Skip to content

Fix Studio-pushed employee edit/hire and knowledge-base install lists - #15

Merged
XYAIStudio merged 1 commit into
mainfrom
cursor/studio-reserve-ops-kb-import-e1c4
Sep 18, 2026
Merged

XYAIStudio merged 1 commit into
mainfrom
cursor/studio-reserve-ops-kb-import-e1c4

Conversation

@XYAIStudio

Copy link
Copy Markdown
Owner

Summary

Studio-pushed employees could not be edited or hired, and installed knowledge bases did not show up in OpenXYOS lists.

This keeps the existing import contract from PR #14:

  • POST /api/xyai/agents/import + X-XYAI-Interop: studio still writes talent_pool.status=recruited (not listed in 人才市场) and employees.employment_category=reserve.
  • Capabilities schema remains openxyos.studio-agent.v1.
  • 招募 stays for available agent-customization talent only. Studio-pushed rows are not sent to a broken recruit path.

Fixes for 编辑 / 录用 / 知识库:

  • 编辑: PUT /api/org/employees/:id now treats Studio-sourced and unbound reserve AI employees as org-editable. They have no user_id, so non-admin org editors no longer get 404.
  • 录用: POST /api/employees/:id/onboard (reserve → internal) is permission-aligned and wired on 备选员工 as 编辑 + 录用. Org canvas “从备选员工添加” also onboards.
  • 知识库: POST /api/xyai/knowledge/import writes knowledge_files + knowledge_notes with tenant_id, folder=/, and external_id, so GET /api/knowledge/files/list?folder=/ shows them after Studio install. /api/xyai/inbox routes knowledge-mount to the same importer.

Studio { asset: { id, kind, name, description, payload } } bodies are accepted as aliases; JWT tenant wins over client tenant_id.

Security and data impact

  • Import routes still require a tenant JWT and X-XYAI-Interop: studio.
  • Employee edit/hire remains tenant-scoped; unrelated human employees still 404 for non-admins.
  • Cross-tenant reads of imported employees and KBs stay isolated.
  • Additive SQLite columns only: knowledge_files.external_id, knowledge_notes.external_id.
  • Knowledge snapshots are written under uploads/tenants/<tenantId>/.

Verification

npx tsx scripts/test-org-talent-ux.ts
npx tsx scripts/test-agent-studio.ts
npm run lint
npm run typecheck
npm run i18n:check
npm run verify:open-source

All of the above passed. Covered: recruited-not-available import, org-editor edit without user_id, 录用, rejected Studio 招募, asset-wrapper payload, KB list at folder=/, idempotent external_id, inbox knowledge-mount, cross-tenant isolation.

Browser click-through of 备选员工 / 知识库 was not run here (demo seed is opt-in and not enabled in this environment).

Checklist

  • No credentials, customer data, runtime databases, uploads, logs, or build artifacts are included.
  • Tests cover changed behavior and relevant failure paths.
  • User-visible changes include both zh-CN and en copy.
  • npm run verify:open-source passed.
  • Every commit has a DCO Signed-off-by line.
Open in Web Open in Cursor 

Studio-pushed agents stay recruited+reserve (not talent-market available).
Org editors can edit those employees without user_id, 录用 onboards them,
and POST /api/xyai/knowledge/import writes folder=/ files so install lists.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: XYAI Labs <haoboy8@gmail.com>
@XYAIStudio
XYAIStudio marked this pull request as ready for review September 18, 2026 08:12
@XYAIStudio
XYAIStudio merged commit 93a959d into main Sep 18, 2026
1 of 2 checks passed
@XYAIStudio
XYAIStudio deleted the cursor/studio-reserve-ops-kb-import-e1c4 branch September 18, 2026 08:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants