5 Commits

Include renames

Author	SHA1	Message	Date
weichen	f1302ed5b3	Enable canonical versioned Go module consumption ... Why: Allow consumers to download an immutable module revision without nested source checkouts or local path replacements. Evidence: SELF package tests and the prior canonical-path rejection are recorded in the Dev dependency-workspace task card; remote consumption is replayed against the committed candidate. Impact: Change the module identity and its Go imports while preserving API behavior. Existing historical submodule revisions remain buildable. Refs: Versioned dependencies U1/U3; feature/dependency-workspace	2026-10-13 15:47:16 +00:00
weichen	e0b1c27f1f	Scope command audit storage and queries to the requesting owner ... Why: GET /api/commands/audit leaked every tenant's audit rows (command ids, entrances, conversation ids, param digests) to any authenticated user; owner was never recorded nor filtered. Evidence: Red run at a7cc69b FAIL (alice sees bob's row); after fix go test ./... 32/32 packages ok, including TestCommandAuditOwnerScoping and the v18 backfill test (rows recorded on the task card). Impact: v18 migration adds command_audit.owner with actor-based backfill (empty-actor rows stay invisible via API, kept in-table); AppendAudit/ListAudits gain owner params; cmdbus port and fakes updated; handler passes authenticated owner. No public extension surface change. Refs: Task card R1; U0 proposal section 5 C7 finding.	2026-10-08 14:02:19 +00:00
weichen	cb26e4c947	Add EXT-1 inproc plugin command handler with owner-scoped host handle ... Why: 进程内插件命令此前只登记规格不绑处理器，分发即 "no host handler bound"， 且插件无 owner 凭证（H4）；EXT-1 最小集补上处理器绑定与 owner 作用域宿主句柄。 Evidence: pkg/extension 新增 Request/Handler/Host + Registry.AddCommandHandler（surface.txt 12→15）； cmdbus.RegisterPluginCommand 三例测试（committed/未绑 rejected/高危确认卡先拦）； rag.IndexChunks 抽出并两例直测；internal/app hostcaps+inprocHost 复用 hostapi owner 作用域实现， applyCompiled 携 caps，inproc_host_test 双 owner 隔离 + provider=hash 向量写入均通过；go test ./... 29 包全绿。 Impact: 公开面依赖从零外部模块变为 +agent-system-core（声明式 go.mod 需按 compat-policy §4 加 core require+replace）； 既有路径语义不变，SurfaceVersion 保持 2.0.0-experimental。 Refs: documents 提案 2026-10-05-ext-1-inproc-command-handler.md；V1.2 方案批注 1。	2026-10-05 11:39:25 +00:00
weichen	9a545b1e69	Add admin-issued accounts with forced first-login password change ... Why: the user ruled out self-registration (2026-09-30): accounts are created only by admins who set an initial password; first login (and first login after any admin reset) must force a password change. Evidence: - migration v10 auth_accounts (users password/must_change/is_admin + sessions table; upgrade test walks v1<->v10 both directions). - argon2id hash/verify with PHC encoding; store tests cover hash roundtrip, duplicate-owner conflict, must-change lifecycle, session keep/except semantics. - e2e TestAdminAccountFlow: static login page reachable without auth, wrong password 401, login sets HttpOnly cookie + mustChangePassword, admin creates user (409 on duplicate), non-admin create 403, forced change clears flag and old password dies, admin reset revokes sessions and re-arms forced change, API-key channel untouched, 5-fail backoff 429, logout kills session. Full go test ./... green. Impact: middleware now accepts Bearer key OR session cookie and exempts static + /api/auth/login (also fixes the latent case where the login page itself could 401). Embedded no-auth mode unchanged. Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (admin-issued variant, user decision 2026-09-30)	2026-09-30 11:15:22 +00:00
weichen	5c52c71f9c	Add cmdbus: registry-driven command dispatch with audit and inline confirm ... Why: T3 of the interaction foundation - unify button/card/slash/chat entries onto one command bus (D27) composing the Agent-Command library (D30), with danger=high commands gated behind inline confirm cards and every dispatch leaving the same audit envelope. Evidence: go test green - cmdbus suite (four-entrance audit symmetry, high-danger confirm lifecycle incl. cancel/expiry/handler-reject, audit-unavailable yields unknown, plugin spec fail-closed, schema scalar validation) and server e2e (danger command via POST /api/commands -> confirm card -> card action confirm -> committed receipt -> audit query ordered accepted->committed); legacy /help,/new,/mock,/model,/profile contract preserved through the bus; store migration v7 command_audit (both dialects) with roundtrip test updated. Impact: new internal/cmdbus (L1 package per D33), server routes POST /api/commands/{id} + GET /api/commands/audit + registry-driven GET /api/commands, postMessage chat-entrance dispatch when the intent gate matches a registered command, plugins host OnCommands overlay, module cards policy/modules/{cmdbus,cardsvc}.md; pending confirm state is process-local (documented limitation). Refs: docs/proposals/2026-09-30-ui-inbox-command-workspace.md T3; task card feature/command-bus-r1	2026-09-30 07:51:31 +00:00