为何现在可做This is the last non‑overlapping, concrete test slice flagged by the bot after the three merged PRs.
第一步View `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py`, inspect imports, locate the SQLite fixture, and map the two mocked `session.…
问题MCPServer caps HTTP requests at 4 MiB with no configurable limit, causing 413 errors for larger payloads like document uploads.
为何现在可做Straightforward feature: expose an existing SDK option via MCPServer constructor; low risk, minimal changes; matches user’s clear request and use case.
第一步Navigate to the MCPServer definition, examine its constructor and getNodeHandler, then implement maxRequestBodySize as optional property and pass it through to…
问题SQLTools.run_sql catches exceptions during row fetch and returns an empty list `[]`, which `run_sql_query` then serializes to JSON string `"[]"`.
为何现在可做The bug is a straightforward misuse of exception handling that silently masks fetch failures, causing incorrect model behavior.
第一步Clone the repo (if not already), open `agno/tools/sql.py`, locate the `run_sql` method (around line 158), and examine its try/except block and the calling `run…
今日行动队列 · 完整
⚠ 当前行动队列不可直接使用:请先重新核验本轮运行状态。
Easy
langgenius/dify · 新鲜
too much Mock(spec=
问题:Issue #45585 tracks a DB‑double cleanup effort.
为何可做:This is the last non‑overlapping, concrete test slice flagged by the bot after the three merged PRs.
Test1-2 hoursEasybranch: maintests if riskhuman review
[v2] e2e `protocol:timeout:reset-on-progress` leaves unhandled rejections on its known-failing SSE variants, so vitest exits 1 on macOS
问题:On macOS, the e2e test for protocol:timeout:reset-on-progress with SSE transport leaves unhandled promise rejections because the 200ms timeout fires after the test has exited the…
为何可做:Bug causes CI failures on macOS due to unhandled rejections; fix is a one‑line addition that resolves the race condition and restores clean test exits.
Annotation quota dialog Close button is covered by its content
问题:Annotation quota dialog positions an absolutely placed Close button under a relatively positioned GridMask overlay, causing pointer events to be intercepted.
为何可做:Straightforward UI bug that blocks user interaction; the fix is localized to CSS/z‑index; a contributor has offered to handle it; resolving it improves UX with minimal effort.
Bug fix1-2 hoursEasybranch: maintests if riskhuman review
问题:The Spanish (es-ES) locale still contains about 90 English strings, causing UI elements to display mixed languages when the interface language is set to Spanish.
为何可做:A straightforward localization task that improves UX for Spanish users and requires only translating ~90 JSON entries.
Docs/config1-2 daysEasybranch: maintests if riskhuman review
[feat] Add TopxAI as an OpenAI-compatible model provider
问题:TopxAI provides an OpenAI-compatible Chat Completions endpoint, but currently requires users to manually configure `OpenAILike` with base URL and API key, lacking the convenience…
为何可做:A complete, tested implementation already exists in a ready‑to‑merge branch; the remaining effort is a quick review and integration.
Two model-response docstrings describe a tuple the methods never return
问题:Two private methods in AgnoModel (`_process_model_response` and `_aprocess_model_response`) and two in Workflow (`save_session` and `asave_session`) have docstrings that claim to…
为何可做:Straightforward docstring corrections with negligible risk and effort, improving code clarity for subclasses and contributors while maintaining repository standards.
问题:CSVReader.async_read(page_size=0) behaves inconsistently: small CSVs (<10 rows) bypass pagination and return a document, while larger CSVs cause a silent ValueError that is caught…
为何可做:Bug leads to silent data loss for larger CSVs; fix is a straightforward validation change and test addition, reducing risk and improving reliability.
count_image_tokens scales at 2000px where OpenAI scales to fit 2048x2048
问题:The `count_image_tokens` function incorrectly scales images down when the longest side exceeds 2000px, while OpenAI's image tokenization actually scales to a 2048px×2048px square.…
为何可做:A straightforward constant change that aligns with OpenAI's documented scaling rule, with an existing reproduction and a ready regression test.
[Feature] Desearch search tool example for DSPy agents
问题:Issue requests a small, optional example (or docs) showing DSPy agents (`dspy.ReAct`) using Desearch search tool, either via `dspy.Tool.from_mcp_tool` pointing to hosted MCP serve…
为何可做:Feature request for a straightforward documentation/example addition that improves usability for integrating external MCP tools in DSPy agents.
Factory: board phases can't grant the work-item tools, so a Building run can't split work into child items
问题:Factory board phases currently cannot call work-item tools (e.g., `factory_create_work_item`) because board validation only allows two review‑specific tools, session‑kind logic st…
为何可做:The issue provides a clear reproduction, identifies exact validation and logic blocks, and outlines a straightforward set of code changes to enable board phases to use work‑item t…
[Bug] MistralChat streaming drops the first answer chunk (and all reasoning) when `reasoning_effort` is enabled: "391" becomes "91"
问题:MistralChat streaming parser `_parse_provider_response_delta` expects string content from provider deltas, but Mistral reasoning models send deltas as a list during thinking phase…
为何可做:The bug is a specific, reproducible parsing error in a high-profile repository (43k stars).
[BUG] toModelOutput receives validation errors but is typed as TSchemaOut
问题:A tool's `execute` can return a `ValidationError` when input/request/output validation fails, but the typed `toModelOutput` callback only accepts `TSchemaOut`.
为何可做:Bug causes validation errors to be lost due to type mismatch; fixing will improve error reporting and reduce manual guards for tool authors.
Bug fixHalf day to 1 dayMediumbranch: maintestshuman review
[FEATURE] AgentChannels: a supported way to move or remove a channel thread's mapping
问题:AgentChannels currently creates an immutable mapping from external chat threads to Mastra threads via metadata fields.
为何可做:Auto‑triaged, high impact, medium effort feature waiting for implementation; adding unmap/map APIs will solve the unlink/relain and ownership problems.
[BUG] AgentController `allow` auto-approval loses the tool call with AGENT_RESUME_ALREADY_CLAIMED on PostgresStore: the run re-writes its suspended s…
问题:AgentController with allow policy writes the same suspended snapshot twice to the agentic-loop row on PostgresStore, causing a race where the auto-approval resume can read the fir…
为何可做:Confirmed bug causing tool loss in AgentController allow policy on concurrent stores; fix needed to eliminate duplicate suspension writes and add regression test.
Bug fixHalf a day to 2 daysMediumbranch: maintestshuman review
Scope challenge raised from inside a running tool handler
问题:The SDK currently supports raising a scope challenge at tool registration time, but cannot do so when a tool handler discovers missing scopes mid-execution (e.g., the backend says…
为何可做:This enhancement completes the two‑part scope‑challenge design, enabling proper OAuth flows when authorization is discovered during tool execution.
[Feature]: Outbound Web Bot Auth signing for navigated requests
问题:Browser-use agents currently send outbound HTTP requests without any cryptographic identifier, making it impossible for destination servers to verify that the traffic originates f…
为何可做:The issue is well‑specified, the contributor is ready to implement, the change is optional and low‑risk, and maintainers have shown interest in reviewing it.
[RFC] Carrying trusted identity beyond the HTTP request: the unattended paths (scheduler, IM channels, workflow recovery)
问题:The RFC audits three unattended execution paths (scheduler, IM channels, workflow recovery) showing they currently lack durable, revocable identity delegation, relying on internal…
为何可做:Provides a concrete first‑step grant for unattended workflow recovery, addressing identity delegation gaps identified in #7884 and #7652, and aligns with existing durable grant pa…
[Bug]: Bedrock Titan embedding passthrough succeeds but fails success logging
问题:LiteLLM v1.108.0 succeeds at invoking the native Bedrock Titan embedding endpoint but then routes the successful response through the chat transformer, which expects `results[0].o…
为何可做:The bug prevents usage metrics and spend logging for Titan embeddings, a critical telemetry loss.
问题:Slack's agent design guide recommends adding an LLM-generated disclaimer and source citations in a styled context block at the footer of messages, but the current interface only s…
为何可做:The request solves a concrete compliance and usability gap for Slack agents, aligning with the project's design guidelines and adding a widely requested feature.
[Feature Request] Slack: support the new agent messaging model (agent_view, app_home_opened, agents.sessions.*)
问题:Slack's new agent messaging model requires handling `app_home_opened`, `agent_session_stopped`, `agent_session_title_changed` and using `agents.sessions.*` APIs, but the current a…
为何可做:Provides critical missing Slack support (suggested prompts, session stop, title sync, loading messages) with low risk via an opt‑in flag, improving user experience for new Slack a…
OtherHalf a day to 2 daysMediumbranch: maintestsAI disclosure
[feat] Support Pi coding agent via ACP (Agent Client Protocol) / 通过 ACP 协议接入 Pi Coding Agent
问题:DeerFlow provides configuration and documentation for external coding agents via ACP (Agent Client Protocol) for Claude Code, OpenAI Codex, and MiniMax Code, but lacks support for…
为何可做:Adds missing Pi support with minimal, low‑risk changes following existing ACP patterns; improves documentation and error guidance for users.
[Feature Request] Add Wiro AI as an OpenAI-compatible model provider
问题:Agno lacks a built-in provider for Wiro AI, an OpenAI-compatible gateway that consolidates models from multiple labs.
为何可做:Feature mirrors existing providers (Heabsy, Cloudflare, MiniMax) and is low complexity with clear implementation steps; branch exists so work is straightforward.
Managed subagent signature misses an update written in the same clock tick
问题:SqlManagedSubagentStore.signature() uses each row's updated_at timestamps to detect definition changes.
为何可做:The bug causes silent loss of updates, risking stale definitions; the fix is a one‑line timestamp adjustment that resolves the race condition and aligns with the existing test exp…
Bug fixHalf a day to 1 dayMediumbranch: maintestsAI disclosure
StdioClientTransport.close() doesn't clean up listeners, causing EventEmitter memory leak warning
问题:StdioClientTransport.close() does not remove listeners attached in start() and send(), leaving drain listeners orphaned when the process ends, causing Node.js EventEmitter memory…
为何可做:Simple listener cleanup, low risk, directly addresses a memory leak affecting all stdio users.
[Feature Request] SolanaPulseTools: pre-sign transaction and token safety checks for Solana
问题:Agno agents interacting with Solana lack built‑in safety checks before signing transactions or buying tokens, exposing them to drainer, honeypot, decimals‑slip, and expired blockh…
为何可做:The feature is fully implemented and tested; integration will be straightforward and adds valuable safety for Solana agents.
5 ready fixes available as PRs (blocked from opening)
问题:The repository blocks the user from creating pull requests due to interaction limits, preventing five ready bug fixes from being merged.
为何可做:Five ready, low‑risk bug fixes for high‑impact reliability and conformance issues are blocked from PR; merging them now improves SDK stability and unblocks the contributor.
Dynamic client registration accepts plain-HTTP non-loopback and fragment redirect URIs
问题:The registration handler validates redirect_uris only with SafeUrlSchema, allowing non-loopback plain HTTP and URIs with fragments, violating the MCP auth spec and RFCs.
为何可做:Security hardening with a ready patch and community interest; low-risk change that aligns with the spec and prevents cleartext and fragment redirect URIs.
Bug fixHalf a day to a dayMediumbranch: maintestshuman review
问题:DeerFlow provides sandbox providers for several platforms, but lacks one for Maritime sandboxes.
为何可做:The feature request includes a ready implementation and tests, adding a needed sandbox provider that aligns with existing patterns and improves the project's coverage.
Feature request: port PostgresSaver.prune (keep_latest) from Python #9290
问题:LangGraph.js's PostgresSaver lacks a `prune` method that exists in the Python version, causing storage to balloon (e.g., 18.5 TB) when many checkpoints accumulate per thread.
为何可做:High storage cost in production, clear existing plan, and a contributor has offered to implement and test, making this a low‑risk, high‑impact addition.
[v1.x] Protocol.request keeps its abort listener after the request resolved, so a later abort sends notifications/cancelled for an answered request (…
问题:Protocol.request() adds an abort listener to options.signal but never removes it.
为何可做:The bug leads to unnecessary network traffic and can be amplified in batch scenarios; a ready fix exists in PR #3091 with test coverage, making this a low‑risk, high‑value fix.
Bug fixHalf a dayMediumbranch: maintestshuman review
StreamableHTTPServerTransport: option to send SSE keepalive comments on open streams
问题:The StreamableHTTPServerTransport does not write any data on idle SSE streams, causing proxies and load balancers (e.g., AWS ALB, nginx, Cloudflare) to close connections after the…
为何可做:The issue provides a clear problem statement, a concrete code proposal, and limited scope (adding a timer option).
[Bug]: Question: fix status for CVE-2026-93355 and CVE-2026-108575 (Snyk reports no fixed version)
问题:Snyk flags two CVEs (CVE-2026-93355 (JWT email lookup) and CVE-2026-108575 (get_secret / model management endpoint bypass)) against litellm 1.106.5 with no fix listed, while exter…
为何可做:Security advisory mismatches could block users from trusting the library; clarifying fix versions and scope is essential for users and the GHSA database.
[Bug]: Shared YAML model_info alias causes cross-model metadata contamination and incorrect spend calculation
问题:LiteLLM uses YAML anchors (`*anth_info`) to share capability metadata across multiple model entries.
为何可做:The bug causes financial under‑reporting and metadata corruption, and the community has confirmed the root cause (shared dict due to YAML anchors).
[FEATURE] Add bounded enumeration of namespaced thread state for recovery
问题:A fresh worker cannot discover persisted thread states without already knowing thread IDs because ThreadStateStorage lacks a bounded enumeration operation within a type namespace.…
为何可做:Feature is needed for worker recovery but awaits maintainer triage; moderate effort and fits storage domain design.
Evented engine: workflows-finish events carry the whole run state (5–10 MB per durable loop iteration), every subscriber parses all of them
问题:Evented engine publishes `workflow.end`, `workflow.suspend`, and `workflow.fail` events to a shared `workflows-finish` topic, including the entire run state (`stepResults`, `state…
为何可做:High severity OOM and CPU impact with clear actionable proposals; changes required across core and Redis streams modules.
[feat] Add a checkpoint-based trajectory inspection and export extension for future evaluation
问题:This issue proposes adding a checkpoint-based trajectory inspection and export extension to DeerFlow core, so users can inspect retained execution history, understand context comp…
为何可做:The issue proposes integrating an existing extension into DeerFlow core, which requires mapping new backend routes, frontend UI integration, and ensuring compatibility with checkp…
问题:V4 secretBindings is limited to secrets and has a 4 KiB limit and hostname-only allowedDomains, making it unsuitable for long non‑secret values like IDs, JSON, or cover letters.
为何可做:The issue solves a concrete user pain point (long text injection errors) and has clear community interest; extending the existing secretBindings pattern with a new valueBindings t…
[Feature] Declare a provider that speaks TypeSafe's System One wire, and route decisions by dialect
问题:DSPy's vendored lm15 lacks a 'typesafe' dialect, so custom providers that serve TypeSafe System One wire (e.g., lunaroute-systemone) cannot be declared using ProviderDefinition.
为何可做:Missing typesafe dialect blocks a legitimate use case and violates the project's rule that provider names should reflect wire behavior.
问题:DSPy programs currently lose learned examples, user preferences, and project decisions between runs because there is no built‑in persistent memory layer.
为何可做:The issue is a well‑scoped feature request with a willing contributor, but it introduces an external dependency and requires maintenance oversight.
[BUG] DurableAgent.recover() skips the agent's defaultOptions callbacks (onFinish/onError/onAbort)
问题:DurableAgent.recover() does not merge the agent's defaultOptions callbacks (onFinish, onError, onAbort) when resuming a run, causing per‑turn bookkeeping (e.g., usage accounting,…
为何可做:The bug removes essential bookkeeping for recovered agent runs, affecting reliability of durable agents in production.
[Bug]: Proxy startup takes ~2 min on Python 3.14: `prisma.types` is imported three times and each import takes ~40 s
问题:Python 3.14 drastically slows import of `prisma.types` due to PEP 649 lazy evaluation, causing LiteLLM proxy startup to take ~2 minutes because the generated 10 MB types module is…
为何可做:The bug adds a two‑minute startup penalty on Python 3.14, directly hurting user experience; fixing it requires only small import adjustments but yields a large performance gain.
[FEATURE] [Tool] SRA-RiskGate: payment guardrail for agents that send stablecoins
问题:The issue requests a built‑in payment guardrail tool for crewAI agents that move stablecoins (USDC, x402).
为何可做:A compliance guardrail for monetary agents is high‑value and aligns with crewAI’s security focus; the existing third‑party package provides ready implementation, and integrating i…
[BUG] A background task that has just suspended is cancelled by shutdown, or can't be resumed after a crash
问题:Background tasks that suspend are marked as 'suspended' before the workflow actually suspends, creating a window where the task's abort controller is active and not yet truly susp…
为何可做:Bug causes loss of background tasks during shutdown and after crashes, affecting core reliability of deferred tools and MCP tasks.
Bug fixHalf day to 2 daysMediumbranch: maintestshuman review
feat(workspace): opt-in lifetime limit and SIGKILL escalation for background processes
问题:Workspace sandbox background processes currently have no lifetime limit unless the model explicitly provides a timeout, which is discouraged for dev servers.
为何可做:Provides crucial resource protection for multi‑user deployments and aligns with existing bounded‑wait improvements, preventing runaway background processes.
[Bug]: Streaming request is no longer cancelled when the client disconnects before the first chunk (regression in 1.107.0)
问题:Since version 1.107.0, streaming requests are not cancelled when a client disconnects before receiving the first chunk, because the router reads the first chunk inside llm_call be…
为何可做:High impact regression causing wasted upstream capacity, quota, and blocked queue slots; a community member has reproduced it and intends to fix, making it a priority for the proj…
Bug fixHalf a day to 2 daysMediumbranch: litellm_internal_stagingCLAtestshuman review
[Feature Request] Slack: optional reaction acknowledgement while processing (parity with Telegram #7368)
问题:The issue requests adding an optional emoji reaction feature to Slack agents (and possibly mirror Telegram's #7368) so the agent can react with a lightweight emoji (e.g., 👀) when…
为何可做:A well‑defined feature request with clear use‑cases, alternative solutions evaluated, and existing patterns to mirror.
Python: [Issue]: MCP workflow resume test failed in Python 3.12 Windows CI
问题:Windows Python 3.12 CI job failed on a test that verifies authorization context binding survives workflow resume.
为何可做:CI failure on Windows Python 3.12 is blocking merges; the test appears flaky or possibly buggy, requiring investigation and a fix to make the test reliable.
Bug fixHalf day to 1 dayMediumbranch: maintestshuman review
[Feature]: OpenAI-compatible GPT-Live API support in LiteLLM Proxy
问题:The issue requests adding OpenAI's public GPT-Live API (gpt-live-1) to LiteLLM Proxy so that existing Live clients can connect via LiteLLM without changing their code.
为何可做:The request is well‑specified and clear, but implementing full GPT‑Live support requires new REST and WebSocket handlers, integration with auth/usage tracking, and test coverage,…
[Feature]: Include the original request envelope in the cold storage log object
问题:Litellm's S3/GCS cold‑storage log objects currently contain only the conversation messages and completion response, not the original HTTP envelope (URL, method, headers).
为何可做:Provides a clean, opt‑in way for operators to see the request envelope without polluting the database or enabling prompt storage, directly addressing a debugging pain point.
[Feature Request] Schedules that can end: end_at and max_runs (covers one-shot schedules)
问题:Schedules in Agno are cron‑only and cannot be automatically terminated, forcing users to manage expiration outside the scheduler.
为何可做:The feature adds essential schedule expiration support, solves common one‑shot and time‑bounded use cases, and the maintainers have expressed openness to a staged implementation.…
[Bug] Notion page expansion and preview cannot be reached with the keyboard
问题:Notion page‑tree expansion and preview actions are implemented with plain divs that only respond to clicks.
为何可做:A direct accessibility bug affecting a widely used UI component; fixing it improves inclusivity and prevents user frustration with keyboard navigation.
Bug fix1-2 daysMediumbranch: maintests if riskhuman review
PKCE verification: 2025-11-25 requires refusing when `code_challenge_methods_supported` is absent, which conflicts with the #832 / #992 resolution
问题:The SDK's PKCE verification treats an absent `code_challenge_methods_supported` field as "assume PKCE supported" (per issue #992) to support providers like Azure AD and AWS Cognit…
为何可做:This is a spec‑compliance bug that directly impacts real‑world OIDC providers (Azure AD, AWS Cognito, Microsoft).
Security hardening: enforce `public_fetch` SSRF protection and add missing `return` in Knowledge URL ingestion (`knowledge.py`)
问题:Issue #11509 identifies two security/correctness bugs in the URL ingestion path: (1) missing `return` statements after marking invalid URLs as FAILED, causing execution to fall th…
为何可做:Critical security hardening (SSRF & state leak) with active maintainer discussion; fixing both bugs will improve security posture and prevent regression in knowledge ingestion.
Embed protocol `queuedEvents` grows without bound on threads that never interrupt
问题:Per‑thread `queuedEvents` buffer in `@langchain/langgraph-api` grows indefinitely on threads that never interrupt because `run.start` only clears it when a pending interrupt exist…
为何可做:Critical bug causing unbounded memory growth and stream failures; partially fixed by PR #2926 but the replay/clear race remains, risking data loss.
useStream / StreamManager: a message id streamed again in a later run keeps its previous run's list index, leaving holes in messages
问题:MessageTupleManager records each streamed message's index based on its ID when first streamed, and that index is reused in later runs (e.g., after resume).
为何可做:The bug leads to sparse arrays and downstream runtime errors; it's triggered on resume after interrupt, which is a realistic scenario.
Bug fixHalf day to 1 dayMediumbranch: maintestshuman review
Public inbound-processing completion seam for reusable bounded admission
问题:Transports can limit the number of concurrently admitted requests, but the public `onmessage` callback returns `void` and provides no way to observe when the inbound SDK handler h…
为何可做:The issue presents a well‑defined feature request with a clear implementation proposal and no conflicting work; it is not yet addressed and the scope is moderate, making it action…
checkpoint-sqlite: better-sqlite3 ^12 pulls deprecated prebuild-install; 13.x drops it and the install script
问题:The checkpoint-sqlite package currently pins better-sqlite3 to ^12, which pulls the deprecated prebuild-install package and triggers install-script warnings for all consumers.
为何可做:The issue is well‑reproduced, has a clear proposed fix, and active maintainer discussion, but implementing it requires evaluating Node version compatibility and possibly raising t…
sdk: on reload, StreamController binds a deep-agent subagent to the WRONG namespace when its delegation is older than the 20+20 history discovery win…
问题:When a thread is reloaded via StreamController.hydrate, the controller attempts to reconstruct subagent namespaces by looking up recent delegation events in the thread's history.…
为何可做:The issue is well‑described with a reproducible example, pinpointing a specific bug in StreamController’s namespace reconstruction logic.
[feat] RFC: Agent Bundle Version Control (detailed design for #6862)
问题:DeerFlow currently stores custom agents as mutable documents without history, making it impossible to publish reproducible versions, track changes, roll back, or guard against con…
为何可做:High‑impact feature that enables reproducible agent releases and rollback, but requires extensive changes across backend, database, and frontend; the RFC is draft and needs implem…
问题:CrewAI's a2a integration pins to a2a-sdk~=0.3.10, which is end-of-life (last release April 2026) and blocks installing newer a2a-sdk>=1.0 alongside other packages.
为何可做:The issue addresses a blocked dependency that will become unusable as a2a-sdk 0.3 reaches end‑of‑life, and the A2A team at Google has offered to contribute the migration and futur…
[bug] Caller-supplied message IDs can collide with dynamic-context suffix
问题:Caller‑supplied human message IDs that already end with the reserved suffix `__user` collide with the `DynamicContextMiddleware` internally generated IDs, causing duplicate sequen…
为何可做:A multi‑component bug that can cause silent data loss; maintainer is preparing a fix but needs guidance on ID collision handling, making it a high‑priority triage item.
The supplied inventory marks this repository as issue-only for the ordinary contribution pipeline. · Issue-only · External PRs not accepted · 不参与 PR候选扫描
来源
user-supplied-policy-inventory:openai/codex
检查日期
2026-08-28
目标分支
main
交付前要求
Keep a human responsible for reviewing any later submission.
Target branch: main.
Do not spend ordinary Issue-list, detail, or AI-triage calls on this repository.
langflow-ai/langflow
状态
Unknown / needs confirmation · uncertain
理由
The contribution target follows the active release branch rather than an assumed default branch.
Run the repository's relevant tests before any submission.
Review the repository AI-assistance/disclosure policy and keep human accountability.
Resolve the live release branch before preparing a patch; never assume main.
langgenius/dify
状态
Known policy · eligible
理由
External work should be tied to a current Issue and the repository's normal review path.
来源
user-supplied-policy-inventory:langgenius/dify
检查日期
2026-08-28
目标分支
main
交付前要求
Review the repository AI-assistance/disclosure policy and keep human accountability.
Target branch: main.
For behavior changes or obvious regression risk, run relevant tests before any submission; otherwise keep the validation proportional. Re-check claimant, timeline, and related PR signals immediately before coding.
browser-use/browser-use
状态
Known policy · eligible
理由
Small reproducible fixes may use the normal external PR path when no existing work is found.
Run the repository's relevant tests before any submission.
Review the repository AI-assistance/disclosure policy and keep human accountability.
Target branch: main.
The readiness label is a hard gate; enterprise-only work is excluded.
mem0ai/mem0
状态
Known policy · eligible
理由
Normal code contributions require an accepted Issue; explicitly docs-only work has a narrow exception.
来源
user-supplied-policy-inventory:mem0ai/mem0
检查日期
2026-08-28
目标分支
main
交付前要求
Run the repository's relevant tests before any submission.
Confirm and satisfy the repository CLA/DCO requirement before any submission.
Disclose AI assistance according to repository policy before any submission.
Target branch: main.
docs_only must be explicitly supplied; the exception does not bypass PR, assignment, freshness, or scope checks.
FlowiseAI/Flowise
状态
Known policy · eligible
理由
Focused external fixes may use the normal PR path after checking for existing implementation work.
来源
user-supplied-policy-inventory:FlowiseAI/Flowise
检查日期
2026-08-28
目标分支
main
交付前要求
Run the repository's relevant tests before any submission.
Review the repository AI-assistance/disclosure policy and keep human accountability.
Target branch: main.
Existing or promised implementation work blocks a clean recommendation even before a PR is merged.
stanfordnlp/dspy
状态
Known policy · eligible
理由
Minor external changes may use the normal PR path; AI-assisted work requires human review and responsibility.
来源
user-supplied-policy-inventory:stanfordnlp/dspy
检查日期
2026-08-28
目标分支
main
交付前要求
Run the repository's relevant tests before any submission.
Issue tracking is optional for minor changes; use an Issue for larger changes.
A human must understand, review, and own the final submission.
Target branch: main.
A human must understand and take responsibility for any later AI-assisted submission.
crewAIInc/crewAI
状态
Known policy · eligible
理由
A focused Issue with local evidence can follow the normal external contribution path.
来源
user-supplied-policy-inventory:crewAIInc/crewAI
检查日期
2026-08-28
目标分支
main
交付前要求
Run the repository's relevant tests before any submission.
If AI/LLM generated the change, prepare the `llm-generated` label before any submission.
Target branch: main.
The llm-generated label is preparation metadata only when AI/LLM generated; missing evidence does not block this evaluator. This repository is an additional policy inventory entry, not a DEFAULT_REPOS change in P0.
microsoft/agent-framework
状态
Known policy · eligible
理由
External work follows the repository's issue, review, testing, and contribution requirements.
Run the repository's relevant tests before any submission.
Review the repository AI-assistance/disclosure policy and keep human accountability.
Target branch: main.
Treat only new integration-package or new pyproject.toml integration proposals as outside the small, fast contribution queue; existing integration maintenance remains in scope.
langchain-ai/langgraphjs
状态
Known policy · eligible
理由
A narrow reproducible Issue may use the standard external PR path after live-state checks.
为什么适合小 PR:Provides a concrete first‑step grant for unattended workflow recovery, addressing identity delegation gaps identified in #7884 and #7652, and aligns with existing durable grant patterns. (预计 1-2 days)
第一步:Explore the workflow recovery module (examples/deerflow-extension-workflows/deerflow_extension_workflows/recovery.py) and the existing grant infrastructure (tool_approvals, approval_grants) to understand validation and persistence patterns. Then prototype a simple grant creation endpoint that issue…
预期验证:Follow the existing grant pattern from tool_approvals (backend/app/gateway/tool_approvals.py). Read internal auth and recovery code to understand validation points. Write unit tests covering grant creation, validation, revocation, and ensure the grant does not leak privileges. Keep changes minimal…
证据摘要:No evidence of maintainer response or recent comments; issue is a RFC with zero comments.
为什么适合小 PR:Adds missing Pi support with minimal, low‑risk changes following existing ACP patterns; improves documentation and error guidance for users. (预计 1-2 days)
第一步:Clone the repository, examine `config.example.yaml`, `CONFIGURATION.md`, `invoke_acp_agent_tool.py`, and `test_invoke_acp_agent_tool.py` to understand the existing `claude_code`/`codex`/`minimax` implementations. Then start editing with the first change: adding the `acp_agents.pi` block to `config.…
预期验证:Replicate the exact YAML structure and ordering used by `claude_code` and `codex`. Follow the same error message phrasing and remediation pattern as for MiniMax Code. Ensure the new unit tests cover both the error formatting path (when `pi-acp` is not found) and successful agent invocation dispatch…
证据摘要:No recent comments; issue is open with no maintainer activity, indicating it is not yet resolved and is available for contribution.
为什么适合小 PR:The bug causes silent loss of updates, risking stale definitions; the fix is a one‑line timestamp adjustment that resolves the race condition and aligns with the existing test expectations. (预计 Half a day to 1 day)
第一步:Clone the repo, navigate to `deerflow/persistence/managed_subagents/model.py`, inspect the `update()` method, and apply the microsecond increment when `now <= current`. Then run the specific test to verify the fix.
预期验证:- Reproduce the issue with a small script that freezes `datetime` and calls signature before/after a same‑tick update. - Follow the existing code style (type hints, imports at top, explicit UTC handling). - Keep the change minimal—no schema or migration changes. - Verify the fix works with the exis…
证据摘要:The issue author has prepared a ready branch (`fix/managed-subagent-same-tick-signature`) with the exact patch but cannot open a pull request due to permission constraints. No further community discussion or maintainer response is visible.
为什么适合小 PR:The feature request includes a ready implementation and tests, adding a needed sandbox provider that aligns with existing patterns and improves the project's coverage. (预计 1-2 days)
第一步:Inspect the existing community provider structures (Tenki, OpenSandbox) and examine the diff from the fork (or check if a branch already contains the maritime provider). Then run the test suite for the new provider to verify it passes.
预期验证:Follow the established pattern of other community providers, keep imports lazy, add proper configuration comments, write/tests that mock the maritime SDK, run the full test suite, and ensure the provider integrates seamlessly with the sandbox lifecycle.
证据摘要:No evidence of maintainer work; the author (co‑founder of Maritime) has prepared a fork and plans to open a PR after testing.
为什么适合小 PR:The issue proposes integrating an existing extension into DeerFlow core, which requires mapping new backend routes, frontend UI integration, and ensuring compatibility with checkpoint persistence. This is non‑trivial but doable in a few days. (预计 2-3 days)
第一步:First, clone the deer-flow repository and explore the extension directory structure to understand how extensions are registered. Next, locate the existing deerflow-extension-trajectory repository (likely a separate repo) and examine its source code, manifest, and how it expects to communicate with…
预期验证:1. Start by exploring the existing extension repository and mapping its file structure to DeerFlow's extension conventions (look at other extensions like deerflow-extension-*). 2. Create a minimal reproduction by hitting the checkpoint endpoint to ensure data is accessible. 3. Ensure changes are ba…
证据摘要:There is one comment expressing enthusiasm and suggesting adding this to the 2.3.0 roadmap for discussion. The maintainer hasn't responded yet, indicating the feature is still under consideration. No clear blockers mentioned, but integration depends on roadmap approval.
为什么适合小 PR:High‑impact feature that enables reproducible agent releases and rollback, but requires extensive changes across backend, database, and frontend; the RFC is draft and needs implementation. (预计 1-2 weeks)
第一步:Explore the repository to locate `agents` persistence (`backend/packages/harness/deerflow/persistence/agents/`), examine the current `agents` table schema and migrations, review the `AgentConfig` definition in `config/agents_config.py`, and read the RFC details to understand the proposed revision m…
预期验证:Study existing `AgentConfig` storage and migration patterns; follow the project’s content‑addressed design conventions; ensure migrations are reversible; add comprehensive tests for race conditions; maintain backward compatibility for existing exports; document new API routes and UI actions; iterat…
证据摘要:No evidence (issue is new with zero comments).
为什么适合小 PR:The RFC tackles a core bottleneck: many PRs lack issue context and can be buried. An evidence‑based triage system will directly cut maintainer time and prioritize valuable contributions, which is critical for a high‑traffic project with 85 k stars and over a thousand monthly PRs. (预计 1 week or longer)
第一步:Clone the repo, examine the prototype collector and the tree at bfa2794c to understand the existing triage workflow, locate any related scripts or CI configs, and read CONTRIBUTING/agent.md to see current guidelines for evidence and PR requirements. Spend ~30‑60 minutes documenting the current stat…
预期验证:Start by exploring the existing prototype and the referenced commit bfa2794c to understand the current triage workflow. Clarify missing decision rules (R2‑R9) from the RFC before implementation. Build a minimal viable collector focusing on R1 and evidence extraction, add comprehensive unit tests, r…
证据摘要:Only the RFC description and comment discussion are present; there is no code implementation or merged PR to base work on.
为什么适合小 PR:A multi‑component bug that can cause silent data loss; maintainer is preparing a fix but needs guidance on ID collision handling, making it a high‑priority triage item. (预计 1 week)
第一步:Open the repository, locate `gateway/services.py` and examine `normalize_input` to see how IDs are preserved, then read `dynamic_context_middleware.py` to understand how `__user` suffix is added, and finally run the provided reproduction script to confirm the bug locally.
预期验证:Run the reproduction script to confirm the bug, trace the call chain through the involved modules, write a focused change that respects existing contracts, add tests that cover edge cases (duplicate IDs, replay, legacy checkpoints), and coordinate with the author (Yzzz88) to avoid duplicate work.
证据摘要:Yzzz88 has indicated they will implement the fix and is seeking maintainer guidance on the compatibility contract for caller‑supplied IDs; no consensus yet, and the issue remains open.
为什么适合小 PR:Straightforward feature: expose an existing SDK option via MCPServer constructor; low risk, minimal changes; matches user’s clear request and use case. (预计 1-2 hours)
第一步:Navigate to the MCPServer definition, examine its constructor and getNodeHandler, then implement maxRequestBodySize as optional property and pass it through to createMcpHandler.
预期验证:Review existing MCPServer initialization pattern for consistency; add JSDoc comment for new field; ensure TypeScript types are updated; write a simple test that creates server with custom size and verifies handler options; avoid breaking existing usage by keeping field optional.
证据摘要:Issue labeled 'needs triage' with no further maintainer discussion; only generic bot comment waiting for maintainer triage – no evidence of ongoing work or recent resolution.
为什么适合小 PR:The issue provides a clear reproduction, identifies exact validation and logic blocks, and outlines a straightforward set of code changes to enable board phases to use work‑item tools, addressing a core missing feature. (预计 1‑2 days)
第一步:Run the provided `repro.mjs` script to confirm the validation failure and missing tools, then examine the three key files (`boards/define-board.ts`, `src/tools/index.ts`, `rules/tools.ts`) to understand the current tool‑granting logic and identify where to add the work‑item tools.
预期验证:Run the reproduction script first to confirm the bug. Follow existing patterns for adding tools (see how `factory_record_review_verdict` is added). Keep changes backward compatible—existing boards should continue to work. Write tests that validate a phase can invoke work‑item tools and that child c…
证据摘要:Only a triage notice from the bot; no maintainer comments or resolutions. No evidence of prior work.
为什么适合小 PR:Bug causes validation errors to be lost due to type mismatch; fixing will improve error reporting and reduce manual guards for tool authors. (预计 Half day to 1 day)
第一步:Open the repository and examine `tools/tool.d.ts` (line 136) and `tools/types.d.ts` (line 510). Then find where `toModelOutput` is invoked in the execution flow (search for `toModelOutput(`). After that, create a test file based on the gist to confirm the bug.
预期验证:- Run the existing test suite to ensure no regressions. - Use the reproduction example to manually test the fix. - Keep changes minimal: only adjust the type signature and add a guard where the result is passed. - Export `isValidationError` from the package if needed; rely on existing utilities. -…
证据摘要:The issue includes a minimal reproducible example and points to exact type definitions, providing clear evidence of the bug. The fix involves adjusting those types and runtime logic.
为什么适合小 PR:Auto‑triaged, high impact, medium effort feature waiting for implementation; adding unmap/map APIs will solve the unlink/relain and ownership problems. (预计 1‑2 days)
第一步:Open the repository and locate the AgentChannels class and the updateThread implementation in @mastra/pg. Search for 'channel_platform', 'channel_externalThreadId' to understand current write paths and identify where to add the new unmap/map methods.
预期验证:Start by reading the existing mapping creation PR #27460 and the updateThread logic to understand the DB schema and mutation patterns. Use the same transaction/atomic pattern as the creation code. Write unit tests that simulate concurrent inbound messages to verify the atomicity guarantees. Follow…
证据摘要:Issue has only generic triage bot comments, no active PRs or resolved work. It is labeled enhancement, impact:high, effort:medium, status:auto-triaged, and is awaiting maintainer approval.
为什么适合小 PR:Confirmed bug causing tool loss in AgentController allow policy on concurrent stores; fix needed to eliminate duplicate suspension writes and add regression test. (预计 Half a day to 2 days)
第一步:Clone the repo, examine workflows/default.ts lines 1153‑1178 and workflows/handlers/entry.ts:263 to see the two writes. Look at agent/agent.ts:8522 for claim timestamp check. Run the existing allow‑policy tests to confirm they use InMemoryStore. Then start designing a minimal fix.
预期验证:Reproduce using the provided repro script to confirm bug. Read the full flow for allow policy in session-run-engine.ts and session.ts. Make minimal change: either skip the second snapshot write when already suspended, or prevent overwriting a pending claim in persistWorkflowSnapshot. Write a focuse…
证据摘要:Factory triage label 'confirmed bug', maintainer approved work, @Atman‑Angle wants to proceed with PR.
为什么适合小 PR:Feature is needed for worker recovery but awaits maintainer triage; moderate effort and fits storage domain design. (预计 2-3 days)
第一步:Open packages/core/src/storage/domains/thread-state/base.ts and stores/pg/src/storage/domains/thread-state/index.ts to examine the current contract and adapter implementation. Spend 30‑60 minutes to understand the interface and locate where pagination could be added.
预期验证:Follow existing pagination patterns in the codebase, keep changes minimal, use typed contracts, add unit tests before merging, document behavior for edge cases, and coordinate with maintainers if the feature aligns with storage priorities.
证据摘要:The issue is labeled "needs triage" and a bot comment indicates it is waiting for maintainer triage or approval. No evidence of ongoing work or recent commits.
为什么适合小 PR:High severity OOM and CPU impact with clear actionable proposals; changes required across core and Redis streams modules. (预计 3-5 days)
第一步:Navigate to `packages/core/src/workflows/evented/workflow-event-processor/index.ts`, locate the three publish sites for `workflow.end`, `workflow.suspend`, and `workflow.fail`. Review the `Run` class in `packages/core/src/workflows/evented/run.ts` (or similar) to see how `finishCb` consumes the eve…
预期验证:Reproduce the issue by triggering a durable agent loop and monitoring event size. Read the existing event publishing and subscription code to understand the contract. Make minimal, focused changes—don't alter unrelated topics or behavior. Keep backward compatibility if possible (e.g., handle both o…
证据摘要:The issue is marked with triage labels and a bot notice waiting for maintainer approval. No fix has been merged; the maintainers have acknowledged the bug but not yet resolved it.
为什么适合小 PR:The bug removes essential bookkeeping for recovered agent runs, affecting reliability of durable agents in production. (预计 1-2 days)
第一步:Clone the repo, navigate to packages/core/src/agent/durable/durable-agent.ts, examine the recover() method (line ~1378) and resolveExecutionOptions (line ~1945). Run the reproduction script from the gist to confirm that defaultOptions.onFinish is not called on recover. Add console logs or a simple…
预期验证:Reproduce the bug first with the existing script to confirm missing callbacks. Examine the fix pattern used for #28641 (#28779) to ensure consistency. Keep changes minimal—preferably reuse resolveExecutionOptions where possible. Write focused tests that assert callback execution on both normal stre…
证据摘要:A bot comment indicates the issue is awaiting maintainer triage; no other community activity present.
为什么适合小 PR:Bug causes loss of background tasks during shutdown and after crashes, affecting core reliability of deferred tools and MCP tasks. (预计 Half day to 2 days)
第一步:Clone the repo, navigate to `packages/core/src/background-tasks/`, examine `workflow.ts` lines 191‑216 and 262‑314, and `manager.ts` shutdown and resume sections. Then run the reproduction script (complete the truncated code) to confirm the bug locally.
预期验证:Start by reading the relevant code sections and existing tests. Reproduce the bug exactly, then write a focused test that fails before the fix and passes after. Make the smallest changes needed to close the race condition. Ensure any new state transitions are atomic and documented in comments. Run…
证据摘要:No evidence that the issue is being actively worked on; there is only a triage notice comment awaiting maintainer approval.
为什么适合小 PR:Provides crucial resource protection for multi‑user deployments and aligns with existing bounded‑wait improvements, preventing runaway background processes. (预计 1-2 days)
第一步:Search the codebase for 'execute_command', 'background', 'LocalProcessHandle', and 'killProcessTree' to understand current sandbox behavior and locate relevant files for modification.
预期验证:• First reproduce the issue with a background script that ignores SIGTERM to see indefinite runtime. • Study the existing bounded wait pattern (#29381) and follow similar conventions. • Keep changes minimal: only augment existing functions, don't rewrite unrelated code. • Ensure opt‑in behavior: al…
证据摘要:Issue is in triage; waiting for maintainer triage/approval. No resolution or PR present.
为什么适合小 PR:Low priority enhancement awaiting maintainer triage; requires deep integration across agents, tools, memory, and workflows. (预计 3-5 days)
第一步:Clone the repo, locate `packages/core/src/agent/durable/workflows/steps/tool-call.ts`, read the placeholder logic in `tool-call-bg.test.ts`, and examine the surrounding code to understand how provider metadata is currently passed and where background tools are dispatched.
预期验证:Follow the existing test pattern (tool‑call‑bg & MessageList round‑trip suites). Use deterministic provider fixtures for verification. Keep changes minimal and focused on metadata preservation and async dispatch. Ensure serialization contracts match existing replay‑safety policy. Write tests that v…
证据摘要:No evidence of maintainer activity; issue is awaiting triage.
为什么适合小 PR:The bug prevents usage metrics and spend logging for Titan embeddings, a critical telemetry loss. A targeted config change restores accurate accounting and can be delivered quickly. (预计 1-2 days)
第一步:Clone the repo, open `litellm/llms/bedrock/passthrough/transformation.py`. Look at `BedrockPassthroughConfig.logging_non_streaming_response` and `self.get_bedrock_passthrough_transformers`. Run the provided regression test to confirm the TypeError. Identify where `amazon.titan-embed-text-v2:0` is b…
预期验证:Reproduce the bug with the given test script first. Examine the transformer selection logic in `litellm/llms/bedrock/passthrough/transformation.py`. Make the smallest change needed to route Titan embeddings to the embedding transformer. Write a focused unit test, run the full bedrock test suite loc…
证据摘要:A recent comment explicitly asks to route Titan embedding responses through the embedding transformer and add regression coverage, indicating community interest and maintainer openness to a fix.
为什么适合小 PR:Security advisory mismatches could block users from trusting the library; clarifying fix versions and scope is essential for users and the GHSA database. (预计 1-2 days)
第一步:Examine tag history for v1.102.2 and v1.106.5, and run git log on functions related to JWT email lookup and get_secret to pinpoint mitigation commits.
预期验证:Start by checking git tags for v1.102.2 and v1.106.5, use git log and blame on relevant functions, run existing tests to ensure changes are safe, document findings clearly, and coordinate with maintainer for advisory updates.
证据摘要:A collaborator (@Skull-boy) has commented indicating they will investigate the CVEs and map mitigations, showing active community engagement on this issue.
为什么适合小 PR:The bug causes financial under‑reporting and metadata corruption, and the community has confirmed the root cause (shared dict due to YAML anchors). A targeted fix in the model registration logic will prevent cross‑model contamination and restore correct spend calculation. (预计 1-2 days)
第一步:1. Navigate to the repository root. 2. Search for `set_model_list` and `model_info` in `litellm/router.py` and `litellm/models.py`. 3. Create a minimal YAML file with two models sharing an anchor (`model_info: *anth_info`) and run a script that loads it via `Router.set_model_list` to confirm the sh…
预期验证:- Reproduce the bug with a minimal YAML config using anchors. - Examine the existing deep‑copy logic to confirm that it does not isolate nested shared references. - Propose the fix in the least‑invasive location (preferably where the dict is first copied into the router state). - Ensure the fix doe…
证据摘要:A maintainer (diaosj) reproduced the bug and explained that YAML anchors cause PyYAML to return the same dict object for all referencing models, which is then mutated during registration, leading to the observed cross‑model contamination.
为什么适合小 PR:The bug adds a two‑minute startup penalty on Python 3.14, directly hurting user experience; fixing it requires only small import adjustments but yields a large performance gain. (预计 1‑2 days)
第一步:Inspect `litellm_proxy_extras/prisma_toolchain.py` and search for `prisma.types` imports; run a quick test to confirm the three import points and measure their timings on Python 3.14.
预期验证:Reproduce the startup timing on Python 3.14 before and after changes; compare with 3.13 to verify improvement. Read the relevant code paths to understand dependencies. Keep changes minimal and focused on removing unnecessary imports. Use lazy imports where possible and ensure backward compatibility…
证据摘要:Only one comment asking for investigation; no maintainer response or clear direction, indicating the issue is open and community interest is modest.
为什么适合小 PR:High impact regression causing wasted upstream capacity, quota, and blocked queue slots; a community member has reproduced it and intends to fix, making it a priority for the project. (预计 Half a day to 2 days)
第一步:1. Examine router_python_core.py:5056 (_aread_first_chunk) and proxy/common_request_processing.py:1164 (_buffer_first_chunk_honoring_disconnect). 2. Create a minimal reproduction script using a custom provider that delays first chunk (e.g., asyncio.Semaphore) and simulate a streaming request, then…
预期验证:• Reproduce the bug locally before making changes. • Keep the fix focused on the specific race (e.g., guard the first‑chunk read with the disconnect watcher). • Use asyncio.wait or similar to race tasks when appropriate. • Ensure the fix works for both custom and built‑in providers. • Add a test th…
证据摘要:Varshith-Kali has reproduced the regression on main and indicated they will provide a fix with a regression test. No maintainer response yet.
为什么适合小 PR:The request is well‑specified and clear, but implementing full GPT‑Live support requires new REST and WebSocket handlers, integration with auth/usage tracking, and test coverage, making it a moderate‑effort feature rather than a quick fix. (预计 3-5 天)
第一步:Search the proxy codebase for existing realtime/Live WebSocket implementations (e.g., files handling /v1/realtime) to understand the current pattern, then sketch a minimal proof‑of‑concept for the /v1/live/sessions POST endpoint.
预期验证:Follow the existing proxy implementation patterns for realtime/Live endpoints; keep changes minimal and focused; reuse authentication middleware and usage tracking modules; write tests before or alongside implementation; ensure backward compatibility; document any unsupported Live operations; seek…
证据摘要:Only a single bump comment from @ma‑menta; no explicit maintainer feedback or activity on the issue.
为什么适合小 PR:Provides a clean, opt‑in way for operators to see the request envelope without polluting the database or enabling prompt storage, directly addressing a debugging pain point. (预计 2‑3 days)
第一步:Explore the repository to find the S3/GCS callback implementation (search for `s3_callback_params`, `cold_storage_custom_logger`, `proxy_server_request`). Examine the log dict structure and locate where the request envelope is available before writing to S3.
预期验证:Start by reading the existing callback and UI code paths to understand data flow. Keep changes minimal and opt‑in. Preserve any existing redaction logic for headers. Add tests that verify the envelope appears in S3 objects when enabled and is omitted when disabled. Ensure backward compatibility (ex…
证据摘要:One community comment offering to work on the feature, but no maintainer confirmation or existing PR indicates the issue is still open.
为什么适合小 PR:The bug blocks a core caching feature for users with security‑focused Redis ACLs, and a concrete upgrade path (RedisVL ≥0.26.0) is documented. The fix is straightforward but requires updating both source imports and the dependency lock, which may need maintainer coordination. (预计 1-2 days)
第一步:Open the repository, locate `litellm/cache/redis_semantic_cache.py` (or similar) and inspect imports for `SemanticCache` and `CustomTextVectorizer`. Check the current `uv.lock` to see the pinned RedisVL version. Then run the existing semantic‑cache tests to confirm the failure when using a Redis us…
预期验证:Reproduce the failure by building the Docker image with a Redis user that excludes dangerous commands and observe the "Redis semantic‑cache index build failed" log. Examine the code path that builds the index to confirm the `MODULE LIST` usage. Make minimal import changes and keep the same runtime…
证据摘要:No evidence (issue is recent with no comments or PRs).
为什么适合小 PR:The bug is a straightforward misuse of exception handling that silently masks fetch failures, causing incorrect model behavior. The fix is low‑risk and well‑described, with the author willing to contribute. (预计 1-2 hours)
第一步:Clone the repo (if not already), open `agno/tools/sql.py`, locate the `run_sql` method (around line 158), and examine its try/except block and the calling `run_sql_query`. Run any existing tests for the SQL tools to verify the current state.
预期验证:1. Reproduce the bug with a minimal script to confirm behavior. 2. Read the surrounding code to understand other error handling. 3. Make the smallest change needed: either drop the inner `except Exception:` block or re‑raise after logging. 4. Keep any existing logging if desired. 5. Add a test in t…
证据摘要:The issue author indicated willingness to work on a fix and submit a PR. No maintainer comments or merged PRs are present, so community activity is limited to the author’s offer.
为什么适合小 PR:A complete, tested implementation already exists in a ready‑to‑merge branch; the remaining effort is a quick review and integration. (预计 Half day)
第一步:Clone the repository, checkout the branch `UnbelievableT/agno:add-topxai-provider`, run `pytest libs/agno/tests/unit/models/topxai/` to verify the unit tests pass, run `ruff check` to ensure linting, and diff the changes against `main` to confirm the provider registration, new module, and cookbook…
预期验证:Review the branch against the latest `main` to ensure consistency, confirm code formatting and linting match the project standards, validate that the provider follows the same pattern as other similar providers (e.g., FlexAI, Heabsy), run the topxai unit tests in isolation, and run the full test su…
证据摘要:The branch contains the full provider implementation, nine unit/regression tests that pass without API access, and Ruff linting passes. The code matches the requested layout and includes cookbook examples and provider registration.
为什么适合小 PR:Straightforward docstring corrections with negligible risk and effort, improving code clarity for subclasses and contributors while maintaining repository standards. (预计 1-2 hours)
第一步:Open the repository and navigate to the likely files: `libs/agno/agno/models/model.py` (for AgnoModel) and `libs/agno/agno/workflow/workflow.py` (for Workflow). Inspect the four methods, edit their docstrings to reflect the correct behavior, and run `ruff format --check` on the edited files.
预期验证:‑ Use a quick AST check or grep to confirm the methods indeed return `None`.‑ Keep changes minimal; do not alter any logic or other documentation.‑ Run the project's lint/formatting tools to maintain code style.‑ After editing, run any existing unit tests for the modules to ensure nothing broke.‑ C…
证据摘要:The issue was recently opened by an external contributor who performed an automated AST sweep, discovered two additional similar docstrings, and reposted them in a single issue. There is no visible maintainer response or PR yet, indicating the fix has not been addressed.
为什么适合小 PR:Bug leads to silent data loss for larger CSVs; fix is a straightforward validation change and test addition, reducing risk and improving reliability. (预计 1-2 hours)
第一步:Open the repository, locate `csv_reader.py`, view the validation block, and inspect `test_csv_reader.py` to see the existing negative page‑size test. Then run the reproduction script to confirm the inconsistent behavior.
预期验证:Reproduce the bug with the provided script to confirm the bug. Read the relevant code path to understand why the ValueError is swallowed. Make a minimal, focused change. Ensure the same error message style is used across related readers. Run the specific test file and any related integration tests.…
证据摘要:Comments provide a clear root‑cause analysis and a tested fix, but the issue is not yet marked 'ready' by maintainers and no official fix has been merged.
证据摘要:准备就绪的分支:https://github.com/Shanmukh-l33t/agno/tree/fix/11499-sqlite-empty-page-total (提交 e8fe5e0)。新测试在未修改的 main 上失败 (assert total == 3 → assert total == 0),在应用修复后通过。现有的单元和集成测试继续通过。
为什么适合小 PR:A straightforward constant change that aligns with OpenAI's documented scaling rule, with an existing reproduction and a ready regression test. (预计 1-2 hours)
第一步:Open the repository, navigate to `libs/agno/agno/utils/tokens.py`. Run the reproduction script to confirm the bug. Then change the two constants from 2000 to 2048 and add a regression test for 2048x520 in `tests/unit/utils/test_tokens.py`.
预期验证:Reproduce the bug with the provided script. Examine the surrounding code to ensure no other related constants exist. Make only the minimal change (the constant). Add a test that checks the fixed behavior and the edge case, using the existing test format. Include a comment linking to OpenAI's tile‑b…
证据摘要:Maintainer comment confirming they will fix the issue and include regression tests; no merged PR yet.
