Optimize: cleanup, docs, and CI improvements - #1
Conversation
The original .gitignore had 'Thumbs.db*.msi' on one line, which neither matched Thumbs.db nor *.msi files. Now properly separated and added more build artifact patterns.
- Replace React/Vite/TS with accurate Yew (Rust → WASM) frontend - Remove npm commands (no package.json exists) - Fix architecture diagram to match actual Rust workspace - Add agent server API section, project structure tree - Add CI secrets documentation
- Add lint-and-test job: cargo fmt, clippy, test, WASM dev build - Build job now depends on lint-and-test passing first - Add platform labels to matrix for better log readability - Add cargo clippy with -D warnings for CI gate
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6fe4bc7732
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Run cargo clippy | ||
| run: cargo clippy --all-targets --all-features -- -D warnings |
There was a problem hiding this comment.
In the new Ubuntu lint-and-test job, cargo clippy --all-targets --all-features is the first step that compiles the workspace, including the Tauri backend, but this job never installs the Linux WebKit/AppIndicator/pkg-config dependencies that the later build job installs. On a clean ubuntu-latest runner those Tauri system crates fail during build script discovery, and because the matrix build now has needs: lint-and-test, every installer build is skipped until the dependency install block is also added to this prerequisite job.
Useful? React with 👍 / 👎.
|
|
||
| 启动后 Nexus 自动在 **端口 18789** 启动 Agent Server，提供 HTTP API： | ||
| ```bash | ||
| curl -X POST http://localhost:18789/chat \ |
There was a problem hiding this comment.
The documented Agent Server example posts to /chat, but the server only registers POST /api/chat in src-tauri/src/agent_server/mod.rs and there is no /chat route. Users following this newly added README section will get a 404 from a running Nexus instance; the example should use http://localhost:18789/api/chat.
Useful? React with 👍 / 👎.
| cd nexus | ||
| npm install | ||
| npm run tauri dev | ||
| cargo tauri dev |
There was a problem hiding this comment.
The new quick-start/build docs tell a fresh checkout to run cargo tauri dev/build directly, but src-tauri/tauri.conf.json has empty beforeDevCommand/beforeBuildCommand; dev mode points at http://localhost:1420, and production loads ../dist. Since the generated dist/nexus.js and dist/nexus_bg.wasm are ignored and not tracked, these commands either wait/fail for a missing dev server or package an app whose index.html references missing frontend assets unless users run wasm-pack/serve the frontend first.
Useful? React with 👍 / 👎.
|
|
||
| ### Agent 工具调用 | ||
|
|
||
| Nexus 的所有工具调用（shell、文件写入、网络请求）都经过 **Approval Gateway** 审查： |
There was a problem hiding this comment.
This policy now says every shell/file/network tool call is reviewed by Approval Gateway, but the actual chat execution paths call tool.execute(...) directly after registry lookup without invoking engine.approval.check. In deployments where users rely on SECURITY.md before enabling the Agent Server or providers, dangerous tool calls can run without the promised confirmation, so the policy should describe the current limits or the execution path must enforce approval.
Useful? React with 👍 / 👎.
| ### LLM API Keys | ||
|
|
||
| API Keys 存储在 `~/.nexus/.env`（Linux/macOS）或 `%APPDATA%/nexus/.env`（Windows）中： | ||
| - 文件权限默认 600（仅所有者可读） |
There was a problem hiding this comment.
~/.nexus/.env is written with std::fs::write in persist_env_file and no Unix mode is set, so on common umasks a newly created file can be group/world-readable rather than 0600. The security policy now tells users only the owner can read API keys; that guarantee should be removed or backed by explicit permission setting.
Useful? React with 👍 / 👎.
1 participant
Summary
This PR brings several important improvements to the nexus repository:
1. Fix .gitignore (bug)
The original
.gitignorehad a broken patternThumbs.db*.msiwhich matched neitherThumbs.dbnor*.msifiles. Fixed by separating them into proper patterns and adding more build artifact patterns (.dmg,.deb,.AppImage,.exe) plus Tauri/Node ignore rules.2. Correct README (docs)
The README incorrectly described the frontend as React/Vite/TypeScript, but the actual frontend is Yew 0.23 (Rust compiled to WebAssembly). Fixed:
npmcommands (project has nopackage.json)cargo tauri dev/cargo tauri buildcommands3. Enhance CI (ci)
Added
lint-and-testjob as a prerequisite for builds:cargo fmt --check- code formattingcargo clippy -D warnings- lintingcargo test --all- unit testswasm-pack build --dev- WASM frontend build check4. Add project docs (docs)
Commits in this PR:
fix: correct .gitignore- fix Thumbs.db/MSI pattern bugdocs: correct README- accurate Yew WASM descriptionci: add lint-and-test job- gate builds with lint + testdocs: add CONTRIBUTING.md- contributor guidedocs: add SECURITY.md- security policy