v2026.06.24

.github/workflows/sync-main-into-dev.yml

@@ -0,0 +1,126 @@
+name: Sync main into dev
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      sync_label:
+        description: "Optional label to use in the sync branch and PR title"
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: sync-main-into-dev-${{ github.sha || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  sync-main-into-dev:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch branches
+        run: git fetch origin main dev
+
+      - name: Resolve sync label
+        id: sync
+        env:
+          INPUT_SYNC_LABEL: ${{ github.event.inputs.sync_label }}
+        run: |
+          set -euo pipefail
+
+          main_sha="$(git rev-parse --short=12 origin/main)"
+          sync_label="${INPUT_SYNC_LABEL:-main-${main_sha}}"
+          safe_label="$(printf '%s' "$sync_label" | tr -c 'A-Za-z0-9._-' '-' | sed -e 's/^-*//' -e 's/-*$//')"
+
+          if [ -z "$safe_label" ]; then
+            safe_label="main-${main_sha}"
+          fi
+
+          echo "label=$sync_label" >> "$GITHUB_OUTPUT"
+          echo "safe_label=$safe_label" >> "$GITHUB_OUTPUT"
+
+      - name: Check branch difference
+        id: diff
+        run: |
+          set -euo pipefail
+
+          counts="$(git rev-list --left-right --count origin/main...origin/dev)"
+          read -r main_only dev_only <<< "$counts"
+
+          echo "main_only=$main_only" >> "$GITHUB_OUTPUT"
+          echo "dev_only=$dev_only" >> "$GITHUB_OUTPUT"
+          echo "origin/main only: $main_only"
+          echo "origin/dev only: $dev_only"
+
+      - name: Skip when dev is not behind main
+        if: steps.diff.outputs.main_only == '0'
+        run: echo "dev is not behind main; nothing to sync."
+
+      - name: Merge main into generated sync branch
+        if: steps.diff.outputs.main_only != '0'
+        id: merge
+        env:
+          SAFE_SYNC_LABEL: ${{ steps.sync.outputs.safe_label }}
+          SYNC_LABEL: ${{ steps.sync.outputs.label }}
+        run: |
+          set -euo pipefail
+
+          branch="chore/sync-main-into-dev-${SAFE_SYNC_LABEL}"
+
+          git switch -C "$branch" origin/dev
+          git merge --no-ff origin/main -m "chore: sync main into dev after ${SYNC_LABEL}"
+          git push --force-with-lease -u origin "$branch"
+
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+
+      - name: Create or reuse pull request
+        if: steps.diff.outputs.main_only != '0'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SYNC_BRANCH: ${{ steps.merge.outputs.branch }}
+          SYNC_LABEL: ${{ steps.sync.outputs.label }}
+          MAIN_ONLY: ${{ steps.diff.outputs.main_only }}
+          DEV_ONLY: ${{ steps.diff.outputs.dev_only }}
+        run: |
+          set -euo pipefail
+
+          existing_pr="$(gh pr list --base dev --head "$SYNC_BRANCH" --state open --json url --jq '.[0].url // ""')"
+          if [ -n "$existing_pr" ]; then
+            echo "Existing sync PR: $existing_pr"
+            exit 0
+          fi
+
+          body_file="$(mktemp)"
+          cat > "$body_file" <<EOF
+          This PR was created automatically after origin/main was updated.
+
+          It merges origin/main into origin/dev to clear dev's behind count while preserving dev-only commits.
+
+          Sync label: ${SYNC_LABEL}
+
+          Branch comparison before sync:
+          - origin/main only: ${MAIN_ONLY}
+          - origin/dev only: ${DEV_ONLY}
+          EOF
+
+          gh pr create \
+            --base dev \
+            --head "$SYNC_BRANCH" \
+            --title "chore: sync main into dev after ${SYNC_LABEL}" \
+            --body-file "$body_file"

README.md

@@ -1,8 +1,19 @@
-# Flocks
-
-**English** | [简体中文](README_zh.md)
-
-AI-Native SecOps Platform
+<h1 align="center">Flocks</h1>
+
+<p align="center">
+  AI-Native SecOps Platform
+</p>
+
+<p align="center">
+  <a href="https://agentflocks.github.io/flocks-docs/"><img alt="Docs" src="https://img.shields.io/badge/docs-agentflocks.github.io-555555?style=for-the-badge"></a>
+  <a href="https://github.com/AgentFlocks/flocks/releases"><img alt="Release" src="https://img.shields.io/badge/release-v2026.6.18-f06f2f?style=for-the-badge"></a>
+</p>
+
+<p align="center">
+  <a href="LICENSE.txt"><img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-52b100?style=for-the-badge"></a>
+  <a href="README.md"><img alt="English" src="https://img.shields.io/badge/lang-English-e33f44?style=for-the-badge"></a>
+  <a href="README_zh.md"><img alt="Chinese" src="https://img.shields.io/badge/lang-%E4%B8%AD%E6%96%87-e33f44?style=for-the-badge"></a>
+</p>
 