为什么适合小 PR:The bug is a specific, reproducible parsing error in a high-profile repository (43k stars). The fix requires modifications in a single model file and aligned tests, addressing a clear functional bug that corrupts answer content for users with reasoning models. This will improve user trust and corre… (预计 2-3 days)
第一步:Navigate to repository root, open `agno/models/mistral.py`, examine `_parse_provider_response_delta`. Run existing tests to see if any currently fail related to streaming. Then run the reproduction script from the issue to confirm bug locally (install any missing dependencies). After confirming, cr…
预期验证:First, read the current implementation to understand the base parsing pattern. Then reproduce the bug with the provided mock to confirm. Next, design a minimal fix: adapt `_parse_provider_response_delta` to accept list deltas and extract content and reasoning. Use defensive coding: check `isinstanc…
证据摘要:No recent comments in issue (0 replies). The issue is labeled as 'bug' and 'ready', indicating maintainers are ready for fixes. No indication of ongoing fix or PR.
为什么适合小 PR:The request solves a concrete compliance and usability gap for Slack agents, aligning with the project's design guidelines and adding a widely requested feature. (预计 1-2 days)
第一步:Clone the repo, locate the Slack integration files (e.g., agno/integrations/slack/agent.py or similar), examine the message formatting logic, then add footer_text and sources_footer parameters and implement context block rendering.
预期验证:Reproduce by creating a Slack agent and confirming missing footer; read the existing Slack message builder to follow existing patterns; keep changes minimal; add tests for new footer rendering; ensure backward compatibility with existing Slack agent configurations.
为什么适合小 PR:Provides critical missing Slack support (suggested prompts, session stop, title sync, loading messages) with low risk via an opt‑in flag, improving user experience for new Slack apps and fixing session lifecycle bugs. (预计 Half a day to 2 days)
第一步:Locate the Slack integration module in the repository (e.g., `agno/infra/integrations/slack/`), examine the current manifest JSON and event handlers, and understand how `assistant_thread_started` is processed. Then identify where new Slack events can be registered and where the flag will be introdu…
预期验证:‑ Start by reading the existing Slack bridge and manifest schema to understand the current structure. 2. Keep changes minimal: introduce the flag and new handlers without modifying legacy paths. 3. Follow the project's code style and add tests for any new code paths. 4. Write clear docstrings and u…
证据摘要:No recent comments or maintainer activity; issue author expressed willingness to work on it but no PR yet. No evidence of ongoing work.
为什么适合小 PR:The request follows established provider patterns, requires moderate effort, and will improve the user experience for UberLLM users. No maintainer input yet, but the issue is ready for implementation. (预计 1‑2 days)
第一步:Open the repository and examine an existing provider (e.g., TrustedRouter) in `libs/agno/agno/models/trustedrouter/` and its mapping in `utils.py`. Understand how the class, imports, and provider entry are structured, then start creating the new UberLLM provider files.
预期验证:Follow CONTRIBUTING.md's "Adding a new Model Provider" guide. Use the same error shape as TrustedRouter. Keep changes minimal and consistent with existing provider conventions. Test both the class import and the string syntax. Ensure cookbook examples demonstrate usage and include required environm…
证据摘要:No evidence of maintainer interest; the issue author is waiting for a maintainer to mark it "ready" before submitting a PR. No recent maintainer comments.
为什么适合小 PR:Feature mirrors existing providers (Heabsy, Cloudflare, MiniMax) and is low complexity with clear implementation steps; branch exists so work is straightforward. (预计 0.5-1 day)
第一步:Open the repository, examine the Heabsy provider implementation in agno/models/heabsy.py, then create wiro.py following the same pattern, add provider entry, and check OpenAIChat.get_request_params list.
预期验证:Clone Heabsy provider pattern for consistency. Use ModelAuthenticationError when API key missing. Ensure env var naming follows existing convention. Write tests that run against live API (like branch). Update provider list only when needed. Keep code simple and minimal.
证据摘要:Contributor has prepared a branch with unit tests and cookbook examples ready; no maintainer discussion yet.
为什么适合小 PR:The feature is fully implemented and tested; integration will be straightforward and adds valuable safety for Solana agents. (预计 1-2 days)
第一步:Clone the repo, inspect the existing serpapi.py and the tool registration pattern, locate the provided solana_pulse.py, run its unit tests with mocked HTTP to confirm they work, then plan the integration steps.
预期验证:Examine `serpapi.py` to understand the pattern for API‑key tools, replicate its structure, add clear docstrings, handle the optional API key via environment variable, write tests that mock httpx requests, verify integration with Agno's tool registration, and run the test suite to ensure everything…
证据摘要:No maintainer comments or recent activity; the author provides ready‑to‑use code.
为什么适合小 PR:A well‑defined feature request with clear use‑cases, alternative solutions evaluated, and existing patterns to mirror. The repo size is large (43k stars), indicating mature code; careful integration is needed to avoid breaking changes. (预计 2-3 days)
第一步:Explore the repository to find Slack agent implementation (likely under `agno/agent/providers/slack/` or similar). Look for existing parameters like `loading_text` and see how the agent runs messages. Also check Telegram's reaction feature to understand the naming and code patterns.
预期验证:Examine existing Telegram implementation (#7368) for patterns; ensure the feature is optional, documented, and scope errors are handled gracefully. Follow the repo's code style, add unit tests, and update any relevant README or docstrings. Use existing Slack client wrapper methods if available to a…
证据摘要:No evidence of recent activity on this issue; no PRs or comments present. The issue author indicates willingness to work on it, but the repository appears to need implementation.
为什么适合小 PR:The feature adds essential schedule expiration support, solves common one‑shot and time‑bounded use cases, and the maintainers have expressed openness to a staged implementation. Community feedback provides clear design questions, making it a high‑value addition. (预计 1-2 weeks)
第一步:Locate the Schedule model (e.g., `agno/schedule.py`), examine ScheduleManager and SchedulerTools definitions, and review the DB adapters for schema migrations. Then add the nullable fields to the model and adapters, create a migration, and update the manager's create/update signatures to accept and…
预期验证:Explore the existing schedule flow first to understand how `next_run_at` and the executor work. Keep the changes minimal and backward compatible (nullable fields). Ensure expiration logic is applied in all admission paths, not just the executor. Follow existing naming conventions and migration patt…
证据摘要:Two comments from maintainers and contributors discuss design details and suggest a staged rollout (end_at first). No existing PRs or resolved work, indicating the issue is still open and actively considered.
为什么适合小 PR:Critical security hardening (SSRF & state leak) with active maintainer discussion; fixing both bugs will improve security posture and prevent regression in knowledge ingestion. (预计 3-5 days)
第一步:Open `libs/agno/agno/knowledge/knowledge.py` and examine lines 2620‑2640 and 2810‑2840 to verify the missing `return` statements. Also open `libs/agno/agno/knowledge/reader/website_reader.py` and `reader_factory.py` to confirm `public_only` defaults. After confirming the bug locations, create a sma…
预期验证:Read the existing `public_fetch.py` and `url_validation.py` to understand the public‑IP guard contract. Keep changes minimal and focused, ensuring we do not break legitimate downloads (PDFs, CSVs, etc.). Write unit tests that cover invalid URL handling, public‑IP blocking, and redirect behavior for…
证据摘要:Active discussion with maintainer comments; they want the issue marked `ready` and have outlined a fix but raised concerns about using `public_fetch` for file downloads. No merged PR or final resolution exists yet.
为什么适合小 PR:The bug leads to data loss and UI failures for local development. Fixing it restores parity with HTTP behavior and improves developer experience without affecting production security. A straightforward code change with unit tests will resolve the issue. (预计 1-2 days)
第一步:Open agno/os/router.py at the referenced commit (26cc04f9ed8d43c2ae7987fe246d4033fa2ccd2d) and locate the WebSocket dispatcher methods (start-workflow, reconnect, continue-workflow). Examine lines around the elif auth_user_id or ws_user_isolation_enabled branch that clears user_id. Then run the pro…
预期验证:Follow the pattern used in NoAuthIdentityMiddleware and the HTTP router for handling unauthenticated user isolation. Write focused unit tests that reproduce the probe scenario, cover all three WebSocket actions, and ensure the fix does not break existing authenticated flows. Keep changes minimal an…
证据摘要:Maintainer comments show the issue is understood and a fix is being considered; no resolution evidence present.
为什么适合小 PR:This is the last non‑overlapping, concrete test slice flagged by the bot after the three merged PRs. Requirements are explicit, effort is low, and completing it will close the DB‑double cleanup work. (预计 1-2 hours)
第一步:View `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py`, inspect imports, locate the SQLite fixture, and map the two mocked `session.scalar()` calls (lines ~96‑167). Plan seeding using that fixture to replace the mocks.
预期验证:Follow the same pattern used in the other cleanup PRs (e.g., replace scripted mocks with fixture seeding, retain failure‑injection mocks, and ensure the original test contract is unchanged). Run focused `pytest` and relevant lint/type checks before opening a PR.
证据摘要:Bot comment: "One concrete additional DB-double cleanup slice remains in the November 11 checkout (`6d3447e8c3`): `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py` – `test_transform_promotes_serialized_tool_file_link_to_files_output` ... Replace those session/result doubl…
为什么适合小 PR:Straightforward UI bug that blocks user interaction; the fix is localized to CSS/z‑index; a contributor has offered to handle it; resolving it improves UX with minimal effort. (预计 1-2 hours)
第一步:Open the repo, locate web/app/components/billing/annotation-full/modal.tsx, examine the CSS for DialogClose/IconButton and GridMask, run the failing Browser Mode test to confirm the click failure, then adjust styling to bring the close button above the overlay.
预期验证:Reproduce with the failing Browser Mode test; read the code to see why the close button is obscured; make the smallest CSS change (e.g., increase z-index of close button or set pointer-events: none on overlapping content); ensure other modals remain unaffected; coordinate with #46102 to avoid dupli…
证据摘要:Contributor @GYJ99 offered to fix; no maintainer assignment yet.
为什么适合小 PR:A straightforward localization task that improves UX for Spanish users and requires only translating ~90 JSON entries. (预计 1-2 days)
第一步:Navigate to web/i18n/locales/es-ES/, compare each listed JSON file with the English source (web/i18n/locales/en-US/) to list missing keys, then start translating them into Spanish.
预期验证:Review existing Spanish translations for consistency and terminology. Keep product names and technical terms in English as intended. Use the repository's translation guidelines and any contributed translation style. Validate by running the app with locale es‑ES and checking that all UI strings appe…
证据摘要:No evidence of maintainer engagement or recent discussion.
证据摘要:聊天布局浏览器测试中的测试用例 'scrolls restored history above the composer after lazy Markdown content appears' 持续失败,评论中提到的计划需要修改 `use-chat-layout.ts` 以等待内容尺寸变化。
为什么适合小 PR:A direct accessibility bug affecting a widely used UI component; fixing it improves inclusivity and prevents user frustration with keyboard navigation. (预计 1-2 days)
第一步:Open `web/app/components/base/notion-page-selector/page-selector/page-row.tsx` and examine lines 73 and 96. Review the surrounding JSX to understand how the divs are used (e.g., `onClick` handlers, any additional classes). Then create a quick local reproduction (e.g., start the dev server if possib…
预期验证:Follow the repository’s existing accessibility patterns (use semantic elements, proper ARIA attributes, and keyboard event handling). Keep changes minimal and focused on the component only. Preserve all current functionality (search, selection, virtualization). Add unit tests for keyboard navigatio…
证据摘要:A community member (@GYJ99) offered to take the fix and provided a concrete plan for the changes, indicating the issue is acknowledged and ready for implementation.
为什么适合小 PR:The issue is well‑specified, the contributor is ready to implement, the change is optional and low‑risk, and maintainers have shown interest in reviewing it. (预计 1-2 天)
第一步:Locate the existing network interception code (e.g., where Fetch.enable or request interception is set up) to understand how to inject per‑request headers, then create a minimal prototype that signs a request using an Ed25519 key and verify the output.
预期验证:First reproduce the signing behavior by enabling the config and making a request to a test server that logs headers, verify the signature matches expectations; keep the cryptographic dependency optional; follow existing configuration patterns in the project; ensure signing does not break existing f…
证据摘要:Maintainer @PrabalParihar provided a design sketch and offered to review; @htl-syterme confirmed willingness to support a PR, indicating active community engagement and openness to the feature.
为什么适合小 PR:The issue solves a concrete user pain point (long text injection errors) and has clear community interest; extending the existing secretBindings pattern with a new valueBindings type is a manageable feature addition that can be delivered incrementally. (预计 2-3 days)
第一步:Open the repository and read the existing secretBindings implementation (e.g., `browser_use/tools/registry/service.py`). Understand how aliases are replaced at runtime and note any size/origin limits. Draft a minimal design for valueBindings (alias + value, relaxed limits) and write a simple unit t…
预期验证:Start with a local reproduction: read the existing secretBindings code, write a small script that creates a placeholder in a task and verifies substitution. Keep changes minimal by reusing the existing substitution service. Write focused regression tests and ensure they pass before opening a PR. Co…
证据摘要:Active comments from multiple contributors (Sumukh-15, SidharthSKR99, Keesan12) expressing interest and willingness to implement; maintainer @erkanarslan confirmed a separate valueBindings approach is preferred, indicating community readiness.
为什么适合小 PR:Feature request for a straightforward documentation/example addition that improves usability for integrating external MCP tools in DSPy agents. Low effort, high value, author willing to contribute. (预计 1-2 hours)
第一步:Clone the repository, explore `docs/` folder to see existing tools.md and example patterns. Locate the file `docs/docs/diving-deeper/tools.md` (or similar) and examine its structure. Then decide whether to update the existing docs or create a new example file. Check if any existing examples use `ds…
预期验证:Search repo for similar tool examples (e.g., `tools.md` or `examples/`) to understand style and format. Follow existing doc formatting (markdown). Ensure code snippets are minimal, runnable, and include necessary comments. Use consistent naming and include short explanation of the Bearer token usag…
证据摘要:Issue author expresses willingness to contribute; Desearch team offers to implement, add tests, and maintain. No evidence of prior work on this issue; it's a fresh request.
为什么适合小 PR:Missing typesafe dialect blocks a legitimate use case and violates the project's rule that provider names should reflect wire behavior. Community interest is present, and fixing it will enable custom TypeSafe gateways and correct decision routing. (预计 1‑2 days)
第一步:Inspect dspy/_vendor/lm15/registry.py and the LM class to locate _DIALECTS, _COMPAT_TABLES, the existing ProviderDefinition.chat/responses/anthropic methods, and LM.supports_decision_requests. Reproduce the ValueError with the snippet to confirm the missing dialect, then plan the necessary edits.
预期验证:Follow the existing pattern of chat/responses/anthropic methods; keep changes minimal; add a simple unit test that creates a ProviderDefinition.typesafe and confirms it registers; ensure decision routing respects dialect; communicate changes in a PR with clear description and any required version s…
证据摘要:One comment from @pma1999 expressing interest and asking about direction; no evidence of ongoing work or resolution.
为什么适合小 PR:The issue is a well‑scoped feature request with a willing contributor, but it introduces an external dependency and requires maintenance oversight. The work is moderate and doable, yet its value depends on community interest in a third‑party memory service, making it a lower‑priority enhancement. (预计 1-2 天)
第一步:Search the codebase for existing adapter or extension patterns (e.g., any cache, storage, or plugin modules) to understand how optional integrations are implemented, then sketch the MemCode adapter interface based on those examples.
预期验证:First locate existing persistence or cache adapters in the repo to follow the same structure. Keep the MemCode dependency behind an import‑guard or extra‑requirements tag. Provide a fake/in‑memory stub for tests. Use clear configuration keys (e.g., dspy.settings.memcode_enabled). Submit a draft PR…
证据摘要:No comments or reactions from maintainers or community members; no evidence of prior discussion.
为什么适合小 PR:Issue is stale and only requests minimal documentation; adding a brief MCP example resolves it at low cost, avoids maintaining a new tool. (预计 1-2 hours)
第一步:Find MCP documentation file (e.g., docs/mcp/overview.md), inspect existing examples (e.g., Serper, Exa), and add a concise looot integration snippet referencing https://api.looot.ai/mcp with Authorization header.
预期验证:Follow existing documentation style, reference the looot API endpoint, keep mention minimal, add to relevant MCP integration page. Optionally add a note about using looot via crewai-tools if tool package is later added.
证据摘要:Author explicitly prefers docs only; adding a mention in existing MCP examples addresses the request.
为什么适合小 PR:A compliance guardrail for monetary agents is high‑value and aligns with crewAI’s security focus; the existing third‑party package provides ready implementation, and integrating it will prevent unsafe transfers and reduce custom check‑logic across projects. (预计 2-3 days)
第一步:Clone the crewai‑tools source, locate the pattern for optional third‑party tools (e.g., look at `crewai_tools/tools/external/`), and examine the `crewai‑sra‑riskgate` repository to understand its public API and packaging. Then propose a concrete integration design (option a or b) for discussion.
预期验证:Read existing tool definitions and optional dependency patterns; copy the import guard used for other third‑party tools. Write tests that mirror the acceptance criteria from the comments (policy bound to quote, reject new quote with different payee, and reconcile lost responses without generating n…
证据摘要:No maintainer decision yet; only community discussion about acceptance criteria.
为什么适合小 PR:The issue addresses a blocked dependency that will become unusable as a2a-sdk 0.3 reaches end‑of‑life, and the A2A team at Google has offered to contribute the migration and future support. This is a high‑value upgrade that will keep crewai[a2a] viable and compatible with newer agents, but requires… (预计 5-7 days)
第一步:Clone the repository, explore the crewai/a2a directory, list all Python files, and run the existing a2a tests to capture the current baseline behavior before any changes.
预期验证:Maintain exact API compatibility for A2AClientConfig and A2AServerConfig; use version detection to pick the appropriate transport; write unit tests that import both SDK versions (or use a mock) to verify interoperability; keep changes minimal and focused; run existing test suite to avoid regression…
证据摘要:The issue includes a recent comment from @guglielmo‑san (A2A team at Google) stating they are willing to contribute the implementation and help support the integration going forward, indicating active community interest and possible collaborative effort. No evidence of a merged PR or resolved issue…
为什么适合小 PR:The bug silently drops error information from hosted MCP calls, impairing error handling and user experience. Fixing it restores visibility into failures. (预计 1-2 days)
第一步:Run the reproduction script to confirm the bug, then inspect the two parsing methods in `_chat_client.py` to locate where mcp_call is handled and where the error field should be propagated.
预期验证:Reproduce with the minimal script first, then read the surrounding code to see how other errors or results are represented. Follow the existing pattern for constructing `mcp_server_tool_result` content (e.g., using `Content.from_error` if available). Keep changes focused and minimal. Write tests th…
证据摘要:There is a recent comment confirming reproduction and noting that no maintained spec defines how MCP errors should surface. The issue remains unresolved.
为什么适合小 PR:Adds essential observability for operators and telemetry consumers when multiple MCP servers are used; resolves ambiguity in span correlation. (预计 1-2 days)
第一步:Clone the repo, grep for 'execute_tool' span creation, examine MCPTool, MCPStreamableHTTPTool, and MCPStdioTool classes to understand how spans are emitted and where the server name and URL are available.
预期验证:Follow OpenTelemetry semantic conventions (use `url.full` for endpoint). Keep attributes low‑cardinality and non‑sensitive. Respect existing privacy flags (ENABLE_SENSITIVE_DATA). Keep changes minimal and focused on the span generation code. Add tests covering both HTTP and stdio MCP tools.
证据摘要:Issue is open with design questions; no PR or implementation present.
为什么适合小 PR:CI failure on Windows Python 3.12 is blocking merges; the test appears flaky or possibly buggy, requiring investigation and a fix to make the test reliable. (预计 Half day to 1 day)
第一步:Open the repository, inspect `python/packages/declarative/tests/test_invoke_mcp_tool_executor.py` around line 471, understand the test method `test_auth_context_binding_survives_workflow_resume`. Then attempt to run this test locally (or in a CI matrix) to see if it reproduces on the current base c…
预期验证:Reproduce the failure by running the specific test in a Windows Python 3.12 environment or a CI simulator. Review the test setup and any async/threading behavior. Use logging or debug output to see when the handler is called. If it's a timing issue, consider adding a small delay, using a mock that…
证据摘要:No comments or recent activity; the issue is newly created and unresolved.
为什么适合小 PR:Bug report highlights inconsistent serialization for slot‑backed subclasses, which could cause data loss. The fix is a modest code adjustment and requires maintainer clarification on support scope. Issue is currently routed to core Python owner, making it a medium‑priority triage item. (预计 1-2 days)
第一步:Clone the repository (or fetch the _serialization.py snapshot), run the reproduction script to confirm the missing slot fields, and inspect _serialization.py to locate to_dict and _iter_instance_fields so you can plan the fix.
预期验证:First, reproduce the bug with the provided script to confirm missing fields. Then study the existing slot‑test for copy/pickle to understand the pattern used by _iter_instance_fields. Make the smallest change that respects existing exclude/exclude_none behavior. Add a focused test that mirrors the…
证据摘要:Issue is in triage; only a routing comment from GitHub Actions bot, no further community discussion or maintainer response. The status is unresolved and awaiting maintainer decision.
为什么适合小 PR:High storage cost in production, clear existing plan, and a contributor has offered to implement and test, making this a low‑risk, high‑impact addition. (预计 2-3 days)
第一步:Clone the repository, inspect the Python PR #9290 to understand the SQL and logic, then examine the current @langchain/langgraph-checkpoint-postgres source (especially PostgresSaver class and any similar methods like deleteThread). After that, create a branch and start implementing the `prune` meth…
预期验证:Read the Python source first to avoid misinterpretations. Follow the existing code style (async/await, error handling, input validation). Write tests before or alongside implementation, matching Python test expectations. Use the same input validation (array vs single string, strategy enum). Keep ch…
证据摘要:Active plan: contributor @henricop has commented offering to port the Python prune implementation, specifying the exact method signature and test strategy. No evidence of an existing PR or merged changes.
为什么适合小 PR:Critical bug causing unbounded memory growth and stream failures; partially fixed by PR #2926 but the replay/clear race remains, risking data loss. (预计 1-2 days)
第一步:Open the repository, locate `libs/langgraph-api/src/experimental/embed/protocol.mts`, examine the current `handleRunStart` and replay logic, and write a small script that triggers a non‑interrupting run while attaching a `/stream/events` subscriber to reproduce the buffer growth and race condition.
预期验证:‑ Reproduce the race with a test before fixing. ‑ Read the existing test suite and follow the same patterns (e.g., using `describe/it` with `vi` mocks). ‑ Make the smallest change needed (only adjust clearing logic and replay safety). ‑ Ensure any new test is deterministic and can be run locally. ‑…
证据摘要:One comment notes PR #2926 handles retention but leaves the replay/clear race unchanged, asking for maintainer confirmation on replay behavior after a resume. This indicates partial progress and an open race bug.
为什么适合小 PR:The bug leads to sparse arrays and downstream runtime errors; it's triggered on resume after interrupt, which is a realistic scenario. A fix will improve stability and user experience. (预计 Half day to 1 day)
第一步:Clone the repository, explore the files mentioned: src/StreamManager.ts and src/ui/messages.ts (or wherever MessageTupleManager is defined). Run the repro script to confirm the bug. Then examine existing tests for StreamManager and MessageTupleManager to understand test patterns.
预期验证:1. Read code paths: look at StreamManager.ts and ui/messages.ts (where MessageTupleManager resides). Understand chunk aggregation logic. 2. Write a minimal failing test in the existing test suite (likely in tests/ folder) reproducing the hole and error. 3. Keep change focused: either clear registry…
证据摘要:The issue is open, no merged PR referenced, and the bug is reproduced in the description. There's an open comment discussing a possible fix but no final resolution.
为什么适合小 PR:The issue is well‑reproduced, has a clear proposed fix, and active maintainer discussion, but implementing it requires evaluating Node version compatibility and possibly raising the minimum Node version or adding conditional distribution, which adds non‑trivial work. (预计 1-2 days)
第一步:Clone the repo, install @langchain/langgraph-checkpoint-sqlite@1.0.4, observe the prebuild-install warnings, then temporarily add an overrides field for better-sqlite3@13.0.3 and reinstall to confirm the warnings disappear and the SqliteSaver basic operations succeed.
预期验证:First reproduce the warnings with a clean install of the current package; then test the proposed version range using npm overrides or a temporary package.json edit to verify that warnings disappear and the SqliteSaver works; consult the better-sqlite3 changelog and the open segfault issue to unders…
证据摘要:Two recent comments from a contributor indicate they are actively examining the change but stepped back due to Node compatibility concerns; no maintainer decision has been posted yet, showing ongoing discussion but no resolution.
为什么适合小 PR:The issue is well‑described with a reproducible example, pinpointing a specific bug in StreamController’s namespace reconstruction logic. The fix is likely confined to the hydrate/resolveSubagentNamespace path, making it actionable, though it requires careful handling of history pagination and thus… (预计 1-2 days)
第一步:先确认 issue 仍能复现,再搜索相关代码和测试。
预期验证:First reproduce the issue locally using the supplied Python/JS example to confirm the misbinding. Then implement the smallest possible change that fixes the lookup logic without altering the public API. Write a unit test that covers stale delegation, valid pending subagents, and direct mapping on t…
证据摘要:A recent comment from Shay‑Deng expresses interest in working on the issue, offers a focused fix, and asks for assignment, indicating active community engagement.
为什么适合小 PR:Bug causes CI failures on macOS due to unhandled rejections; fix is a one‑line addition that resolves the race condition and restores clean test exits. (预计 1-2 hours)
第一步:Open test/e2e/protocolTimeout.test.ts, find the call for the SSE reset‑on‑progress variant, and add call.catch(() => {}) right after the call creation. Then run that specific test to verify the fix.
预期验证:Attach the catch at creation, capture the rejection (e.g., assign to a variable) and assert it is a timeout, keep the test signal, and ensure the fix follows the pattern used elsewhere (e.g., protocol:timeout:max-total). Test only the SSE variants.
证据摘要:No evidence of recent maintainer comments or PRs addressing this issue; only one comment with guidance.
为什么适合小 PR:This enhancement completes the two‑part scope‑challenge design, enabling proper OAuth flows when authorization is discovered during tool execution. It builds on existing, tested patterns and will significantly improve the SDK's auth capabilities. (预计 2-3 days)
第一步:Explore the repository to locate the existing `scopeChallenge` implementation (likely in `packages/server` or `packages/shared`), examine the transport layer (`streamableHttp`), and identify where `responseCommitted` is set. Use `git grep` for `ScopeChallengeError`, `scopeChallenge`, `insufficient_…
预期验证:Follow the existing pattern for `scopeChallenge` on registration (see #1624). Use consistent error naming and serialization. Ensure the new errors are exported from the SDK's error module. Add comprehensive tests covering both transport branches and edge cases. Keep changes minimal and focused, and…
证据摘要:Active design discussion with concrete proposals from maintainers (@Ben-Home, @buptliuhs). No implementation yet, indicating a clear path forward.
为什么适合小 PR:Simple listener cleanup, low risk, directly addresses a memory leak affecting all stdio users. (预计 1-2 days)
第一步:Open src/client/stdio.ts, examine close() (L280-319) and start() (listeners), reproduce warning with a quick script, then edit close() to add unpipe and removeAllListeners for the three streams.
预期验证:Reproduce the warning with a local MCP server that logs to stderr, read the existing test suite to understand patterns, make minimal changes, add a test that validates no listeners remain after close, and keep PR description concise with a link to the issue.
证据摘要:Issue is open with active discussion, a contributor has expressed interest, and there is a backport for v1.x but no evidence the main branch is fixed.
