* feat(plugins): add plugin marketplace with curated registry and updates
Discover and install plugins from inside kandev instead of only by URL/upload.
- Backend marketplace subpackage: SQLite-backed sources, catalog fetch/merge
(dedup, install_state, degraded-source handling), and the /api/plugins/
marketplace[/sources] API. Install reuses the existing install-by-URL pipeline.
- Frontend: Settings > Plugins gains a Browse tab (search/category/star sort),
source management, one-click install, and an Update button on the Installed
tab when the catalog has a newer version. Plugins may ship an icon (manifest
`icon` -> catalog icon_url) with a letter-tile fallback.
- Registry infra: plugin-registry/ (curated plugins.yaml + schema.json) and two
GitHub Actions (zero-dependency Node build-index.mjs -> index.json on Pages,
daily star refresh). Ships empty at launch; the empty catalog is valid.
- Spec: docs/specs/plugins/marketplace.md. No download telemetry; stars only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(plugins): address marketplace PR review feedback
- CodeQL: stub fetch routers keyed off a path segment, not a hostname substring.
- Nullable stars end to end: a failed star lookup stays unknown (not 0) and
sorts last, instead of decoding null -> 0 and corrupting ranking.
- Fetch marketplace sources concurrently and dedupe identical in-flight
downloads (singleflight), so a slow source can't serialize the Browse tab.
- Register /marketplace routes before the /:id wildcard (gin tree ordering).
- Duplicate source URL returns 409 ErrDuplicateSource, not a raw SQL error.
- Browse: filter category client-side so the category dropdown never collapses.
- marketplaceInstall swallows after toasting (no unhandled promise rejection).
- Source badge keys off source_id, not a name substring.
- build-index: read block-sequence manifest categories, not just inline.
- Registry index workflow validates on pull_request; Pages deploy gated to
push/schedule/dispatch. Spec: align package_sha256 (advisory in v1) + sort enum.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(plugins): guard catalog repo_url against javascript: href injection
repo_url comes from an untrusted index.json, so a malicious/compromised source
could set a javascript: URL that runs in the operator's session when the Repo
link is clicked (rel/target don't block it). Only render the anchor for http(s)
schemes. Adds regression tests for the scheme guard and null-star rendering.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(plugins): require https for remote sources; test oversized download
- Reject remote plain-http marketplace sources (MITM catalog-poisoning risk);
loopback http stays allowed for local dev/e2e fixtures.
- Add the missing oversized-response assertion to TestDownloadRejectsNon200AndOversized
so the maxIndexBytes memory bound has coverage.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(plugins): detach source download from singleflight leader's context
Two concurrent Browse opens after a cache Refresh share one singleflight
download; if the leader's request context is canceled (it navigates away), the
waiters must not inherit that cancellation. Use context.WithoutCancel so values
are preserved but the leader can't cancel everyone; the client's 20s timeout
still bounds the download.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: harden submodule init against malicious .gitmodules
initSubmodules ran a bare `git submodule update --init --recursive` in a
worktree whose HEAD is attacker-controlled during a fork-PR review task,
with no protocol restriction, no hooks disable, and no cmd.Env. Attacker
`.gitmodules` could pick a command-executing transport (`ext::sh -c`,
CVE-2018-17456), a local `file://` path, or a plain-http URL (cloud
metadata SSRF).
Harden the single sink so all call sites benefit:
- protocol.allow=never default-denies every transport; only https/ssh are
re-enabled (blocks file://, git://, plain http:// SSRF).
- protocol.ext.allow=never hard-pins the RCE transport off; on the command
line it outranks any ambient protocol.ext.allow=always.
- core.hooksPath=/dev/null neutralizes attacker-planted hooks.
- GIT_TERMINAL_PROMPT=0 stops attacker URLs from hanging on a prompt.
Residual: attacker-chosen https/ssh URLs are still fetched (transports real
submodules require); fully closing that needs gating submodule init off for
untrusted worktrees, tracked separately.
* fix: address submodule hardening review feedback
- Reuse newNonInteractiveGitCmd so submodule init inherits the full
non-interactive env set (GIT_SSH_COMMAND=ssh -oBatchMode=yes, SSH/GCM
askpass suppression, WaitDelay). Prevents an attacker ssh:// submodule
URL from hanging the review runner on host-key/passphrase prompts until
the context deadline (GIT_TERMINAL_PROMPT=0 alone only covers git's HTTP
prompt, not SSH).
- Correct the file:// comment: command-line -c outranks repo/global git
config, so ambient protocol.file.allow=always does NOT re-enable file
submodules here. This is intentional for untrusted trees; a trusted
opt-in must be an explicit per-repo -c, not implicit host config.
- Add a file:// URL variant to the transport-block test alongside the
bare-path form (CVE-2022-39253 classification differs by git version).
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
* fix: validate destination parent chain in copyfiles byte copy
copyState.copyFile wrote into the target worktree via os.MkdirAll +
os.Create with no destination-parent symlink validation, unlike the
sibling paths that were hardened for exactly this: symlinkMatch calls
validateParentChain and remote writeOneEntry calls secureDestination.
A worktree whose HEAD ships a directory segment as a symlink (a fork-PR
head can set a tree entry to mode 120000 pointing at an absolute host
path) let MkdirAll follow the link and os.Create write the source file's
bytes outside the worktree as the backend user — a zero-click,
content-driven arbitrary-file-write reachable on the PR-review path
(copyConfiguredFiles -> copyfiles.Copy during worktree creation).
Route the byte copy through the same secureDestination hardening: it
runs validateParentChain, creates the parent dirs, and re-confirms
containment via EvalSymlinks before returning a destination guaranteed
inside the worktree. A rejected destination emits a non-fatal warning,
mirroring symlinkMatch. The leaf os.Lstat skip-if-exists behavior is
preserved (only a symlinked parent was the escape vector).
