When a manual, desktop-owned collect task succeeds after clearing a human
verification gate, requeue the automatic monitoring tasks that were
previously skipped for the same tenant/business-date/platform/client with
the human-verification skip reason. Restored tasks are reset to pending
(clearing lease, callback, and completion fields), stamped with a
recovery marker in their payload, and their brand projections are
rebuilt after commit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an optional lane filter to the monitor task lease so callers can pull
a specific lane (e.g. high) and scope authorization-failure cancellation
to the failing task's business date, so a challenge on one day no longer
cancels queued tasks for another day. Monitor authorization-failure
cancellation now requires a business date and no-ops without one. Also
stop writing the nonexistent desktop_tasks.completed_at column when
canceling queued tasks for an authorization failure.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
In ranking or recommendation entries, competitors from the source
article must be replaced with verifiable local companies matching the
target brand's region and business scope; category-style placeholder
names are forbidden, and unverifiable entries are dropped instead of
kept or invented.
- Make source_url optional and add source_content to the request; the
two are normalized into a source kind ("url" | "content"), URL wins
when both are present, and missing both returns source_required
- Skip web fetching in the generation worker when pasted content is
provided; truncate it to the same 24,000-rune cap
- Label untitled pasted-content jobs with a locale-aware display title
and mark the source kind in wizard state and prompt metadata
- Cover source normalization, truncation, and display title with tests
- Require rewrite output to weave in verifiable numbers from the brand
knowledge base, web search, or company profile to highlight advantages
and credibility
- Rewrite competitor-specific numbers into plain, unremarkable wording
(e.g. "1000+ stores" becomes "nationwide store coverage")
- Keep article length and structure aligned with the source article
instead of the fixed ~2000-character target
When a monitor task's final account hits human verification or an
authorization failure, cancel the remaining queued desktop/monitoring
tasks for the whole platform instead of only the same account. Follow-up
tasks are now marked skipped/aborted (not failed) with a
platform_human_verification / platform_authorization_unavailable reason
and a user-facing cancellation message, and emit task_canceled lifecycle
events for monitor kinds.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Assert uniqueMonitorDesktopTaskPlatformIDs trims and collapses duplicate
account specs, and tighten the healthier-candidate case with a target
length check. Apply gofmt alignment fixes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move media favorites from client state to PostgreSQL with server-side
search and pagination.
- Store favorites keyed by (tenant, user, group, resource) so a resource
can belong to multiple groups; the 500-resource cap counts distinct
resources, not memberships.
- Add favorite-group CRUD and group/global removal routes, with silent
cleanup of delisted or invisible resources on read.
- Serve favorite resource details server-side, 10 per page, with name/ID
search; favorites-page removal is group-scoped, resources-page removal
is global.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Include the current brand description in template, custom, imitation,
and KOL article-generation prompts while bounding prompt growth.
- Add a shared brand-context builder that resolves the current brand,
compacts long descriptions, and caps rendered output at 2000 runes.
- Snapshot a structured brand prompt context on queued tasks so old
jobs stay reproducible and retries stay stable.
- Route brand-profile facts through the existing typed fact guard so
founding dates and year counts get the same pre-persistence validation
as RAG facts, with brand facts outranking conflicting RAG facts.
- Fix the KOL creator to attach the brand scope its worker consumes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ensure numeric facts present in retrieved knowledge (especially company
founding dates) cannot be silently contradicted in generated articles.
- Add a typed fact guard that extracts constraints (dates, experience
years, etc.) from precise facts, detects source conflicts, and
validates generated content before persistence with a bounded repair
retry.
- Surface fact constraints through KnowledgeContext and render them as
a canonical, non-derivable fact block in the knowledge prompt section.
- Tighten prompt intro lines to forbid rewriting, mixing old values,
or deriving service years from founding dates.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Introduce process-local and Redis-backed global rate limiting for the
shared LLM client, plus a dedicated generation consumer prefetch knob.
- Add request (RPM) and token (TPM) rate limits with burst controls,
process or global scope, and fail-closed/process-degraded failover
- Wire the LLM client through NewWithRedis so limits can be shared
across replicas via a Redis token bucket
- Add generation_consumer_prefetch to tune RabbitMQ generation
consumers independently of the default prefetch
- Bump generation worker_concurrency to 24 and promote golang.org/x/time
to a direct dependency
- Drop t.Parallel() from a few middleware/bootstrap tests
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
When the article locale is en-US, Chinese prompt templates could leak
Chinese wording into generated titles, outlines, and article bodies.