为什么适合小 PR:Five ready, low‑risk bug fixes for high‑impact reliability and conformance issues are blocked from PR; merging them now improves SDK stability and unblocks the contributor. (预计 1-2 days)
第一步:Add the user's fork as a remote (`git remote add nikolas-sapa https://github.com/nikolas-sapa/typescript-sdk`), fetch all branches, and checkout each fix branch to review the diffs and run the associated tests.
预期验证:Reproduce each bug using existing test suites or manual scenarios, review the code path for the affected module (e.g., transport layer, error routing, exports), make minimal changes, run the full test suite, and document any new acceptance test if needed. Communicate with the original contributor a…
证据摘要:A maintainer comment (@media-ctrl) ordered the fixes by severity, showing community awareness and readiness to accept the changes; no further discussion indicates the issue is waiting for action.
为什么适合小 PR:Security hardening with a ready patch and community interest; low-risk change that aligns with the spec and prevents cleartext and fragment redirect URIs. (预计 Half a day to a day)
第一步:Open packages/server-legacy/src/auth/handlers/register.ts, locate findInvalidRedirectUri, and apply the provided helper and validation logic. Then run existing tests to ensure nothing breaks.
预期验证:Follow existing patterns for validation errors, reference RFCs in error messages, add tests for both valid and invalid cases, ensure patch does not affect client metadata parsing, and keep changes minimal.
证据摘要:Patch provided by @media-ctrl in comment, includes isLoopbackHost helper and validation logic. PR #3143 covers v1, but this issue (main line) remains unfixed.
第一步:阅读packages/server/src/index.ts和createMcpHandler实现,确认McpServer vs Server的区别;创建最小复现脚本验证header validation和scope challenge在非McpServer产品上被跳过;搜索现有测试如何覆盖createMcpHandler。
为什么适合小 PR:The bug leads to unnecessary network traffic and can be amplified in batch scenarios; a ready fix exists in PR #3091 with test coverage, making this a low‑risk, high‑value fix. (预计 Half a day)
第一步:Open the repository at the v1.x branch, inspect src/shared/protocol.ts to locate the request method and compare with v2's implementation, and read the test files referenced in PR #3091 to understand the expected behavior.
预期验证:Replicate the v2 fix exactly: use responseReceived guard, register with { once: true }, detach listener on response, add tests for both pre‑response cancellation (should still send notifications/cancelled) and post‑response cancellation (should be no‑op). Run the full test suite to avoid regression…
证据摘要:PR #3091 proposes adding a responseReceived guard, using { once: true } abort listener, and removing it after response arrives; the PR includes test cases that currently fail on v1.x.
为什么适合小 PR:The issue provides a clear problem statement, a concrete code proposal, and limited scope (adding a timer option). No conflicting discussions or missing information. (预计 2-3 小时)
第一步:Open the source file for StreamableHTTPServerTransport, locate where GET and POST streams are created and how the controller is used to write SSE data, then sketch where to inject the keep‑alive interval logic.
预期验证:Keep the change backward compatible (default off). Use the existing stream controller API to write comments, not internal `_webStandardTransport._streamMapping`. Add tests that simulate stream lifecycle and verify that comments are written at the configured interval and stopped on close. Follow the…
为什么适合小 PR:This is a spec‑compliance bug that directly impacts real‑world OIDC providers (Azure AD, AWS Cognito, Microsoft). The community has provided concrete examples and is actively discussing a fix, making it a high‑priority issue for both security and usability. (预计 2-3 days)
第一步:Open the repository and locate the client’s authorization logic. Find the file containing `startAuthorization` and examine how metadata validation is performed. Run the existing test suite to ensure baseline passes, then create a minimal reproduction using a mock metadata endpoint without `code_cha…
预期验证:Read the 2025‑11‑25 spec section on Authorization Code Protection to understand exact requirements. Keep changes minimal to avoid breaking existing integrations. Follow existing patterns for warnings or extra fields in discovery results. Ensure tests cover edge cases (field present with S256, absen…
证据摘要:Two comments include a real‑world example (Microsoft Sentinel) and discuss possible solutions, but there is no maintainer response yet, indicating the issue is still open and under active consideration.
为什么适合小 PR:The issue presents a well‑defined feature request with a clear implementation proposal and no conflicting work; it is not yet addressed and the scope is moderate, making it actionable though it will require touching core transport and request‑handling code. (预计 3-5 days)
第一步:Open the transport definition file (e.g., `src/transport.ts`) and the request‑handling code (e.g., `src/protocol.ts`), locate the `finally` block that deletes the abort‑controller entry, and plan to add the optional completion callback invocation there.
预期验证:First reproduce the described scenario with a deferred handler and deferred `send` to confirm the missing signal; locate the exact `finally` block where the abort‑controller entry is deleted and place the callback invocation there; keep the callback optional to maintain backward compatibility; run…
证据摘要:No comments or reactions on the issue; no recent activity from maintainers, so there is no explicit signal either way.
checked_at:2026-11-13 10:53:34 (北京时间)
已分析候选归档(展开查看)
展开已分析候选归档:152 条(保留 Focus、Hard、排除项和详细 AI 理由)
审查入口:这里保留本轮已分析、可进入报告的候选;每仓库最多展示 50 条。待分析、政策阻断/待确认、Not Now 与隐藏项不在本页展开。
A bot comment added a concrete remaining slice after the three merged PRs, indicating the issue is still open and maintainers have not confirmed closure.
我现在先做什么
View `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py`, inspect imports, locate the SQLite fixture, and map the two mocked `session.scalar()` calls (lines ~96‑167). Plan seeding using that fixture to replace the mocks.
问题描述
Issue #45585 tracks a DB‑double cleanup effort. After three merged PRs, a final concrete slice remains: two test methods in `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py` currently mock `session.scalar()` with a `MagicMock`/`SimpleNamespace` row. They should be replaced with real SQLite seeds using the existing fixture, preserving test logic and any external mocks.
工作内容
Open the file `api/tests/unit_tests/core/workflow/nodes/agent/test_message_transformer.py`. Identify the SQLite fixture (e.g., `sqlite_session`). Seed a real ToolFile (or related) row for `test_transform_promotes_serialized_tool_file_link_to_files_output`. For `test_transform_rejects_unknown_tool_file_link`, seed no row (or a NULL result) via fixture. Remove `MagicMock`/`SimpleNamespace` mocks, adjust assertions if needed, and keep any unrelated external mocks. Run the two test cases and any related lint/type checks.
最佳实践
Follow the same pattern used in the other cleanup PRs (e.g., replace scripted mocks with fixture seeding, retain failure‑injection mocks, and ensure the original test contract is unchanged). Run focused `pytest` and relevant lint/type checks before opening a PR.
Easy 1‑2 hours to review and merge the existing example into the documentation
可处理性
Level 1 Clear & Easy
清晰度 / 值得做
Clear / Yes
社区信号
Active development by @ZYZ666‑RGB, maintainer review notes, draft PR and revised notebook, indicating community readiness.
我现在先做什么
Open PR #24094, inspect the physics/bounds validation notebook and handler, compare it to existing llama-index‑core example patterns, then run a quick smoke test to confirm it works as‑is.
问题描述
The issue proposes an example of deterministic physics/bounds validation as a workflow event handler, to catch physically impossible values (e.g., probability >1, negative mass, speed > c, NaN/Inf) in a LlamaIndex workflow. This is valuable for audit‑friendly pipelines and composes with existing retry policies. A draft PR (#24094) already contains a ready implementation, but the example still needs to be integrated into llama‑index‑core docs/examples.
工作内容
Examine PR #24094 and existing example notebooks, ensure the physics handler follows the cookbook pattern, adjust any formatting, add brief documentation comments, verify the example runs in a minimal pipeline, and then merge the changes into the llama-index-core examples directory.
最佳实践
Keep the checker as a pure deterministic function, guard the four false‑positive traps (negative‑value flags, percentage bounds, abs() for speed‑of‑light, NaN/Inf handling), reference phm‑lite‑check, emit a {"verdict": "PASS|WARN|FAIL", "violations": [...]} shape, and follow existing example conventions for notebooks and docstrings.
Issue labeled 'needs triage' with no further maintainer discussion; only generic bot comment waiting for maintainer triage – no evidence of ongoing work or recent resolution.
我现在先做什么
Navigate to the MCPServer definition, examine its constructor and getNodeHandler, then implement maxRequestBodySize as optional property and pass it through to createMcpHandler.
问题描述
MCPServer caps HTTP requests at 4 MiB with no configurable limit, causing 413 errors for larger payloads like document uploads. The handler uses createMcpHandler from @modelcontextprotocol/server, which supports maxRequestBodySize, but Mastra's MCPServer does not expose or pass it through.
工作内容
1. Locate MCPServer class (likely in @mastra/mcp/src/server.ts or @mastra/mcp/src/MCPServer.ts). 2. Add optional maxRequestBodySize field to constructor and store it. 3. Update getNodeHandler to pass maxRequestBodySize to createMcpHandler. 4. Possibly update types like MCPOptions if needed. 5. Add tests for the new option (if any exist). 6. Ensure default behavior unchanged (undefined uses SDK default 4 MiB).
最佳实践
Review existing MCPServer initialization pattern for consistency; add JSDoc comment for new field; ensure TypeScript types are updated; write a simple test that creates server with custom size and verifies handler options; avoid breaking existing usage by keeping field optional.
The issue author indicated willingness to work on a fix and submit a PR. No maintainer comments or merged PRs are present, so community activity is limited to the author’s offer.
我现在先做什么
Clone the repo (if not already), open `agno/tools/sql.py`, locate the `run_sql` method (around line 158), and examine its try/except block and the calling `run_sql_query`. Run any existing tests for the SQL tools to verify the current state.
问题描述
SQLTools.run_sql catches exceptions during row fetch and returns an empty list `[]`, which `run_sql_query` then serializes to JSON string `"[]"`. This makes a fetch error indistinguishable from a legitimate empty result, preventing the model from handling errors correctly. The intended error reporting path in `run_sql_query` becomes unreachable for fetch failures.
工作内容
Locate and examine `agno/tools/sql.py` to see the `run_sql` method. Identify the `try/except` block that swallows fetch exceptions and returns `[]`. Modify it to let the exception propagate (e.g., remove the catch or re‑raise after logging). Verify that `run_sql_query` already handles exceptions and returns an error string. Add a regression test that simulates a fetch failure (e.g., by patching `Result.fetchall`) and asserts that `run_sql` raises or that `run_sql_query` returns an error rather than `"[]"`. Ensure existing tests still pass.
最佳实践
1. Reproduce the bug with a minimal script to confirm behavior. 2. Read the surrounding code to understand other error handling. 3. Make the smallest change needed: either drop the inner `except Exception:` block or re‑raise after logging. 4. Keep any existing logging if desired. 5. Add a test in the appropriate test file (`tests/tools/test_sql.py`) that patches `Result.fetchall`/`fetchmany` to raise an exception and checks that `run_sql` does not return `[]`. 6. Run the existing test suite to avoid regressions. 7. Write a clear commit message explaining the fix and the added test.
Issue author is the maintainer of looot and offers to contribute a tool, but prefers docs only. No other community comments.
我现在先做什么
Find MCP documentation file (e.g., docs/mcp/overview.md), inspect existing examples (e.g., Serper, Exa), and add a concise looot integration snippet referencing https://api.looot.ai/mcp with Authorization header.
问题描述
Issue proposes adding looot data tools to crewai-tools, or confirming MCP route is enough. Author offers two options: docs only (mention in MCP examples) or a thin tool package. They lean toward docs only to avoid extra maintenance. The issue is stale (30 days inactive). Needs a decision to either update existing MCP examples or create a new tool.
工作内容
Locate existing MCP examples in docs (likely docs/mcp/overview.md or lib/crewai-tools documentation). Add a short snippet showing how to use looot as an MCP server (URL + Authorization header). Ensure formatting matches existing examples.
最佳实践
Follow existing documentation style, reference the looot API endpoint, keep mention minimal, add to relevant MCP integration page. Optionally add a note about using looot via crewai-tools if tool package is later added.
No evidence of recent maintainer comments or PRs addressing this issue; only one comment with guidance.
我现在先做什么
Open test/e2e/protocolTimeout.test.ts, find the call for the SSE reset‑on‑progress variant, and add call.catch(() => {}) right after the call creation. Then run that specific test to verify the fix.
问题描述
On macOS, the e2e test for protocol:timeout:reset-on-progress with SSE transport leaves unhandled promise rejections because the 200ms timeout fires after the test has exited the expected‑failure branch and before any catch handler can swallow it. The test logs show SdkError: Request timed out and vitest exits with code 1, even though all tests pass or are expected to fail. This is a timing‑related race condition that only manifests on macOS.
工作内容
Open test/e2e/protocolTimeout.test.ts and locate the call promise for the reset‑on‑progress SSE case. Immediately after the call is created, add call.catch(() => {}) to swallow the timeout rejection. Verify that the known‑failure branch still records the expected timeout and that other transports remain unchanged. Run the specific e2e test variant to confirm no unhandled rejections.
最佳实践
Attach the catch at creation, capture the rejection (e.g., assign to a variable) and assert it is a timeout, keep the test signal, and ensure the fix follows the pattern used elsewhere (e.g., protocol:timeout:max-total). Test only the SSE variants.
Contributor @GYJ99 offered to fix; no maintainer assignment yet.
我现在先做什么
Open the repo, locate web/app/components/billing/annotation-full/modal.tsx, examine the CSS for DialogClose/IconButton and GridMask, run the failing Browser Mode test to confirm the click failure, then adjust styling to bring the close button above the overlay.
问题描述
Annotation quota dialog positions an absolutely placed Close button under a relatively positioned GridMask overlay, causing pointer events to be intercepted. Users cannot click the close control in Chromium, while Escape still dismisses the dialog. The bug occurs when annotation quota is full and the dialog is opened, blocking access to the close button.
工作内容
Review modal.tsx and its CSS to understand stacking order; adjust z-index or pointer-events so the close button is above GridMask; verify the fix with the existing failing Browser Mode test; run lint and type‑check; create a PR with minimal changes only to modal.tsx (and possibly annotation-ctrl-button if needed).
最佳实践
Reproduce with the failing Browser Mode test; read the code to see why the close button is obscured; make the smallest CSS change (e.g., increase z-index of close button or set pointer-events: none on overlapping content); ensure other modals remain unaffected; coordinate with #46102 to avoid duplicate test work; follow contribution guide and PR template.
No evidence of maintainer engagement or recent discussion.
我现在先做什么
Navigate to web/i18n/locales/es-ES/, compare each listed JSON file with the English source (web/i18n/locales/en-US/) to list missing keys, then start translating them into Spanish.
问题描述
The Spanish (es-ES) locale still contains about 90 English strings, causing UI elements to display mixed languages when the interface language is set to Spanish. This affects sections like IP Policies, navigation menus, onboarding guides, plugin installation messages, and agent environment editors, degrading the user experience for Spanish speakers.
工作内容
Inspect the existing Spanish JSON files (common.json, navigation.json, onboarding.json, plugin.json, tools.json, model-provider.json, agent-v-2.json) to identify missing or English keys. Translate the missing strings into Spanish, preserving existing terminology and keeping product‑specific terms in English (e.g., API Key, Marketplace). Ensure translations follow repository conventions and pass any linting or validation checks for i18n files.
最佳实践
Review existing Spanish translations for consistency and terminology. Keep product names and technical terms in English as intended. Use the repository's translation guidelines and any contributed translation style. Validate by running the app with locale es‑ES and checking that all UI strings appear in Spanish without mixed English fragments.
Clone the repository, checkout the branch `UnbelievableT/agno:add-topxai-provider`, run `pytest libs/agno/tests/unit/models/topxai/` to verify the unit tests pass, run `ruff check` to ensure linting, and diff the changes against `main` to confirm the provider registration, new module, and cookbook updates are correct.
问题描述
TopxAI provides an OpenAI-compatible Chat Completions endpoint, but currently requires users to manually configure `OpenAILike` with base URL and API key, lacking the convenience of a dedicated provider class, environment variable fallback, default model identifier, and the provider registry integration that Agno offers. Adding a native TopxAI provider would improve developer experience and align with the existing provider patterns used for similar gateways.
工作内容
Merge the prepared branch (`UnbelievableT/agno:add-topxai-provider`) into `main`. Verify that the new `topxai` provider is correctly registered in `_PROVIDERS`, run the topxai unit tests (which are designed to work without network access), run Ruff linting, and ensure the cookbook examples under `90_models/topxai/` are valid and follow the existing style. Confirm that the changes integrate seamlessly with the rest of the codebase and that CI passes.
最佳实践
Review the branch against the latest `main` to ensure consistency, confirm code formatting and linting match the project standards, validate that the provider follows the same pattern as other similar providers (e.g., FlexAI, Heabsy), run the topxai unit tests in isolation, and run the full test suite to avoid regressions. Document any deviations and ensure the new provider’s examples are up‑to‑date.
The issue was recently opened by an external contributor who performed an automated AST sweep, discovered two additional similar docstrings, and reposted them in a single issue. There is no visible maintainer response or PR yet, indicating the fix has not been addressed.
我现在先做什么
Open the repository and navigate to the likely files: `libs/agno/agno/models/model.py` (for AgnoModel) and `libs/agno/agno/workflow/workflow.py` (for Workflow). Inspect the four methods, edit their docstrings to reflect the correct behavior, and run `ruff format --check` on the edited files.
问题描述
Two private methods in AgnoModel (`_process_model_response` and `_aprocess_model_response`) and two in Workflow (`save_session` and `asave_session`) have docstrings that claim to return a tuple/session, but their signatures and implementations return `None`. This misleads subclasses and future developers, causing potential runtime errors if callers try to unpack the return value. The issue was discovered via an AST sweep that flagged inconsistent docstrings across the codebase.
工作内容
1. Locate `AgnoModel._process_model_response` and `AgnoModel._aprocess_model_response` in the models module.
2. Locate `Workflow.save_session` and `Workflow.asave_session` in the workflow module.
3. Edit each method's docstring: replace the summary with a description of what the method does (e.g., "Populate the assistant message and model response" or "Save the WorkflowSession to storage") and remove the incorrect `Returns:` block.
4. Run `ruff format --check` on the modified files to ensure formatting passes.
5. Verify no code changes were introduced beyond the docstring edits.
最佳实践
‑ Use a quick AST check or grep to confirm the methods indeed return `None`.‑ Keep changes minimal; do not alter any logic or other documentation.‑ Run the project's lint/formatting tools to maintain code style.‑ After editing, run any existing unit tests for the modules to ensure nothing broke.‑ Commit the changes with a descriptive message and, if appropriate, add Co-authored-by.
Two community comments (@henricop and @Shanmukh-l33t) have identified the root cause and provided a tested fix, but the issue lacks a 'ready' label from maintainers, indicating it is awaiting triage.
我现在先做什么
Open the repository, locate `csv_reader.py`, view the validation block, and inspect `test_csv_reader.py` to see the existing negative page‑size test. Then run the reproduction script to confirm the inconsistent behavior.
问题描述
CSVReader.async_read(page_size=0) behaves inconsistently: small CSVs (<10 rows) bypass pagination and return a document, while larger CSVs cause a silent ValueError that is caught, leaving the caller with an empty list after the input is consumed. This hides invalid pagination settings and can cause RAG ingestion jobs to treat non‑empty uploads as empty.
工作内容
1. Examine `libs/agno/agno/knowledge/reader/csv_reader.py` around line 157 where page_size validation occurs. 2. Change validation from `page_size < 0` to `page_size < 1`. 3. Update the error message to be consistent with other readers (e.g., "page_size must be a positive integer."). 4. Extend the existing test parametrization in `tests/unit/reader/test_csv_reader.py` to include page_size=0 in the test that validates rejection. 5. Run the test suite to ensure all tests pass and the new zero case is caught.
最佳实践
Reproduce the bug with the provided script to confirm the bug. Read the relevant code path to understand why the ValueError is swallowed. Make a minimal, focused change. Ensure the same error message style is used across related readers. Run the specific test file and any related integration tests. Commit changes with a clear message and add Co-authored-by if required.
Maintainer responded, indicating they will implement the fix and open a PR by November 10, showing the issue is accepted and being worked on.
我现在先做什么
Open the repository, navigate to `libs/agno/agno/utils/tokens.py`. Run the reproduction script to confirm the bug. Then change the two constants from 2000 to 2048 and add a regression test for 2048x520 in `tests/unit/utils/test_tokens.py`.
问题描述
The `count_image_tokens` function incorrectly scales images down when the longest side exceeds 2000px, while OpenAI's image tokenization actually scales to a 2048px×2048px square. This causes token count under‑estimation for images that fit within the 2048px limit but are longer than 2000 (e.g., 2048x520). The same erroneous constant is used in `count_video_tokens`, producing the same bug for video frames.
工作内容
Edit `libs/agno/agno/utils/tokens.py` at lines 456‑457 and 516‑517 to change the scaling threshold from 2000 to 2048. Add a regression test for the 2048x520 image (and optionally for video) in `tests/unit/utils/test_tokens.py` to verify token counts match OpenAI's specification. Run the test suite to ensure no regressions.
最佳实践
Reproduce the bug with the provided script. Examine the surrounding code to ensure no other related constants exist. Make only the minimal change (the constant). Add a test that checks the fixed behavior and the edge case, using the existing test format. Include a comment linking to OpenAI's tile‑based tokenisation guide. After changes, run the token tests and the reproduction script to confirm the expected token count.
Issue author expresses willingness to contribute; Desearch team offers to implement, add tests, and maintain. No evidence of prior work on this issue; it's a fresh request.
我现在先做什么
Clone the repository, explore `docs/` folder to see existing tools.md and example patterns. Locate the file `docs/docs/diving-deeper/tools.md` (or similar) and examine its structure. Then decide whether to update the existing docs or create a new example file. Check if any existing examples use `dspy.Tool.from_mcp_tool` for reference. Finally, draft the content for the new section or example file.
问题描述
Issue requests a small, optional example (or docs) showing DSPy agents (`dspy.ReAct`) using Desearch search tool, either via `dspy.Tool.from_mcp_tool` pointing to hosted MCP server `https://mcp.desearch.ai/mcp` with Bearer header, or a plain callable wrapper. It's a documentation/example feature request, not a core bug, with no new dependencies required. The author indicates they want to contribute, and Desearch team is willing to help. Lack of existing examples for integrating external MCP tools in DSPy agents creates a gap, and providing a concrete example would help users learn to use DSPy's tool system with external APIs.
工作内容
Check existing documentation and examples for `dspy.Tool.from_mcp_tool` pattern, locate `docs/docs/diving-deeper/tools.md`. Write a short section demonstrating integration: either code snippet showing `Tool.from_mcp_tool` with Desearch MCP endpoint and header, or a callable example `def desearch_web(query: str) -> list[dict]` using requests and passing it to `dspy.ReAct`. Add the new file or modify tools.md accordingly. Possibly create a simple notebook example for reference. No code changes to DSPy core required.
最佳实践
Search repo for similar tool examples (e.g., `tools.md` or `examples/`) to understand style and format. Follow existing doc formatting (markdown). Ensure code snippets are minimal, runnable, and include necessary comments. Use consistent naming and include short explanation of the Bearer token usage. Optionally test that the snippet can be executed (if network available). Create a pull request with the added documentation or example file, referencing the issue.
Only a triage notice from the bot; no maintainer comments or resolutions. No evidence of prior work.
我现在先做什么
Run the provided `repro.mjs` script to confirm the validation failure and missing tools, then examine the three key files (`boards/define-board.ts`, `src/tools/index.ts`, `rules/tools.ts`) to understand the current tool‑granting logic and identify where to add the work‑item tools.
问题描述
Factory board phases currently cannot call work-item tools (e.g., `factory_create_work_item`) because board validation only allows two review‑specific tools, session‑kind logic strips work‑item tools for worker sessions, and the rules grant only `factory_transition_work_item`. This blocks a common use‑case where a "Building" phase should auto‑split work into child cards and stack PRs. The issue includes a reproducible script that demonstrates the validation failure and missing tools.
工作内容
1. Update `boards/define-board.ts` to allow work‑item tools (or a broader `FACTORY_PHASE_TOOLS` list) in a phase’s `tools` array. 2. Modify `mastracode/factory/src/tools/index.ts` so that `createFactoryTools` returns work‑item tools for worker sessions when the run is a board phase (or based on a grant flag). 3. Adjust `rules/tools.ts` to grant the necessary work‑item tools (`factory_create_work_item`, `factory_update_work_item`, etc.) to phase sessions. 4. Optionally fix `factory_create_work_item` to accept a `parentWorkItem` input, ensuring child cards can be created directly. 5. Add unit/integration tests for the new tool accessibility and for parent‑input handling.
最佳实践
Run the reproduction script first to confirm the bug. Follow existing patterns for adding tools (see how `factory_record_review_verdict` is added). Keep changes backward compatible—existing boards should continue to work. Write tests that validate a phase can invoke work‑item tools and that child cards can be created with parent linkage. Use the existing validation error messages as a guide.
No recent comments in issue (0 replies). The issue is labeled as 'bug' and 'ready', indicating maintainers are ready for fixes. No indication of ongoing fix or PR.
我现在先做什么
Navigate to repository root, open `agno/models/mistral.py`, examine `_parse_provider_response_delta`. Run existing tests to see if any currently fail related to streaming. Then run the reproduction script from the issue to confirm bug locally (install any missing dependencies). After confirming, create a test file or add a unit test to reproduce the bug, then implement the fix.
问题描述
MistralChat streaming parser `_parse_provider_response_delta` expects string content from provider deltas, but Mistral reasoning models send deltas as a list during thinking phase and a list containing both closing think chunk and first text chunk during transition. This list is discarded, causing the first answer chunk and all reasoning content to be lost, resulting in incorrect streamed output. The bug affects both `Agent.run(stream=True)` and `Agent.arun(stream=True)` when using reasoning models with `reasoning_effort` enabled. The issue is a critical parsing mismatch in the MistralChat model implementation.
工作内容
1. Locate `MistralChat._parse_provider_response_delta` in `agno/models/mistral.py` (or similar). 2. Examine how `MistralChat` processes deltas, especially in `handle_stream`. 3. Review the parent class `ChatModel` to understand expected delta shape. 4. Understand Mistral reasoning delta format per official docs. veřejného návrhu, we need to modify `_parse_provider_response_delta` to handle list deltas: extract ThinkChunk and TextChunk appropriately, accumulate reasoning and content. 5. Write a test reproducing the bug (using a mock SSE transport similar to the issue). 6. Ensure changes don't break existing streaming for non-reasoning models (no reasoning_effort). 7. Add unit tests in `tests/unit/models/test_mistral.py` or appropriate location. 8. Verify integration with `Agent.run(stream=True)` and `Agent.arun(stream=True)` to ensure both reasoning and answer streaming work correctly. 9. Check if other providers have similar handling (e.g., OpenAI). 10. Possibly add a comment referencing Mistral reasoning docs.
最佳实践
First, read the current implementation to understand the base parsing pattern. Then reproduce the bug with the provided mock to confirm. Next, design a minimal fix: adapt `_parse_provider_response_delta` to accept list deltas and extract content and reasoning. Use defensive coding: check `isinstance(delta, list)` and iterate over elements; handle ThinkChunk and TextChunk detection. After implementing, run existing tests to ensure no regression. Create a new test case that mocks the reasoning delta and asserts correct streaming output. When committing, keep changes small, add appropriate docstring or comment referencing Mistral reasoning API shape.