 ![Flocks WebUI](assets/flocks.webp)
 

README_zh.md

@@ -1,8 +1,19 @@
-# Flocks
-
-[English](README.md) | **简体中文**
-
-AI 原生 SecOps 平台
+<h1 align="center">Flocks</h1>
+
+<p align="center">
+  AI 原生 SecOps 平台
+</p>
+
+<p align="center">
+  <a href="https://agentflocks.github.io/flocks-docs/"><img alt="文档" src="https://img.shields.io/badge/docs-agentflocks.github.io-555555?style=for-the-badge"></a>
+  <a href="https://github.com/AgentFlocks/flocks/releases"><img alt="Release" src="https://img.shields.io/badge/release-v2026.6.18-f06f2f?style=for-the-badge"></a>
+</p>
+
+<p align="center">
+  <a href="LICENSE.txt"><img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-52b100?style=for-the-badge"></a>
+  <a href="README.md"><img alt="English" src="https://img.shields.io/badge/lang-English-e33f44?style=for-the-badge"></a>
+  <a href="README_zh.md"><img alt="中文" src="https://img.shields.io/badge/lang-%E4%B8%AD%E6%96%87-e33f44?style=for-the-badge"></a>
+</p>
 
 ![Flocks Web](assets/flocks.webp)
 

flocks/cli/service_manager.py

@@ -34,13 +34,20 @@
 
 MIN_NODE_MAJOR = 22
 FOLLOW_POLL_INTERVAL = 0.5
+MAX_SERVICE_LOG_BYTES = 1024 * 1024 * 1024
+LOG_TRIM_CHUNK_BYTES = 1024 * 1024
 WEBUI_DIRECT_BACKEND_URLS_ENV = "FLOCKS_WEBUI_DIRECT_BACKEND_URLS"
 DEFAULT_FLOCKS_CONSOLE_BASE_URL = "https://portalflocks.threatbook.cn"
 DEFAULT_VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS = "portalflocks.threatbook.cn"
 MISSING_PORT_OWNER_TOOLS_WARNING = (
     "未检测到 lsof 或 fuser，无法解析端口占用 PID；将退回到 bind 检查。"
     "可尝试安装：apt/yum install lsof -y"
 )
+WINDOWS_FRONTEND_BUILD_ASSERTION_MARKERS = (
+    "UV_HANDLE_CLOSING",
+    "src\\win\\async.c",
+    "src/win/async.c",
+)
 
 
 class ServiceError(RuntimeError):
@@ -557,10 +564,12 @@ def _windows_process_snapshot(pid: int) -> dict[str, str] | None:
             check=False,
             capture_output=True,
             text=True,
+            encoding="utf-8",
+            errors="replace",
         )
         if completed.returncode == 0:
             with contextlib.suppress(json.JSONDecodeError):
-                payload = json.loads(completed.stdout.strip() or "{}")
+                payload = json.loads((completed.stdout or "").strip() or "{}")
                 if isinstance(payload, dict):
                     return {
                         "name": str(payload.get("Name") or ""),
@@ -1036,14 +1045,20 @@ def start_frontend(config: ServiceConfig, console) -> None:
     frontend_env = build_frontend_env(config)
     if not config.skip_frontend_build:
         console.print("[flocks] 构建 WebUI...")
-        completed = subprocess.run(
-            [npm, "run", "build"],
-            cwd=webui_dir,
-            check=False,
-            env=frontend_env,
-        )
+        run_kwargs: dict[str, object] = {"cwd": webui_dir, "check": False, "env": frontend_env}
+        if sys.platform == "win32":
+            run_kwargs.update({"capture_output": True, "text": True, "encoding": "utf-8", "errors": "replace"})
+        completed = subprocess.run([npm, "run", "build"], **run_kwargs)
         if completed.returncode != 0:
-            raise ServiceError("WebUI 构建失败。")
+            output = "\n".join(
+                value for value in (getattr(completed, "stdout", None), getattr(completed, "stderr", None)) if value
+            )
+            if windows_frontend_build_assertion_is_recoverable(webui_dir, output):
+                console.print("[flocks] WebUI 构建产物已生成，忽略 Windows Node.js 退出断言。")
+            else:
+                if output:
+                    console.print(output)
+                raise ServiceError("WebUI 构建失败。")
 
     command = [
         npm,
@@ -1612,6 +1627,15 @@ def websocket_access_base_url(config: ServiceConfig) -> str:
     return _http_to_ws_url(backend_access_base_url(config))
 
