wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
2,994 Commits 203 Branches 2 Tags
d7db0faa4dc8a873c3d3c889ac9e4f6cda05c68b
Commit Graph

24 Commits

Author SHA1 Message Date
Your Name
4111ea4f9f fix(ai): remove 188 ollama provider
All checks were successful
Code Review / ai-code-review (push) Successful in 12s
Details
CD Pipeline / tests (push) Successful in 1m13s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m36s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m20s
Details
2026-05-06 14:34:48 +08:00
Your Name
9ef9633aff fix(alerts): bypass proxy timeout for GCP Ollama 2026-05-06 08:55:14 +08:00
Your Name
2aa31c205a fix(ai): require 111 before alert cloud fallback
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m21s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m2s
Details
2026-05-06 00:05:51 +08:00
Your Name
e208798531 fix(ai): keep GCP Ollama lane on safe models
All checks were successful
CD Pipeline / tests (push) Successful in 54s
Details
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m25s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m50s
Details
2026-05-05 23:37:33 +08:00
Your Name
bf847ad045 fix(ai): stabilize GCP Ollama alert lane
Some checks failed
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-05-05 22:20:27 +08:00
Your Name
f78b1b0690 fix(ollama): honor provider endpoint selection
All checks were successful
Code Review / ai-code-review (push) Successful in 37s
Details
2026-05-05 13:14:46 +08:00
Your Name
2b2359e367 fix(ai-router): ADR-110 GCP 三層容災 — 修復 Ollama 直跳 Gemini 根因
All checks were successful
Code Review / ai-code-review (push) Successful in 55s
Details
run-migration / migrate (push) Successful in 41s
Details 
根因（所有告警 Ollama 失敗直接跳 Gemini 的原因）：
AIProviderEnum 缺少 ollama_gcp_a / ollama_gcp_b / ollama_local
→ AIProviderEnum("ollama_gcp_a") 拋 ValueError
→ fallback chain 清空（所有 GCP 端點轉換全失敗）
→ failover_fallback = []（空 list，非 None）
→ fallback_chain 被覆寫為 [] 而非走 Gemini 備援
→ AIProviderRegistry.get("ollama_gcp_a") 回傳 None → not_registered → 跳過
→ 整條 Ollama 鏈（GCP-A → GCP-B → 111）全部略過，直接跳 Gemini

修復：
1. AIProviderEnum 新增 OLLAMA_GCP_A / OLLAMA_GCP_B / OLLAMA_LOCAL
2. PROVIDER_LATENCY_BUDGET 補齊三個新 enum
3. ollama.py 新增 OllamaGcpBProvider（OLLAMA_SECONDARY_URL = GCP-B 34.21.145.224）
4. _init_registry() 補登：
   - "ollama_gcp_a" alias → OllamaProvider（GCP-A，OLLAMA_URL）
   - OllamaGcpBProvider（"ollama_gcp_b"，OLLAMA_SECONDARY_URL）
   - "ollama_local" alias → Ollama188Provider（111，OLLAMA_FALLBACK_URL）

修復後路由順序：GCP-A → GCP-B → Local(111) → Gemini → Claude

2026-05-04 ogt + Claude Sonnet 4.6

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-04 13:49:32 +08:00
Your Name
b6cf616707 fix(aiops): harden agent tool permission names
All checks were successful
CD Pipeline / tests (push) Successful in 1m32s
Details
Code Review / ai-code-review (push) Successful in 27s
Details
CD Pipeline / build-and-deploy (push) Successful in 8m26s
Details
CD Pipeline / post-deploy-checks (push) Successful in 3m37s
Details
2026-05-01 13:52:33 +08:00
Your Name
7e4d995e4b feat(aiops): add mcp agent loop foundation
Some checks failed
CD Pipeline / tests (push) Successful in 1m59s
Details
Code Review / ai-code-review (push) Successful in 28s
Details
run-migration / migrate (push) Failing after 24s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-05-01 13:21:19 +08:00
Your Name
d845d53257 fix(security): keep Gemini key out of request URLs
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 15m5s
Details
2026-04-29 22:56:12 +08:00
Your Name
fe2b8f4571 fix(flywheel): fallback on OpenClaw degraded responses
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 9m56s
Details
2026-04-29 22:38:57 +08:00
Your Name
dccdcdbaf5 fix(flywheel): unblock action safety and Claude fallback
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 9m45s
Details
2026-04-29 21:51:18 +08:00
Your Name
7b471e7ae2 fix(secret-leak): Gemini API key 從 prod log 清除（P0 SECRET LEAK）
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 2m6s
Details 
## 問題（2026-04-29 11:50 prod log 證據）