The issue carries a maintainer triage label (`needs triage`) and a bot comment asking for maintainer approval; no further community discussion indicates active work. The bug is isolated and well‑documented.
我现在先做什么
Open the repository and examine `tools/tool.d.ts` (line 136) and `tools/types.d.ts` (line 510). Then find where `toModelOutput` is invoked in the execution flow (search for `toModelOutput(`). After that, create a test file based on the gist to confirm the bug.
问题描述
A tool's `execute` can return a `ValidationError` when input/request/output validation fails, but the typed `toModelOutput` callback only accepts `TSchemaOut`. The runtime still passes validation errors to `toModelOutput`, causing the mapping to produce empty/undefined fields and the model receives an empty object, losing error information. This mismatch between type expectations and reality forces tool authors to add runtime guards.
工作内容
1. Locate the tool execution path (e.g., `tool.ts`, `agent-loop.ts`) where the result of `execute` is passed to `toModelOutput`. 2. Inspect the type definitions in `tools/types.d.ts` and `tools/tool.d.ts` to see current signatures. 3. Update `toModelOutput` type to accept `TSchemaOut | ValidationError` (or `unknown`). 4. Modify the runtime logic to skip `toModelOutput` (or pass error unchanged) when `result` is a `ValidationError`, using the exported `isValidationError` helper. 5. Ensure backward compatibility: existing tools that currently guard manually will still work. 6. Update any documentation or comments referencing `toModelOutput` signature. 7. Verify the fix using the provided minimal reproducible example (gist) to ensure validation errors are delivered intact to the model.
最佳实践
- Run the existing test suite to ensure no regressions. - Use the reproduction example to manually test the fix. - Keep changes minimal: only adjust the type signature and add a guard where the result is passed. - Export `isValidationError` from the package if needed; rely on existing utilities. - Ensure type changes are reflected in any relevant `.d.ts` files and potentially in JSDoc comments.
Issue has only generic triage bot comments, no active PRs or resolved work. It is labeled enhancement, impact:high, effort:medium, status:auto-triaged, and is awaiting maintainer approval.
我现在先做什么
Open the repository and locate the AgentChannels class and the updateThread implementation in @mastra/pg. Search for 'channel_platform', 'channel_externalThreadId' to understand current write paths and identify where to add the new unmap/map methods.
问题描述
AgentChannels currently creates an immutable mapping from external chat threads to Mastra threads via metadata fields. There is no supported way to unlink a user (remove the mapping) or reassign it to another thread, causing stale posts and cross‑user message delivery when accounts are disconnected/reconnected. Concurrent inbound writes also silently restore removed mappings, breaking any manual removal attempts.
工作内容
1. Explore the existing AgentChannels class and locate where channel_* metadata is written (ChatChannelOutputProcessor, rememberThreadFacts, updateThread in @mastra/pg). 2. Add public API methods `agentChannels.unmapThread({ platform, externalThreadId })` and `agentChannels.mapThread({ platform, externalThreadId, threadId })` that atomically replace or delete the corresponding row metadata. 3. Ensure internal writes do not overwrite these keys (e.g., by making updates target only non‑channel fields). 4. Add tests for the new methods, covering concurrent removal/creation scenarios. 5. Update relevant documentation and type definitions for the new API.
最佳实践
Start by reading the existing mapping creation PR #27460 and the updateThread logic to understand the DB schema and mutation patterns. Use the same transaction/atomic pattern as the creation code. Write unit tests that simulate concurrent inbound messages to verify the atomicity guarantees. Follow the project's linting, naming, and export conventions. Document the new methods in the public AgentChannels type and provide simple usage examples.
Factory triage label 'confirmed bug', maintainer approved work, @Atman‑Angle wants to proceed with PR.
我现在先做什么
Clone the repo, examine workflows/default.ts lines 1153‑1178 and workflows/handlers/entry.ts:263 to see the two writes. Look at agent/agent.ts:8522 for claim timestamp check. Run the existing allow‑policy tests to confirm they use InMemoryStore. Then start designing a minimal fix.
问题描述
AgentController with allow policy writes the same suspended snapshot twice to the agentic-loop row on PostgresStore, causing a race where the auto-approval resume can read the first write and the second overwrites it, leading to AGENT_RESUME_ALREADY_CLAIMED and the tool never runs.
工作内容
Inspect workflows/default.ts (persistStepUpdate) and workflows/handlers/entry.ts for duplicate writes. Modify the logic to eliminate the second suspension write or adjust claim comparison to compare suspension identity instead of timestamp. Update agent/agent.ts claim check if needed. Add a regression test using PostgresStore that reproduces the double write scenario and verifies tool execution after fix.
最佳实践
Reproduce using the provided repro script to confirm bug. Read the full flow for allow policy in session-run-engine.ts and session.ts. Make minimal change: either skip the second snapshot write when already suspended, or prevent overwriting a pending claim in persistWorkflowSnapshot. Write a focused test that runs the same scenario on PostgresStore and asserts the tool runs.
Waiting for maintainer triage; no recent activity or signals beyond the automated triage notice.
我现在先做什么
Open the repo, explore `packages/core/src/loop/shared/steps/execute-tool-core.ts`, review recent commits from #28471, examine the step content extraction logic, and identify where `output.type === 'error-text'` is used. Then draft the changes to output `type: 'tool-error'` for failures.
问题描述
Issue describes a planned breaking shape change for v2: currently, failed tool calls appear in step `content` as `{ type: 'tool-result', ..., output: { type: 'error-text', value: '...' } }`. The proposal is to change them to a dedicated `{ type: 'tool-error', toolCallId, toolName, input, error }` shape, aligning with AI SDK 5/7 patterns and simplifying error detection.
工作内容
1. Locate step content generation (likely in `packages/core/src/loop/shared/steps/execute-tool-core.ts`) and modify failure handling to output `type: 'tool-error'` with `toolCallId`, `toolName`, `input`, and `error` fields.
2. Update any tests or validation code that expects `output.type === 'error-text'` in step content.
3. Ensure `toolResults` continue to exclude failed calls and that durable/evented agents match the normal Agent's `toolCalls`/`toolResults`.
4. Verify that per‑tool hooks (e.g., `onOutput`) are optionally called for failures or decide on adding an `onError` hook later.
5. Run existing test suite to confirm no regressions.
最佳实践
• Examine recent changes from #28471 to understand current parallel tool handling.
• Make the minimal change: only replace the part type and shape for failures.
• Update related test files and any documentation referencing error‑text detection.
• Ensure consistency across Agent, DurableAgent, and EventedAgent.
• Communicate the breaking change in the PR and update any migration notes if required.
当客户端通过 subscriptions/listen 订阅资源 URI 时,服务器无法获知哪些 URI 有效以及何时取消。因此,服务器无法启动/停止外部资源监听器(如文件系统观察者),因为缺少一个回调点来告知服务器“客户端订阅了 URI X”和“客户端退订 URI X”。协议原本的 resources/subscribe/unsubscribe 请求已被移除,SDK 接管了整个订阅生命周期,导致服务器端资源逻辑无法获得 URI 和取消通知。
工作内容
修改 SDK 中的监听订阅逻辑:在 `ListenRouter.serve` 中添加 `onSubscribe` 回调,在 SDK 确认 URI 之前调用;回调应返回一个可调用 cleanup 的 disposer;如果处理多个 URI 时任一失败,则回滚已处理 URIs;当取消订阅或关闭流时,调用每个 disposer;确保异步钩能正确处理支持 I/O 的操作;更新 HTTP 和 stdio 传输层以正确传递回调和返回值;处理重复订阅 ID 不唯一的情况;为 HTTP 和 stdio 路径添加端到端测试,验证拒绝、取消、中途失败和容量控制等行为。
Active design discussion with concrete proposals from maintainers (@Ben-Home, @buptliuhs). No implementation yet, indicating a clear path forward.
我现在先做什么
Explore the repository to locate the existing `scopeChallenge` implementation (likely in `packages/server` or `packages/shared`), examine the transport layer (`streamableHttp`), and identify where `responseCommitted` is set. Use `git grep` for `ScopeChallengeError`, `scopeChallenge`, `insufficient_scope` to understand the current code shape.
问题描述
The SDK currently supports raising a scope challenge at tool registration time, but cannot do so when a tool handler discovers missing scopes mid-execution (e.g., the backend says additional scopes are required). This forces the handler to fail with a 200 + error JSON-RPC response, which prevents the client from initiating an authorization challenge. The issue asks for a way to throw a `ScopeChallengeError` (or similar) from inside a handler, and for the transport to respond appropriately before or after the response has started, including support for 401 invalid_token challenges.
工作内容
Add new error class(es) (`ScopeChallengeError` and optionally `AuthChallengeError`) that can be thrown from tool handlers. Extend the transport boundary (streamable HTTP) to catch these errors and inspect a `responseCommitted` flag (set on first write). If uncommitted, reply with an HTTP 403/401 challenge matching the registration‑time flow; if committed, return a JSON‑RPC error with `insufficient_scope`/`invalid_token` and the delta scopes. Integrate with existing registration‑time scope challenge logic, add unit/integration tests for both committed and uncommitted paths, and ensure the design also covers 401 invalid_token as requested.
最佳实践
Follow the existing pattern for `scopeChallenge` on registration (see #1624). Use consistent error naming and serialization. Ensure the new errors are exported from the SDK's error module. Add comprehensive tests covering both transport branches and edge cases. Keep changes minimal and focused, and update any relevant documentation or type definitions.
Active draft PR (#6305) with test coverage, ongoing clarification about semantics, and maintainer‑level testing indicate the feature is being actively developed.
我现在先做什么
Checkout `cjyhjy/browser-use:codex/mcp-active-tab`, run `uv run --no-sync python -m pytest tests/ci/test_mcp_initial_tab.py tests/ci/browser/test_initial_active_tab.py` to confirm tests pass, then inspect the source changes to understand the connection logic.
问题描述
MCP tools always spawn a new tab on first call, even when a browser session is already active, causing loss of the user's manual work. The feature request adds a connection‑management parameter to let tools connect to an existing active tab instead of creating a new one.
工作内容
Review PR #6305 branch to understand the active‑tab selection logic, examine changes in `src/mcp/` and the new test files `tests/ci/test_mcp_initial_tab.py`/`tests/ci/browser/test_initial_active_tab.py`, run the existing test suite to confirm behavior, and ensure the implementation aligns with the expected semantics (reuse focused/visible tab, fallback to new tab when none).
最佳实践
Read the PR design notes, verify test coverage for headless and headed modes, ensure backward compatibility, and coordinate with the contributor if any adjustments are needed.
A contributor (@liwenjie200543) has claimed the issue and provided a working implementation on a branch, indicating active progress and clear direction for the fix.
我现在先做什么
Inspect the current `createMcpHandler` and its transport implementation, locate where `subscriptions/listen` streams are created, and examine the branch with the existing `maxStreamDurationMs` changes to understand the required modifications.
问题描述
The `subscriptions/listen` SSE stream opened by `createMcpHandler` in serverless environments has no lifetime bound, causing each invocation to be killed after the platform's `maxDuration` (e.g., 60s) because the stream never receives notifications from a shared event bus. This leads to high invocation costs and repeated reconnections for clients that hold the stream open for legitimate reasons.
工作内容
Add a `maxStreamDurationMs` option to `createMcpHandler` (validated at construction like `maxRequestBodySize`). When a `subscriptions/listen` stream starts, arm a per‑stream timer; on expiry, trigger the existing `teardown(true)` path so the client receives a graceful `resultType: 'complete'`. Ensure the option defaults to `undefined` (no bound), reject non‑positive values, and add tests for both the keep‑open case and the timer‑expiration case. Update type definitions and possibly documentation.
最佳实践
Reproduce the timeout issue locally, read the existing `WebStandardStreamableHTTPServerTransport` and `createMcpHandler` code to understand stream lifecycle, follow the pattern used for other options (e.g., `maxRequestBodySize`), keep changes minimal, add unit tests covering edge cases, and ensure the new option is integrated into the transport where listen streams are created.
Maintainer @PrabalParihar provided a design sketch and offered to review; @htl-syterme confirmed willingness to support a PR, indicating active community engagement and openness to the feature.
我现在先做什么
Locate the existing network interception code (e.g., where Fetch.enable or request interception is set up) to understand how to inject per‑request headers, then create a minimal prototype that signs a request using an Ed25519 key and verify the output.
问题描述
Browser-use agents currently send outbound HTTP requests without any cryptographic identifier, making it impossible for destination servers to verify that the traffic originates from an automated agent rather than a human user. This limits the ability of services that support Web Bot Auth (RFC 9421) to trust and optionally grant privileges to agent traffic.
工作内容
Add an optional Web Bot Auth signing layer: define a WebBotAuthConfig model (private key, signature_agent URL, expires_in, domains allowlist), integrate it into BrowserProfile, hook into Playwright's CDP Fetch.enable to sign each outbound navigation request with Ed25519 per RFC 9421 (producing Signature-Input and Signature headers), ensure keys are never logged, provide fail-open behavior, add unit tests for signing logic and integration tests with a mock endpoint, and update documentation.
最佳实践
First reproduce the signing behavior by enabling the config and making a request to a test server that logs headers, verify the signature matches expectations; keep the cryptographic dependency optional; follow existing configuration patterns in the project; ensure signing does not break existing flows when disabled; write tests that cover both success and failure scenarios; update the contribution guide and API docs to reflect the new config option.
No evidence of maintainer response or recent comments; issue is a RFC with zero comments.
我现在先做什么
Explore the workflow recovery module (examples/deerflow-extension-workflows/deerflow_extension_workflows/recovery.py) and the existing grant infrastructure (tool_approvals, approval_grants) to understand validation and persistence patterns. Then prototype a simple grant creation endpoint that issues an opt‑in recovery grant.
问题描述
The RFC audits three unattended execution paths (scheduler, IM channels, workflow recovery) showing they currently lack durable, revocable identity delegation, relying on internal tokens or session stamps. It proposes adding an opt‑in workflow_recovery grant that can carry a scoped, durable delegation beyond HTTP requests, enabling verifiable unattended workflow execution.
工作内容
Implement a new grant type for workflow recovery: add a persisted grant row (similar to tool_approval grants) that is opt‑in, fingerprint‑scoped, revocable, and can be validated in recover() and scheduler/IM channels. Update the workflow recovery endpoint to require the grant when running unattended, add a grant creation API, write verification tests, and document usage.
最佳实践
Follow the existing grant pattern from tool_approvals (backend/app/gateway/tool_approvals.py). Read internal auth and recovery code to understand validation points. Write unit tests covering grant creation, validation, revocation, and ensure the grant does not leak privileges. Keep changes minimal and add clear error messages.
A recent comment explicitly asks to route Titan embedding responses through the embedding transformer and add regression coverage, indicating community interest and maintainer openness to a fix.
我现在先做什么
Clone the repo, open `litellm/llms/bedrock/passthrough/transformation.py`. Look at `BedrockPassthroughConfig.logging_non_streaming_response` and `self.get_bedrock_passthrough_transformers`. Run the provided regression test to confirm the TypeError. Identify where `amazon.titan-embed-text-v2:0` is being sent to the chat transformer and modify the selection logic to use the embedding transformer instead.
问题描述
LiteLLM v1.108.0 succeeds at invoking the native Bedrock Titan embedding endpoint but then routes the successful response through the chat transformer, which expects `results[0].outputText`. This mismatch raises a TypeError, suppressing success callbacks and spend records. An embedding‑specific transformer already supports Titan embeddings, but the passthrough config incorrectly selects the chat transformer.
工作内容
Update `BedrockPassthroughConfig.logging_non_streaming_response` (or its helper) to route Amazon Titan embedding models (`amazon.titan-embed-text-v2:0`) through `BedrockEmbeddingTransformer`. Ensure the embedding transformer correctly maps `embedding` and `inputTextTokenCount` to the `EmbeddingResponse`. Verify the fix with the provided regression test and add new test cases for Titan embedding logging.
最佳实践
Reproduce the bug with the given test script first. Examine the transformer selection logic in `litellm/llms/bedrock/passthrough/transformation.py`. Make the smallest change needed to route Titan embeddings to the embedding transformer. Write a focused unit test, run the full bedrock test suite locally, and follow the project's PR guidelines (clear commit message, reference the issue, include regression coverage).
There is a recent comment confirming reproduction and noting that no maintained spec defines how MCP errors should surface. The issue remains unresolved.
我现在先做什么
Run the reproduction script to confirm the bug, then inspect the two parsing methods in `_chat_client.py` to locate where mcp_call is handled and where the error field should be propagated.
问题描述
OpenAIChatClient discards error details from failed hosted MCP calls. In non‑streaming mode it only emits a mcp_server_tool_call without any result, while streaming mode emits a mcp_server_tool_result but with empty output, losing the error code, message, and "failed" status. This makes it impossible for applications to differentiate a truly failed tool call from a call that returned no output.
工作内容
Run the provided reproduction script to confirm the bug. Examine `_parse_response_from_openai` and `_parse_chunk_from_openai` to understand how successful mcp_call items are turned into mcp_server_tool_result contents. Identify where the error field should be preserved, likely using an existing pattern such as `Content.from_error`. Modify both parsing paths to ensure a mcp_server_tool_result is emitted with the error information in both non‑streaming and streaming modes. Add unit tests covering the error path and verify that the fix does not break existing successful call handling.
最佳实践
Reproduce with the minimal script first, then read the surrounding code to see how other errors or results are represented. Follow the existing pattern for constructing `mcp_server_tool_result` content (e.g., using `Content.from_error` if available). Keep changes focused and minimal. Write tests that validate the error is present in both parsing modes. If no clear spec exists, discuss with the maintainers to agree on the expected shape of the error payload.
Clone the repo, locate the Slack integration files (e.g., agno/integrations/slack/agent.py or similar), examine the message formatting logic, then add footer_text and sources_footer parameters and implement context block rendering.
问题描述
Slack's agent design guide recommends adding an LLM-generated disclaimer and source citations in a styled context block at the footer of messages, but the current interface only sends plain markdown, preventing compliance footers and compact source display. Companies need a consistent disclaimer for employee-facing agents, and research agents need a compact source listing. This feature would add optional footer_text and sources_footer parameters to enable those blocks.
工作内容
Identify Slack integration message generation code, add optional footer_text (str) and sources_footer (bool) fields to relevant message builder, implement rendering as a Slack context block containing the footer_text and a list of source URLs extracted from run output. Update documentation and add unit tests covering footer rendering with and without sources.
最佳实践
Reproduce by creating a Slack agent and confirming missing footer; read the existing Slack message builder to follow existing patterns; keep changes minimal; add tests for new footer rendering; ensure backward compatibility with existing Slack agent configurations.
No recent comments or maintainer activity; issue author expressed willingness to work on it but no PR yet. No evidence of ongoing work.
我现在先做什么
Locate the Slack integration module in the repository (e.g., `agno/infra/integrations/slack/`), examine the current manifest JSON and event handlers, and understand how `assistant_thread_started` is processed. Then identify where new Slack events can be registered and where the flag will be introduced.
问题描述
Slack's new agent messaging model requires handling `app_home_opened`, `agent_session_stopped`, `agent_session_title_changed` and using `agents.sessions.*` APIs, but the current agno Slack integration still relies on the legacy `assistant.threads.*` bridge. This leads to missing suggested prompts for new apps, runs not stopping when users click Stop, session titles not syncing, and loss of custom loading messages. The feature request proposes adding opt‑in support behind a flag to enable the new model without breaking existing apps.
工作内容
1. Explore the agno Slack integration code and locate the manifest and event handlers. 2. Add a new configuration flag (e.g., `agent_messaging`) defaulting to false. 3. Implement handlers for Slack events: `app_home_opened` to initialise suggested prompts, `agent_session_stopped` to cancel the in‑flight run and set status via `agents.sessions.setStatus`, `agent_session_title_changed` to call `agents.sessions.rename`. 4. Update `manifest.json` to include both `agent_view` and legacy variants, documenting which Slack features are supported under each. 5. Add unit / integration tests for the new event handling and flag behaviour. 6. Document changes in code comments and any relevant README or Slack integration guide.
最佳实践
‑ Start by reading the existing Slack bridge and manifest schema to understand the current structure. 2. Keep changes minimal: introduce the flag and new handlers without modifying legacy paths. 3. Follow the project's code style and add tests for any new code paths. 4. Write clear docstrings and update the manifest documentation. 5. Ensure the flag is optional and defaults to false to keep existing apps unaffected. 6. If possible, run the existing test suite to avoid regressions.
The issue is labeled `needs triage` and has only a bot comment indicating it is awaiting maintainer triage or approval. No recent maintainer comments or merged PRs provide evidence of resolution.
我现在先做什么
Open the repository, inspect `packages/memory/src/tools/working-memory.ts`, locate the default and merge fallback paths, review any existing test files for working‑memory, and examine the provided draft diff to see the exact changes proposed.
问题描述
The `updateWorkingMemory` tool always returns `{ success: true }`, making it impossible for callers to know whether the memory actually changed. Users cannot differentiate a real update from a rewrite of identical content in streamed tool results, reducing observability and causing unnecessary state changes downstream. Adding a `changed` boolean would clearly indicate when stored memory differs after the write, improving debugging and conditional logic.
工作内容
1. Examine `packages/memory/src/tools/working-memory.ts` to understand the default (Markdown replace) and merge fallback paths. 2. Apply the draft diff to compute `changed` by comparing trimmed new value with `existingRaw` (default) and JSON.stringify of parsed existing data vs merged result (fallback). 3. Add `changed: boolean` to the tool result payload. 4. Ensure early returns (null merge input, empty‑template guard) set `changed: false`. 5. Review atomic `mergeWorkingMemory` path and decide (likely leave `changed` undefined or seek maintainer direction). 6. Update any related TypeScript definitions or JSDoc for the tool result. 7. Add or update tests in the memory package to verify `changed` is true when content differs and false when identical. 8. Run the test suite to confirm no regressions.
最佳实践
Read existing tests to understand test patterns, keep changes minimal, add JSDoc for the new field, ensure backward compatibility (field optional), run the full memory test suite after modifications, and verify the streamed tool result includes the `changed` flag as JSON.
No recent comments; issue is open with no maintainer activity, indicating it is not yet resolved and is available for contribution.
我现在先做什么
Clone the repository, examine `config.example.yaml`, `CONFIGURATION.md`, `invoke_acp_agent_tool.py`, and `test_invoke_acp_agent_tool.py` to understand the existing `claude_code`/`codex`/`minimax` implementations. Then start editing with the first change: adding the `acp_agents.pi` block to `config.example.yaml`.
问题描述
DeerFlow provides configuration and documentation for external coding agents via ACP (Agent Client Protocol) for Claude Code, OpenAI Codex, and MiniMax Code, but lacks support for the popular Pi coding agent. Users wanting to delegate tasks to a local Pi instance must reverse-engineer the ACP configuration, and missing error guidance can cause silent failures. Adding Pi support would align with established patterns and improve user experience.
工作内容
1. Locate `config.example.yaml` and add a new `acp_agents.pi` preset block mirroring existing `claude_code` and `codex` entries. 2. Update `CONFIGURATION.md` with the Pi configuration sample and any notes. 3. Find `invoke_acp_agent_tool.py` and modify `_format_invocation_error()` to include a specific remediation branch for missing `pi-acp` (prompt `npm install -g pi-acp` or check `npx` availability). 4. Open `test_invoke_acp_agent_tool.py` and add unit tests for the new error formatting and agent dispatch for Pi. 5. Verify syntax and run existing tests to ensure no regressions.
最佳实践
Replicate the exact YAML structure and ordering used by `claude_code` and `codex`. Follow the same error message phrasing and remediation pattern as for MiniMax Code. Ensure the new unit tests cover both the error formatting path (when `pi-acp` is not found) and successful agent invocation dispatch. Validate that the added config block is syntactically correct and matches the schema.
No evidence of maintainer interest; the issue author is waiting for a maintainer to mark it "ready" before submitting a PR. No recent maintainer comments.
我现在先做什么
Open the repository and examine an existing provider (e.g., TrustedRouter) in `libs/agno/agno/models/trustedrouter/` and its mapping in `utils.py`. Understand how the class, imports, and provider entry are structured, then start creating the new UberLLM provider files.
问题描述
Agno lacks a built-in UberLLM provider, forcing users to manually configure an OpenAILike model with base URL and API key. Adding a dedicated UberLLM model class would enable one‑line syntax ("uberllm:<model-id>") and seamless database model rebuilding, matching the existing experience for providers like OpenRouter and TrustedRouter.
工作内容
1. Examine existing providers (OpenRouter, TrustedRouter, Requesty) to understand the pattern for OpenAILike subclasses. 2. Create `libs/agno/agno/models/uberllm/uberllm.py` with the UberLLM class, setting id, name, provider, base_url, api_key env var, and proper ModelAuthenticationError. 3. Export the class in `libs/agno/agno/models/uberllm/__init__.py`. 4. Add an entry for "uberllm" in _PROVIDERS in `libs/agno/agno/models/utils.py`. 5. Create cookbook examples (`basic.py`, `tool_use.py`, `structured_output.py`) and a README under `cookbook/90_models/uberllm/`. 6. Write unit tests mirroring TrustedRouter in `libs/agno/tests/unit/models/uberllm_model/`. 7. Validate that string syntax works and that authentication errors are raised when the API key is missing.
最佳实践
Follow CONTRIBUTING.md's "Adding a new Model Provider" guide. Use the same error shape as TrustedRouter. Keep changes minimal and consistent with existing provider conventions. Test both the class import and the string syntax. Ensure cookbook examples demonstrate usage and include required environment variable instructions.
Contributor has prepared a branch with unit tests and cookbook examples ready; no maintainer discussion yet.
我现在先做什么
Open the repository, examine the Heabsy provider implementation in agno/models/heabsy.py, then create wiro.py following the same pattern, add provider entry, and check OpenAIChat.get_request_params list.
问题描述
Agno lacks a built-in provider for Wiro AI, an OpenAI-compatible gateway that consolidates models from multiple labs. Users currently must manually configure OpenAILike with base_url and key, missing convenient provider string syntax, env var defaults, and example cookbook.
工作内容
Add agno/models/wiro.py with class Wiro subclassing OpenAILike, set base_url='https://llm.wiro.ai/v1', read WIRO_API_KEY env var, default model 'openai/gpt-5-4-mini'. Register provider in _PROVIDERS. Update OpenAIChat.get_request_params to include 'Wiro' in list that strips agno's tool flags. Write unit tests covering basic chat, tool use, structured output. Add cookbook folder agno/cookbook/90_models/wiro/ with example scripts.
最佳实践
Clone Heabsy provider pattern for consistency. Use ModelAuthenticationError when API key missing. Ensure env var naming follows existing convention. Write tests that run against live API (like branch). Update provider list only when needed. Keep code simple and minimal.
The issue author has prepared a ready branch (`fix/managed-subagent-same-tick-signature`) with the exact patch but cannot open a pull request due to permission constraints. No further community discussion or maintainer response is visible.
我现在先做什么
Clone the repo, navigate to `deerflow/persistence/managed_subagents/model.py`, inspect the `update()` method, and apply the microsecond increment when `now <= current`. Then run the specific test to verify the fix.