Add byte-copy regression tests: a symlinked parent is rejected and
nothing is written outside the worktree, a leaf symlink is still
skipped, and a clean nested copy still works.
* fix: canonicalize copyfiles target root before containment checks
copyFile passed the raw s.targetDir into secureDestination, which
EvalSymlinks-resolves the created parent and then Rel-checks it against
that root. When the worktree is reached through a symlinked ancestor
(macOS /tmp -> /private/tmp, or a user-symlinked tasks dir) the canonical
parent looks like it escapes the non-canonical root, so every legitimate
byte copy is silently rejected.
Resolve targetDir once in Copy (falling back to the raw path when it does
not exist yet), mirroring the EvalSymlinks WriteEntries already performs.
Add a regression test that routes the target through a symlinked ancestor
and asserts the copy still lands at the real location.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
* feat: bind HTTP server to multiple addresses
Support a list of bind addresses so the backend can serve on loopback and
a tailnet IP at once, without exposing every interface via 0.0.0.0.
- Config: server.host now parses a comma-separated list; a new server.hosts
YAML array takes precedence when set. Entries are trimmed, deduped, and
validated (IP or hostname); a wildcard entry collapses the set.
- Startup: one net.Listener per resolved address serving one shared
http.Server; the single-listener path is the one-element case.
- Bind-failure policy: all-fail is fatal; partial-fail warns, serves the
good addresses, and runs a cancellable background retry loop that binds
late-arriving addresses (e.g. a tailnet IP after tailscaled starts).
- Graceful shutdown stops the retry loop before closing all listeners;
covered by goleak.
- Readiness probe picks a reachable bound address, preferring loopback.
- Add ServerConfig.NonLoopbackBinds and config.IsLoopbackHost so the
sibling app-auth task can gate fail-closed auth on off-box binds.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: preserve KANDEV_SERVER_HOST over config server.hosts
server.host now wins over the server.hosts array when set, because Host
carries the KANDEV_SERVER_HOST env override and env must beat a config-file
server.hosts (env-over-file precedence and the desktop loopback contract).
The viper default for server.host is empty so an unset host is
distinguishable from an explicit one; server.hosts is used only when host is
unset. Adds regression tests covering the env-override and hosts-when-unset
paths.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: harden multi-bind host parsing and listener lifecycle
Address review feedback:
- Validate every host before wildcard collapse so an invalid entry is
rejected regardless of order; canonicalize IPs so equivalent forms
(::1 and 0:0:0:0:0:0:0:1) dedupe and unspecified longhand IPs count as
the wildcard.
- Probe the IPv6 loopback (::1) for an IPv6 wildcard listener instead of
127.0.0.1, so readiness doesn't stall on an IPv6-only socket.
- Make serverListeners.Stop race-free via sync.Once.
- Register t.Cleanup for the blocker listener before the fatal-assertion
path in the partial-failure test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: prevent command injection via untrusted git branch names
Untrusted git branch names (e.g. a fork PR head branch) were substituted
unescaped into executor prepare scripts and run via `eval` in a shell,
yielding command injection (CRITICAL RCE) in the Docker/Sprites/remote
executors. git check-ref-format permits `;`, `|`, `$`, backticks and
`()`, so a branch like `$(touch pwned)` or `main;touch pwned` executed.
- scriptengine: shell-single-quote every data placeholder that lands in
shell text (repository.path/name/branch/clone_url/ssh_url,
workspace.path, worktree.base_path/path/branch/base_branch). Script
fragments (setup_script, git.identity_setup, github.auth_setup,
kandev.*) are left untouched.
- default_scripts: wrap each data placeholder in single quotes in the
postlude, clone lines, and the Sprites echo (double quotes still allow
$(...) substitution). `'<escaped>'` round-trips to the literal.
- orchestrator: defense-in-depth — reject a PR head branch that fails
securityutil.IsValidBranchName before it reaches CheckoutBranch, while
still creating the review task without a checkout.
- tests: PoC-derived regression asserting the injected command no longer
runs through the real sh -c/eval sink, provider escaping unit tests,
and ingestion-layer validation coverage.
* fix: harden branch-name escaping for legacy stored prepare scripts
Automated review (Codex, CodeRabbit) flagged that shell-single-quoting the
value while relying on the templates to add the surrounding quotes only
protects the templates we ship. Profiles snapshot the default prepare
script at creation time, so an OLD stored script referencing a placeholder
bare (e.g. `git clone --depth=1 --branch {{repository.branch}} ...`) still
resolved with an unquoted, injectable branch value.
- scriptengine: add shellQuote, which emits a fully self-contained
single-quoted shell token (surrounding quotes included). Every data
placeholder (repository.path/name/branch/clone_url/ssh_url,
workspace.path, worktree.base_path/path/branch/base_branch) now carries
its own quoting, so a bare `{{placeholder}}` in any template — including
legacy stored scripts — is safe. shellSingleQuote is kept for the git
identity fragment, which supplies its own quotes.
- default_scripts: reference data placeholders bare (the value self-quotes);
the Sprites echo becomes printf with the values as separate args so a
hostile URL/branch can't expand inside a double-quoted string.
- tests: assert providers emit fully-quoted tokens that round-trip through a
real shell; cover base_path/path/repository.path/name/ssh_url; add a
regression proving a legacy stored script with bare placeholders no longer
executes injected commands.
* test: strengthen branch-injection regression assertions
Address Greptile review feedback on the new tests.
- assertNoUnquotedPayload now tracks real single-quote state char-by-char
instead of "some quote before and after", so a payload in an unquoted
context on a line that happens to contain other quotes is caught.
- Drop the unused wantHasRepoRow table field; repo-row presence is already
asserted via len(got) != 1.