 
+def windows_frontend_build_assertion_is_recoverable(webui_dir: Path, output: str) -> bool:
+    """Return True when Windows npm crashed after producing a usable build."""
+    if sys.platform != "win32":
+        return False
+    if not (webui_dir / "dist" / "index.html").exists():
+        return False
+    return any(marker in output for marker in WINDOWS_FRONTEND_BUILD_ASSERTION_MARKERS)
+
+
 def build_frontend_env(config: ServiceConfig) -> dict[str, str]:
     """Build frontend proxy environment variables from backend service settings."""
     env = os.environ.copy()
@@ -1680,6 +1704,7 @@ def _spawn_process(
         kwargs["start_new_session"] = True
 
     log_path.parent.mkdir(parents=True, exist_ok=True)
+    _cap_service_log_file(log_path, MAX_SERVICE_LOG_BYTES)
     handle = log_path.open("a", encoding="utf-8")
     try:
         return subprocess.Popen(
@@ -1696,6 +1721,40 @@ def _spawn_process(
         handle.close()
 
 
+def _cap_service_log_file(log_path: Path, max_bytes: int = MAX_SERVICE_LOG_BYTES) -> bool:
+    """Keep service logs under *max_bytes* without deleting or renaming them."""
+    if max_bytes <= 0:
+        return False
+    try:
+        size = log_path.stat().st_size
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return False
+    if size <= max_bytes:
+        return False
+
+    read_offset = size - max_bytes
+    write_offset = 0
+    try:
+        with log_path.open("r+b") as handle:
+            while read_offset < size:
+                handle.seek(read_offset)
+                chunk = handle.read(min(LOG_TRIM_CHUNK_BYTES, size - read_offset))
+                if not chunk:
+                    break
+                handle.seek(write_offset)
+                handle.write(chunk)
+                read_offset += len(chunk)
+                write_offset += len(chunk)
+            handle.truncate(write_offset)
+        return True
+    except OSError:
+        # Logging must not make daemon startup fail.  If Windows still has a
+        # transient lock, leave the file untouched and continue with append.
+        return False
+
+
 def _run_windows_netstat(port: int) -> str:
     completed = subprocess.run(
         ["netstat", "-ano", "-p", "tcp"],

flocks/server/routes/workflow.py

@@ -448,22 +448,28 @@ async def _cleanup_workflow_storage(workflow_id: str) -> None:
     await _remove_storage_key_if_exists(f"{_WORKFLOW_CENTER_RUNTIME_PREFIX}{workflow_id}")
     await _remove_storage_key_if_exists(f"{_WORKFLOW_CENTER_LOCAL_PID_PREFIX}{workflow_id}")
     await _remove_storage_prefix(f"{_WORKFLOW_CENTER_RELEASE_PREFIX}{workflow_id}/")
+    await _remove_storage_prefix(f"workflow_execution_index/{workflow_id}/")
 
     try:
-        exec_keys = await Storage.list("workflow_execution/")
+        exec_keys = await Storage.list_keys("workflow_execution/")
         for key in exec_keys:
             try:
                 exec_data = await Storage.read(key)
                 if isinstance(exec_data, dict) and exec_data.get("workflowId") == workflow_id:
-                    await Storage.remove(key)
                     exec_id = key.rsplit("/", 1)[-1]
-                    step_rows = await Storage.list_raw(_workflow_execution_step_prefix(exec_id))
-                    for step_key, _value in step_rows:
-                        await Storage.remove(step_key)
-            except Exception:
-                pass
-    except Exception:
-        pass
+                    await Storage.clear(_workflow_execution_step_prefix(exec_id))
+                    await Storage.remove(key)
+            except Exception as exc:
+                log.warning("workflow.delete.execution_cleanup_failed", {
+                    "workflow_id": workflow_id,
+                    "key": key,
+                    "error": str(exc),
+                })
+    except Exception as exc:
+        log.warning("workflow.delete.execution_scan_failed", {
+            "workflow_id": workflow_id,
+            "error": str(exc),
+        })
 
     service_dir = Config.get_data_path() / "workflow-services" / "workflows" / workflow_id
     if service_dir.is_dir():

flocks/session/runner.py

@@ -1517,6 +1517,7 @@ async def _build_device_asset_hint(self) -> Optional[str]:
             "## 安全设备使用\n\n"
             f"{summary}\n\n"
             "当用户要操作特定机房、设备或产品时，先调用 `device_context` 获取 `device_id` 等相关信息。"
+            "如果当前无已接入设备，请提示用户前往「设备接入」页面添加设备。"
             "使用 `tool_search` 搜索工具名称查看用法；执行设备工具时必须传入目标 `device_id`。"
             "如果同类设备有多个候选，不要猜测，先询问用户选择。"
         )