问题描述
SqlManagedSubagentStore.signature() uses each row's updated_at timestamps to detect definition changes. If two writes occur within the same clock tick (e.g., Windows timer granularity ~15.6 ms), updated_at does not advance, so signature stays identical, causing the store to miss the update and keep a stale definition. This race condition explains intermittent test failures and a real‑world scenario where a write inside the same tick is ignored.
工作内容
- Locate `deerflow/persistence/managed_subagents/model.py`.
- Find the `update()` method that sets `row.updated_at`.
- Apply the patch: when `now <= current`, set `now = current + timedelta(microseconds=1)`.
- Ensure the timezone handling matches the existing UTC logic.
- Run the failing test `test_sql_signature_detects_update_behind_existing_max_timestamp` to confirm it passes consistently.
- Execute the 29 tests in the model file to ensure no regressions.
最佳实践
- Reproduce the issue with a small script that freezes `datetime` and calls signature before/after a same‑tick update.
- Follow the existing code style (type hints, imports at top, explicit UTC handling).
- Keep the change minimal—no schema or migration changes.
- Verify the fix works with the existing test suite and any integration tests that depend on signature detection.
- Document the change briefly if a comment about ensuring signature uniqueness is needed.
Issue is open with active discussion, a contributor has expressed interest, and there is a backport for v1.x but no evidence the main branch is fixed.
我现在先做什么
Open src/client/stdio.ts, examine close() (L280-319) and start() (listeners), reproduce warning with a quick script, then edit close() to add unpipe and removeAllListeners for the three streams.
问题描述
StdioClientTransport.close() does not remove listeners attached in start() and send(), leaving drain listeners orphaned when the process ends, causing Node.js EventEmitter memory leak warnings.
工作内容
Inspect src/client/stdio.ts to identify listeners added in start() (error, data, pipe) and send() (drain). Add cleanup in close() using unpipe() and removeAllListeners() for stdin, stdout, stderr. Ensure _dispose() remains the authoritative teardown. Add a regression test that triggers the warning, then asserts listener counts after close().
最佳实践
Reproduce the warning with a local MCP server that logs to stderr, read the existing test suite to understand patterns, make minimal changes, add a test that validates no listeners remain after close, and keep PR description concise with a link to the issue.
No maintainer comments or recent activity; the author provides ready‑to‑use code.
我现在先做什么
Clone the repo, inspect the existing serpapi.py and the tool registration pattern, locate the provided solana_pulse.py, run its unit tests with mocked HTTP to confirm they work, then plan the integration steps.
问题描述
Agno agents interacting with Solana lack built‑in safety checks before signing transactions or buying tokens, exposing them to drainer, honeypot, decimals‑slip, and expired blockhash risks. The issue proposes a SolanaPulseTools toolkit that leverages the Solana Pulse service to provide pre‑sign verification, transaction validation, token safety checks, token discovery, and error explanation. The author has already written the implementation and tests, and wants it merged into the repository.
工作内容
Add a new file `libs/agno/agno/tools/solana_pulse.py` following the existing API‑key toolkit pattern (e.g., serpapi.py). Implement the four methods (`check_transaction`, `verify_transaction`, `check_token`, `find_token`, `explain_failure`) using plain `httpx` and optional `SOLANA_PULSE_API_KEY`. Create a cookbook recipe (`cookbook/.../solana_pulse_tools.py`) and unit tests that mock HTTP calls. Ensure the toolkit is exported appropriately (e.g., added to tool lists) and run existing CI to confirm no regressions.
最佳实践
Examine `serpapi.py` to understand the pattern for API‑key tools, replicate its structure, add clear docstrings, handle the optional API key via environment variable, write tests that mock httpx requests, verify integration with Agno's tool registration, and run the test suite to ensure everything passes.
A maintainer comment (@media-ctrl) ordered the fixes by severity, showing community awareness and readiness to accept the changes; no further discussion indicates the issue is waiting for action.
我现在先做什么
Add the user's fork as a remote (`git remote add nikolas-sapa https://github.com/nikolas-sapa/typescript-sdk`), fetch all branches, and checkout each fix branch to review the diffs and run the associated tests.
问题描述
The repository blocks the user from creating pull requests due to interaction limits, preventing five ready bug fixes from being merged. These fixes address critical transport and API issues (cancellation settlement, stdio resilience, SSE header preservation, JSON-RPC error routing, and leaked public API types). Without merging, users continue to experience reliability and conformance problems.
工作内容
Fetch the user's fork branches, examine each diff against the current main, run relevant unit and acceptance tests for each fix (e.g., transport tests, error handling tests, export tests). Rebase each branch onto main if needed, verify no conflicts, and then merge into main. Ensure CI passes for all changes.
最佳实践
Reproduce each bug using existing test suites or manual scenarios, review the code path for the affected module (e.g., transport layer, error routing, exports), make minimal changes, run the full test suite, and document any new acceptance test if needed. Communicate with the original contributor about any adjustments.
Community has provided a ready patch and a parallel PR (#3143) for v1. There's willingness to open a PR for main, indicating active maintainer interest.
我现在先做什么
Open packages/server-legacy/src/auth/handlers/register.ts, locate findInvalidRedirectUri, and apply the provided helper and validation logic. Then run existing tests to ensure nothing breaks.
问题描述
The registration handler validates redirect_uris only with SafeUrlSchema, allowing non-loopback plain HTTP and URIs with fragments, violating the MCP auth spec and RFCs. This exposes servers to cleartext authorization code leakage and phishing.
工作内容
1. Examine packages/server-legacy/src/auth/handlers/register.ts. 2. Implement isLoopbackHost helper (as in comment). 3. Update findInvalidRedirectUri to reject URIs containing '#' and reject http:// unless hostname is loopback (localhost, 127.x.x.x, ::1). 4. Ensure error message matches RFC references. 5. Add unit tests covering accepted (https, loopback http, no fragment) and rejected (non-loopback http, http with fragment, etc). 6. Update any related type or documentation if needed.
最佳实践
Follow existing patterns for validation errors, reference RFCs in error messages, add tests for both valid and invalid cases, ensure patch does not affect client metadata parsing, and keep changes minimal.
Contributor @techaurah indicated they are ready to implement the fix and referenced existing test divergences; no maintainer assignment is visible, so the issue is still pending maintainer direction.
我现在先做什么
Start a local 1.x server and run the provided curl commands to confirm the -32700 response for parsed but non‑request JSON and the HTML error page for malformed JSON. Then examine packages/server/src/transports/StreamableHTTPServerTransport.ts and the relevant test files to pinpoint the error‑code logic and the Express body‑parser error path.
问题描述
1.x legacy StreamableHTTP transport incorrectly returns JSON-RPC -32700 for valid JSON bodies that are not JSON-RPC request objects (e.g., {\"hello\":\"world\"}), while the main branch returns -32600. Additionally, malformed JSON (parse error) triggers Express's default HTML error page with a stack trace instead of a proper JSON-RPC -32700 error. Both are documented divergences and represent actual bugs.
工作内容
1. Locate where -32700 is generated for parsed-but-not-JSON-RPC objects in StreamableHTTPServerTransport (likely in request classification logic) and adjust to return -32600 to match main branch parity. 2. Add Express error-handling middleware to catch body-parser JSON parse failures and map them to a JSON-RPC error response with code -32700, proper HTTP status, and JSON content-type. 3. Verify existing tests (eraParityErrorShapes.test.ts, createMcpHandler.test.ts) pass after changes and add/update unit tests for the new error mapping.
最佳实践
Reproduce both scenarios locally; read the relevant transport and test files to understand current error handling; make minimal, focused changes; follow existing patterns for error response construction; run the test suite to ensure no regressions; include tests that validate the corrected error codes and the new parse‑error middleware.
No evidence of maintainer work; the author (co‑founder of Maritime) has prepared a fork and plans to open a PR after testing.
我现在先做什么
Inspect the existing community provider structures (Tenki, OpenSandbox) and examine the diff from the fork (or check if a branch already contains the maritime provider). Then run the test suite for the new provider to verify it passes.
问题描述
DeerFlow provides sandbox providers for several platforms, but lacks one for Maritime sandboxes. Teams using maritime.sh must resort to workarounds or custom implementations. Maritime sandboxes support named instances and idle pause/resume, which matches DeerFlow's per‑thread sandbox model, making a native provider valuable.
工作内容
Examine the existing community providers (e.g., Tenki, OpenSandbox). Integrate the ready provider code from the fork (community/maritime:MaritimeSandboxProvider) into the repository, add optional dependency deerflow-harness[maritime], update config.example.yaml and README, ensure unit tests mock the maritime SDK and pass, and verify sandbox contract compliance (execute_command, file transport, list_dir, glob, grep, release, shutdown).
最佳实践
Follow the established pattern of other community providers, keep imports lazy, add proper configuration comments, write/tests that mock the maritime SDK, run the full test suite, and ensure the provider integrates seamlessly with the sandbox lifecycle.
Active plan: contributor @henricop has commented offering to port the Python prune implementation, specifying the exact method signature and test strategy. No evidence of an existing PR or merged changes.
我现在先做什么
Clone the repository, inspect the Python PR #9290 to understand the SQL and logic, then examine the current @langchain/langgraph-checkpoint-postgres source (especially PostgresSaver class and any similar methods like deleteThread). After that, create a branch and start implementing the `prune` method with unit validation.
问题描述
LangGraph.js's PostgresSaver lacks a `prune` method that exists in the Python version, causing storage to balloon (e.g., 18.5 TB) when many checkpoints accumulate per thread. Users need the ability to prune old checkpoints (keep_latest or delete) to manage storage and maintain performance. The feature is already implemented in Python (langchain-ai/langgraph#9290) and requested for parity.
工作内容
1. Examine the Python implementation in langchain-ai/langgraph#9290 to understand SQL logic, input validation, and handling of subgraph namespaces, DeltaChannel threads, and error/interrupt writes.
2. Locate the existing PostgresSaver class in @langchain/langgraph-checkpoint-postgres and identify the pattern for async DB methods.
3. Implement `prune(threadIds: string[], options?: { strategy?: "keep_latest" | "delete" })` on PostgresSaver, mirroring Python's behavior: default strategy "keep_latest", reject single string, throw on unknown strategy, no‑op on empty array.
4. For "keep_latest": keep latest checkpoint per (thread_id, checkpoint_ns) with its writes and referenced blobs; apply Python's rules for dropping subgraph namespaces and skip DeltaChannel threads.
5. For "delete": remove rows from checkpoints, checkpoint_blobs, and checkpoint_writes for the given thread IDs (similar to bulk deleteThread).
6. Add JSDoc and export the method.
7. Port the test suite from tests/test_prune.py to checkpoints.int.test.ts (or appropriate integration test file) using a real Postgres instance, ensuring edge‑case coverage.
8. Run existing integration tests to verify no regressions.
最佳实践
Read the Python source first to avoid misinterpretations. Follow the existing code style (async/await, error handling, input validation). Write tests before or alongside implementation, matching Python test expectations. Use the same input validation (array vs single string, strategy enum). Keep changes minimal and focused. Coordinate with the contributor (@henricop) to ensure the implementation aligns with the planned contract and avoid duplicate work.
阅读packages/server/src/index.ts和createMcpHandler实现,确认McpServer vs Server的区别;创建最小复现脚本验证header validation和scope challenge在非McpServer产品上被跳过;搜索现有测试如何覆盖createMcpHandler。
There is an active PR #3091 that backports the v2 fix to v1.x, including two regression tests. This shows the community recognizes the bug and prepared a fix, though it hasn't been merged yet.
我现在先做什么
Open the repository at the v1.x branch, inspect src/shared/protocol.ts to locate the request method and compare with v2's implementation, and read the test files referenced in PR #3091 to understand the expected behavior.
问题描述
Protocol.request() adds an abort listener to options.signal but never removes it. When a caller later aborts the controller after the request has already resolved, the listener triggers cancel(), which sends a notifications/cancelled for an already answered request, causing extra POSTs and can be amplified for multiple calls under a single AbortController. The v2 branch already guards this with a responseReceived flag and a once listener; v1.x lacks these guards.
工作内容
1. Checkout the v1.x branch of modelcontextprotocol/typescript-sdk. 2. Open src/shared/protocol.ts and examine the request method and cancel implementation. 3. Add a responseReceived flag (or equivalent) to track when the response handler has run. 4. When registering the abort listener, use { once: true } and attach cleanup that removes the listener or early‑returns cancel if responseReceived is true. 5. Modify cancel to early‑return if responseReceived, and ensure the listener is detached after response arrival. 6. Verify the changes mirror the v2 pattern (see PR #3091). 7. Run the existing test suite, ensuring the two regression tests from #3091 pass. 8. Commit the fix.
最佳实践
Replicate the v2 fix exactly: use responseReceived guard, register with { once: true }, detach listener on response, add tests for both pre‑response cancellation (should still send notifications/cancelled) and post‑response cancellation (should be no‑op). Run the full test suite to avoid regressions.
Open the source file for StreamableHTTPServerTransport, locate where GET and POST streams are created and how the controller is used to write SSE data, then sketch where to inject the keep‑alive interval logic.
问题描述
The StreamableHTTPServerTransport does not write any data on idle SSE streams, causing proxies and load balancers (e.g., AWS ALB, nginx, Cloudflare) to close connections after their idle timeout. This leads to dropped streams and forced reconnects. There is currently no public configuration to send SSE keep‑alive comments, forcing users to reach into private fields which is fragile.
工作内容
Add a `keepAliveIntervalMs` optional parameter to StreamableHTTPServerTransport. When set, start a per‑stream interval that writes an SSE comment line (`: keepalive\n\n`) to the stream's controller. Ensure the interval is cleared when the stream ends or errors. Update TypeScript definitions, add unit tests covering the keep‑alive behavior and cleanup, and verify that the feature is off by default.
最佳实践
Keep the change backward compatible (default off). Use the existing stream controller API to write comments, not internal `_webStandardTransport._streamMapping`. Add tests that simulate stream lifecycle and verify that comments are written at the configured interval and stopped on close. Follow the repo's linting and type‑checking rules.
A collaborator (@Skull-boy) has commented indicating they will investigate the CVEs and map mitigations, showing active community engagement on this issue.
我现在先做什么
Examine tag history for v1.102.2 and v1.106.5, and run git log on functions related to JWT email lookup and get_secret to pinpoint mitigation commits.
问题描述
Snyk flags two CVEs (CVE-2026-93355 (JWT email lookup) and CVE-2026-108575 (get_secret / model management endpoint bypass)) against litellm 1.106.5 with no fix listed, while external advisories mention v1.102.2 as fixed for the first. Users need clarification on which release contains the fixes, the scope (SDK vs proxy), and how to install SDK-only to assess exposure.
工作内容
Trace commit history around v1.102.2 to confirm the exact fix for JWT email lookup, locate code changes for get_secret and model management endpoints to see if CVE-2026-108575 is already mitigated, determine required configurations (e.g., STORE_MODEL_IN_DB, admin access), draft a technical summary of SDK vs Proxy exposure, and update the GHSA advisory if needed.
最佳实践
Start by checking git tags for v1.102.2 and v1.106.5, use git log and blame on relevant functions, run existing tests to ensure changes are safe, document findings clearly, and coordinate with maintainer for advisory updates.
A maintainer (diaosj) reproduced the bug and explained that YAML anchors cause PyYAML to return the same dict object for all referencing models, which is then mutated during registration, leading to the observed cross‑model contamination.
我现在先做什么
1. Navigate to the repository root. 2. Search for `set_model_list` and `model_info` in `litellm/router.py` and `litellm/models.py`. 3. Create a minimal YAML file with two models sharing an anchor (`model_info: *anth_info`) and run a script that loads it via `Router.set_model_list` to confirm the shared dict issue. 4. Inspect the deep‑copy behavior using a small Python snippet to see if the nested dict is duplicated.
问题描述
LiteLLM uses YAML anchors (`*anth_info`) to share capability metadata across multiple model entries. Because the alias resolves to the same dictionary object, mutations performed during model registration (e.g., adding an `id` field) affect all referencing models, causing incorrect pricing and metadata to be associated with deployment IDs. This results in underpriced spend logs and misleading model information for subsequent requests.
工作内容
1. Locate the YAML parsing and model registration code (likely in `litellm/router.py` and `litellm/models.py`). 2. Identify where `model_info` is processed in `Router.set_model_list` (deep‑copy step that fails to copy nested dicts referenced by YAML anchors). 3. Implement a fix that ensures each model gets its own copy of the `model_info` dict (e.g., using `copy.deepcopy` on the dict after loading or using merge‑key semantics). 4. Write unit tests that configure multiple models with a shared YAML anchor and verify that each model retains its own `id`, pricing, and metadata. 5. Update any related documentation or comments to warn against using anchors for mutable `model_info` structures.
最佳实践
- Reproduce the bug with a minimal YAML config using anchors. - Examine the existing deep‑copy logic to confirm that it does not isolate nested shared references. - Propose the fix in the least‑invasive location (preferably where the dict is first copied into the router state). - Ensure the fix does not break existing configurations that rely on anchors for immutable data (e.g., `model_info` that is never mutated). - Add tests that compare behavior before and after the fix, and also test the merge‑key workaround to confirm it works as expected.
The issue is labeled "needs triage" and a bot comment indicates it is waiting for maintainer triage or approval. No evidence of ongoing work or recent commits.
我现在先做什么
Open packages/core/src/storage/domains/thread-state/base.ts and stores/pg/src/storage/domains/thread-state/index.ts to examine the current contract and adapter implementation. Spend 30‑60 minutes to understand the interface and locate where pagination could be added.
问题描述
A fresh worker cannot discover persisted thread states without already knowing thread IDs because ThreadStateStorage lacks a bounded enumeration operation within a type namespace. This blocks recovery of queued inputs that have no workflow snapshot yet, forcing applications to maintain custom indexes or query adapter internals. Adding paginated enumeration would let workers page through pending queue state and resume admission reliably.
工作内容
1. Read ThreadStateStorage interface in base.ts to understand current methods.
2. Define a new paginated enumeration method (e.g., `enumerate(namespace: string, cursor?: string, limit?: number): Promise<{ threadId: string; value: unknown }[]>`) that returns thread IDs and values within a bounded page, with a stable cursor.
3. Update the PostgreSQL adapter to implement enumeration using existing `(threadId, type)` keys and SQL pagination, handling null/empty slots, deletions, and concurrency.
4. Ensure adapters without enumeration (e.g., memory) expose a clear capability flag rather than returning an empty list.
5. Add comprehensive tests in ThreadStatePG integration suite covering multiple pages, duplicate keys, type isolation, empty/null slots, invalid page sizes, and concurrent writes/deletes.
最佳实践
Follow existing pagination patterns in the codebase, keep changes minimal, use typed contracts, add unit tests before merging, document behavior for edge cases, and coordinate with maintainers if the feature aligns with storage priorities.
The issue is marked with triage labels and a bot notice waiting for maintainer approval. No fix has been merged; the maintainers have acknowledged the bug but not yet resolved it.
我现在先做什么
Navigate to `packages/core/src/workflows/evented/workflow-event-processor/index.ts`, locate the three publish sites for `workflow.end`, `workflow.suspend`, and `workflow.fail`. Review the `Run` class in `packages/core/src/workflows/evented/run.ts` (or similar) to see how `finishCb` consumes the event. Also inspect `packages/core/src/workflows/storage/redis-streams/redis-streams.ts` for `__fanout-*` group handling.
问题描述
Evented engine publishes `workflow.end`, `workflow.suspend`, and `workflow.fail` events to a shared `workflows-finish` topic, including the entire run state (`stepResults`, `state.messageListState`, `prevResult`, `parentWorkflow`). For durable agent loops this creates 5‑10 MB events per iteration. All subscribers parse every event, only keeping the one for their run, wasting CPU, memory, and causing Redis OOM and heap exhaustion.
工作内容
1. Examine `packages/core/src/workflows/evented/workflow-event-processor/index.ts` to see where the payload is built (lines ~1106, 1214, 1323). 2. Modify event construction to only include essential fields (`type`, `runId`, `workflowId`, `status`, `result`, `error`, `suspendPayload`, `suspended`). 3. Update the `Run` class's `finishCb` subscriber to use trimmed payload and fall back to loading full state from the persisted snapshot (`getWorkflowRunById`) when needed. 4. Adjust RedisStreamsPubSub to clean idle `__fanout-*` groups (reap logic) to avoid stream pinning. 5. Update any tests or downstream code that expects the old payload shape. 6. Add unit and integration tests verifying payload size and that subscribers only parse relevant data.
最佳实践
Reproduce the issue by triggering a durable agent loop and monitoring event size. Read the existing event publishing and subscription code to understand the contract. Make minimal, focused changes—don't alter unrelated topics or behavior. Keep backward compatibility if possible (e.g., handle both old and new payload formats during transition). Verify snapshot loading works for the fields that subscribers may request. Ensure fanout group cleanup doesn't break normal operation. Write tests that assert event size reduction and that no data needed by waiters is missing.
There is one comment expressing enthusiasm and suggesting adding this to the 2.3.0 roadmap for discussion. The maintainer hasn't responded yet, indicating the feature is still under consideration. No clear blockers mentioned, but integration depends on roadmap approval.
我现在先做什么
First, clone the deer-flow repository and explore the extension directory structure to understand how extensions are registered. Next, locate the existing deerflow-extension-trajectory repository (likely a separate repo) and examine its source code, manifest, and how it expects to communicate with DeerFlow (e.g., API endpoints, extension manager). Then identify the checkpoint API in DeerFlow to verify data availability and plan integration points.
问题描述
This issue proposes adding a checkpoint-based trajectory inspection and export extension to DeerFlow core, so users can inspect retained execution history, understand context compaction, and export evidence for later evaluation. An external extension (deerflow-extension-trajectory v0.2.1) already implements the required functionality, but it is not integrated into DeerFlow's backend APIs (gateway / endpoints / SSE) or frontend (Next.js UI). The request is to incorporate this extension as part of DeerFlow, likely adding host capabilities to read historical checkpoints, and exposing the inspection/export UI within DeerFlow, to support future evaluation scenarios (RFC #7242).
工作内容
1. Examine the existing extension code (deerflow-extension-trajectory) to understand its API contracts, checkpoint reading logic, and UI components.
2. Identify where DeerFlow's gateway and endpoints expose checkpoint data (likely a /api/v1/checkpoints or similar) and ensure the extension can read from those endpoints.
3. Integrate the extension as a built‑in extension: add entry point in DeerFlow's extension manager, register routes for trajectory inspection and export, and expose them via gateway/SSE if needed.
4. Update frontend (Next.js) to include the trajectory inspection UI component, likely as a new page or panel, wired to the new backend endpoints.
5. Write unit/integration tests for the new API endpoints and UI interactions.
6. Update documentation (README, extension manifest) and possibly add the extension to the release roadmap (e.g., 2.3.0).
最佳实践
1. Start by exploring the existing extension repository and mapping its file structure to DeerFlow's extension conventions (look at other extensions like deerflow-extension-*).
2. Create a minimal reproduction by hitting the checkpoint endpoint to ensure data is accessible.
3. Ensure changes are backward compatible; the extension should be opt‑in via configuration or UI toggle.
4. Follow DeerFlow's code style and testing patterns; add tests that verify checkpoint reading, export formats (JSON/ZIP), and UI component rendering.
5. Communicate with maintainers (e.g., @WillemJiang, @Totoro-qaq) to confirm integration approach and roadmap inclusion.
Active comments from multiple contributors (Sumukh-15, SidharthSKR99, Keesan12) expressing interest and willingness to implement; maintainer @erkanarslan confirmed a separate valueBindings approach is preferred, indicating community readiness.
我现在先做什么
Open the repository and read the existing secretBindings implementation (e.g., `browser_use/tools/registry/service.py`). Understand how aliases are replaced at runtime and note any size/origin limits. Draft a minimal design for valueBindings (alias + value, relaxed limits) and write a simple unit test to verify placeholder substitution.
问题描述
V4 secretBindings is limited to secrets and has a 4 KiB limit and hostname-only allowedDomains, making it unsuitable for long non‑secret values like IDs, JSON, or cover letters. The LLM frequently mis‑types or truncates these values, causing task failures. Users need an alias‑based injection mechanism for plain text that supports larger sizes and flexible origins, similar to secrets but without treating data as sensitive.
工作内容
1. Examine secretBindings code in `browser_use/tools/registry/service.py` (and related API schemas) to understand alias substitution and injection.
2. Design a new binding type `valueBindings` with fields: `alias`, `value` (or workspace reference for large text), optional `allowedDomains` (scheme+host+port) and higher size limit (>4 KiB).
3. Update the runs.create API model (Python SDK and Cloud V4 if open for external contributions) to include `valueBindings` alongside `secretBindings`.
4. Extend runtime injection logic to apply `valueBindings` at input time, using the same placeholder replacement mechanism but without secret‑specific security checks.
5. Implement a read‑back verification step (optional length/hash compare) to detect mismatched input.
6. Add comprehensive unit and integration tests for valueBindings, ensuring they work with large text, domain restrictions, and placeholder replacement.
7. Update documentation and possibly add a migration guide.
最佳实践
Start with a local reproduction: read the existing secretBindings code, write a small script that creates a placeholder in a task and verifies substitution. Keep changes minimal by reusing the existing substitution service. Write focused regression tests and ensure they pass before opening a PR. Communicate the chosen design (separate valueBindings) to the issue authors for alignment.
One comment from @pma1999 expressing interest and asking about direction; no evidence of ongoing work or resolution.
我现在先做什么
Inspect dspy/_vendor/lm15/registry.py and the LM class to locate _DIALECTS, _COMPAT_TABLES, the existing ProviderDefinition.chat/responses/anthropic methods, and LM.supports_decision_requests. Reproduce the ValueError with the snippet to confirm the missing dialect, then plan the necessary edits.
问题描述
DSPy's vendored lm15 lacks a 'typesafe' dialect, so custom providers that serve TypeSafe System One wire (e.g., lunaroute-systemone) cannot be declared using ProviderDefinition. The error occurs because the dialect is not in _DIALECTS/_COMPAT_TABLES, and decision routing still matches provider id 'typesafe' instead of dialect, causing incorrect routing for non‑TypeSafe gateways.
工作内容
1. Add 'typesafe' to _DIALECTS and _COMPAT_TABLES in dspy/_vendor/lm15/registry.py. 2. Add a ProviderDefinition.typesafe class method mirroring chat/responses/anthropic that binds TypeSafeLM/AsyncTypeSafeLM with the given access policy. 3. Update LM.supports_decision_requests (or related routing logic) to check resolved definition's dialect == 'typesafe' instead of provider id. 4. Verify register_provider accepts the new definition and that routing works for custom providers using that dialect.
最佳实践
Follow the existing pattern of chat/responses/anthropic methods; keep changes minimal; add a simple unit test that creates a ProviderDefinition.typesafe and confirms it registers; ensure decision routing respects dialect; communicate changes in a PR with clear description and any required version sync notes.
No comments or reactions from maintainers or community members; no evidence of prior discussion.
我现在先做什么
Search the codebase for existing adapter or extension patterns (e.g., any cache, storage, or plugin modules) to understand how optional integrations are implemented, then sketch the MemCode adapter interface based on those examples.
问题描述
DSPy programs currently lose learned examples, user preferences, and project decisions between runs because there is no built‑in persistent memory layer. Users want an optional durable memory adapter so that long‑running agent workflows can retain and reuse important context across executions without rewriting the core framework.