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
* fix: prevent AppleScript injection RCE in macOS notifications
buildAppleScript escaped only the double-quote in notification title/body
and interpolated the result into an `osascript -e` string literal. A raw
trailing backslash defeated that escaping: `\"` became `\\"`, which
AppleScript reads as an escaped backslash plus a real closing delimiter,
so the `display notification "..."` literal terminated early and any
following text (e.g. `do shell script`) executed on the host.
Notification title/body come verbatim from untrusted external-integration
issue titles (Sentry/Linear/Jira) with no sanitization, so an attacker who
can raise an issue in a connected workspace could achieve RCE on the macOS
host when the office session reached WAITING_FOR_INPUT.
Replace string interpolation with argv passing: title/body are delivered as
`run` handler arguments (item 1/2 of argv) and never touch the AppleScript
source, so no escaping is required. Add a proof-of-concept test documenting
the legacy breakout and a regression guard asserting the fixed builder never
leaks attacker text into script fragments.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: terminate osascript option parsing before notification argv
Passing untrusted title/body as trailing arguments still let a title that
looks like an osascript flag be consumed as an option: a title of "-e" would
turn the body into another script fragment, reopening the AppleScript
injection. Add a `--` option terminator before title/body so untrusted text
always lands in argv. Extend the regression tests to cover the flag-like
title vector.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: prove single-line AppleScript payload is host RCE, not just DoS
Add a single-line (Jira/Linear, no newline) PoC alongside the multi-line
Sentry payload. A newline statement separator is only needed for a SECOND
statement; the single-line payload instead injects an expression
`& (do shell script (...))` into the display-notification body argument, so
the command executes as a side effect while the line stays one valid
statement. Both shapes are host code execution. Extend the regression guard
to prove the argv fix neutralizes both.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: treat git-describe builds as ahead of latest release
The update checker flagged "Update available" for local builds whose version
is a git-describe string like v0.79.0-60-g8fae44fb1, even though such a build
is 60 commits AHEAD of the v0.79.0 release. parseSemver treated the
"-60-g8fae44fb1" suffix as a pre-release of 0.79.0, which sorts below the
plain tag, so the comparator reported the build as older than latest.
Recognize the git-describe "-<N>-g<hash>[-dirty]" suffix as a commits-ahead
marker: such a build now sorts at or above its base tag and above any real
pre-release, so an ahead-of-latest build is no longer flagged as
update-available. Genuine pre-releases (rc.1, alpha.2) are unaffected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: require default-length hash for git-describe detection
Tighten the git-describe suffix detector to require the abbreviated commit
hash to be at least 7 hex digits (git's default core.abbrev). This prevents a
contrived pre-release such as v1.0.0-3-ga from being misclassified as a
git-describe "ahead" build. kandev's Makefile runs `git describe` with the
default abbreviation, so real builds always meet the floor.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Plugin `tools[]` overlapped with MCP, kandev's established mechanism for
exposing tools to agents (`internal/mcp/`), and the `InvokeTool` path was
never wired into agent tool sets — the `listTools` handler was
listing-only. Rather than maintain a half-built parallel surface, remove
it. If plugins ever contribute agent tools, they should feed through MCP,
not a separate `InvokeTool` RPC.
Removes:
- proto `InvokeTool` RPC + `ToolRequest`/`ToolResponse`/`ToolContext`
messages (regenerated `*.pb.go` / `*_grpc.pb.go`)
- pkg/pluginsdk `InvokeTool` from the `Plugin` interface and
`UnimplementedPlugin`, the Tool* Go-native types, and the
`RemotePlugin`/`GRPCServer` dispatch
- internal/plugins `Service.InvokeTool`, the `listTools` handler +
`GET /api/plugins/tools` route, `PluginToolDTO`, and the manifest
`Tools` field + tool-name uniqueness validation
- frontend `PluginTool`/`PluginToolDTO` types, `listPluginTools`, and the
manifest-card tools list
- fixture/e2e `InvokeTool` echo impl and the `tools:` manifest block
Test doubles that used the "crash" tool to exercise crash-restart now use
a "crash" webhook key instead. Internal specs (GRPC-CONTRACT, spec) drop
the tool RPC/feature; docs/public was already updated in #1774.
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): provide bounded access to CREATED sibling task descriptions
Include the task description in the list_related_tasks_kandev projection so a
coordinating agent can read dependency metadata (e.g. a "Depends on:" line)
from a related task — including a CREATED sibling that has no session yet —
without falling back to an unbounded list_tasks_kandev call.
The relation graph is the bound: only parent/children/siblings/blockers are
ever projected, so descriptions never leak from unrelated tasks or across
workspaces. ListSiblings already returns CREATED (unstarted) tasks and loads
their descriptions from storage; only the MCP projection was dropping the
field.
Closes#1772
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): gate related-task descriptions by caller access
Address PR review: list_related_tasks_kandev ignored caller_task_id and
projected any named task's description, so a caller that learned an unrelated
or cross-workspace task ID could read it. Add ListRelatedForCaller, which
enforces the same relation/workspace read guard the document tools use
(self/ancestor/descendant/sibling/blocker, same workspace) for non-self
targets, and wire the MCP handler through it (access-denied maps to forbidden).
The un-gated ListRelated stays for trusted internal callers (GetTaskContext).
Add tests for the blocker/blocked-by description projection and the caller
access guard (unrelated + cross-workspace denied, relations allowed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(mcp): align related-tasks error mapping and empty-caller guard
Address PR review nits: route handleListRelatedTasks errors through
mapHandoffError (logging only non-access-denied errors) for parity with the
document handlers, and make ListRelatedForCaller deny an empty caller against a
non-self target instead of silently delegating to the ungated ListRelated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* refactor(secrets): detect absent secret via ErrNotFound sentinel
Replace the "secret not found:" string-prefix matching with an exported
secrets.ErrNotFound sentinel, matched via errors.Is. The store(s) now
return fmt.Errorf("%w: %s", ErrNotFound, id); the rendered message is
byte-identical so logs are unchanged.