prod log 出現完整 Gemini API key 明碼：
```
"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=AIzaSyCqv7TY2iTGi2wa91d2irwH08VYXjT9YUk"
event: gemini_provider_failed
```

違反鐵律：
- feedback_secret_debug_output_ban.md: debug 含 secret 字串禁 echo/log 原值
- feedback_secrets_leak_incidents_2026-04-18.md: 已有 2 起 secret leak 事故

## 根因

`gemini.py:118` `logger.warning("gemini_provider_failed", error=str(e), ...)`

httpx HTTPStatusError str() 會包含完整 URL（含 ?key=... query string）：
- Google Gemini API 設計用 query string 傳 API key（不像 Claude/NVIDIA 用 header）
- httpx 拋例外時把 URL 寫進 error message
- str(e) 直接 log → key 進 K8s pod log → audit log → Sentry → 任何下游 log 接收方

## 修法

新增 `_sanitize_error()` 函式：
- regex `([?&])key=[^&\s'"]+` → `\1key=<redacted>`
- 在 `gemini_provider_failed` log 出口呼叫
- AIResult.error 也用 sanitize 過的（不污染下游）

只修 Gemini（其他 provider 用 header / 內網無 key）：
- Claude: API key 在 `x-api-key` header → 不在 URL → 安全
- OpenClaw: 內網 188:8088 → 無 API key → 安全
- Ollama: 內網 111:11434 → 無 API key → 安全
- NVIDIA: API key 在 `Authorization: Bearer` header → 安全

## 驗證

- 1635 unit tests 全綠（修法不破壞任何既有行為）
- 直接執行 sanitize 函式確認 `AIzaSy*` key 被替換成 `<redacted>`

## 已知債

- 此 commit 只防新 leak，**舊 log 中的 key 仍存在**（K8s pod log / Sentry / structlog backend）
- Gemini API key 仍應**輪換**（已洩漏的 key 不可信）
- 統帥需手動：
  1. 去 https://aistudio.google.com/apikey 新增 key
  2. 在 K8s secret 換 GEMINI_API_KEY
  3. 撤銷舊 key

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-29 19:49:09 +08:00
Your Name
02362eddcf feat(wave4-5): P1.3+P1.4 真接線 + Ollama_188 provider 註冊 + quota atomic 修復
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 2m0s
Details 
3 個 engineers 在限額前的 Wave 4/5 完成工作（補 commit）：

Engineer-B3 — Wave 4 P1.3+P1.4 真飛輪閉環（auto_repair_service.py 才是正確接線位置）:
- execute_auto_repair 成功後 fire-and-forget 啟動 PostExecutionVerifier
- record_verification_result 觸發 EWMA trust_score 演化
- snapshot=None（不依賴 EvidenceSnapshot，避免我之前 webhooks.py 補丁的 B2 bug）
- _pending_tasks 管理生命週期，Lifespan shutdown 時等任務完成

Engineer-A4 — Wave 5 B1-fix Ollama188Provider 註冊:
- ai_providers/ollama.py: 新增 Ollama188Provider(OllamaProvider) 子類
  - name="ollama_188", is_enabled 看 ENABLE_OLLAMA_188 + OLLAMA_FALLBACK_URL
  - analyze() 用 OLLAMA_FALLBACK_URL（192.168.0.188:11434）作為推理端點
- ai_router.py:_init_registry 補 registry.register(Ollama188Provider())
- 修復 BLOCKER：原本 failover_manager 決策返回 "ollama_188"，但 executor 查不到
  → not_registered → 188 從未被打到。Wave 2 P1.1 整套容災系統前段卡住。

