倪程伟 31c98e923d feat(webchat): expose agent-bound skill list to API-Key callers ... GET /api/v1/channels/webchat/skills?agentId=<optional>&visitorId=<required> Headers: X-MC-Key + X-MC-Visitor-Token Downstream systems integrating via the webchat SSE endpoint have no way today to enumerate the skills a visitor can invoke — the existing GET /api/v1/skills is JWT + workspace-role gated, unreachable from the API-Key-authenticated webchat channel. Without a list, integrators can't render a slash picker UI; visitors have to know skill slugs by heart. The new endpoint mirrors the /stream auth chain (resolveChannel + verifyVisitorToken) and reuses AgentBindingResolver.getBoundSkillIds to scope visibility. Only enabled skills explicitly bound to the agent surface; agents with no explicit bindings return an empty list rather than inheriting the global pool (the agent config stays the source of truth for what surfaces in visitor UI). The agentId anti-escalation guard from /stream is reused verbatim — an explicit agentId must belong to the channel's workspace. Returns WebChatSkillView (id / name / nameZh / nameEn / description / icon). Deliberately omits SKILL.md content, configJson and securityScanResult: those never leave the admin console. Issue: #373		2026-06-19 06:20:59 +08:00
..
src	feat(webchat): expose agent-bound skill list to API-Key callers	2026-06-19 06:20:59 +08:00
Dockerfile	fix(docker): honor SPRING_PROFILES_ACTIVE instead of pinning the mysql profile	2026-06-14 16:47:16 +08:00
pom.xml	fix(db): make KingbaseES driver opt-in and restore default SSRF guard	2026-06-14 10:34:35 +08:00
settings.xml	build(maven): declare US + CN repositories in pom.xml, drop opaque mirror	2026-04-25 09:56:17 +08:00