Agent-System-Backend

463 Commits 17 Branches 11 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
weichen	48c5202de2	Validate plugin and bundled skills against the open spec (N2 WP4) Why: plugin skills were written to the skill root unvalidated and the bundled recipes carried no name — both now go through the library's spec validator (name required + kebab-case + equals dir, description required, known-keys whitelist). Evidence: go test -count=1 ./... green; TestV2InvalidSkillRejected pins the fail-closed path with plugin context + field location; Seed validates each SKILL.md before write (recipes dogfood-compliant); nested pins carry agent-native#28 (the validator). Impact: invalid plugin skills now abort the plugin load with a located error instead of landing silently; the architecture baseline gains backend/plugins→backend/skills. Refs: Agent-Native#28, Agent-Squad#32, N2 plan WP4	2026-10-07 13:57:17 +00:00
weichen	dc6d9985d8	Validate plugin agent declarations and wire the squad ask port ci / vet-and-test (pull_request) Successful in 41s Details Why: N1 increment three host side - plugin agent assets must reject hooks/mcp/permissionMode declarations (WP1 acceptance), and squad members need the kernel ask port wired to the HITL card (WP4). Evidence: go vet clean; go test ./... 29 packages ok, including new agent-asset tests (banned keys located to the field, unknown keys, missing id) and the V2 asset suite. Nested pins at native c5b9dca (PR #18) and squad fc9620e (PR #17). Impact: plugins agents/ assets now parse via parseAgentAsset (strict JSON with banned-key rejection); PermissionAskOf exported and takes any host with the optional method; app.go wires cfg.PermissionAsk for the squad path. Legacy behavior unchanged when nothing registers the port. Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP1/WP4	2026-10-07 05:14:06 +00:00
weichenandCursor	cd5b82186d	Add the public extension surface and platform services Why: Downstream products must extend the base through a public package and host API instead of editing internal code. Evidence: go test ./... passed, including plugin v2 assets, sidecar startup, migration v13, pending confirms, HITL timeout, hash embedder, command pairs, and the extension surface snapshot. Impact: apiVersion 2.0-experimental rejects empty network allowlists for declarative HTTP. Hash embeddings stay opt-in via models.embedding.provider=hash. Plugin secrets resolve per owner at execution time. Refs: docs/proposals/2026-10-01-plugin-contract-v2.md Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-01 10:35:02 +00:00

Author

SHA1

Message

Date

weichen

48c5202de2

Validate plugin and bundled skills against the open spec (N2 WP4)

Why: plugin skills were written to the skill root unvalidated and the
bundled recipes carried no name — both now go through the library's
spec validator (name required + kebab-case + equals dir, description
required, known-keys whitelist).
Evidence: go test -count=1 ./... green; TestV2InvalidSkillRejected pins
the fail-closed path with plugin context + field location; Seed
validates each SKILL.md before write (recipes dogfood-compliant);
nested pins carry agent-native#28 (the validator).
Impact: invalid plugin skills now abort the plugin load with a located
error instead of landing silently; the architecture baseline gains
backend/plugins→backend/skills.
Refs: Agent-Native#28, Agent-Squad#32, N2 plan WP4

2026-10-07 13:57:17 +00:00

weichen

dc6d9985d8

Validate plugin agent declarations and wire the squad ask port

ci / vet-and-test (pull_request) Successful in 41s

Details

Why: N1 increment three host side - plugin agent assets must reject
hooks/mcp/permissionMode declarations (WP1 acceptance), and squad
members need the kernel ask port wired to the HITL card (WP4).

Evidence: go vet clean; go test ./... 29 packages ok, including new
agent-asset tests (banned keys located to the field, unknown keys,
missing id) and the V2 asset suite. Nested pins at native c5b9dca
(PR #18) and squad fc9620e (PR #17).

Impact: plugins agents/ assets now parse via parseAgentAsset
(strict JSON with banned-key rejection); PermissionAskOf exported
and takes any host with the optional method; app.go wires
cfg.PermissionAsk for the squad path. Legacy behavior unchanged when
nothing registers the port.

Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP1/WP4

2026-10-07 05:14:06 +00:00

weichenandCursor

cd5b82186d

Add the public extension surface and platform services

Why: Downstream products must extend the base through a public package and host API instead of editing internal code.
Evidence: go test ./... passed, including plugin v2 assets, sidecar startup, migration v13, pending confirms, HITL timeout, hash embedder, command pairs, and the extension surface snapshot.
Impact: apiVersion 2.0-experimental rejects empty network allowlists for declarative HTTP. Hash embeddings stay opt-in via models.embedding.provider=hash. Plugin secrets resolve per owner at execution time.
Refs: docs/proposals/2026-10-01-plugin-contract-v2.md
Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-01 10:35:02 +00:00