Engineer-A4 — Wave 5 B3-fix Gemini quota TOCTOU 修復:
- ollama_failover_manager.py:_check_gemini_quota 改用 redis.pipeline()
  原 GET → 判斷 → INCR → EXPIRE 四步分離，並行請求在 GET/INCR 間競爭超發
  修法：SET NX(首次設 TTL) + INCR atomic pipeline，用 INCR 後新值判斷

Engineer-B3 — test_learning_chain_e2e.py（377 行 No-Mock 整合測試）:
- 純 Python Stub + monkeypatch（feedback_no_mock_testing.md 合規）
- execute_auto_repair 成功 → verifier 被呼叫 ✓
- execute_auto_repair 失敗 → verifier 不被呼叫 ✓
- matched_playbook_id=None → log warning 不 crash ✓
- verifier 拋例外 → 修復回傳成功，trust 不更新 ✓

Tests: 42 passed (failover_manager + ai_router_failover_integration 全綠)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Engineer-A4 + Engineer-B3 (上 session) <noreply@anthropic.com>
 2026-04-26 20:44:19 +08:00
OG T
d8c2969341 feat(telegram): AI 鏈路透明化 — 告警訊息顯示 OpenClaw + Tool Calling 模型/後端
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 12m12s
Details 
- nemotron.py: 偵測 OllamaToolProvider vs NvidiaProvider，記錄 tool_model/tool_backend
- openclaw.py: 傳播 nemotron_tool_model/nemotron_tool_backend 到 proposal
- decision_manager.py: 從 proposal_data 提取並傳給 send_approval_card()
- telegram_gateway.py: TelegramMessage 新增兩個欄位，format_with_nemotron 顯示
  "🔧 Tool Calling: llama3.1:8b (Ollama 本機)" 或 "NVIDIA 雲端"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-09 15:05:16 +08:00
OG T
d467fc11be fix(nemotron): 修復 deployment_name placeholder 問題 
根因: Nemotron tool calling 收到 target_resource=DockerContainerUnhealthy
  (非真實 K8s deployment name)，不確定時填 <deployment_name>

修復:
1. prompt 明確標注 deployment_name 必須填入 target_resource
2. 收到 tool call 結果後，偵測 placeholder 並用 target_resource 覆蓋

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-09 11:44:25 +08:00
OG T
53e1ae7ad7 fix(phase25): I2 NIM system prompt + I4 field_path 正則匹配修正
Some checks failed
CD Pipeline / Deploy Prometheus Alert Rules (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details 
I2: nemotron.analyze() 補上 system role (NIM 標準 message format)
    - 舊: messages=[{role:user, ...}]
    - 新: messages=[{role:system, ...}, {role:user, ...}]
    - 效果: K8s operator 角色定義，改善 tool calling 品質

I4: drift_detector._is_allowlisted/_is_critical 用正則取代 strip
    - 舊: replace('[*]','') 後 startswith/in → 無法匹配 containers[0]
    - 新: [*] → \[\d+\] 正則，正確匹配所有索引
    - 修復: containers[*].image 現在能匹配 containers[0].image
 2026-04-05 12:11:05 +08:00
OG T
96d5e18924 fix(p0): 實測修正 — timeout 依 benchmark 調整，_local_fallback_chain 移除雲端 Nemotron 
- config.py: NEMOTRON_DIAGNOSE_TIMEOUT_SECONDS=60s (NIM 實測 11-45s + 15s buffer)
- config.py: OLLAMA_DIAGNOSE_TIMEOUT_SECONDS=200s (Ollama 實測 ~173s + 27s buffer)
- ollama.py: 新增 per-task timeout (diagnose/force_local 用 200s)
- ai_router.py: _local_fallback_chain 移除 Nemotron (NIM=雲端，不可進 local chain)
- ai_router.py: v4.2 — Option C 分情境路由正式確立