Consumers migrated off the prefix:
- internal/plugins/config.go isSecretNotFound (behind host GetSecret/
DeleteSecret and service.go vault rollback)
- internal/integrations/secretadapter Exists (jira/linear/sentry inherit
the change through the shared adapter)
Adds a non-Postgres-gated secrets test asserting errors.Is(err,
ErrNotFound) plus message-unchanged coverage; updates the affected test
fakes to wrap the sentinel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(secrets): address review — eager t.Cleanup, faithful fake Delete
- sqlite_store_test: register sqlxDB close via t.Cleanup immediately
after creation, before the NewMasterKeyProvider/Provide fatal paths
(per the t.Cleanup-immediately convention).
- secretadapter_test: fakeStore.Delete now returns wrapped
secrets.ErrNotFound for an absent id, mirroring the real store and
the fakeSecretRevealer.Delete fake.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): per-plugin settings pages driven by manifest config_schema
Settings > Plugins rows now open /settings/plugins/:id — a detail page
showing the manifest plus a settings form generated from the plugin
author's config_schema. Secret fields (secret: true / format: password)
are masked on the operator API and kept on masked re-submits; a running
plugin restarts on save and reads its config (cleartext secrets included)
through the new Host GetConfig gRPC RPC.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): write plugin config file owner-only (0600)
Operator config can now carry cleartext secret values (config_schema
fields marked secret), so <id>.config.yml must not be world-readable —
match the 0600 mode the record file already uses.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): vault-backed plugin secrets — Get/Set/DeleteSecret RPCs and encrypted config secrets
Plugins get vault-backed secret primitives on the Host API
(GetSecret/SetSecret/DeleteSecret, capability-gated, namespaced to
plugin:<id>㊙️<key> so a plugin can only touch its own entries;
purged on uninstall). Secret config_schema fields now live in kandev's
AES-256-GCM vault too — <id>.config.yml persists only a vault reference,
and the Host GetConfig RPC resolves it back to cleartext for the plugin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(plugins): serve PR screenshots from the media/pr-1761-screenshots ref instead of the repo
The PR body now points at raw URLs pinned to an unmerged media ref, so
the binaries never land in main (PRs are squash-merged; only the branch
tip tree merges).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): address review feedback on settings validation and save flow
- integer form fields reject non-integral input instead of parseInt-truncating
- enum selections keep their schema-declared types (numeric enums round-trip)
- backend enum validation normalizes int-vs-float64 before comparison
- maskSecrets masks any non-zero secret value regardless of runtime type
- save flow splits PATCH from refetch: a refetch failure no longer reports a
successful save as an error, and typed secrets are masked on screen
- optional enum fields gain a 'Not set' option so they can be cleared
- resolveConfigSecrets copies before mutating; restart-failure SetStatus
errors are logged; SDK test fake returns a non-nil empty config map
- add missing tests: usePluginConfigForm hook, getPluginConfig client,
integer/enum regression cases
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): harden secret config invariants from review
- reject non-string values on declared secret fields at validation time,
closing the path where a numeric/boolean secret bypassed the vault and
persisted cleartext in the config file
- delete removed secret fields' vault entries only AFTER the config commit
succeeds, so a failed SetConfig never leaves the still-current config
referencing a deleted vault entry
- uninstall fails closed: the plugin's vault namespace is purged before any
destructive step, and a cleanup failure aborts the uninstall (retryable)
instead of letting a reinstall inherit stale secrets
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): failure-atomic config secrets, quiesced uninstall purge, ctx propagation
- UpdateConfig is now failure-atomic for secret overwrites: storeConfigSecrets
snapshots each vault entry before writing and returns a rollback that
restores prior values (or deletes newly-created ones). A vault.Set failure
mid-loop or a failed SetConfig commit rolls back, so a request reported as
failed never changes the value a still-current config ref resolves to.
- Uninstall stops the plugin process BEFORE purging its vault namespace, so
the plugin can no longer race the cleanup with a SetSecret between ListIDs
and the deletes; the purge stays fail-closed and retryable.
- Thread the request context through Uninstall -> deletePluginSecrets instead
of context.Background(), per the pass-context-through-chains convention.
- Consolidate the 'secret not found:' prefix check into isSecretNotFound
(host.go + service rollback share one definition).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): detach rollback context, fail closed without a vault, reconcile uninstall status
- vault rollback closures now run on context.WithoutCancel(ctx): a request
cancelled mid-save (browser closed) can no longer abort the rollback and
leave the vault holding new values while the unchanged config still points
at them (Greptile P1).
- storeConfigSecrets fails closed (errSecretVaultRequired) when a plugin
declares secret config fields but no vault is wired, instead of silently
persisting the secret in cleartext.
- vaultRestoreFunc distinguishes not-found from a genuine Reveal error: a
backend read failure aborts the update before writing rather than risk a
rollback that deletes a real secret; rollback now returns errors, joined
into UpdateConfig's failure so an inconsistent vault is surfaced, not just
logged.
- Uninstall reconciles lifecycle status when a secret-purge failure aborts
after the process was stopped: a previously-running plugin transitions to
error and notifies observers instead of being reported active with no
process running.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): detach removed-secret cleanup ctx and clear stale save dirty flag
- cleanupRemovedConfigSecrets now runs on context.WithoutCancel(ctx), matching
the rollback path, so a client disconnect right after the config commit can
no longer cancel the delete and orphan now-unreferenced vault entries.
- tests: assert GetConfig succeeds before treating an empty map as proof that
nothing persisted (a swallowed read error would be a false pass).
- web: on a post-save refetch failure, rebase initialValues onto the masked
snapshot so the saved form no longer reads as dirty.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): fail tests on discarded GetConfig errors, drop setState-in-updater
- config_test: capture and fatal on GetConfig errors at the four remaining
positive-assertion sites (a nil from a failed read would panic on the next
map access instead of giving a clear failure), matching the earlier fix.
