mateaix 83660893a6 fix(chat): restrict generated-file link regex to http(s)/relative URLs ... Follow-up to #447. The generated-file link extraction accepted any non-')' text before the path, so a paren-free javascript:/data: URL embedding /api/v1/files/generated/<id> could be captured and bound to an <a href>, enabling XSS on click. Adopt the scheme-restricted pattern already used by SegmentSupersedeDetector and the channel adapters, on both backend (ChatController) and frontend (useChat). Also replace the inline fully-qualified Pattern/Matcher with imports and drop an unused run-overview i18n key. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-28 16:25:11 +08:00
..
acp	feat(workspace,system): add @RequireGlobalAdmin and gate admin-only controllers	2026-05-15 10:18:10 +08:00
activity	feat(workspace,system): add @RequireGlobalAdmin and gate admin-only controllers	2026-05-15 10:18:10 +08:00
agent	feat(agent): per-employee model-chain preference (provider + model, repeatable provider)	2026-06-28 13:05:48 +08:00
approval	feat(webchat): API-Key 渠道补齐审批 resolve + replay (ISSUE #413 P1) (#415)	2026-06-25 11:18:52 +08:00
audit	feat(webchat): audit visitor-side writes via AuditEventService.recordAs (epic #355 PR 7)	2026-06-18 06:33:17 +08:00
auth	fix(sso): gate SSO runtime beans on mateclaw.sso.enabled	2026-06-26 10:27:16 +08:00
channel	fix(chat): restrict generated-file link regex to http(s)/relative URLs	2026-06-28 16:25:11 +08:00
cli	feat(cli): project-level CLI framework with operational data export command	2026-06-25 09:31:48 +08:00
common	feat(agent): deterministic Markdown normalization for final answers (#275)	2026-06-07 19:10:53 +08:00
config	feat(kb-open): P0-A open-API auth — API keys, rate limit, centralized authorization	2026-06-28 14:45:53 +08:00
cron	fix(cron): restore ShedLock DB-time for dialects that support it	2026-06-14 10:44:52 +08:00
dashboard	fix(dashboard): count tool calls from assistant.metadata, not role=tool rows	2026-05-24 22:58:02 +08:00
datasource	feat(db): support KingbaseES (人大金仓) domestic database (#324)	2026-06-14 10:30:09 +08:00
doc	feat(docs): expose bundled help docs via in-app viewer	2026-06-15 07:48:49 +08:00
exception	fix(exception): return 405 for HttpRequestMethodNotSupportedException	2026-06-19 06:20:59 +08:00
goal	feat(agent): loop-engineering robustness — goal continuation, plan re-plan, stall detection	2026-06-17 06:37:08 +08:00
hook	feat(hook): HMAC-SHA-256 body signing for outbound webhooks	2026-05-02 15:41:13 +08:00
i18n	fix(i18n): stop logging missing-key noise for optional tool descriptions	2026-05-19 20:06:38 +08:00
kbopen	feat(kb-open): P0-A open-API auth — API keys, rate limit, centralized authorization	2026-06-28 14:45:53 +08:00
llm	feat(agent): per-employee model-chain preference (provider + model, repeatable provider)	2026-06-28 13:05:48 +08:00
memory	feat(memory): bound always-on memory growth with injection budget, consolidation, and file ceilings	2026-06-17 11:04:19 +08:00
notification	feat(wiki): KB processing-failure visibility (error-code chain + silent sub-step alerts + cross-KB failure center)	2026-06-28 13:07:34 +08:00
operational	feat(cli): project-level CLI framework with operational data export command	2026-06-25 09:31:48 +08:00
planning	feat(plans): per-step agent delegation + fix kanban pending column (issue #385)	2026-06-21 21:20:58 +08:00
plugin	feat(db): support KingbaseES (人大金仓) domestic database (#324)	2026-06-14 10:30:09 +08:00
skill	feat(skill): self-evolving skills — out-of-band reflection, curator consolidation, agent-authored skill files	2026-06-23 13:51:04 +08:00
stt	feat(stt): route OpenAI Whisper provider to any OpenAI-compatible endpoint (#76)	2026-05-09 13:57:52 +08:00
system	feat(dashboard): show the connected database on the dashboard	2026-06-15 08:47:53 +08:00
task	feat(task): generic one-shot Callable runner with parent-conv cancel	2026-05-16 14:51:04 +08:00
tool	feat(tool): desktop local file/shell tools via WebSocket tunnel	2026-06-26 18:24:25 +08:00
trigger	fix(feishu): decouple trigger ingest from the Lark WS dispatch thread (#208)	2026-06-09 09:17:26 +08:00
tts	feat(workspace): chat-uploads 上传目录工作空间/Agent 感知化 (#422)	2026-06-26 14:20:54 +08:00
wiki	fix(wiki): close IDOR in WikiRelationController & WikiEntityController (cross-KB id binding)	2026-06-28 14:41:19 +08:00
workflow	fix(workflow): activate approval notify + resolve→resume bridge (ISSUE #413 P0) (#414)	2026-06-25 09:54:55 +08:00
workspace	fix(workspace): harden chat-upload base-path containment + cleanup guard	2026-06-26 14:25:56 +08:00
MateClawApplication.java	feat(db): support KingbaseES (人大金仓) domestic database (#324)	2026-06-14 10:30:09 +08:00