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-05 00:29:09 +08:00
OG T
a562db4048 fix(phase25): 首席架構師 Review C1/C2/I1/I3 修正
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 57s
Details 
C1: NemotronProvider.privacy_level cloud→local
    NIM 部署在 192.168.0.188 內網，非官方雲端 API
    可納入 DIAGNOSE _local_fallback_chain 隱私邊界

C2: adopt() 端點暫停，返回 501
    API Pod 執行 git add -A 有安全風險
    ADR-057 起草後改用 Gitea PR API 實作

I1: timeout log 修正，記錄實際套用的 timeout 值
    原本永遠記錄 NEMOTRON_TIMEOUT_SECONDS=45
    現在記錄依 task_type 選擇的正確值

I3: route_sync() 補 DIAGNOSE 隱私邊界
    async route() 已有 _local_fallback_chain
    sync 版本遺漏，此次補齊

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-04 18:00:05 +08:00
OG T
3455044457 feat(phase25): Nemotron 主動防禦三方向 P0+P1+P2 完整實作
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 38s
Details
Type Sync Check / check-type-sync (push) Failing after 35s
Details 
P0 - DIAGNOSE Privacy-First Routing:
- ai_router.py: _local_fallback_chain [NEMOTRON→OLLAMA→REJECT]
- DIAGNOSE 意圖 override 改為 NEMOTRON (原 OLLAMA)
- DIAGNOSE fallback 使用 local-only 鏈，不觸碰雲端
- 全部失敗時 REJECT + Telegram 通知
- config.py: NEMOTRON_DIAGNOSE_TIMEOUT_SECONDS=30, OLLAMA_DIAGNOSE_TIMEOUT_SECONDS=60
- nemotron.py: 根據 context[task_type] 選擇 timeout

P1 - Knowledge Auto-Harvesting:
- models/knowledge.py: EntryType.AUTO_RUNBOOK + ANTI_PATTERN + symptoms_hash
- EntryStatus.PUBLISHED (ANTI_PATTERN 直接發布，無需審核)
- models/playbook.py: SymptomPattern.compute_hash() (16字元確定性 hash)
- services/runbook_generator.py: NemotronRunbookGenerator (v1.1)
  - generate_runbook() → AUTO_RUNBOOK (DRAFT) + Telegram 審核 card
  - generate_anti_pattern() → ANTI_PATTERN (PUBLISHED) + Telegram 通知
  - 使用 nvidia.chat() (正確介面)，Nemotron 超時時 Minimal fallback
- knowledge_service.py: check_anti_pattern(symptoms_hash, days=7)
- db/models.py: symptoms_hash VARCHAR(16) + ix_knowledge_symptoms_hash
- repositories/knowledge_repository.py: create() 支援 symptoms_hash + status
- auto_repair_service.py: anti_pattern_gate 在 decide() + runbook hook 在 execute()
- migrations/phase8_symptoms_hash.sql: ALTER TABLE + partial index + PUBLISHED constraint

P2 - Config Drift Detection:
- models/drift.py: DriftItem/DriftReport/DriftLevel/DriftIntent/DriftStatus
- services/drift_detector.py: GitStateReader + K8sStateReader + DriftDetector
- services/drift_analyzer.py: 白名單過濾 + DriftLevel 分級
- services/drift_interpreter.py: NemotronDriftInterpreter（意圖分析，不生成修復指令）
- services/drift_remediator.py: rollback(kubectl apply) + adopt(git push gitea)
- api/v1/drift.py: POST /scan, GET /reports, POST /rollback, POST /adopt
- migrations/phase9_drift_reports.sql: drift_reports 表
- k8s/drift-cronjob.yaml: 每小時自動掃描 CronJob

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-04 12:35:05 +08:00
OG T
58002e6bf4 feat(phase24-b3): NemotronProvider 抽取 + incident-card 重構
Some checks failed
E2E Health Check / e2e-health (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details 
Phase 24 B3:
- 新增 ai_providers/nemotron.py: NemotronProvider 封裝 K8s Tool Calling
  搬移自 openclaw.py _call_nemotron_tools (L1623-1785)
  capabilities=tool_calling, privacy_level=cloud
- ai_router.py: 加入 NemotronProvider 到 Registry
- ai_providers/__init__.py: 匯出 NemotronProvider

