jd-opensource · yuzzjj · Apr 27, 2026 · Apr 27, 2026 · Apr 27, 2026 · Apr 27, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,36 @@
+# Root build context is only used by claudecode/codex runtime images.
+# Keep it small so Docker does not send frontend node_modules, backend venv,
+# local Rust targets, logs, or other large development artifacts.
+*
+!sandbox-runner/
+!sandbox-runner/**
+!proto/
+!proto/**
+!backend/
+!backend/app/
+!backend/app/joysafeter_orchestrator_rs/
+!backend/app/joysafeter_orchestrator_rs/**
+!deploy/
+!deploy/docker/
+!deploy/docker/**
+
+**/target/
+**/.git/
+**/.venv/
+**/node_modules/
+**/__pycache__/
+**/.pytest_cache/
+**/logs/
+**/*.log
+
+# Runtime images copy the prebuilt runner binary from repo-root target/.
+!target/
+!target/x86_64-unknown-linux-gnu/
+!target/x86_64-unknown-linux-gnu/release/
+!target/x86_64-unknown-linux-gnu/release/joysafeter-runner
+!target/aarch64-unknown-linux-gnu/
+!target/aarch64-unknown-linux-gnu/release/
+!target/aarch64-unknown-linux-gnu/release/joysafeter-runner
+!target/aarch64-unknown-linux-musl/
+!target/aarch64-unknown-linux-musl/release/
+!target/aarch64-unknown-linux-musl/release/joysafeter-runner
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -27,7 +27,7 @@ If applicable, add screenshots to help explain your problem.
 - Browser: [e.g., Chrome 120, Safari 17]
 - Python version: [e.g., 3.12.1]
 - Node.js version: [e.g., 20.10.0]
-- Project version: [e.g., 0.1.0]
+- Project version: [e.g., 0.3.2]
 
 ## Additional context
 Add any other context about the problem here.

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   # =============================================================================
-  # Main application images (backend, frontend, openclaw)
+  # Main application images (backend, frontend)
   # Build only (no push) — release.yml handles publishing versioned images
   # =============================================================================
   build:
@@ -29,10 +29,6 @@ jobs:
           - name: joysafeter-frontend
             context: ./frontend
             dockerfile: ./deploy/docker/frontend.Dockerfile
-          - name: joysafeter-openclaw
-            context: ./deploy/openclaw
-            dockerfile: ./deploy/openclaw/Dockerfile
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -80,10 +80,6 @@ jobs:
             context: ./frontend
             dockerfile: ./deploy/docker/frontend.Dockerfile
             push_dockerhub: true
-          - name: joysafeter-openclaw
-            context: ./deploy/openclaw
-            dockerfile: ./deploy/openclaw/Dockerfile
-            push_dockerhub: false
           - name: joysafeter-sandbox
             context: ./deploy/docker
             dockerfile: ./deploy/docker/sandbox.Dockerfile

diff --git a/.gitignore b/.gitignore
@@ -34,8 +34,6 @@ share/python-wheels/
 MANIFEST
 
 # PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
 *.manifest
 *.spec
 
@@ -62,23 +60,10 @@ cover/
 *.mo
 *.pot
 
-# Crew stuff:
-demo_stands/
-
-# Django stuff:
+# Logs
 *.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-db/*sqlite3
-*_stand/
 backend/logs/*
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
+backend/app/logs
 
 # Sphinx documentation
 docs/_build/
@@ -87,6 +72,10 @@ docs/_build/
 .pybuilder/
 target/
 
+# Rust / Cargo build + vendored caches (sandbox-runner)
+.cargo-home*/
+**/.cargo-home*/
+
 # Jupyter Notebook
 .ipynb_checkpoints
 
@@ -95,60 +84,33 @@ profile_default/
 ipython_config.py
 
 # pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
 # .python-version
 
-# pipenv
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-#Pipfile.lock
-
-# poetry
-#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
-
 # pdm
-#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#pdm.lock
-#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
-#   in version control.
-#   https://pdm.fming.dev/#use-with-ide
 .pdm.toml
 
