feat: add governed public knowledge retrieval

2026-09-10 18:42:44 +08:00
parent ba22a2220f
commit 511a8ca18f
20 changed files with 729 additions and 7 deletions
@@ -110,7 +110,8 @@ class WorkerRuntime:
        if actor_type == "visitor":
            return identity.model_copy(update={
                "roles": ("visitor",),
-                "permissions": ("agent:run",),
+                # 与访客 JWT 对齐，只恢复公开 Agent 和公开知识的最小权限。
+                "permissions": ("agent:run", "knowledge:query"),
                "data_scope": "public",
            })
        return await self.resolve_identity(identity)