- web hook: compute the masked post-save snapshot from the current values and
apply it to setValues + setInitialValues directly, instead of calling
setInitialValues inside a setValues functional updater (a React anti-pattern
that runs twice under StrictMode).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): skip validation of a secret field's own vault ref
- validateConfigSchema takes the plugin id and skips a secret field whose
value is that field's config vault ref (an internal storage marker,
already validated when first set). Without this, a field declaring both
secret: true and enum: [...] 400s on every save that keeps the mask,
because the enum check saw the vault ref instead of a user value. Freshly
entered secret values are still validated; a foreign plugin's ref is not
skipped. Covered by unit + service-level regression tests.
- surface mid-loop vault rollback failures in storeConfigSecrets via a
warning instead of discarding them (double-fault observability).
- web: integer inputs get step=1 so browsers flag non-integral input in
place (serializeConfigValues remains the backstop).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(plugins): split config secret tests into config_secrets_test.go
config_test.go had grown past the 800-line backend file-length limit
(revive), failing CI lint. Move the vault-backed config and plugin-scoped
secret tests (plus their fake-vault/store helpers) into a sibling file;
no test logic changes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(lifecycle): don't split streaming messages on subagent tool calls
A subagent's internal tool calls (ParentToolCallID set) stream on the same
session concurrently with the parent agent's own text. Flushing the message
buffer on those events closed the parent's in-flight streaming message, so
each subagent tool call started a new message row — splitting one logical
message mid-sentence and breaking markdown (e.g. **bold** spans rendered as
literal asterisks) across the fragments.
Only flush on top-level tool calls; subagent-internal ones leave the parent's
streaming segment open.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(lifecycle): drop dead flush-text branch in tool call handler
flushMessageBuffer always publishes remaining content through the streaming
path and returns "", so the event.Text / history-append branch could never
execute. Call it directly instead of through a helper carrying dead code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* docs(plugins): draft Host data API proto (read + write DTOs)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(plugins): ADR + spec + plan for the Host data API
Plugins access kandev data via capability-gated Host gRPC RPCs returning
hand-mapped DTOs, never the DB directly. ADR 0042.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): add Host data API RPCs and DTOs to plugin proto
Extends the existing service Host (per ADR 0042) with read RPCs
(ListTasks/GetTask, ListWorkspaces, ListWorkflows, ListWorkflowSteps,
ListAgentProfiles, ListRepositories, ListSessions, ListSessionCodeStats)
and declares the deferred phase-2 write RPCs (CreateTask, UpdateTask,
CreateComment) so the contract is stable for later tasks. Regenerates
plugin.pb.go/plugin_grpc.pb.go via `make -C apps/backend proto`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat(plugins): Host data API SDK accessors + session LOC aggregation
Wave 1-2 of ADR 0042: pkg/pluginsdk gains typed reader accessors (host.Tasks(),
host.Sessions().CodeStats(), host.Workflows(), ...) over the extended Host gRPC
service, with proto<->native DTO conversions and an UnimplementedHostData seam
for the kandev-side impl. internal/analytics gains the per-session LOC
aggregation those readers surface. Backend handlers + capability gating land in
the next wave.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): capability-gated Host data read handlers (ADR 0042)
Implement pluginHost Tasks/Sessions/Workspaces/Workflows/AgentProfiles/
Repositories readers: each gated on api_read:<resource> (PermissionDenied
otherwise), backed by the service layer via narrow injected interfaces, and
hand-mapped to the pluginsdk DTOs. Sessions().CodeStats routes through the
analytics aggregation; acp_session_id preserves the metadata->resume_token
fallback. Wired through plugins.Service.SetDataSources + backendapp.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(plugins): wire test for Host data reads + docs (ADR 0042 accepted)
End-to-end test over the real go-plugin transport: session data round-trips,
per-resource api_read gating returns PermissionDenied over the wire, cursor
pagination. Document the Host data API + SDK accessors in GRPC-CONTRACT.md,
reconcile the spec to shipped code, mark ADR 0042 accepted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): full session history + snapshot profile name in data API
Sessions().List now fetches tasks with includeArchived=true — an archived
task's sessions are still real sessions, and CodeStats already made the
same call at the SQL layer, so the two session reads were inconsistent
(26 of 359 sessions visible on a real instance). Tasks().List keeps
archived tasks excluded.
