feat: deliver certified records to Feishu Bitable

.env.docker.example

@@ -18,6 +18,9 @@ TASK_EXECUTOR=local
 COLLECTION_MODE=local
 DEBUG=false
 
+# Optional: Feishu bot webhook for Gaojixing verification recovery alerts.
+GAOJIXING_FEISHU_WEBHOOK_URL=
+
 # Interactive browser is available at http://localhost:6080.
 OPENCLI_CDP_ENDPOINT=http://agent-1:19222
 NOVNC_PORT=6080

.env.example

@@ -1,4 +1,4 @@
-# Docker 镜像仓库前缀（默认留空使用 docker.io，国内网络可切换镜像源）
+# Docker 镜像仓库前缀。应用镜像留空时默认使用 ghcr.io/；基础镜像留空时使用 docker.io。
 # 华为云 SWR：swr.cn-north-4.myhuaweicloud.com/<命名空间>/
 # DaoCloud：docker.m.daocloud.io/（官方镜像可用）
 # 腾讯云：mirror.ccs.tencentyun.com/
@@ -151,6 +151,13 @@ IMAGE_ASSET_STORAGE_PATH=/data/image-studio/assets
 # agent  — 分布式边缘采集；采集任务分发到远端 Agent 节点执行
 COLLECTION_MODE=local
 
+# Gaojixing published-run identity. Set this to the exact Git commit used to
+# build both compose images; it is exposed only through authenticated system
+# configuration and is recorded by the claimant runtime.
+OPENCLI_RUNTIME_REVISION=set-to-exact-git-commit
+# Published API, frontend, browser, and agent image version.
+IMAGE_TAG=0.4.0
+
 # ── 边缘节点 Agent 配置（在 Agent 所在机器上配置，非中心节点）─────────────────
 # 中心 API 地址，Agent 启动时自动注册自己（留空则跳过自动注册）
 # CENTRAL_API_URL=http://192.168.1.1:8031
@@ -187,6 +194,10 @@ SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=
 
+# 高吉星豆包证据批次：仅在页面出现验证码/登录/访问异常时发送飞书恢复通知。
+# 该值是飞书机器人 webhook；节点和运行 trace 只保存下面的环境变量名，不保存 URL。
+GAOJIXING_FEISHU_WEBHOOK_URL=
+
 # 采集超时（秒）
 # opencli 子进程最长执行时间（local 模式 + agent 侧）
 # OPENCLI_TIMEOUT=120

.github/workflows/ci.yml

@@ -109,7 +109,9 @@ jobs:
           persist-credentials: false
 
       - name: Validate Compose
-        run: docker compose --env-file .env.docker.example -f docker-compose.yml -f docker-compose.build.yml config --quiet
+        run: |
+          test -x chrome-extra/entrypoint.sh
+          docker compose --env-file .env.docker.example -f docker-compose.yml -f docker-compose.build.yml config --quiet
 
       - name: Build and start public stack
         run: docker compose --env-file .env.docker.example -f docker-compose.yml -f docker-compose.build.yml up -d --build --wait api frontend agent-1
@@ -144,13 +146,14 @@ jobs:
         with:
           python-version-file: ".python-version"
 
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e .[dev]
+        run: uv sync --extra dev
 
       - name: Backend syntax check
-        run: python -m compileall backend
+        run: uv run python -m compileall backend
 
       # Coverage visibility, not a gate: pyproject.toml bakes in
       # `--cov-fail-under=80` via [tool.pytest.ini_options].addopts, but the
@@ -167,7 +170,7 @@ jobs:
       # The upstream oracle stays opt-in (DATAFLOW_RUN_UPSTREAM_ORACLE=1) and
       # self-skips in this job.
       - name: Backend tests (with coverage report)
-        run: python -m pytest tests/unit tests/compat tests/integration -m "not live" --cov=backend --cov-report=term-missing --cov-fail-under=0
+        run: uv run pytest tests/unit tests/compat tests/integration -m "not live" --cov=backend --cov-report=term-missing --cov-fail-under=0
 
   frontend-workflow-checks:
     runs-on: ubuntu-latest
@@ -237,28 +240,29 @@ jobs:
         with:
           python-version-file: ".python-version"
 
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e .[dev]
+        run: uv sync --extra dev
 
       - name: Wait for Postgres
-        run: python -c "import time; time.sleep(2)"
+        run: uv run python -c "import time; time.sleep(2)"
 
       - name: alembic upgrade head
-        run: alembic upgrade head
+        run: uv run alembic upgrade head
 
       # Catches broken downgrade() bodies / non-reversible migrations before
       # merge: a chain that only ever gets tested via upgrade() can silently
       # rot (dropped columns with no re-add, wrong op order, etc.).
       - name: alembic downgrade/upgrade smoke test
         run: |
-          alembic downgrade -1
-          alembic upgrade head
+          uv run alembic downgrade -1
+          uv run alembic upgrade head
 
