Reject /api/page-data/ legacy passthrough, verify live API before send,
and resolve delivery links to Portal (8081) instead of Vite (5173).
Add local repair/verify scripts for daily-register Page Data flow.
Co-authored-by: Cursor <cursoragent@cursor.com>
The bundled portal runtime crashed on boot because workspace deliver referenced
ensurePageDataHtmlPagesBound without importing it from page-data-workspace-ensure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Finish/sync now auto-registers datasets and binds any HTML using page-data-client.js
before publication, so user confirmation cannot publish unbound collect pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop blocking WeChat delivery when Page Data insert works but publish
quota blocks h5_publish_records; fix smoke URL missing /api; patch survey
radios for WeChat X5 and detect dataset constants in admin pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop blocking WeChat delivery when Page Data insert works but publish
quota blocks h5_publish_records; fix smoke URL missing /api; patch survey
radios for WeChat X5 and detect dataset constants in admin pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent Portal .env from overriding MindSpace storage/users roots, and
set launchd env plus runtime docs to use /Users/john/MindSpace paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
H5 chat via POST /api/agent/runs failed with ReferenceError after the
session Finish alignment change; restore the missing import from
session-reply-wait.mjs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page Data questionnaires were returning publication slugs to users; password-mode
pages always fell back to /u/ routes. Prefer MindSpace paths at publish time and
rewrite mistaken delivery links in WeChat and Portal chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show privacy popup on launch, gate login on legal consent, and link
user agreement and privacy policy pages in the mini program.
Co-authored-by: Cursor <cursoragent@cursor.com>
When schedule_create_item includes a start time and reminder intent, create the
matching h5_schedule_reminders row in the same tool call so 10:00 pushes are not
lost. Also reconcile Goose SSE request ids with the portal agent-run gate to keep
MindSpace chat streaming reliable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return sessionToken from login endpoints and store it client-side because
wx.request cannot rely on Set-Cookie. Also fix multi-cookie parsing,
start on login page, and guard chat rendering fields.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeChat DevTools failed to resolve utils/uuid.js at runtime; move UUID
generation into config.js which is already loaded by app.js.
Co-authored-by: Cursor <cursoragent@cursor.com>
Commit the utility modules required by api.js, messages.js, and chat page
so WeChat DevTools can resolve require('./uuid') at runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add jscode2session exchange, CSRF bypass for servicewechat.com,
and openid-based auto register/login for the mini program client.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add chat file/image upload UX, attachment proxying, vision thumbnails, and per-turn image scoping so agents only use the current upload. Extend MindSpace asset context, billing token state, OA/scenario verify scripts, and related runtime config.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep online publication snapshots aligned when public/*.html changes, default static page binds to public access with MindSpace delivery URLs, and split browser-safe workspace helpers out of the Vite import chain.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose owner PATCH/soft-delete routes, allow anonymous read/stats on
public pages when policy enables read, and add login_required role
editor to the ops panel with tests and doc updates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract UserDataSpaceService for shared SQLite access, wire logged-in Page
Data routes, and add public insert plus password-token read/update/delete with
policy storage, rate limits, and regression tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
john
tkmind