# Changelog

All notable changes to Theseus will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Known Issues

- **No HTTP timeouts** — `reqwest::Client::new()` with default (infinite) timeouts on all HTTP calls. DeepSeek API hangs block request handlers indefinitely. Add `.timeout(Duration::from_secs(60))` to prevent indefinite hangs.
- **No retry logic** — DeepSeek 429 rate limits, network blips, and 502/503 errors are treated as permanent failures. The agent subsystem (multi-turn conversation) is especially vulnerable — one failed turn kills the entire run.
- **No graceful shutdown** — `axum::serve(listener, app).await.unwrap()` with no signal handling. In-flight requests, WebSocket connections, and agent runs are dropped on SIGTERM.
- **SQLite concurrent access** — No `PRAGMA busy_timeout` configured. Concurrent access may produce `SQLITE_BUSY` errors.
- **Per-request HTTP client allocation** — Each route handler creates `Client::new()` per call. Should be a shared client in `AppState`.
- **lib.rs god-file** — 900+ lines handling AppError, AppState, Config, middleware, and deepseek_chat(). Should be extracted into separate modules.

## [0.2.1] - 2026-06-06

### Added

- **AI Agent Subsystem** (`src/agent/`) — Autonomous LLM loop with tool-calling for natural language graph operations
  - `llm.rs` — DeepSeek API client with streaming and function-calling support
  - `loop.rs` — Turn-based agent runtime with memory persistence
  - `memory.rs` — Per-project conversation history via `agent_memory` table
  - `prompts.rs` — System prompt engineering with graph stats injection
  - **13 agent tools**: `create_node`, `create_edge`, `update_node`, `delete_node`, `list_nodes`, `get_node_detail`, `list_edges`, `create_credential`, `get_analysis`, `get_timeline`, `get_health_checks`, `search_nodes`, `search_global`
- **WebSocket live updates** — Graph mutations broadcast to all connected browsers via `GET /api/ws`
- **Agent route** — `POST /api/agent/run` creates an agent runtime and returns answer, turn count, and tool call summaries
- Agent tool mutations broadcast `graph:{pid}` after success for real-time UI updates

### Changed

- Project context (stats, timeline summary) injected into agent system prompts
- Memory store auto-prunes old messages to prevent context overflow

## [0.2.0] - 2026-02-15

### Added

- **Agent system foundation** — Initial framework for AI-assisted graph operations
- **Check endpoints** — Graph health checks for entry isolation, dangling exploits, broken chains, and unreachable nodes
- **Project analysis** — BFS attack path traversal with unexploited vulnerability detection
- **Credential management** — Full CRUD for credentials with type (password, SSH key, AK/SK, token) and verification status
- **Daily report generation** — Date-filtered Markdown reports in China Standard Time (CST)
- **Timeline view** — Chronological node view with incoming and outgoing edges

### Changed

- Structured `CheckResult` types for deterministic graph health validation

## [0.1.0] - 2025-09-01

### Added

- **Attack path graph** — Typed nodes (host, service, vulnerability, privilege_escalation, credential, finding, note, entry_point, attack_step, impact, objective) and directed edges
- **CLI** — Full command-line interface via clap for all operations (project, node, edge, credential, search, import, tell, ask)
- **REST API** — 15 route modules with JSON responses and consistent `ApiResponse<T>` envelope
- **Embedded Cytoscape.js frontend** — Interactive browser UI with node panel, legend, and canvas controls
- **Natural language input** — `theseus tell` parses free-text notes into nodes and edges
- **Graph questioning** — `theseus ask` answers questions about the current project via DeepSeek
- **Evidence management** — File upload/download attached to nodes
- **Cross-project search** — LIKE-based search across all projects
- **Bulk JSON import** — Seed projects from structured scan results
- **Short ID resolution** — UUID prefix matching (6+ characters) throughout CLI, API, and browser
- **Bilingual error handling** — `AppError` with Chinese and English messages
- **Config cascading** — CLI args → env vars (`THESEUS_API_KEY`, `THESEUS_DEEPSEEK_API_KEY`) → `theseus.toml` → `~/.config/theseus/config.toml`
