handleSetupWeixinPoll reads `api_url` from the request body, trims a
trailing "/", and then does:
u, _ := url.Parse(apiBase + "/")
u = u.JoinPath("ilink", "bot", "get_qrcode_status")
For inputs like `"://"`, `"://malformed"`, or `"%zz"`, `url.Parse`
returns a nil *URL together with a non-nil error. The discarded error
means the next line dereferences a nil pointer and crashes the
management server with `runtime error: invalid memory address or nil
pointer dereference`. The management API is authenticated, but an
operator pasting a typo in the WeChat setup form is enough to bring
down the daemon — and the panic propagates out of the HTTP handler
goroutine.
handleSetupWeixinBegin already validates the same `apiBase + "/"`
parse and returns HTTP 400 on error. Mirror that handling here:
u, err := url.Parse(apiBase + "/")
if err != nil {
mgmtError(w, http.StatusBadRequest, "invalid api_url")
return
}
Add TestMgmt_SetupWeixinPoll_RejectsMalformedAPIURL covering three
malformed inputs ("://", "://malformed", "%zz"). The test wraps the
handler call in a defer/recover so a regression to the panicking
behaviour produces a clear test failure rather than crashing the test
binary, then asserts the response is HTTP 400. Confirmed to fail on
main with the exact panic and pass on this branch.
- Project creation wizard now requires work_dir (working directory) and
allows selecting agent_type (claudecode, codex, gemini, cursor, etc.)
- work_dir and agent_type are passed through QR setup (feishu/weixin)
and manual platform form creation paths
- Project settings page reorganized into three sections:
- Agent: work_dir, permission mode (default/acceptEdits/plan/yolo/dontAsk)
- General: quiet, context indicator toggle, language, admin_from,
disabled commands
- Platform access control: per-platform allow_from editing
- Backend: GET /projects/{name} now returns work_dir, agent_mode,
show_context_indicator, and platform_configs with allow_from
- Backend: PATCH /projects/{name} accepts and persists work_dir, mode,
show_context_indicator, and platform_allow_from to config.toml
- config.AddPlatformToProject accepts workDir/agentType for new projects
- SaveProjectSettings refactored to use ProjectSettingsUpdate struct
- Added GetProjectConfigDetails to read extended config from TOML
- i18n: all 5 languages updated with new translation keys
Made-with: Cursor
- Fix WeChat QR polling stuck in "waiting for scan" caused by React 18
StrictMode double-mount leaving cancelledRef as true; reset refs at
flow start and inline polling loop to avoid stale closure issues
- Increase iLink API poll timeouts (37s context, 40s HTTP client) and
Vite proxy timeout (45s) to match long-poll behavior
- Add debug logging to WeChat QR begin/poll handlers for troubleshooting
- Fix restart API returning 400 on empty body; make JSON body optional
- Add restart button to platform setup completion screen with i18n
- Add TOML config formatter: insert blank lines between sections, strip
zero-value keys and empty sections for cleaner config output
Made-with: Cursor
- Add generic AddPlatformToProject API (POST /projects/{name}/add-platform)
that persists any platform type + options to config.toml, creating the
project automatically if it doesn't exist.
- Add PlatformManualForm component with field metadata for 8 non-QR
platforms (Telegram, Discord, Slack, DingTalk, WeChat Work, QQ,
QQ Bot, LINE), supporting password toggle, required validation,
and collapsible advanced options.
- Integrate manual forms into both the project creation wizard and
the project detail "Add platform" dialog, replacing the previous
"edit config.toml" fallback.
- Add i18n translations for all 28 platform field labels and hints
across all 5 locales (EN/ZH/ZH-TW/JA/ES).
Made-with: Cursor
- Add backend setup API endpoints for Feishu and Weixin QR onboarding
flow (/api/v1/setup/{feishu,weixin}/{begin,poll,save}), proxying
external registration APIs and persisting credentials via existing
config.EnsureProjectWith* + SavePlatformCredentials functions.
- Add PlatformSetupQR React component with full QR scan lifecycle:
idle → scanning → scanned → saving → completed, with retry on
expiry/error.
- Restore "Add project" button on project list with a multi-step
wizard (name → platform selection → QR or manual setup).
- Expand "Add platform" dialog in project detail to support all 10
platform types (Feishu, WeChat, Telegram, Discord, Slack, DingTalk,
WeChat Work, QQ, QQ Bot, LINE), with QR flow for Feishu/WeChat and
manual config guidance for others.
- Add responsive font scaling in index.css (17px at 1536px, 18px at
1920px, 20px at 2560px) for better readability on large screens.
- Add i18n keys for setup flow in all 5 locales (EN/ZH/ZH-TW/JA/ES).
Made-with: Cursor