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+# PEP 582
 __pypackages__/
 
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# SageMath parsed files
-*.sage.py
-
 # Environments
 *.env
 .env
+# .env backups / variants (.env.bak, .env.local, .env.prod, ...). The bare
+# `.env`/`*.env` rules above do NOT match `.env.<suffix>`, so list it
+# explicitly — these files routinely hold real secrets.
+.env.*
+**/.env.*
 .venv
 # env.* 会误伤 backend/alembic/env.py，故只忽略根目录下的 env.*
 /env.*
 !frontend/lib/core/config/env.ts    # 允许前端配置文件
-src/ENV/
 venv/
 ENV/
 env/
 env.bak/
 venv.bak/
-.django_venv
-.crew_venv
 *venv
 venvs/
-run_program/manager.env
 !src/.env
 !src/debug.env
 
@@ -158,6 +120,24 @@ run_program/manager.env
 !env.example
 !**/env.example
 
+# Deploy sensitive files (contain real secrets / site-specific config)
+deploy/.env.remote.example
+deploy/docker-compose.remote.yml
+
+# Docker image archives
+/deploy/*.tar
+/deploy/docker/claude-code-best-*.tgz
+
+# Runtime data (user uploads, logs)
+backend/data/
+
+# Scripts, logs, docs (not for git)
+scripts/
+logs/
+backend/scripts/
+backend/logs/
+backend/docs/
+
 # Spyder project settings
 .spyderproject
 .spyproject
@@ -183,10 +163,6 @@ dmypy.json
 cython_debug/
 
 # PyCharm
-#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#  and can be added to the global gitignore or merged into this file.  For a more nuclear
-#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 .idea/
 
 # VSCode
@@ -195,8 +171,6 @@ cython_debug/
 # Logging files
 log.txt
 .telemetry_log/
-
-backend/langgraph_app.*
 backend/app/logs
 *.jsonl
 
@@ -221,17 +195,11 @@ api_keys.json
 .secrets.baseline.scan.json
 .secrets.baseline.tmp
 
-# Additional tool
-additional_tools/
-make_scripts/backups
-
 # Savefiles
 **/savefiles
 
 # FRONTEND GIT ignore
 
-
-
 # Compiled output
 frontend/dist
 frontend/tmp
@@ -281,19 +249,19 @@ frontend/typings
 frontend/.DS_Store
 Thumbs.db
 
-executions
-openai-realtime-console
-src/django_app/staticfiles/*
-
-
-#knowledge data
-knowledge/graph_data/
+/executions
 
 # IDE/Editor folders
 .claude/
 .cursor/
 .specify/
 
+# File storage
+backend/data/files/
+
+# Local Rust orchestrator experiment (do not publish)
+backend/app/joysafeter_orchestrator_rs/
+
 deploy/docker/mcp/mcp_servers/jebmcp/jeb
 deploy/docker/mcp/mcp_servers/jebmcp/core
 deploy/docker/mcp/mcp_servers/jebmcp/logs
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -29,8 +29,7 @@ repos:
       - id: ruff-format
         files: ^backend/
 
-  # Backend - Ruff check (强制检查，不允许错误)
-  # 注意：此 hook 会检查整个 backend 目录，确保没有 lint 错误
+  # Backend - Ruff strict check
   - repo: local
     hooks:
       - id: backend-ruff-check
@@ -39,22 +38,10 @@ repos:
         language: system
         files: ^backend/.*\.py$
         pass_filenames: false
-        always_run: false  # 只在有 Python 文件更改时运行
-        stages: [commit]
+        always_run: false
+        stages: [pre-commit]
 
