Switch default MindSpace HTML delivery to a hybrid inline CSP so onclick handlers and addEventListener pages both run under real HTTP headers, and add Playwright interaction verify beyond HTTP 200 checks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Recover WIP modules from stash so admin can persist capability config,
observe chat writes in shadow mode, and review persisted candidates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject /api/page-data/ legacy passthrough, verify live API before send,
and resolve delivery links to Portal (8081) instead of Vite (5173).
Add local repair/verify scripts for daily-register Page Data flow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Finish/sync now auto-registers datasets and binds any HTML using page-data-client.js
before publication, so user confirmation cannot publish unbound collect pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop blocking WeChat delivery when Page Data insert works but publish
quota blocks h5_publish_records; fix smoke URL missing /api; patch survey
radios for WeChat X5 and detect dataset constants in admin pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent Portal .env from overriding MindSpace storage/users roots, and
set launchd env plus runtime docs to use /Users/john/MindSpace paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
When schedule_create_item includes a start time and reminder intent, create the
matching h5_schedule_reminders row in the same tool call so 10:00 pushes are not
lost. Also reconcile Goose SSE request ids with the portal agent-run gate to keep
MindSpace chat streaming reliable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add chat file/image upload UX, attachment proxying, vision thumbnails, and per-turn image scoping so agents only use the current upload. Extend MindSpace asset context, billing token state, OA/scenario verify scripts, and related runtime config.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract UserDataSpaceService for shared SQLite access, wire logged-in Page
Data routes, and add public insert plus password-token read/update/delete with
policy storage, rate limits, and regression tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add id/created defaults for user_message, ensure metadata in agent-run
gateway before submit, and kickstart the agent-run worker after portal deploy
so queued page-generation runs use the latest runtime bundle.
Co-authored-by: Cursor <cursoragent@cursor.com>
john
tkmind