Session gains agent_profile_name (proto field 10) sourced from the
profile snapshot, so sessions of since-uninstalled agents keep a human
label — the AgentProfiles registry only lists live agents.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(plugins): renumber Host data API ADR 0042 -> 0043
main merged its own ADR 0042 (project shell output); renumber this one to the
next free slot and update all references.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): address Host data API review (perf, pagination, filters, proto)
- paginate before DTO conversion so per-session ACP lookups run <=limit times
- fetch all source pages (no silent 1000/workspace truncation); accurate HasMore
- stable id tiebreaker on paginated sorts
- AND SessionFilter.TaskIDs with WorkspaceIDs; exclude config-mode sessions from
CodeStats (shared dialect.ExcludeConfigModePredicate) so List/CodeStats match
- Get returns codes.NotFound consistently in-process and over the wire
- wrap bare-DTO RPC responses (GetTaskResponse etc.) for Buf response uniqueness
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(plugins): mark Host data API plan tasks done
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add plugin system with grpc runtime and native ui plugins
- go plugin backends ship as release tarballs (per-platform binaries, checksums) that
kandev installs from url/upload or filesystem sideload+sync, then spawns and
supervises via hashicorp/go-plugin (unix socket / loopback tcp+automtls)
- strict typed grpc contract (kandev.plugin.v1): DeliverEvent/InvokeTool/HandleWebhook
plus a capability-gated host service (state, secrets, emit); author sdk in
pkg/pluginsdk; packaging cli in cmd/plugin-pack
- native frontend bundles: window.registerKandevPlugin + registry/host loader with
dynamic routes, nav items, slots and ws handlers; plugins settings page with
install dialog, sync button and enable/disable/uninstall
- gated behind the plugins feature flag (prod off, dev/e2e on); covered by unit and
integration tests plus playwright e2e against a real packaged fixture plugin
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): hydrate base app context on plugin routes
Plugin-owned SPA routes classify as RouteUnknown, so the boot payload shipped
only feature flags — no workspaces, workflows, or kanban context. Native plugin
UI (e.g. host.ui.TaskCreateDialog) then had an empty store. Hydrate the same
base context as the Home route for unknown SPA routes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(plugins): expose TaskCreateDialog on host.ui
Lets a native plugin open kandev's real create-task modal (prefilled via
initialValues) instead of POSTing directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): harden filesystem/URL sinks against CodeQL findings
Add sink-level guards on the plugin trust boundary: securejoin containment on
archive extraction (zip-slip), plugin-id validation before every fs_store path,
http/https scheme validation on install-from-URL, and non-interpolated ws-handler
error logging.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): address review findings (races, resource caps, lifecycle)
- serialize per-plugin startup to close a TOCTOU double-spawn race, and let a
plugin restart after exhausting attempts
- bound plugin startup with an explicit 30s timeout
- reject backslash paths and cap decompressed bytes by actual size in pkgtar;
only mark a package Signed when a verifier actually ran and passed
- delete plugin_state on uninstall; validate webhook keys against the manifest
and cap webhook body size; restart an active plugin when a new version installs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): sanitize plugin-id path sinks for CodeQL
Pin the plugin id to a single path segment with filepath.Base at recordPath/
configPath and pkgtar.Remove — a barrier the taint analysis recognizes.
Behaviour-identical for valid ids (already validated by safePluginID); clears
the go/path-injection alerts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): inline plugin-id validation at path sinks for CodeQL
filepath.Base does not strip '..', so it is not a path-injection barrier. Call
the recognized safePluginID / id-pattern guard inline in Delete/GetConfig/
SetConfig and pkgtar.Remove — the same barrier that already cleared the Get sink.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): address code-review findings (backend)
- add capability-gating tests for the Host RPC service (was untested)
- close a stop-during-start orphan race so Disable/Uninstall can't leave a
supervised subprocess behind
- on failed upgrade, remove only the new version dir (not all versions + data);
restart the prior version
- validate manifest version and reject ids ending in .config (record-file alias)
- make Deliverer.Refresh non-blocking and cancel in-flight delivery on worker stop
- clamp out-of-range webhook status, skip-and-warn corrupt records in List,
write records atomically, semver-aware sideload version pick
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): address code-review findings (frontend)
- wrap plugin routes + settings routes in a shared PluginErrorBoundary so a
throwing plugin page shows a fallback instead of white-screening the SPA
- fix disable/re-enable in one session: keep the cached registration and
re-run initialize instead of relying on a cached ES-module re-import
- prefix root-relative bundle/style URLs with apiBaseUrl (split-origin/Tauri)
- surface partial-install warnings via toast.warning instead of a bare success
- dedupe/remove injected style links on unload; gate PluginNavItems on the flag
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(plugins): serialize per-plugin lifecycle + guard config writes
- add a per-plugin keyed lock in Service so concurrent Enable/Disable/Install/
Uninstall/UpdateConfig for one id are serialized (no status-machine race)
- take s.mu in SetConfig/GetConfig and write config atomically
- bound each plugin initialize() with a timeout so one hung bundle can't stall
the rest of the boot load
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(plugins): split service_test.go to satisfy file-length lint
Move the install/URL test group into service_install_test.go; no logic change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: build and ship the e2e fixture plugin package to E2E shards
The plugin E2E specs' global-setup requires apps/backend/.build/kandev-plugin-e2e-1.0.0.tar.gz.
Build it in the E2E build job, upload it as an artifact, and download it in both
the regular and container shard jobs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(orchestrator): persist ACP session id in session metadata
storeResumeToken now mirrors the agent's ACP session id into the
session's durable acp metadata map after the CAS succeeds. Previously
the id only reached metadata when an agent emitted a session_info
frame, so most sessions could not be joined to their agent-CLI
transcripts once their executors_running row was pruned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(orchestrator): make ACP session id mirror atomic and rotation-safe
Address review feedback on the metadata mirror: replace the
read-modify-write in persistACPSessionID with a single guarded UPDATE
(SetSessionACPSessionID). json_patch merges the session_id sub-key
atomically, preserving session_info keys, and the write is gated on
executors_running still holding the id as its resume token — so a
delayed event from a rotated execution can never overwrite the live
execution's id, and the session_info TOCTOU disappears along with the
unlogged GetTaskSession read.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: choose worktree when opening IDE on multi-repo tasks
On multi-repo tasks the open-in-IDE button always opened the first
worktree. The editors menu now shows a worktree picker (repo + branch)
when a session has multiple worktrees, and each editor in the dropdown
expands into a per-worktree submenu.