工作内容
1. Define a minimal adapter interface for durable memory (save/load key‑value memories).
2. Implement a MemCode adapter that talks to the MemCode MCP server/SDK.
3. Add configuration hooks to enable/disable the adapter via DSPy settings.
4. Write unit tests with mocked MemCode client and integration‑style tests.
5. Update documentation (README, API docs) to explain opt‑in usage and setup.
6. Ensure the adapter is optional (no hard dependency) and follows existing DSPy extension patterns.
最佳实践
First locate existing persistence or cache adapters in the repo to follow the same structure. Keep the MemCode dependency behind an import‑guard or extra‑requirements tag. Provide a fake/in‑memory stub for tests. Use clear configuration keys (e.g., dspy.settings.memcode_enabled). Submit a draft PR for maintainer feedback before investing in extensive testing. Verify that enabling the adapter does not affect core performance when disabled.
A bot comment indicates the issue is awaiting maintainer triage; no other community activity present.
我现在先做什么
Clone the repo, navigate to packages/core/src/agent/durable/durable-agent.ts, examine the recover() method (line ~1378) and resolveExecutionOptions (line ~1945). Run the reproduction script from the gist to confirm that defaultOptions.onFinish is not called on recover. Add console logs or a simple test to verify the missing behavior before making changes.
问题描述
DurableAgent.recover() does not merge the agent's defaultOptions callbacks (onFinish, onError, onAbort) when resuming a run, causing per‑turn bookkeeping (e.g., usage accounting, audit rows) to be lost for runs that crash and are later recovered. Normal stream() calls merge defaultOptions via resolveExecutionOptions, but recover() passes only caller‑provided options to setupRecoveredStream, breaking consistency.
工作内容
1. Read packages/core/src/agent/durable/durable-agent.ts to understand resolveExecutionOptions and how stream()/resume()/generate() merge defaultOptions. 2. Locate recover() and setupRecoveredStream, verify they skip defaultOptions merging. 3. Adapt recover() (and recoverActiveRuns/recovery: { durableAgents: 'auto' } if needed) to merge defaultOptions similarly, either by calling resolveExecutionOptions or copying the merge logic. 4. Ensure defaultOptions.delegation callbacks remain restored (they already are). 5. Create a minimal test/reproduction script based on the provided gist to verify callbacks are called on recover after fix. 6. Add or update unit tests for DurableAgent recovery to assert defaultOptions.onFinish/onError/onAbort are invoked. 7. Run existing tests to confirm no regressions.
最佳实践
Reproduce the bug first with the existing script to confirm missing callbacks. Examine the fix pattern used for #28641 (#28779) to ensure consistency. Keep changes minimal—preferably reuse resolveExecutionOptions where possible. Write focused tests that assert callback execution on both normal stream and recover paths. Update documentation if any behavior changes.
Only one comment asking for investigation; no maintainer response or clear direction, indicating the issue is open and community interest is modest.
我现在先做什么
Inspect `litellm_proxy_extras/prisma_toolchain.py` and search for `prisma.types` imports; run a quick test to confirm the three import points and measure their timings on Python 3.14.
问题描述
Python 3.14 drastically slows import of `prisma.types` due to PEP 649 lazy evaluation, causing LiteLLM proxy startup to take ~2 minutes because the generated 10 MB types module is imported three times during startup. This slows developer workflow and contradicts LiteLLM's claim of 3.14 support.
工作内容
1. Locate `litellm_proxy_extras/prisma_toolchain.py` and all places where `prisma.types` is imported (line 55 and elsewhere). 2. Determine whether `from prisma import config` is required for config reading; replace with lazy import or alternative config access that avoids loading types. 3. Examine the Prisma CLI bootstrap (`prisma --version`) to see if it can be cached or skipped after toolchain preparation. 4. Identify any other import repetitions in the migration step and consider pre‑loading the module once, caching it, or moving the import out of hot paths. 5. Modify the code to eliminate duplicate imports while preserving existing functionality on Python ≥3.10. 6. Add a simple sanity test (e.g., import test) and optionally a timing check to ensure startup is not regressed.
最佳实践
Reproduce the startup timing on Python 3.14 before and after changes; compare with 3.13 to verify improvement. Read the relevant code paths to understand dependencies. Keep changes minimal and focused on removing unnecessary imports. Use lazy imports where possible and ensure backward compatibility. Document the performance impact in commit messages or a short note.
No maintainer decision yet; only community discussion about acceptance criteria.
我现在先做什么
Clone the crewai‑tools source, locate the pattern for optional third‑party tools (e.g., look at `crewai_tools/tools/external/`), and examine the `crewai‑sra‑riskgate` repository to understand its public API and packaging. Then propose a concrete integration design (option a or b) for discussion.
问题描述
The issue requests a built‑in payment guardrail tool for crewAI agents that move stablecoins (USDC, x402). A third‑party Apache‑2.0 package `crewai‑sra‑riskgate` already provides this functionality, but it is not integrated into the core crewAI tools. The maintainers need to decide whether to embed it as an optional extra in `lib/crewai‑tools` or simply document the external package. This missing integration exposes agents to unsafe transfers and forces users to write ad‑hoc checks.
工作内容
1. Explore `crewai-tools` to understand tool registration, optional dependency patterns, and existing third‑party integrations. 2. Clone `crewai‑sra‑riskgate` to map its public API (`risk_gated`, `SRARiskGateTool`). 3. Decide on integration approach (option a vs b) and discuss with maintainers if needed. 4. Add the tool to `lib/crewai_tools/tools/` (or a new sub‑module) with an optional import guard. 5. Write doc page under Tools > Guardrails describing usage, policy binding, and optional package dependency. 6. Write unit tests for the wrapper covering acceptance criteria: quote binding, nonce reuse detection, OFAC snapshot metadata, per‑payment limits, hold on unverified payee, and reconciliation handling for lost HTTP responses. 7. Ensure tests pass locally and follow crewAI’s linting/style guidelines. 8. Draft a PR with clear changelog entry and update `README.md` for optional tools.
最佳实践
Read existing tool definitions and optional dependency patterns; copy the import guard used for other third‑party tools. Write tests that mirror the acceptance criteria from the comments (policy bound to quote, reject new quote with different payee, and reconcile lost responses without generating new authorization). Keep the change minimal and use the same coding style (type hints, docstrings). Use `pytest` for unit tests and ensure they are isolated. Communicate early with the community on which maintainer option is chosen.
Two comments show maintainers still debating attribute naming; no implementation or resolution yet.
我现在先做什么
Clone the repo, grep for 'execute_tool' span creation, examine MCPTool, MCPStreamableHTTPTool, and MCPStdioTool classes to understand how spans are emitted and where the server name and URL are available.
问题描述
Python execute_tool spans for MCP tools do not indicate which MCP server handled the tool call. Operators cannot easily determine which configured MCP server (e.g., MCPStreamableHTTPTool or MCPStdioTool) served a span when multiple servers exist, especially when tool names collide or for telemetry that attributes usage to a server.
工作内容
Search the Python SDK for where execute_tool spans are created (likely in MCPTool subclasses). Add `microsoft.tool.server.name` attribute using the configured logical name of the MCP server, and `url.full` attribute using the server's endpoint URL (strip user info, query, fragment; include path only when ENABLE_SENSITIVE_DATA is on). Ensure stdio servers emit only the name. Update any unit/integration tests to verify the new attributes are present and correctly sanitized.
最佳实践
Follow OpenTelemetry semantic conventions (use `url.full` for endpoint). Keep attributes low‑cardinality and non‑sensitive. Respect existing privacy flags (ENABLE_SENSITIVE_DATA). Keep changes minimal and focused on the span generation code. Add tests covering both HTTP and stdio MCP tools.
No evidence that the issue is being actively worked on; there is only a triage notice comment awaiting maintainer approval.
我现在先做什么
Clone the repo, navigate to `packages/core/src/background-tasks/`, examine `workflow.ts` lines 191‑216 and 262‑314, and `manager.ts` shutdown and resume sections. Then run the reproduction script (complete the truncated code) to confirm the bug locally.
问题描述
Background tasks that suspend are marked as 'suspended' before the workflow actually suspends, creating a window where the task's abort controller is active and not yet truly suspended. During graceful shutdown, `shutdown()` cancels these tasks because they are not `running` with retries, losing their pending request. After a crash, the task remains marked `suspended` but the workflow snapshot never suspended, so `resume()` fails with 'This workflow run was not suspended', leaving the task failed and the tool without answer.
工作内容
1. Investigate `workflow.ts` and `manager.ts` to understand the suspend‑resume‑cancel state machine. 2. Reproduce the bug with the provided script (or a completed version). 3. Identify exact race conditions: move abort controller registration to after true suspend, adjust shutdown to skip truly suspended tasks, and ensure resume can detect mismatched suspend state. 4. Make minimal changes: a) In `workflow.ts`, delay adding abort controller until after `runLocalSuspendHooks` completes and the workflow is actually suspended. b) In `manager.ts`, modify shutdown logic to preserve tasks that are already marked suspended and have no active abort controller, or treat them like running tasks with retries. c) In `manager.ts`, improve `resume()` to check whether the workflow snapshot truly suspended before claiming the task. 5. Add or update unit tests for suspend, shutdown cancellation, and resume after crash scenarios. 6. Verify changes with existing test suite and the reproduction script.
最佳实践
Start by reading the relevant code sections and existing tests. Reproduce the bug exactly, then write a focused test that fails before the fix and passes after. Make the smallest changes needed to close the race condition. Ensure any new state transitions are atomic and documented in comments. Run the full test suite after changes to avoid regressions.
Issue is in triage; waiting for maintainer triage/approval. No resolution or PR present.
我现在先做什么
Search the codebase for 'execute_command', 'background', 'LocalProcessHandle', and 'killProcessTree' to understand current sandbox behavior and locate relevant files for modification.
问题描述
Workspace sandbox background processes currently have no lifetime limit unless the model explicitly provides a timeout, which is discouraged for dev servers. Processes that ignore SIGTERM can run indefinitely, consuming CPU and memory. The issue proposes adding opt‑in operator‑level timeout defaults and a SIGKILL escalation after a grace period, giving users safe limits while keeping dev servers running by default.
工作内容
1. Locate Workspace configuration and sandbox tool definitions (e.g., @mastra/core/src/workspace/workspace.ts, tools/sandbox/executeCommand.ts). 2. Read the LocalProcessHandle and killProcessTree implementations to understand current timeout handling. 3. Add optional `backgroundProcesses` config to Workspace (defaultTimeoutMs, maxTimeoutMs) and `killGraceMs` to LocalSandbox/ProcessManager. 4. Modify spawn options to apply defaults/max caps and enable graceful escalation (SIGTERM → SIGKILL after killGraceMs). 5. Update tool description to inform the model about the applied limits. 6. Write unit tests for timeout and escalation behavior, ensuring backward compatibility. 7. Add documentation/comments for new config options.
最佳实践
• First reproduce the issue with a background script that ignores SIGTERM to see indefinite runtime. • Study the existing bounded wait pattern (#29381) and follow similar conventions. • Keep changes minimal: only augment existing functions, don't rewrite unrelated code. • Ensure opt‑in behavior: all new settings default to disabled (or zero) to preserve current behavior. • Validate that foreground commands are unaffected and that timeout limits are respected in both foreground and background contexts. • Write focused tests covering default, max cap, and escalation scenarios, and ensure they pass on CI.
Varshith-Kali has reproduced the regression on main and indicated they will provide a fix with a regression test. No maintainer response yet.
我现在先做什么
1. Examine router_python_core.py:5056 (_aread_first_chunk) and proxy/common_request_processing.py:1164 (_buffer_first_chunk_honoring_disconnect). 2. Create a minimal reproduction script using a custom provider that delays first chunk (e.g., asyncio.Semaphore) and simulate a streaming request, then close the client connection before the first chunk arrives. Verify that the task is not cancelled in the current version. 3. Review the surrounding async patterns to decide on a fix (e.g., race llm_call with request.is_disconnected()).
问题描述
Since version 1.107.0, streaming requests are not cancelled when a client disconnects before receiving the first chunk, because the router reads the first chunk inside llm_call before the disconnect watcher runs, leaving upstream work and quota wasted. This regression reintroduces long TTFT and can cause request queue slots to stay occupied.
工作内容
1. Locate and read router_python_core.py:5056 (_aread_first_chunk) and proxy/common_request_processing.py:1164 (_buffer_first_chunk_honoring_disconnect). 2. Understand how disconnect detection works and why the race condition occurs. a. Determine whether to move the first‑chunk read out of the router for proxy calls, or race llm_call with request.is_disconnected(). 3. Write a reproduction script that uses a custom provider with a delayed first chunk (e.g., asyncio.Semaphore). Simulate a streaming request, close the client connection before first chunk, and verify if the task is cancelled. 4. Implement the fix (minimal change) that ensures cancellation when client disconnects. 5. Add a regression test that covers the scenario for future releases. 6. Run existing tests related to streaming and disconnect handling to ensure no regressions.
最佳实践
• Reproduce the bug locally before making changes. • Keep the fix focused on the specific race (e.g., guard the first‑chunk read with the disconnect watcher). • Use asyncio.wait or similar to race tasks when appropriate. • Ensure the fix works for both custom and built‑in providers. • Add a test that explicitly checks that the task receives CancelledError on client disconnect before first chunk. • Verify existing streaming and disconnect tests still pass.
No evidence of recent activity on this issue; no PRs or comments present. The issue author indicates willingness to work on it, but the repository appears to need implementation.
我现在先做什么
Explore the repository to find Slack agent implementation (likely under `agno/agent/providers/slack/` or similar). Look for existing parameters like `loading_text` and see how the agent runs messages. Also check Telegram's reaction feature to understand the naming and code patterns.
问题描述
The issue requests adding an optional emoji reaction feature to Slack agents (and possibly mirror Telegram's #7368) so the agent can react with a lightweight emoji (e.g., 👀) when processing a user's message, improving visibility in busy channels. Currently Slack's agent design guide suggests reactions but the implementation lacks this capability. The solution involves adding optional `react_emoji` and `done_emoji` parameters that trigger `reactions.add` at start and swap/remove at completion, requiring the `reactions:write` scope and non-fatal error handling.
工作内容
First, explore the codebase to locate Slack agent classes, see how runs are initiated, and understand existing reaction handling (if any). Then implement optional `react_emoji` and `done_emoji` parameters in the relevant agent or handler method(s). Add code to call Slack's `reactions.add` (or `reactions.remove`) with proper permission checks, ensuring failures are caught and logged non‑fatally. Update documentation and possibly add tests for the new feature. Ensure parity with Telegram's naming and behavior.
最佳实践
Examine existing Telegram implementation (#7368) for patterns; ensure the feature is optional, documented, and scope errors are handled gracefully. Follow the repo's code style, add unit tests, and update any relevant README or docstrings. Use existing Slack client wrapper methods if available to avoid reinventing API calls. Ensure backward compatibility (default behavior unchanged).
No comments or recent activity; the issue is newly created and unresolved.
我现在先做什么
Open the repository, inspect `python/packages/declarative/tests/test_invoke_mcp_tool_executor.py` around line 471, understand the test method `test_auth_context_binding_survives_workflow_resume`. Then attempt to run this test locally (or in a CI matrix) to see if it reproduces on the current base commit.
问题描述
Windows Python 3.12 CI job failed on a test that verifies authorization context binding survives workflow resume. The test expects the handler call count to be zero after resuming from a checkpoint with a changed authorization context, but it observed one call, causing the job to fail and block merging of unrelated PRs.
工作内容
Examine the failing test in `python/packages/declarative/tests/test_invoke_mcp_tool_executor.py:471`. Understand the test logic, reproduce the failure locally (if possible) or on a Windows Python 3.12 environment. Determine if the failure is a flaky race condition, a bug in the MCP workflow resume logic, or an incorrect test expectation. Fix either the test (e.g., add synchronization, adjust assertion) or the underlying code to ensure correct behavior.
最佳实践
Reproduce the failure by running the specific test in a Windows Python 3.12 environment or a CI simulator. Review the test setup and any async/threading behavior. Use logging or debug output to see when the handler is called. If it's a timing issue, consider adding a small delay, using a mock that records call counts atomically, or adjusting the test expectation based on actual semantics. Ensure any fix does not break other platforms or Python versions.
Issue is in triage; only a routing comment from GitHub Actions bot, no further community discussion or maintainer response. The status is unresolved and awaiting maintainer decision.
我现在先做什么
Clone the repository (or fetch the _serialization.py snapshot), run the reproduction script to confirm the missing slot fields, and inspect _serialization.py to locate to_dict and _iter_instance_fields so you can plan the fix.
问题描述
SerializationMixin.to_dict only iterates over self.__dict__, so classes that store fields in __slots__ omit those fields from dict/JSON output. This prevents correct object reconstruction when using from_dict, and creates inconsistency with copy/pickle (which already include slot fields). The lack of documentation on slot‑backed support makes the intended contract unclear, and the bug could lead to data loss for subclasses that use slots.
工作内容
1. Locate python/packages/core/agent_framework/_serialization.py and examine to_dict (around line 467) and _iter_instance_fields (line 233). 2. Identify where exclude/exclude_none logic is applied for __dict__ fields. 3. Adapt to_dict to also iterate over slot fields (e.g., by calling _iter_instance_fields with the same filtering). 4. Verify that from_dict and _data_to_object correctly set slot‑backed values. 5. Add a test case in python/packages/core/tests/core/test_serializable_mixin.py that defines a slot‑backed subclass, checks to_dict/to_json preservation, and validates from_dict round‑trip for both required and default constructor arguments.
最佳实践
First, reproduce the bug with the provided script to confirm missing fields. Then study the existing slot‑test for copy/pickle to understand the pattern used by _iter_instance_fields. Make the smallest change that respects existing exclude/exclude_none behavior. Add a focused test that mirrors the reproduction steps, ensuring edge cases are covered. Keep changes consistent with the project's code style and existing naming conventions.
Only a single bump comment from @ma‑menta; no explicit maintainer feedback or activity on the issue.
我现在先做什么
Search the proxy codebase for existing realtime/Live WebSocket implementations (e.g., files handling /v1/realtime) to understand the current pattern, then sketch a minimal proof‑of‑concept for the /v1/live/sessions POST endpoint.
问题描述
The issue requests adding OpenAI's public GPT-Live API (gpt-live-1) to LiteLLM Proxy so that existing Live clients can connect via LiteLLM without changing their code. This involves implementing the /v1/live/sessions REST endpoint, the Live WebSocket session protocol, sideband attach connections, and preserving all request/response schemas, streaming events, and session lifecycle while applying LiteLLM's auth, routing, permissions, and usage tracking.
工作内容
1. Locate existing proxy WebSocket/realtime handling code (e.g., /v1/realtime) to reuse patterns.
2. Implement POST /v1/live/sessions endpoint with proper JSON validation, returning session.id and transport.sdp.
3. Implement Live WebSocket handler that forwards messages to/from the upstream provider, preserving event types and streaming.
4. Implement /v1/live/sessions/{session_id}/attach sideband connection, linking to the original session.
5. Integrate authentication/authorization: validate LiteLLM virtual keys, enforce model permissions, rate limits, and budget.
6. Wire usage tracking for duration-based voice usage from the provider.
7. Update model catalog/pricing for gpt-live-1 (referencing #40606).
8. Add unit and integration tests for the new endpoints and WebSocket flow.
9. Update documentation to reflect GPT-Live support and any gaps.
最佳实践
Follow the existing proxy implementation patterns for realtime/Live endpoints; keep changes minimal and focused; reuse authentication middleware and usage tracking modules; write tests before or alongside implementation; ensure backward compatibility; document any unsupported Live operations; seek maintainer feedback early via a draft PR.
One community comment offering to work on the feature, but no maintainer confirmation or existing PR indicates the issue is still open.
我现在先做什么
Explore the repository to find the S3/GCS callback implementation (search for `s3_callback_params`, `cold_storage_custom_logger`, `proxy_server_request`). Examine the log dict structure and locate where the request envelope is available before writing to S3.
问题描述
Litellm's S3/GCS cold‑storage log objects currently contain only the conversation messages and completion response, not the original HTTP envelope (URL, method, headers). Operators must enable prompt storage in the database to retrieve this envelope, which adds noise and truncates long fields. The envelope is already present in memory when the log object is written, so the feature is about storing it optionally in the cold‑storage object.
工作内容
1. Locate the S3/GCS callback code (e.g., `s3_callback.py` or `cold_storage_custom_logger`) and examine the log dict that is persisted.
2. Identify where `proxy_server_request` (or equivalent) is captured during request handling.
3. Add a new optional parameter `store_request_envelope` (or similar) to `s3_callback_params` (default `false`).
4. When enabled, copy the request envelope fields (URL, method, headers) into the log object, applying any existing header‑redaction rules.
5. Update the UI/API that reads from S3 (e.g., `/spend/logs/ui/{request_id}`) to expose the envelope from the stored object when present.
6. Write regression tests for the new behavior and ensure redaction is still applied.
7. Document the new config option.
最佳实践
Start by reading the existing callback and UI code paths to understand data flow. Keep changes minimal and opt‑in. Preserve any existing redaction logic for headers. Add tests that verify the envelope appears in S3 objects when enabled and is omitted when disabled. Ensure backward compatibility (existing logs remain unchanged).
No evidence (issue is recent with no comments or PRs).
我现在先做什么
Open the repository, locate `litellm/cache/redis_semantic_cache.py` (or similar) and inspect imports for `SemanticCache` and `CustomTextVectorizer`. Check the current `uv.lock` to see the pinned RedisVL version. Then run the existing semantic‑cache tests to confirm the failure when using a Redis user with `-@dangerous`.
问题描述
LiteLLM's Docker image ships RedisVL 0.4.1, which runs the `MODULE LIST` command during semantic cache index building. This command is tagged `@admin` and `@dangerous`, causing the cache to fail when Redis users exclude dangerous commands (e.g., Redis Cloud's read‑write role). The bug disables semantic caching for many production deployments, and upgrading RedisVL to ≥0.26.0 resolves the permission issue plus other related bugs.
工作内容
1. Locate imports of `SemanticCache` and `CustomTextVectorizer` in LiteLLM's cache modules (e.g., `litellm/cache/redis_semantic_cache.py` and any vectorizer files). 2. Update imports to the new paths (`redisvl.extensions.cache.llm.SemanticCache` and `redisvl.vectorizer.CustomVectorizer`). 3. Update the dependency lock file (`uv.lock`) to require `redisvl>=0.26.0` (or at least `0.26.0`) and adjust any version constraints in `pyproject.toml`/requirements. 4. Ensure the `extra_proxy` dependency floor is raised to ≥0.13.0 to avoid deprecated imports. 5. Run existing semantic‑cache tests to verify functionality with a standard Redis instance. 6. Optionally add a test scenario that simulates an ACL‑restricted Redis user (+@all -@dangerous) to confirm the cache builds successfully after the fix.
最佳实践
Reproduce the failure by building the Docker image with a Redis user that excludes dangerous commands and observe the "Redis semantic‑cache index build failed" log. Examine the code path that builds the index to confirm the `MODULE LIST` usage. Make minimal import changes and keep the same runtime behavior. Update the lock file in a way that passes any CI checks (the repository may have a "Block fork dependency changes" check). Use the existing test suite to ensure no regressions, and communicate with the maintainer if the lock‑file update requires special approval.
Two comments from maintainers and contributors discuss design details and suggest a staged rollout (end_at first). No existing PRs or resolved work, indicating the issue is still open and actively considered.
我现在先做什么
Locate the Schedule model (e.g., `agno/schedule.py`), examine ScheduleManager and SchedulerTools definitions, and review the DB adapters for schema migrations. Then add the nullable fields to the model and adapters, create a migration, and update the manager's create/update signatures to accept and persist them.
问题描述
Schedules in Agno are cron‑only and cannot be automatically terminated, forcing users to manage expiration outside the scheduler. This makes one‑shot, time‑bounded, or limited‑run jobs awkward and requires manual cleanup. The issue proposes adding nullable `end_at` and `max_runs` fields to the Schedule model so schedules can expire naturally based on a deadline or a run count.
工作内容
Add nullable `end_at` (epoch seconds) and `max_runs` (int) fields to the Schedule model and all DB adapters (PostgreSQL, SQLite, Mongo) with a migration. Update ScheduleManager.create, update, and enable to accept these fields. Propagate support through SchedulerTools.create_schedule and the REST API (request/response schemas). Ensure the schedule executor checks `end_at` and `max_runs` in the release step and rejects new runs after the deadline. Implement consistent validation in admission paths (enable, trigger, on‑demand). Write tests covering end‑of‑life behavior, missed runs counting, and edge cases. Use the staged approach (end_at only) if preferred, but lay groundwork for future `max_runs` integration.
最佳实践
Explore the existing schedule flow first to understand how `next_run_at` and the executor work. Keep the changes minimal and backward compatible (nullable fields). Ensure expiration logic is applied in all admission paths, not just the executor. Follow existing naming conventions and migration patterns. Write unit and integration tests for new fields and expiration scenarios. Ask maintainers for clarification on counting semantics and `enable` behavior before finalizing design. Use the split‑stage suggestion to implement `end_at` alone initially, then revisit `max_runs`.
A community member (@GYJ99) offered to take the fix and provided a concrete plan for the changes, indicating the issue is acknowledged and ready for implementation.
我现在先做什么
Open `web/app/components/base/notion-page-selector/page-selector/page-row.tsx` and examine lines 73 and 96. Review the surrounding JSX to understand how the divs are used (e.g., `onClick` handlers, any additional classes). Then create a quick local reproduction (e.g., start the dev server if possible) to confirm the keyboard focus issue, but given the clear issue description you can proceed directly to the refactoring.
问题描述
Notion page‑tree expansion and preview actions are implemented with plain divs that only respond to clicks. Keyboard users cannot focus or activate these actions, making the UI inaccessible for screen‑reader and tab‑navigation users. The bug is isolated to the page‑row component where expand/collapse (line 73) and preview (line 96) divs lack ARIA roles, keyboard handlers, and proper focus visibility.
工作内容
Inspect `web/app/components/base/notion-page-selector/page-selector/page-row.tsx`. Replace the clickable divs at line 73 (expand/collapse) and line 96 (preview) with native button elements (or semantically appropriate interactive elements). Add `aria-expanded` (or `aria‑controls`/ `aria‑label`) to the toggle, and expose the preview as a focusable element with a `role="button"`/`role="link"` or button for keyboard activation. Implement keyboard handlers: `Enter`/`Space` to toggle expansion, `Tab` to reach preview, `Enter`/`Space` to open/close preview. Ensure the virtualized list and selection logic remain unchanged and that the preview can still be shown on hover. Update `page-row.spec.tsx` (and any related test suites) to include keyboard interaction tests using the existing happy‑dom test IDs. Run lint, type‑check, and a11y checks to verify no regressions.
最佳实践
Follow the repository’s existing accessibility patterns (use semantic elements, proper ARIA attributes, and keyboard event handling). Keep changes minimal and focused on the component only. Preserve all current functionality (search, selection, virtualization). Add unit tests for keyboard navigation that mirror the existing test structure and verify focus order and action triggers. Ensure linting and type‑checking pass before committing.
Maintainer GYJ99 has commented that they will investigate and potentially fix the issue, and a bot has hypothesized a multimodal history replay cause. The issue is still open and appears to be under investigation.