Phase R-UI2 (架構師 Warning):
- incident-card.tsx: 抽取 useApprovalAction hook
  handleApprove/handleReject 60行重複邏輯 → 共用 hook
  行為完全不變，維護性提升

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-02 23:12:42 +08:00
OG T
5a8aae89c4 fix(phase24): 首席架構師 Review C1/C2/C3/I4 修復
All checks were successful
CD Pipeline / build-and-deploy (push) Successful in 7m12s
Details
E2E Health Check / e2e-health (push) Successful in 18s
Details 
C1 (P0): AIRouterExecutor.execute() 補 Langfuse Trace (D5)
  - 建立 langfuse_trace("ai_router_execute") 包住整個執行鏈
  - 成功時記錄 generation (model/input/output/tokens/cost)
  - prod 所有 AI 呼叫現在有 LLMOps 追蹤

C2 (P0): 絞殺者改為呼叫 AIRouter.route() 智慧路由
  - 先取得 RoutingDecision (意圖分類 + 複雜度評分)
  - provider_order 從 selected_provider + fallback_chain 動態生成
  - D1 意圖路由矩陣、D7 隱私保護 (DIAGNOSE 強制 local) 生效

C3 (P1): 型別標注 typo 修復
  - AIProviderEnumEnum → AIProviderEnum
  - AIProviderEnumProtocol → AIProviderProtocol

I4 (P1): interfaces.py AIProvider Protocol 補 close() 定義

S1: ai_router.py 模組版本標頭更新至 v4.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-02 21:47:06 +08:00
OG T
3ad7b60f68 fix(ai): Phase 24 R1+R2 首席架構師 Review 修復 (C1-C3 + I1-I5)
Some checks failed
E2E Health Check / e2e-health (push) Successful in 18s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details 
Critical 修復:
- C1: AIProvider Enum 改名為 AIProviderEnum (避免與 Protocol 同名衝突)
- C2: 共用 Circuit Breaker → per-provider _SimpleCircuitBreaker
  (避免 Gemini 掛掉時 Ollama 也被擋)
- C3: cache_key 移到 try 外面 (避免 UnboundLocalError)

Important 修復:
- I1: Claude hardcode model → 用 get_model_registry()
- I2: Claude 追蹤 tokens/cost (input_tokens + output_tokens)
- I3: Ollama 追蹤 tokens (eval_count + prompt_eval_count)
- I4: Gemini temperature → 用 model_registry
- I5: AIProviderRegistry.close_all() shutdown hook

2026-04-02 ogt: Phase 24 首席架構師審查通過後修復

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-02 13:40:58 +08:00
OG T
73e8f8ab77 feat(ai): Phase 24-A+B1 — AI Provider Registry + 絞殺者包裝 (ADR-052)
Some checks failed
E2E Health Check / e2e-health (push) Successful in 16s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details 
Brain Layer 雙軌 Registry 架構:
- 新建 src/services/ai_providers/ 目錄 (interfaces + 4 providers)
  - OllamaProvider (local, rca/chat/code_review)
  - GeminiProvider (cloud, rca/chat)
  - ClaudeProvider (cloud, rca/chat/code_review)
  - OpenClawNemoProvider (cloud, rca — 委派 188→NIM)
- 擴展 ai_router.py 加入:
  - AIProviderRegistry (動態註冊/啟停)
  - AIRouterExecutor (Cache + 閘門 CB/RL/Sem + 執行)
- openclaw.py 絞殺者包裝: USE_AI_ROUTER=true 走新路徑
- config.py + ConfigMap 加入 USE_AI_ROUTER=false (安全預設)
- ADR-052 正式文件 (14 項決策 D1-D14)
- HARD_RULES v1.7 加入 AI Router 規範

安全: USE_AI_ROUTER=false 預設不啟用，需手動開啟觀察
回滾: kubectl set env deployment/awoooi-api USE_AI_ROUTER=false

2026-04-02 ogt: Phase 24 首批實作

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-02 13:16:09 +08:00