       - name: Native intelligence and event spine PostgreSQL conformance
         run: >-
-          pytest tests/integration/test_intelligence_session_store.py
+          uv run pytest tests/integration/test_intelligence_session_store.py
           tests/integration/test_intelligence_session_migration.py
           tests/unit/test_workflow_run_events.py
           tests/integration/test_workflow_event_spine_migrations.py
@@ -274,7 +278,7 @@ jobs:
       # is caught. --no-cov: this is a targeted single-test step, not a coverage
       # run (pyproject's addopts would otherwise fail it under the 80% gate).
       - name: cursor FOR UPDATE locking (Postgres)
-        run: python -m pytest tests/unit/pipeline/test_db_cursor_store.py -k postgres --no-cov -p no:cacheprovider
+        run: uv run pytest tests/unit/pipeline/test_db_cursor_store.py -k postgres --no-cov -p no:cacheprovider
 
   cargo:
     runs-on: ubuntu-latest

.nvmrc

@@ -1 +1 @@
-26.3.1
+24

DESIGN.md

@@ -1,3 +1,7 @@
+---
+name: OpenCLI Admin design system
+---
+
 # Design
 
 ## Source of truth
@@ -400,3 +404,36 @@
 - [ ] Workflow UX / `manifest.presentation` 的 experience descriptor 首版字段名和版本如何定义，使内建专用编辑器可声明但不把任意插件前端带入平台？
 - [ ] Workflow UX / 跨工作流复制首版是否仅支持同一 OpenCLI 实例，还是同时定义跨实例剪贴板格式与兼容性报告？
 - [ ] Workbench engines / Perspective + DuckDB-Wasm 与 OpenTelemetry + Langfuse 的首个生产适配器边界、数据量阈值和许可证复核何时进入 ADR？当前页面只验证 OpenCLI 内的信息架构与真实数据交互。
+
+## Product Context
+
+OpenCLI Admin 是面向自托管操作者的研究、采集和工作流控制台。界面必须优先表达真实状态、明确权限边界，并为失败提供可执行的恢复路径。
+
+## Overview
+
+产品采用桌面优先、信息密集、渐进披露的控制台体验。首次部署必须能够完成安全初始化，后续高频操作不暴露底层部署凭据。
+
+## Colors
+
+沿用 `docs/DESIGN_SYSTEM.md` 与 `frontend/app/globals.css` 的语义色；橙色用于主要操作和品牌信号，状态不能只依赖颜色表达。
+
+## Typography
+
+正文使用现有界面字体栈，运行标识、端口和令牌类内容使用等宽字体。紧凑布局不得牺牲标签、错误信息和正文可读性。
+
+## Layout
+
+控制台保持现有侧栏、内容区和检查器边界。认证界面在窄屏采用单列，在桌面保留产品背景与固定宽度表单，并保证表单顺序稳定。
+
+## Do's and Don'ts
+
+- Do：先显示用户要完成的任务，再按需揭示实现细节和恢复入口。
+- Do：为加载、空、错误、阻塞和成功状态提供明确文案与下一步。
+- Don't：把环境变量、OIDC 术语或 Fleet Token 当作新用户必须理解的产品概念。
+- Don't：使用装饰动画遮盖状态变化，或把不可用能力表现为可执行。
+
+## Source Decisions
+
+- Adopted：现有 Dark Ops Console 视觉体系、shadcn 组件、渐进披露和可恢复状态原则。
+- Rejected：要求首次用户先配置外部身份提供方或从 `.env` 中寻找日常登录凭据的流程。
+- Active change：`openspec/changes/local-admin-onboarding`。

MOTION.md

@@ -0,0 +1,41 @@
+---
+schema: design-pipeline.motion-foundation.v0.1
+name: OpenCLI operator motion language
+posture: minimal
+primitiveRegistry: design-pipeline.motion-primitives.v1
+---
+
+## Motion Thesis
+
+Motion confirms a completed operator action or a changed system state. It never delays access to credentials, recovery, or operational data.
+
+## Motion Principles
+
+- Keep authentication transitions short, interruptible, and secondary to the active form state.
+- Never move focused controls or change their order while the user is typing.
+- Prefer opacity and color feedback over layout movement for repeated operational use.
+
+## Motion Vocabulary
+
+- primitive: reveal.trim-line
+  - Use only for a non-blocking transition between login states.
+
+## Procedural Motion
+
+No procedural motion is used for authentication or recovery surfaces.
+
+## Runtime Policy
+
+CSS transitions are the default adapter for small state changes. The existing Motion React adapter may preserve the selected primitive where it is already loaded; no new animation runtime is introduced.
+
+## Reduced Motion
+
+When `prefers-reduced-motion` is enabled, state changes use immediate opacity changes and do not animate position, scale, or background effects.
+
+Fallback: every animated confirmation has an immediate static state change with the same text and focus result.
+
+## Source Decisions
+
+- Adopted: the existing login surface's short, non-blocking confirmation transitions; this keeps the new authentication states consistent with repeated console use.
+- Rejected: decorative background and position animation for password and recovery states; these make an access-critical form less legible and are not required for the operator workflow.
+- Authored for `openspec/changes/local-admin-onboarding`; no external motion implementation or visual reference is adopted.