- open-editor/open-folder accept an optional worktree_id; empty keeps
the first-worktree fallback so existing clients are unaffected
- session DTOs now serialize the full worktrees list instead of only
the flattened first-worktree fields
- useSessionWorktrees unions API worktrees with the WS-populated list
- new Playwright spec covers the picker on a real multi-repo session
* fix: address review feedback on worktree picker
- fall back on empty-string worktree fields, not only null/undefined
- bind optional open-folder body via EOF check instead of ContentLength
so chunked requests keep their worktree_id
- wrap disabled editor buttons in a focusable span so tooltips work
- add hook test asserting worktreeId is forwarded as worktree_id
* fix: map editor service errors to HTTP status, drop e2e sleep
- open-editor/open-folder return 404/400/409 for known service errors
(unknown worktree or editor, invalid config, unavailable editor)
instead of a blanket 500
- replace the picker spec's 750ms sleep with an explicit composer click
so the autofocus race is deterministic
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
* fix(scripts): launch dev-isolated backend via __backend subcommand
The kandev binary became a bundle launcher with the restart supervisor
(ADR 0019) and exits without KANDEV_BUNDLE_DIR when invoked bare; the
isolated dev instance must run the backend entrypoint directly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(mcp): session spawning, sibling messaging, and renameable tabs
- spawn_session_kandev spawns an additional agent session on an existing
task (default: the caller's own) via LaunchSession(IntentStart), with
optional agent_profile_id (defaults to the spawner's profile) and a
session name; the initial prompt carries spawner attribution and reply
instructions.
- message_task_kandev accepts an optional session_id to target a specific
session, enabling same-task sibling messaging. Explicit targets are
pinned through dispatch so the idle-path primary-session re-resolution
cannot reroute a sibling message back to its sender (regression-tested).
- task_sessions gains a name column (migration ordered after the
agent_execution_id-drop rebuild), a session.rename WS action, and inline
tab rename UI; custom names take precedence over derived agent/model
labels across the tab, agents dropdown, mobile list, chat header, and
dockview panel titles.
- Inter-session messages stamp sender_session_name into metadata so the
sender badge shows which session sent the message.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): address review findings on session spawn/rename/messaging
- include name in task-session DTOs (list + full, no omitempty) so
persisted tab names survive list hydration and clears propagate
- sanitize sender task/session ids embedded in <kandev-system> blocks
- reject cross-workspace spawn targets; require sender_task_id
- truncate session names by runes, not bytes
- distinguish not-found from internal errors in message target lookup
- guard TabRenameInput blur-commit after Enter/Escape resolution
- cap optimistic rename length client-side and toast on rename failure
- add tests: spawn launch-failure and cross-workspace paths, renameSession
API client
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mcp): round-two review fixes for spawn/rename lint and hardening
- extract spawn validation/authorization helpers (cyclop/nestif limits)
- make stripSystemTag replace until stable to block nested tag evasion
- load session before rename so a durable rename can never skip its
broadcast; surface lookup failures to the caller instead
- drop redundant sessionLauncher nil check (guarded registration)
- add maxLength to the rename input matching the server cap
- add tests: nested sanitizer evasion, spawn rename-failure tolerance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: sync workflows from a configured github repo
Per-workspace setting pointing at a GitHub repo directory of portable
workflow export files. A background poller fetches it on an interval and
creates, updates, or deletes the matching workflows; a force-sync endpoint
bypasses the content-hash check. Synced workflows carry source/source_path
provenance and coexist with manual ones; changes that cannot be applied
safely (steps or workflows that still hold tasks, ambiguous step names,
unparseable files) surface as warnings in the new settings section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): fill workflow sync form from a pasted github link
A new Repository link field parses plain repo URLs, SSH remotes, and
tree/blob links (which also carry branch and directory) into the
structured owner/repo/branch/path fields.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): simplify workflow sync form to link, branch, and interval
The repository link is now the only repo input: owner, repo, and
directory resolve from the pasted URL (echoed as a summary under the
field), and a stored config renders back into a canonical tree link via
buildGitHubRepoUrl. Branch and poll interval stay individually editable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): collapse workflow sync into a button, dialog, and status card
The Workflows settings page now shows only a GitHub Sync button by
default; the link/branch/interval form lives in a dialog that closes on
successful save or removal. Once configured, a compact status card
(mirroring the GitHub connection-status card) shows the synced repo,
branch, directory, last result, warnings, and a Sync now action.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): move github sync button into the workflows page header
The GitHub Sync trigger now stacks under the Workspace settings button
on the top right, and the extra separator around the sync area is gone —
unconfigured workspaces show no sync chrome at all, configured ones show
just the status card above the workflow list.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): move github sync button next to the workflow actions
GitHub Sync now sits in the Workflows section toolbar alongside
Export All, Import, and Add Workflow; the status card renders inside the
section above the workflow list. The toolbar moved to its own component
to keep the page under the file-size limit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): separate sync status card from the workflow list
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(web): align sync status card with the workflow list gutter
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: repair local edits to synced workflows on periodic sync
Periodic syncs previously skipped applying when the repo content hash
was unchanged, so local UI edits to a synced workflow were only reverted
by a manual Sync now. Every sync now reconciles against the repo; the
applier compares each step against its definition and only writes (and
broadcasts) actual differences, so a no-drift sync stays silent.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: make github-synced workflows read-only
Workflows with source=github reject UI mutations: workflow rename,
description, agent-profile, and delete return 409 from the task-domain
handlers; step create/update/delete/reorder and template application are
guarded in the workflow controller. The sync applier writes through the
service/repo layer and stays exempt. The frontend disables the card's
inputs, save/delete, and the step pipeline editor for synced workflows,
with a tooltip pointing at the synced repository. Drift repair on sync
remains as the backstop.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: optional workflow sync polling and repo-derived branch picker
A per-workspace auto-sync toggle (poll_enabled, default on) controls
the background polling loop; when off the workspace only syncs via Sync
now. The dialog's branch field becomes a select fed by the repository's
actual branches (same loader the task-create dialog uses), falling back
to free text until branches load. Existing dev databases gain the new
column via an idempotent ALTER.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: release synced workflows when the sync config is removed
Deleting a workspace's workflow sync configuration converts its
GitHub-sourced workflows back to manual ownership (source=manual), so
they become editable instead of being stranded read-only. Release runs
before the config row is deleted so a failure keeps the config for
retry. The settings page reloads after removal (and after syncs that
changed workflows) so cards unlock without a manual refresh.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): drop branch selector and compact the auto-sync row
The pasted link already carries the branch (main by default), so the
dialog no longer needs a branch field — the resolved summary echoes it.