我现在先做什么
Clone the repo, set up a local Dify environment, start the services, create a chatflow matching the described configuration (Classifier → Agent with FunctionCalling, separate image‑editing workflow, memory enabled). Reproduce the sequence, record the error logs and request IDs, and examine the history serialization code to pinpoint the failure.
问题描述
The agent fails after an image analysis and editing sequence when memory is enabled. After uploading an image, describing the room, editing the image via a separate workflow tool, and then asking a follow-up text question, the agent returns an internal server error with empty input/output, while the question classifier works. The issue suggests a possible multimodal history replay problem where historical messages (including image attachments) are incorrectly handled when memory persists across turns.
工作内容
Reproduce the bug in a local sandbox. Inspect history building and serialization code (e.g., memory service, conversation history models) to understand how attachments from image edits are merged with conversation history. Identify the exact point where the agent request loses context (empty input). Implement a targeted fix (likely in history replay or memory loading) and add regression tests for multimodal memory replay. Ensure compatibility with existing history‑file capability fixes and recent agent‑message‑preservation PRs.
最佳实践
Reproduce using the exact steps in the issue, capture logs and request IDs. Read the relevant modules (history builder, memory service, Agent Strategies plugin) to understand the flow. Keep changes minimal and focused on the identified root cause. Write unit/integration tests that verify multimodal history persistence after image editing with memory enabled. Run existing linting, type‑checking, and test suites before opening a PR. Communicate with the maintainer (GYJ99) to coordinate if needed.
Two comments include a real‑world example (Microsoft Sentinel) and discuss possible solutions, but there is no maintainer response yet, indicating the issue is still open and under active consideration.
我现在先做什么
Open the repository and locate the client’s authorization logic. Find the file containing `startAuthorization` and examine how metadata validation is performed. Run the existing test suite to ensure baseline passes, then create a minimal reproduction using a mock metadata endpoint without `code_challenge_methods_supported` to confirm the current silent acceptance behavior.
问题描述
The SDK's PKCE verification treats an absent `code_challenge_methods_supported` field as "assume PKCE supported" (per issue #992) to support providers like Azure AD and AWS Cognito that omit the field but support S256. However, the MCP spec revision 2025-11-25 now requires refusing authorization when the field is missing, because an authorization server that ignores the `code_challenge` parameter cannot be distinguished from one that simply omits advertising. This non‑compliance blocks real clients (e.g., Microsoft Sentinel) from signing in and leaves embedders without a signal to apply their own policy. Aligning with the spec restores security guarantees and resolves the ambiguity.
工作内容
1. Locate `startAuthorization` in `@modelcontextprotocol/client` (likely `packages/client/src/auth.ts`). 2. Review `OAuthMetadataSchema` and `OpenIdProviderDiscoveryMetadataSchema` to see how `code_challenge_methods_supported` is defined (currently `.optional()`). 3. Identify the validation block that currently only checks `includes`. 4. Add detection for the field’s absence: emit a warning or expose a flag (e.g., `pkceSupported: false`) in the returned discovery result, preserving backward compatibility. 5. Optionally add an opt‑in strict mode that throws when the field is missing. 6. Write tests that mock metadata with and without the field, verify the warning/flag is emitted, and ensure the flow still works when the field is present. 7. Update relevant documentation to describe the new signal and the spec deviation.
最佳实践
Read the 2025‑11‑25 spec section on Authorization Code Protection to understand exact requirements. Keep changes minimal to avoid breaking existing integrations. Follow existing patterns for warnings or extra fields in discovery results. Ensure tests cover edge cases (field present with S256, absent, empty array, unsupported method). Communicate the change clearly in commit messages and any updated README or spec compliance notes.
Active discussion with maintainer comments; they want the issue marked `ready` and have outlined a fix but raised concerns about using `public_fetch` for file downloads. No merged PR or final resolution exists yet.
我现在先做什么
Open `libs/agno/agno/knowledge/knowledge.py` and examine lines 2620‑2640 and 2810‑2840 to verify the missing `return` statements. Also open `libs/agno/agno/knowledge/reader/website_reader.py` and `reader_factory.py` to confirm `public_only` defaults. After confirming the bug locations, create a small test script that reproduces the fall‑through (e.g., pass an invalid URL) and verify the behavior.
问题描述
Issue #11509 identifies two security/correctness bugs in the URL ingestion path: (1) missing `return` statements after marking invalid URLs as FAILED, causing execution to fall through into the fetch logic; (2) SSRF bypass because file‑extension URLs are fetched via generic `async_fetch_with_retry`/`fetch_with_retry` (which lack public‑IP checks) and because `WebsiteReader` defaults `public_only=False`, allowing ingestion of non‑extension URLs without SSRF protection. Both bugs expose the platform to private‑IP SSRF attacks and incorrect state handling.
工作内容
1. Add missing `return` after `await self._aupdate_content(content)` / `self._update_content(content)` in the four invalid‑URL branches of `_aload_from_url` (knowledge.py lines 2627, سوريا, 2633) and `_load_from_url` (lines 2813, 2819). 2. Investigate SSRF protection options: (a) default `WebsiteReader(public_only=True)` for extensionless URLs; (b) create a dedicated file‑download helper for extension‑bearing URLs that reuses `validate_public_url`/`afetch_public_page`‑style DNS pinning and per‑hop public‑IP checks while relaxing same‑origin redirect restrictions, size caps, and encoding policies. 3. Integrate the new helper in `knowledge.py` (2648‑2651, 2835‑2837) and `reader_factory.py` where appropriate. 4. Add regression tests for both the fall‑through bug and the SSRF bypass fix.
最佳实践
Read the existing `public_fetch.py` and `url_validation.py` to understand the public‑IP guard contract. Keep changes minimal and focused, ensuring we do not break legitimate downloads (PDFs, CSVs, etc.). Write unit tests that cover invalid URL handling, public‑IP blocking, and redirect behavior for both HTML and file downloads. Follow the project’s contribution workflow: create a branch, add tests first if possible, then modify source, and ensure the PR passes CI.
Maintainer comments show the issue is understood and a fix is being considered; no resolution evidence present.
我现在先做什么
Open agno/os/router.py at the referenced commit (26cc04f9ed8d43c2ae7987fe246d4033fa2ccd2d) and locate the WebSocket dispatcher methods (start-workflow, reconnect, continue-workflow). Examine lines around the elif auth_user_id or ws_user_isolation_enabled branch that clears user_id. Then run the provided reproduction script to confirm the bug.
问题描述
Workflow WebSocket dispatcher incorrectly discards client‑provided user_id when user_isolation=True and authentication is disabled. The dispatcher overwrites the supplied user_id with auth_user_id (which is None), resulting in NULL user IDs in queue tickets, runs, and sessions. Later UI queries fail because the session lacks an owner, breaking workflow tracking. The bug is in agno/os/router.py where the elif auth_user_id or ws_user_isolation_enabled branch unconditionally clears the asserted user_id even when no auth token exists.
工作内容
1. Locate agno/os/router.py and examine the WebSocket handling code for start‑workflow, reconnect, and continue‑workflow.
2. Identify the branch that clears user_id (lines referenced in comments) and understand why it behaves differently from the HTTP router.
3. Implement a fix that preserves the client‑provided user_id when auth_user_id is None and user_isolation is enabled (e.g., treat the asserted value as the effective user_id for local development).
4. Add unit tests mirroring the provided probe script to verify the fix for all three actions.
5. Verify the fix against existing parity with HTTP router and ensure security is not compromised when auth is enabled.
最佳实践
Follow the pattern used in NoAuthIdentityMiddleware and the HTTP router for handling unauthenticated user isolation. Write focused unit tests that reproduce the probe scenario, cover all three WebSocket actions, and ensure the fix does not break existing authenticated flows. Keep changes minimal and document any assumptions about local‑dev behavior.
One comment notes PR #2926 handles retention but leaves the replay/clear race unchanged, asking for maintainer confirmation on replay behavior after a resume. This indicates partial progress and an open race bug.
我现在先做什么
Open the repository, locate `libs/langgraph-api/src/experimental/embed/protocol.mts`, examine the current `handleRunStart` and replay logic, and write a small script that triggers a non‑interrupting run while attaching a `/stream/events` subscriber to reproduce the buffer growth and race condition.
问题描述
Per‑thread `queuedEvents` buffer in `@langchain/langgraph-api` grows indefinitely on threads that never interrupt because `run.start` only clears it when a pending interrupt exists. The buffer stores full graph‑state snapshots (`values`) plus other events, causing memory bloat and, when a late subscriber replays the backlog, exceeding write‑size caps and breaking the live stream. A secondary race exists between buffer truncation and the replay cursor, risking missed events.
工作内容
1. Examine `protocol.mts` to confirm current clearing logic (lines 136‑137 push, 256‑262 conditional clear, 406 unconditional clear).
2. Modify `handleRunStart` to clear `thread.queuedEvents` for every start (or at least when `isResume` is false) to bound buffer growth.
3. Optionally add a size cap or drop older `values` events to keep memory usage reasonable.
4. Fix the race between clearing and replay cursor: ensure replay either works on a snapshot of the buffer (e.g., `const events = thread.queuedEvents.slice();`) or use a lock/atomic index so clearing does not affect an in‑flight replay.
5. Add deterministic regression tests that simulate concurrent `run.start` (no interrupt) and `/stream/events` replay, verifying buffer bounds and no missed events.
6. Update documentation/comments to clarify which events are sent on replay after a resume that cleared the buffer.
最佳实践
‑ Reproduce the race with a test before fixing.
‑ Read the existing test suite and follow the same patterns (e.g., using `describe/it` with `vi` mocks).
‑ Make the smallest change needed (only adjust clearing logic and replay safety).
‑ Ensure any new test is deterministic and can be run locally.
‑ When committing, reference the issue and any related PR (e seems to be #2926).
There are two comments: one from @oliarmak-web suggesting resetting registry vs preserving state across reconnects; another from @Titan-M referencing a related issue #3138 where duplicate content appears. The conversation indicates maintainers are aware and open to changes, but haven't merged a fix yet.
我现在先做什么
Clone the repository, explore the files mentioned: src/StreamManager.ts and src/ui/messages.ts (or wherever MessageTupleManager is defined). Run the repro script to confirm the bug. Then examine existing tests for StreamManager and MessageTupleManager to understand test patterns.
问题描述
MessageTupleManager records each streamed message's index based on its ID when first streamed, and that index is reused in later runs (e.g., after resume). This leaves holes in the messages array when the later run's history is shorter, causing sparse arrays and downstream errors in React or when accessing getters. The expectation is that messages should be placed relative to current run's initialValues: replace in place when ID present, otherwise append. The bug stems from StreamManager not clearing the tuple registry at the start of a new run, and from MessageTupleManager trusting a stored index across runs.
工作内容
1. Examine StreamManager.start and MessageTupleManager's handling of ids and indices.
2. Determine whether resetting the registry at each start or adjusting index assignment is appropriate.
3. Identify tests for interrupt/resume with replayed IDs and ensure dense arrays.
4. Modify code: either call this.messages.clear() in StreamManager.start, or modify MessageTupleManager.get to ignore stale index across runs (e.g., by tracking run token or clearing registry). Ensure same-run behavior (chunk aggregation, replacement) remains intact.
5. Add deterministic tests that cover the scenario: two runs, overlapping IDs, shorter history, ensure no holes, and content for resumed messages is correct.
6. Verify existing tests still pass, and run repro script to confirm fix.
最佳实践
1. Read code paths: look at StreamManager.ts and ui/messages.ts (where MessageTupleManager resides). Understand chunk aggregation logic.
2. Write a minimal failing test in the existing test suite (likely in tests/ folder) reproducing the hole and error.
3. Keep change focused: either clear registry or adjust index assignment; ensure we don't break chunk aggregation for same-run streaming.
4. After changes, run existing tests to ensure no regressions.
5. Communicate intent in PR: mention why clearing the registry is safe, or that we track run IDs to isolate indices across runs.
6. Use deterministic test data (e.g., known IDs) to verify dense output.
No comments or reactions on the issue; no recent activity from maintainers, so there is no explicit signal either way.
我现在先做什么
Open the transport definition file (e.g., `src/transport.ts`) and the request‑handling code (e.g., `src/protocol.ts`), locate the `finally` block that deletes the abort‑controller entry, and plan to add the optional completion callback invocation there.
问题描述
Transports can limit the number of concurrently admitted requests, but the public `onmessage` callback returns `void` and provides no way to observe when the inbound SDK handler has finished validation, encoding, response sending, and internal cleanup. This leads to premature admission release on `transport.send`, causing issues with cancellation and bounded connection reuse. The issue proposes adding an optional per‑message processing‑completion callback to the transport surface to signal when inbound processing is truly finished.
工作内容
Add an optional `onInboundProcessComplete?: (requestId: string) => void` field to the `Transport` type; modify the internal request handling logic (e.g., `Protocol._onrequest`) to invoke this callback in the `finally` block after the abort‑controller entry is removed and any response send settles; ensure the callback is propagated through helpers like `serveStdio`; write unit tests covering success, error, cancellation, unknown method, and notification cases; add integration/adversarial tests that verify admission bounds are respected; update any relevant documentation or type definitions.
最佳实践
First reproduce the described scenario with a deferred handler and deferred `send` to confirm the missing signal; locate the exact `finally` block where the abort‑controller entry is deleted and place the callback invocation there; keep the callback optional to maintain backward compatibility; run the existing test suite to ensure no regressions; add focused tests that check the callback fires exactly once per request across all outcomes; keep changes limited to the transport and request‑handling modules.
Two recent comments from a contributor indicate they are actively examining the change but stepped back due to Node compatibility concerns; no maintainer decision has been posted yet, showing ongoing discussion but no resolution.
我现在先做什么
Clone the repo, install @langchain/langgraph-checkpoint-sqlite@1.0.4, observe the prebuild-install warnings, then temporarily add an overrides field for better-sqlite3@13.0.3 and reinstall to confirm the warnings disappear and the SqliteSaver basic operations succeed.
问题描述
The checkpoint-sqlite package currently pins better-sqlite3 to ^12, which pulls the deprecated prebuild-install package and triggers install-script warnings for all consumers. Better-sqlite3 13+ removes these warnings by using N-API and has no install script, but requires Node >=22 and has known segfaults on older Node versions, so a simple version bump would break users on Node 18-21. The issue is to update the dependency range safely while maintaining compatibility with the existing Node >=18 support.
工作内容
Update package.json dependencies and devDependencies for better-sqlite3 to a conditional range (e.g., ^12.10.0 || ^13.0.3) or ^13 after deciding on Node floor; add or adjust engines field if raising Node minimum; modify CI matrix to test both Node 18/20/22/24 with the new range; run the existing test suite (including SqliteSaver round‑trip) on each Node version to ensure no segfaults or failures; update README or docs if Node requirement changes; create a PR and address any review feedback.
最佳实践
First reproduce the warnings with a clean install of the current package; then test the proposed version range using npm overrides or a temporary package.json edit to verify that warnings disappear and the SqliteSaver works; consult the better-sqlite3 changelog and the open segfault issue to understand the Node compatibility boundary; keep changes minimal (only version range and possibly engines); ensure all existing tests pass on both the old and new ranges before merging; add a test case that explicitly checks for absence of install-script warnings.
A recent comment from Shay‑Deng expresses interest in working on the issue, offers a focused fix, and asks for assignment, indicating active community engagement.
我现在先做什么
先确认 issue 仍能复现,再搜索相关代码和测试。
问题描述
When a thread is reloaded via StreamController.hydrate, the controller attempts to reconstruct subagent namespaces by looking up recent delegation events in the thread's history. The lookup is limited to a fixed 20+20 turn window; if the original delegation that created a subagent occurred earlier than this window, the controller falls back to a positional match that can incorrectly bind the subagent to a later, unrelated tool task's namespace. This causes the subagent to operate under an incorrect namespace on reload, breaking deep-agent delegation logic and leading to incorrect tool calls or state corruption.
工作内容
Locate StreamController.hydrate and resolveSubagentNamespace in the SDK (likely packages/langgraph-sdk/src/stream/controller.ts). Examine how delegation history is fetched (e.g., getThreadState with a limit). Extend the lookup to search beyond the 20+20 window or store delegation metadata with the subagent to avoid positional fallback. Add a regression test that reproduces the bug using the provided example (deep agent with delegation older than the window) and verifies correct namespace binding after reload. Ensure existing tests pass and update any relevant documentation if needed.
最佳实践
First reproduce the issue locally using the supplied Python/JS example to confirm the misbinding. Then implement the smallest possible change that fixes the lookup logic without altering the public API. Write a unit test that covers stale delegation, valid pending subagents, and direct mapping on the fallback history page. Run the full test suite to ensure no regressions. Keep changes focused, follow existing code style, and avoid breaking changes. If unsure about the history limit constant, consult the codebase comments or ask the maintainer for clarification.
No evidence of maintainer activity; issue is awaiting triage.
我现在先做什么
Clone the repo, locate `packages/core/src/agent/durable/workflows/steps/tool-call.ts`, read the placeholder logic in `tool-call-bg.test.ts`, and examine the surrounding code to understand how provider metadata is currently passed and where background tools are dispatched.
问题描述
Mastra's durable agent loop currently replaces background tool calls with placeholder results, losing provider‑native async semantics (e.g., OpenAI Responses' async/caller metadata). This prevents Mastra from preserving unresolved async calls that can be reconciled later, which is needed for long‑running sandbox tools that continue after the call returns. The feature request is to keep provider metadata and caller identity through the background‑task path while still using Mastra's native background‑task manager, avoiding synthetic placeholders.
工作内容
1. Read `packages/core/src/agent/durable/workflows/steps/tool-call.ts` and related `tool-call-bg.test.ts` to understand placeholder insertion, checkpoint serialization, and replay logic. 2. Identify where provider metadata (`async`, `caller`) is passed and where background tools are dispatched. 3. Modify the durable tool path to preserve provider metadata for async calls, dispatch them directly to Mastra's background‑task manager without placeholder insertion, and ensure serialization retains call identity. 4. Update checkpoint and prompt reconstruction to keep unresolved async calls through tool history. 5. Add new test suites mirroring existing background tool tests but verifying non‑placeholder behavior, async/caller metadata preservation, cancellation, and recovery. 6. Verify integration using deterministic provider fixtures (no external adapter changes). 7. Ensure existing sync and deferred background tools continue to work unchanged.
最佳实践
Follow the existing test pattern (tool‑call‑bg & MessageList round‑trip suites). Use deterministic provider fixtures for verification. Keep changes minimal and focused on metadata preservation and async dispatch. Ensure serialization contracts match existing replay‑safety policy. Write tests that verify no synthetic result appears before completion and that cancellation/recovery uses native task machinery.
Explore the repository to locate `agents` persistence (`backend/packages/harness/deerflow/persistence/agents/`), examine the current `agents` table schema and migrations, review the `AgentConfig` definition in `config/agents_config.py`, and read the RFC details to understand the proposed revision model before designing changes.
问题描述
DeerFlow currently stores custom agents as mutable documents without history, making it impossible to publish reproducible versions, track changes, roll back, or guard against concurrent edits. This RFC proposes introducing immutable, content‑addressed revisions for agent bundles, enabling versioned releases, auditability, and controlled promotion across environments.
工作内容
Create a new revision model and migration table; modify `agents` persistence to append revisions and keep a `head_revision` pointer; add optimistic‑concurrency (`If-Match`) guards in API handlers; expose endpoints for diff, rollback, and new package format (`deerflow.custom-agent` version 2); update `lead_agent` to resolve the revision at runtime; adjust built‑in tools (`setup_agent`, `update_agent`) and configuration to work with revisions; update frontend agent settings UI to display version history and allow rollback; write tests for revision creation, concurrency, and package generation.
最佳实践
Study existing `AgentConfig` storage and migration patterns; follow the project’s content‑addressed design conventions; ensure migrations are reversible; add comprehensive tests for race conditions; maintain backward compatibility for existing exports; document new API routes and UI actions; iterate with the RFC author for feedback.
The issue includes a recent comment from @guglielmo‑san (A2A team at Google) stating they are willing to contribute the implementation and help support the integration going forward, indicating active community interest and possible collaborative effort. No evidence of a merged PR or resolved issue is present.
我现在先做什么
Clone the repository, explore the crewai/a2a directory, list all Python files, and run the existing a2a tests to capture the current baseline behavior before any changes.
问题描述
CrewAI's a2a integration pins to a2a-sdk~=0.3.10, which is end-of-life (last release April 2026) and blocks installing newer a2a-sdk>=1.0 alongside other packages. The feature request is to migrate the 22 modules that use a2a-sdk to version 1.x while preserving backward compatibility with existing 0.3 agents, keeping config APIs unchanged, and optionally providing a helper to wrap existing crewai constructs into an a2a-sdk AgentExecutor.
工作内容
1. Locate and list all 22 modules under crewai/a2a that import a2a-sdk. 2. Update import statements and type references to 1.x equivalents (AgentCard, A2AClient, A2AServer, executors, etc.). 3. Keep A2AClientConfig and A2AServerConfig fields unchanged, adapting any underlying SDK usage to 1.x. 4. Implement card parsing using parse_agent_card so ClientFactory selects the correct transport for 0.3 vs 1.0 agents. 5. Modify _agent_to_agent_card to emit a 1.0‑style card advertising both 1.0 and 0.3 interfaces. 6. Port utils/task.py to use 1.x executor types while preserving existing crewai behavior. 7. Ensure fallback logic for 0.3‑only cards via existing transport layers. 8. Write or extend tests that run against both a2a-sdk 0.3.x and 1.x peers. 9. Optionally create a to_a2a() helper that wraps crewai agent.to_agent_card(url) and crewai.a2a.utils.task.execute into an a2a-sdk AgentExecutor and returns an ASGI app. 10. Update dependency specification (likely >=0.3.10,<2 or >=1.0) based on chosen approach and maintain documentation.
最佳实践
Maintain exact API compatibility for A2AClientConfig and A2AServerConfig; use version detection to pick the appropriate transport; write unit tests that import both SDK versions (or use a mock) to verify interoperability; keep changes minimal and focused; run existing test suite to avoid regressions; coordinate with the A2A team for compatibility guidance; add clear comments for any transitional code.
Active maintainer‑driven RFC with community feedback (comments from @ggnnggez, @Totoro‑qaq, @ShenAC‑SAC). The proposal is marked important, but no implementation exists yet.
我现在先做什么
Clone the repo, examine the prototype collector and the tree at bfa2794c to understand the existing triage workflow, locate any related scripts or CI configs, and read CONTRIBUTING/agent.md to see current guidelines for evidence and PR requirements. Spend ~30‑60 minutes documenting the current state and identifying where the new collector would integrate.
问题描述
Deer‑Flow receives over a thousand PRs monthly, yet most lack issue context, making it hard for maintainers to prioritize useful work. This RFC proposes an evidence‑based triage system that quickly surfaces reviewable PRs with concise reasons and actions, reducing maintainer overhead while preserving existing contribution rules. The goal is a short daily queue (PR → one‑sentence reason → next actor/action) and separate maintainer decisions, backed by concrete evidence rather than issue links alone.
工作内容
Implement a triage collector that reads GitHub PR/issue data, extracts evidence (failures, feature direction, contract protection, documentation/maintainability issues), applies the RFC decision rules (R1‑R9), and outputs a prioritized queue with one‑sentence reasons and next actions. Also add incremental test‑value evaluation to assess test changes impact. Update CONTRIBUTING and relevant documentation, write unit tests for the triage logic, and optionally integrate as a GitHub Action or scheduled script.
最佳实践
Start by exploring the existing prototype and the referenced commit bfa2794c to understand the current triage workflow. Clarify missing decision rules (R2‑R9) from the RFC before implementation. Build a minimal viable collector focusing on R1 and evidence extraction, add comprehensive unit tests, respect GitHub API rate limits, keep the output readable, and iterate with maintainer feedback to ensure backward compatibility and alignment with existing checks.
Yzzz88 has indicated they will implement the fix and is seeking maintainer guidance on the compatibility contract for caller‑supplied IDs; no consensus yet, and the issue remains open.
我现在先做什么
Open the repository, locate `gateway/services.py` and examine `normalize_input` to see how IDs are preserved, then read `dynamic_context_middleware.py` to understand how `__user` suffix is added, and finally run the provided reproduction script to confirm the bug locally.
问题描述
Caller‑supplied human message IDs that already end with the reserved suffix `__user` collide with the `DynamicContextMiddleware` internally generated IDs, causing duplicate sequence numbers and loss of the second message. This breaks message identity, feed ordering, and context injection across same‑run and cross‑run scenarios.
工作内容
Inspect `gateway/services.py` normalize_input, `runtime/events/store/memory.py`, `agents/middlewares/dynamic_context_middleware.py`, and the frontend `messageIdentity` logic to understand where the `__user` suffix is added/checked. Decide on a contract for handling colliding external IDs (e.g., reject, rename, or maintain a separate namespace). Implement a fix that (1) prevents caller IDs that end with `__user` from being admitted (or rewrites them), (2) ensures the middleware only renames its own internally generated messages, (3) updates event‑store sequence lookup to treat legacy `X__user` messages separately, and (4) aligns frontend identity mapping. Add comprehensive unit tests for same‑run collisions, cross‑run replay, and legacy checkpoint compatibility.
最佳实践
Run the reproduction script to confirm the bug, trace the call chain through the involved modules, write a focused change that respects existing contracts, add tests that cover edge cases (duplicate IDs, replay, legacy checkpoints), and coordinate with the author (Yzzz88) to avoid duplicate work.
Hard 1 week or more (significant effort to cover all listed subsystems and maintain CI)
可处理性
Level 2 Solvable but Costly
清晰度 / 值得做
Clear / Maybe
社区信号
Active community engagement – several contributors have already claimed small slices (e.g., logging_utils, annotation, hasher, unbatchify) and merged them. This shows the direction is viable, but many larger modules still need typing.
我现在先做什么
Examine the foundation PR #10673 and the current `ty` config, then select an untyped module from the checklist (e.g., `dspy/utils/syncify.py`). Begin annotating its public functions, add the module to `tool.ty.src`, and create a corresponding `tests/typing/syncify.py` with `assert_type` contracts.
问题描述
DSPy lacks explicit Python type annotations throughout its first‑party code, making inputs, outputs, and shared data structures opaque to developers, editors, and coding agents. Adding thorough types – enforced by `ty` in CI and pre‑commit – would improve understandability, enable static checking, and reduce runtime errors. The issue is a systematic rollout across dozens of modules, not just annotation clean‑ups.
工作内容
Read the existing `ty` configuration from PR #10673, then for each untyped module (e.g., `dspy/utils/syncify.py`, `dspy/utils/logging_utils.py`, `dspy/primitives`, `dspy/signatures`, etc.) add explicit parameter/return types, preserve callable signatures with generics, add `assert_type` contract tests in `tests/typing/*`, include the module in `[tool.ty.src]`, and verify runtime tests still pass. Avoid blanket `Any` and ensure narrow types at public boundaries.
最佳实践
Study the patterns from already‑typed slices (e.g., #10724, #10725). Keep changes minimal, reuse existing concrete structures, add shared types only for real contracts, and run `ty` check locally before committing. Add focused static contract tests with `assert_type` and negative call cases. Keep CI and pre‑commit checks green and communicate progress.