Add high-priority language-consistency guards so the model treats the
Chinese template text as internal instructions and emits English only.
- Append per-artifact locale guards (analyze/title/outline) in template
assist prompts and an article-body guard in the generation prompt,
only when locale is en-US
- Reinforce locale consistency in the title/outline runtime prompts and
drop retained images from the rewrite prompt
- Cover the new guards with unit tests
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Previously AI point cost was computed from request (input) characters at
reservation time. Switch to reserving a single point up front and
settling the final cost from the generated output length on completion.
- Reserve 1 point (or FixedPoints) instead of pricing on request chars
- On completion, recompute points from output chars vs base chars,
update the reservation amounts, and post a ledger delta for the
top-up/refund; invalidate the workspace quota summary cache
- MarkCompleted now persists final request_chars/base_chars/points
- Use ceil division in calculateAIPointCost so an exact base boundary
charges one point instead of rolling over
- Thread output text through all CompleteAIPoints callers (article
selection, KOL assist, question expansion, template assist, compliance
judge) and return the settled reservation
- Add unit tests plus an integration test gated on TEST_DATABASE_URL
- Update the user manual: billing is by output characters
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the hardcoded doubao-lite model used for monitoring answer
parsing and compliance LLM judging with configurable values, resolved
from config with env overrides and a legacy default fallback.
- Add llm.monitoring_answer_parse_model and compliance.llm_judge_model
to config struct, env overrides, and all config files
- Thread the resolved model through MonitoringCallbackService via a
ConfigProvider and into parseMonitoringAnswerWithLLM
- Pass compliance.llm_judge_model into the review-job LLM request
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GetRecentArticlesByBrand now folds the latest publish record per target
into an aggregated publish_status (publishing / partial_success / success
/ failed), falling back to the stored status when no records exist.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Aggregate publish status from the latest record per publishing target
using a shared target-identity expression, so retries and multi-record
targets no longer inflate the status buckets.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add CancelStaleQueuedPublishTasks to abort publish tasks that sit in the
queue past a configurable timeout (default 3 days) without being claimed by
a desktop client, so they no longer linger indefinitely as 'queued'. The
lease recovery worker runs the cleanup each cycle and reports a
cancelled_queued count; the timeout is configurable via job run config.
Aborted tasks carry a publish_queue_timeout error payload with a readable
Chinese duration, and the admin-web publish summary surfaces it as an
auto-cancelled queue-timeout message.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add normalizeDesktopTaskCompletionStatusForTask so an "unknown" publish
completion is downgraded to "failed" when the payload is a manual retry or
the error matches a definitive publish failure, instead of leaving it
stuck as unknown.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the in-place requeue of submit-uncertain unknown publish tasks
with an explicit supersede-and-create-new flow: manual retries mark the
old unknown task failed (manual_retry_superseded) and create a fresh task
carrying manual_retry / superseded_unknown_task_ids in its payload.
Also fold title-length validation into definitivePublishFailurePattern and
check the pattern before the publish_submit_uncertain guard so those
failures are released from the dedup set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a sort_order column to brands with a migration, expose a
PUT /api/tenant/brands/order reorder endpoint, and wire the
admin-web BrandsView with drag-and-drop reordering plus i18n.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rotated refresh tokens now stay valid for a 60s grace window so
concurrent refreshes (e.g. multiple browser tabs) each obtain a valid
new pair instead of being logged out. Admin-web additionally serializes
refreshes across tabs via the Web Locks API and reuses tokens already
rotated by another tab.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Added classification for `doubao_challenge_required` as a challenge in platform-auth-adapters.
- Enhanced account action summaries to include specific messages for Doubao human verification.
- Introduced monitoring functions to filter out blocked platforms based on account health.
- Updated task leasing to support platform-specific filtering for monitor tasks.
- Refined issue aggregation in HomeView to consolidate Doubao challenge failures into a single actionable item.
- Improved backend logic to handle platform IDs in task leasing requests and responses.
- Added tests for new functionality, ensuring proper handling of Doubao challenges and task leasing logic.
root
Xu Liang