Switch default MindSpace HTML delivery to a hybrid inline CSP so onclick handlers and addEventListener pages both run under real HTTP headers, and add Playwright interaction verify beyond HTTP 200 checks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Let Personal Memory candidates pass policy gates without per-user manual review, while keeping shadow mode for explicit human approval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hook shadow pipeline observation into session finish and agent runs, and
expose skill runtime settings through auth and runtime status endpoints.
Co-authored-by: Cursor <cursoragent@cursor.com>
Recover skill runtime policy/admin services and Skill Router v2 helpers so
admins can toggle manifest routing and inspect the platform skill catalog.
Co-authored-by: Cursor <cursoragent@cursor.com>
Recover WIP modules from stash so admin can persist capability config,
observe chat writes in shadow mode, and review persisted candidates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject /api/page-data/ legacy passthrough, verify live API before send,
and resolve delivery links to Portal (8081) instead of Vite (5173).
Add local repair/verify scripts for daily-register Page Data flow.
Co-authored-by: Cursor <cursoragent@cursor.com>
The bundled portal runtime crashed on boot because workspace deliver referenced
ensurePageDataHtmlPagesBound without importing it from page-data-workspace-ensure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Finish/sync now auto-registers datasets and binds any HTML using page-data-client.js
before publication, so user confirmation cannot publish unbound collect pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop blocking WeChat delivery when Page Data insert works but publish
quota blocks h5_publish_records; fix smoke URL missing /api; patch survey
radios for WeChat X5 and detect dataset constants in admin pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop blocking WeChat delivery when Page Data insert works but publish
quota blocks h5_publish_records; fix smoke URL missing /api; patch survey
radios for WeChat X5 and detect dataset constants in admin pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent Portal .env from overriding MindSpace storage/users roots, and
set launchd env plus runtime docs to use /Users/john/MindSpace paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
H5 chat via POST /api/agent/runs failed with ReferenceError after the
session Finish alignment change; restore the missing import from
session-reply-wait.mjs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page Data questionnaires were returning publication slugs to users; password-mode
pages always fell back to /u/ routes. Prefer MindSpace paths at publish time and
rewrite mistaken delivery links in WeChat and Portal chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show privacy popup on launch, gate login on legal consent, and link
user agreement and privacy policy pages in the mini program.
Co-authored-by: Cursor <cursoragent@cursor.com>
john
tkmind