (canId/frame), so add a CAN_COMMAND_PATTERN whitelist
(^[A-Za-z0-9 _#,.=%/-]+$) rejecting shell metacharacters, and validate
interfaceName against ^[A-Za-z0-9_]+$ at all 3 entry points. Fixes
CodeQL #2173,#2172,#2120,#1514,#1513,#1022,#1017,#1016,#1014.
Verified: mvn compile agentic+can clean.
RenderedAssistantMessage rendered model output via v-html after a
hand-rolled regex sanitizer that CodeQL flagged 5 ways: bad-tag-filter,
incomplete-multi-character-sanitization (on* attributes, javascript:),
incomplete-url-scheme-check (data:/vbscript:). Replace with DOMPurify,
which covers all these plus mutation XSS. Fixes CodeQL #2146-2150.
ci-backend.yml ignored dc3-web paths on pull_request, so npm-only
dependabot PRs never triggered backend CI — but compile/Unit/Integration/
coverage are required status checks, leaving those PRs perpetually
BLOCKED (had to --admin merge). Drop the pull_request paths-ignore so
every PR runs backend CI; keep it on push (a dc3-web-only push still
skips backend CI, which is fine — the PR already ran it).
M6 relocated CoapExchange from core.server.resources to core (verified
via compile). dc3-driver-coap uses only the core CoAP API
(CoapClient/Server/Endpoint/Resource/Configuration) and avoids the
DTLS/observe/MessageObserver areas where M3→M6 broke, so this single
import is the whole adaptation. Supersedes dependabot #81.
Gains: M4-M6 bugfixes (deferred CID records, CON notify reliability,
anonymous cipher-suite), Java 21 virtual-thread support, RFC 7252
compliance. 4.0.0 GA has no timeline; no reason to stall on M3.
mybatis-plus 3.5.17 fixes the JDK 9+ split-package conflict (#7027) by
relocating service classes from com.baomidou.mybatisplus.extension.service
to com.baomidou.mybatisplus.spring.service. Verified via the 3.5.17 jar:
only IService and ServiceImpl moved — Page, JacksonTypeHandler, chain
wrappers, Db, interceptors all stay in extension. Updated 112 imports.
Supersedes dependabot #141 (which failed compile on the same move).
Verified: mvn compile clean across every IService module (bacnet4j driver
excluded only due to a local mirror cache miss, unrelated to this change).
dependabot.yml had no target-branch, so updates targeted the default
branch (main). main is the release branch and was red — compiler fixes
lived only on develop — which left every open dependabot PR BLOCKED.
Set target-branch: develop on all five ecosystems so upgrades land on
the integration branch first, get validated, then promote to main.
Brings develop's compiler/CI fixes into main (main was red; the fixes
in PR#88-91 lived only on develop). This unblocks the dependabot PRs
that target main.
Resolves the docs/.vitepress/config.mts merge conflict by fusing both
navigation designs into 7 pillars (总览·架构·驱动·AI·基础·开发·运维):
develop's overview/operations pillars + main's standalone AI pillar.
- Keeps develop's version-switcher (version.mts/VersionSwitcher/VersionBanner)
- AdSense stays dropped per main's earlier perf decision (drop AdSense)
- technology-stack remains under 开发, since the develop-side rename to
introduction/ was not carried through the merge (file still at development/)
Point-value ingestion is now driven by PointValueIngestBuffer workers, so the Quartz 5s tick job is removed; ScheduleForDataServiceImpl only registers the hourly maintenance job; HourlyJobForData test migrated to its own file.
PointValueReceiver offers every message to PointValueIngestBuffer (ack on accept, nack-requeue when full) and switches to the high-throughput listener container factory; drops the speed-threshold dual path.
Bounded ArrayBlockingQueue plus worker threads draining on a size-or-time trigger; offer returns false when full so the receiver can nack-requeue; a failed save re-queues the batch for retry. PointValueServiceImpl.savePointValuesToRepository wraps failures into RepositoryException so the buffer can re-queue instead of silently dropping.
pnoker