README.md

@@ -57,10 +57,10 @@ Invoke-WebRequest https://raw.githubusercontent.com/2233admin/opencli-Razormind/
 
 安装完成后，终端会打印：
 
-- `BOOTSTRAP_ADMIN_TOKEN`：首次进入管理界面使用；
+- `BOOTSTRAP_ADMIN_TOKEN`：首次创建本地管理员及紧急恢复时使用；
 - `API_AUTH_TOKEN`：Fleet、Agent、API 和 MCP 访问使用。
 
-两者同时保存在安装目录的 `.env`。不要公开 noVNC、令牌或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
+首次进入控制台时设置本地管理员密码并输入一次 `BOOTSTRAP_ADMIN_TOKEN`；后续直接使用管理员密码登录。令牌同时保存在安装目录的 `.env`，仅供恢复使用。不要公开 noVNC、令牌或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
 
 ## 正常的研究流程
 
@@ -167,39 +167,44 @@ flowchart LR
 
 ## 从源码开发
 
-前置要求：Python 3.13+、Node.js 26.3.1（见 `.nvmrc`）、uv、pnpm。
+前置要求：Python 3.13+、Node.js 24（见 `.nvmrc`）、uv、pnpm。
 
 ~~~bash
 git clone https://github.com/2233admin/opencli-Razormind.git
 cd opencli-Razormind
 
-uv sync
-uv run uvicorn backend.main:app --host 127.0.0.1 --port 8031
+uv sync --extra dev
+npm run doctor
+npm run dev:backend
 ~~~
 
 另开终端：
 
 ~~~bash
-cd frontend
-pnpm install
-pnpm dev --hostname 127.0.0.1 --port 3010
+npm run dev:frontend
 ~~~
 
 常用验证：
 
 ~~~bash
-npm run lint:frontend
-npm run typecheck:frontend
-npm run build:frontend
-uv run pytest
+npm run check
+npm run test:backend
 ~~~
 
+可选能力在启动前使用同一套环境预检：`npm run doctor:agent`、
+`npm run doctor:celery`、`npm run doctor:ai`、`npm run doctor:dify`、
+`npm run doctor:kats`、`npm run doctor:image-studio`。对应 Docker 入口为
+`npm run docker:agent|docker:celery|docker:dify|docker:kats|docker:image-studio`。
+`CHROME_SUFFIX` 在默认栈中应为空；
+启用远程 Agent 的内置 Chrome 镜像时必须设为 `-chrome`，并运行
+`node scripts/dev-environment.mjs --profiles=agent,embedded-chrome`。预检只报告变量名，不输出密钥值。
+
 从源码构建完整 Docker 栈：
 
 ~~~bash
 cp .env.docker.example .env
 # 设置 API_AUTH_TOKEN、BOOTSTRAP_ADMIN_TOKEN、SECRET_KEY、CREDENTIAL_ENCRYPTION_KEY
-docker compose -f docker-compose.yml -f docker-compose.build.yml up --build -d
+npm run docker:up
 ~~~
 
 ## 发布镜像

_bmad-output/implementation-artifacts/deferred-work.md

@@ -0,0 +1,6 @@
+- source_spec: `D:\projects\opencli-Razormind-gjx-live\_bmad-output\implementation-artifacts\spec-feishu-bitable-record-delivery.md`
+  summary: Reposting an identical workflow run ID can conflict on regenerated event timestamps instead of returning or resuming the stored run.
+  evidence: A second identical POST for `run-gaojixing-feishu` raised `WorkflowRunEventConflictError` on the first queued event because its canonical payload differed; this behavior predates the Feishu sink and belongs to workflow-run idempotency infrastructure.
+- source_spec: `D:\projects\opencli-Razormind-gjx-live\_bmad-output\implementation-artifacts\spec-feishu-bitable-record-delivery.md`
+  summary: Repository-wide Ruff is not currently a usable clean gate because the baseline contains extensive unrelated lint debt.
+  evidence: `uv run ruff check backend tests` reported 1,704 pre-existing findings across unrelated modules, while the complete Feishu changed-file set passes Ruff cleanly.