The auto-sync toggle is now one compact row with the interval inline and
a single short helper line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: address PR review feedback
Backend: fail-open read-only guard on workflow lookup errors (fixes MCP
step handler CI failures); poller Stop holds its mutex through drain;
per-workspace lock serializes syncs against config delete/replace;
rollback workflow creation when provenance stamping fails; idiomatic
duplicate-column migration via db.IsDuplicateColumnError; branch-name
validation and a 30-day interval cap; generic 500s with logged detail;
WS read-only rejections use CONFLICT with the real reason; e2e reset
aborts when sync-config cleanup fails; test hygiene (t.Cleanup,
SetMaxOpenConns).
Frontend: malformed percent escapes parse as invalid instead of
throwing; save disabled during initial load and for invalid intervals;
Remove disabled while saving; stale async config responses discarded;
delete-dialog confirms re-check read-only; focusable Synced badge;
explicit button types; failed polls labeled 'last attempt'; unique
warning list keys; test cleanup via afterEach.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: guard workflow sync test fake against concurrent poller access
The poller invokes the fake applier from its own goroutine while the
synctest test asserts on call counts; -race caught the unguarded reads.
Also documents that the per-workspace lock is deliberately held across
the GitHub fetch.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: stop task renames from wiping task repositories
A title-only PATCH (or WS task.update) converted the absent repositories
field into a non-nil empty slice, which Service.UpdateTask treats as an
explicit replace-with-nothing — deleting every task_repositories row and
dropping the task out of repo-filtered sidebar views. Map "field absent"
to nil at both update handlers so partial updates leave repositories
untouched, while an explicitly empty list still clears them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test: assert update-task responses reflect repository state
Address cubic review feedback: make the repo fake stateful so the
explicit-clear test can assert the response body returns no
repositories, and unmarshal the WS payload to confirm the preserved
repository is present, matching the HTTP test's coverage.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat: surface agent subscription usage in settings and chat tooltip
Adds live subscription rate-limit visibility for Claude Code and Codex:
- GET /api/v1/agents/usage lists per-agent utilization windows (plan, percent,
reset time) for host agents with subscription credentials; ?fresh=true
bypasses the 5-minute cache with a 15s per-provider clamp.
- Fixes both existing usage clients: Claude parsed float utilization as int
(decode failure) and now reads the richer limits[] array incl. per-model
weekly windows; Codex read a nonexistent auth.json field and response
headers - now reads tokens.access_token, parses the body windows, and
refreshes OAuth tokens on 401. Token refresh persists without dropping
unknown credential fields.
- Settings > Agents gains a Subscription Usage section; the chat context
doughnut tooltip shows the session agent's windows, fetched fresh on hover.
- Shared UsageWindowRows component (bars, Good/High/Critical status,
reset countdowns) keeps settings, tooltip, and office surfaces consistent.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: recompute agent billing type on every read
Subscription billing detection for Claude and Codex was cached with
sync.OnceValue for the process lifetime, so logging in with OAuth after
the backend started never flipped billing badges or office usage checks
until restart. Detection now re-reads the credential files on each call
and reuses the usage clients' HasSubscriptionCredentials checks. Also
adds a regression assertion that fractional-second resets_at timestamps
parse under the RFC3339 layout.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: address subscription usage review feedback
- serialize empty utilization windows as arrays, not null
- sanitize per-agent usage errors in the API (raw provider errors are
logged server-side; they can carry credential paths/response bodies)
- persist refreshed CLI credentials via atomic temp-file rename
- keep previous settings usage on transient refresh failure; drop stale
tooltip usage (and its memo) when a fresh fetch fails
- add controller tests for SubscriptionUsage mapping and fresh propagation
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: coalesce concurrent usage fetches and guard codex token refresh
- serialize usage-cache fetches per key with a double-checked lock so
concurrent fresh requests make one provider call instead of a burst
- reject codex refresh responses with an empty access_token instead of
persisting them and wiping working credentials
- pin the usage-rows reset fixture 30s under the day boundary so the
formatted value is deterministic on fast runners
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: coalesce failed usage fetches with short negative caching
Concurrent lookups after a fetch error each retried the provider once
the per-key lock rotated. Failures are now cached for 15 seconds (never
longer than the caller's staleness bound), so bursts share one error
result and the provider gets a breather before the next retry.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: keep stale usage through failed refreshes and skip caching cancellations
Track the last success and last failure independently in the usage
cache: a failed fresh refresh no longer evicts a still-valid success
(non-fresh callers keep the stale value while fresh callers share the
recent error), and a caller-cancelled context no longer records a
negative entry that would penalize other callers.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test: synchronize concurrent usage-cache tests with a channel barrier
Replaces the sleep-widened race window in the coalescing tests with a
started/release barrier per the backend testing guidelines, and dedupes
the two concurrent-caller tests into one helper.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix: enforce origin validation on websocket upgrades
The gateway /ws upgrader hardcoded CheckOrigin to true, so any web page
could open a socket to the local backend and drive session/shell actions
(cross-site WebSocket hijacking → RCE on the host).
Both upgraders now share checkWebSocketOrigin: no Origin header is
allowed (non-browser clients), same-hostname and loopback↔loopback
origins are allowed, everything else is rejected. Replaces the terminal
handler's prefix-based check, which accepted origins like
http://localhost.attacker.tld.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor: share origin trust policy between cors and websocket checks
Review feedback on #1698: the CORS middleware and the WebSocket upgrader
carried two copies of the same origin policy, which could silently
diverge. Both now delegate to httpmw.AllowedOrigin, which also rejects
URL components that never appear in a browser Origin header (userinfo,
path, query, fragment, opaque data).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Carlos Florêncio