busya
4c57789218
Round 2 — P1 MCL + GRACE: - logger intent-drop repaired across 182 call sites; logging unified repo-wide on the intent-first facade (211 direct SSOT log() sites migrated); facade level= support; molecular-cot-logging skill synced with the module (.agents -> .kilo). - EXPLORE/REASON-REFLECT gaps closed: poll-dispatch failure path, exploration fail-closed choke point in _finish(), 9 silent mcp_ops_dispatch adapters. - INV_6: dead agent/app.py edge removed (_llm_health); specs 033/035/036/039 sweep -> 0 dead edges (5 retargeted to live IDs, 15 tombstoned with successors). - INV_9 dedupes (TaskDrawer BINDS_TO, vestigial assistantOffset, duplicated @SIDE_EFFECT); INV_1: migrations 0014-0016 anchored, exploration_sandbox module-region span fixed. - Full-suite defect root-caused: leaked DI singleton mocks from test_dependencies_unit -> autouse restore fixture + get_session_idle_timeout_minutes hardening (int validation, EXPLORE fallback SESSION_POLICY_CONFIG_INVALID). - Executable pins: tests/test_core/test_logger_wire_format.py (wire fields, misuse proof, repo-wide AST sweeps over both forbidden shapes). Round 3 — server.py decomposition EXECUTED per the binding gate plan (specs/050-mcp-interface/plans/server-decomposition-gate.md, execution log included): - 1571 -> 177 LOC: scenario_inputs.py (268), auth.py (238, single _access_token_context site), rbac_server.py (393), tools_authoring.py (367), tools_scenario.py (373). - Addendum E: pre-existing ops_tools.py INV_7 offender split 420 -> 215 + tools_review.py (253). - Contract IDs frozen, import surface frozen, registration order frozen; monkeypatch seams relocated to owning modules (recorded); zero behavior diff. Round 4 — P2 queue closed: - Story 5 AC2: HandoffSurface copyable prompt parameterized with dashboard context (/agent route forwards objectType/objectId/objectName/envId/route/intent; i18n handoff_context_label ru/en; contract + render tests). - E6 / MCPX-FR-007a: McpTransportGuard enforces server-owned JSON-depth bound (typed 400 json_depth_exceeded pre-dispatch, iterative fail-closed walker) and per-session sliding-window rate limit (typed 429 rate_limited + standard Retry-After); rejections create no mutable state. Limits live in McpServerConfiguration. - SC-005 remnants CLOSED: /api/assistant router unmounted (package retained as MCP parity provenance, header records rationale); /api/agent/llm-config REMOVED with in-place Tombstone + dead strict service DI deleted; assistant.ts deleted (inbound edge removed first); SystemSettings assistant-retention UI + 16 i18n keys removed; .env.example 7860/GRADIO vars removed (zero consumers verified repo-wide). - SC-004 + SC-009: exact RBAC catalog pins (admin 47 / analyst 21 / viewer 15 derived from the live catalog); mid-flow role revocation hides tools in the next tools/list AND denies cached-catalog calls by name on the same identity-only token; mid-flow grant exposes the approvals surface without new consent. - Browser cookie-consent decision recorded (tasks.md T008): not built in 050. Round 5 — last 050 task + FR-010: - T008b: Core.EndpointLocality deny-by-default perimeter guard for LLM/VLM provider base_url at the create/update choke points (private ranges, enterprise DNS suffixes, all-private resolution; fail closed; anti-substring-spoofing; empty URL denied); typed 400 endpoint_not_local:<reason> pre-persistence; EXPLORE audit line on every denial; env escape hatches documented (INSTALL.md "Локальный периметр"). - MCPX-FR-010: MCP_CATALOG_VERSION published as serverInfo.version at initialize; deprecated/deprecation_note on McpToolDefinition; [DEPRECATED] marker at the single list_tools choke point (entry stays listed/callable one minor cycle); deliberate major-bump ritual pinned by test. Evidence: full backend suite 11243 passed / 240 skipped / 1 xpassed / 0 failed; frontend vitest 3435 passed / lint 0 errors; MCP slice 103; locality slice 107; anchor+AST sweeps ALL BALANCED over 138 touched files; 050 tasks.md fully [x] with proof.
Superset Tools Frontend (SvelteKit)
This is the frontend for the Superset Tools application, built with SvelteKit in SPA mode.
Development
-
Install dependencies:
npm install -
Run development server:
npm run devThe frontend will be available at
http://localhost:5173. It is configured to proxy API requests tohttp://localhost:8000.
Production Build
-
Build the static SPA:
npm run buildThis generates a static SPA in the
build/directory. -
Serve with Backend: The Python backend is configured to serve the files from
frontend/build/. Ensure the backend is running:cd ../backend python src/app.py
Architecture
- Routing: File-based routing in
src/routes/. - Layouts: Shared UI in
src/routes/+layout.svelte. - Data Loading:
loadfunctions in+page.tsfor efficient data fetching. - API Client: Centralized API logic in
src/lib/api.js. - Styling: Tailwind CSS.