-  # Python - Type checking (mypy runs in Backend CI job only; skipped in pre-commit)
-  # - repo: https://github.com/pre-commit/mirrors-mypy
-  #   rev: v1.13.0
-  #   hooks:
-  #     - id: mypy
-  #       files: ^backend/app/
-  #       args: [--ignore-missing-imports]
-  #       additional_dependencies:
-  #         - types-requests
-  #         - types-PyYAML
-
-  # Frontend - ESLint (强制检查，不允许错误)
-  # 注意：此 hook 会检查整个 frontend 目录，确保没有 lint 错误
+  # Frontend - ESLint + TypeScript type-check + Prettier format check
   - repo: local
     hooks:
       - id: frontend-lint
@@ -63,8 +50,26 @@ repos:
         language: system
         files: ^frontend/.*\.(ts|tsx|js|jsx)$
         pass_filenames: false
-        always_run: false  # 只在有前端文件更改时运行
-        stages: [commit]
+        always_run: false
+        stages: [pre-commit]
+
+      - id: frontend-type-check
+        name: Frontend TypeScript Check
+        entry: bash -c 'cd frontend && bun run type-check || exit 1'
+        language: system
+        files: ^frontend/.*\.(ts|tsx)$
+        pass_filenames: false
+        always_run: false
+        stages: [pre-commit]
+
+      - id: frontend-format-check
+        name: Frontend Prettier Check
+        entry: bash -c 'cd frontend && bun run format:check || exit 1'
+        language: system
+        files: ^frontend/.*\.(ts|tsx|js|jsx|json|css|md)$
+        pass_filenames: false
+        always_run: false
+        stages: [pre-commit]
 
 # CI configuration
 ci:

diff --git a/.pre-commit-setup.md b/.pre-commit-setup.md
@@ -12,6 +12,8 @@
 
 ### 前端检查
 1. **ESLint** - JavaScript/TypeScript 代码检查
+2. **TypeScript Check** - `tsc --noEmit`
+3. **Prettier Format Check** - 检查前端 TS/JS/JSON/CSS/Markdown 格式
 
 ### 通用检查
 - 行尾空白检查
@@ -108,7 +110,7 @@ backend/.venv/bin/python -m pre_commit run frontend-lint --all-files
   backend/.venv/bin/python -m pre_commit run --all-files
   ```
 
-### 问题：`uv run ruff check` 找不到命令
+### 问题：`backend/.venv/bin/ruff check` 找不到命令
 
 **解决方案：**
 1. 确保已安装 uv：`curl -LsSf https://astral.sh/uv/install.sh | sh`
@@ -150,8 +152,10 @@ backend/.venv/bin/python -m pre_commit install --install-hooks
 配置文件：`.pre-commit-config.yaml`
 
 主要配置：
-- **后端 Ruff Check**: 使用 `uv run ruff check .` 检查整个 backend 目录
+- **后端 Ruff Check**: 使用 `backend/.venv/bin/ruff check .` 检查整个 backend 目录
 - **前端 ESLint**: 使用 `bun run lint` 检查整个 frontend 目录
+- **前端 TypeScript Check**: 使用 `bun run type-check`
+- **前端 Prettier Check**: 使用 `bun run format:check`
 - 两个检查都设置为 `always_run: false`，只在相关文件更改时运行
 
 ## 最佳实践

diff --git a/.tmp/api.pid b/.tmp/api.pid
@@ -0,0 +1 @@
+74225
diff --git a/.tmp/orchestrator.pid b/.tmp/orchestrator.pid
@@ -0,0 +1 @@
+74226
diff --git a/.tmp/worker.pid b/.tmp/worker.pid
@@ -0,0 +1 @@
+74227
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -103,7 +103,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 - Docker 构建流程优化：限制为仅构建，仅在 release 时推送镜像
 - 新增 Docker Hub 双推送支持（ghcr.io + docker.io）
-- 移除 MCP 镜像并跳过 openclaw 的 DockerHub 推送
+- 移除 MCP 镜像并跳过 DockerHub 推送
 
 ### 其他
 
@@ -243,7 +243,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 ### System Architecture
 
 - **Multi-Tenant Sandbox Engine**
-  - Strict per-user isolation for code execution environments (OpenClaw)
+  - Strict per-user isolation for code execution environments
   - Guarantees data sovereignty and prevents state leakage between concurrent sessions
 
 - **Glass-Box Observability**