João Salavisa
78cae96bb1
* feat(plugins): add capability-gated Host reader for conversation content Plugins can now read historical user/agent message content over the Host data API, gated by a new `api_read:messages` capability (ADR 0047). This unblocks "summarize yesterday"-style plugins that the live `message.added` bus event alone cannot serve. - proto: `ListMessages` RPC + `Message`/`MessageFilter` on `service Host`. - SDK: `Host.Messages() MessageReader`, Go-native `Message`/`MessageFilter`. - host: `api_read:messages` accessor + denied reader; content sanitized via `sysprompt.StripSystemContent` (no raw system prompts); RFC3339 `since`/ `until` → `InvalidArgument` on bad input. - data: new `ListMessagesForPlugin` filtered query (session/task ids, type, created_at range) through the task service, never the DB file. - tests: in-process + wire capability gating, content stripping, filter/time passthrough, pagination, and the SQLite query. - docs: ADR 0047, spec, plugins-manifest, plugins-authoring. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(plugins): add Host.InvokeUtilityAgent for settings-selectable utility agent Plugins can now delegate a one-shot LLM step to an operator-configured agent, gated by a new `agent_invoke` capability (ADR 0048), so a plugin needs no provider API key of its own. - setting: new `utility_agent_profile_id` user setting (Settings > System > Utility Agent), a profile dropdown cloned from the existing utility-agent path; selectable in the UI. - capability: boolean `agent_invoke`, enforced like `state`/`secrets`. - proto/SDK: `InvokeUtilityAgent(prompt) -> text` RPC and `Host.InvokeUtilityAgent(ctx, prompt)`. - backend: reuses the sessionless host-utility inference tier (ADR 0002) via a thin adapter — no agent loop, no task/session/workspace; resolves the configured profile to (agent type, model). Unconfigured / deleted profile -> gRPC FailedPrecondition. - tests: capability gating, completion path (asserts the configured profile is used and text returned), no-utility-agent and stale-profile error paths, SDK/wire round-trips, and the settings apply/trim behavior. - docs: ADR 0048, spec, plugins-manifest, plugins-authoring. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): resolve utility-agent deps live and bound message filter size Address CI + review feedback on the host plugin capabilities: - docs: register the new /settings/system/utility-agent route in docs/public/coverage.json (fixes the "Validate public docs" CI failure). - utility agent (ADR 0048): hostUtilityMgr is wired late in boot — after StartActivePlugins has already spawned boot-active plugins — so snapshotting the utility deps in hostForPlugin stranded those hosts with nil deps and made InvokeUtilityAgent return Unimplemented for their lifetime. Read the deps live from the Service (mutex-guarded) at call time instead; add a regression test for late wiring reaching an already-spawned host. - messages (ADR 0047): cap the combined session/task/type filter values at 400 so an oversized filter fails fast with InvalidArgument instead of hitting SQLite's host-parameter limit at query execution; add a test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
12 KiB
12 KiB
Decision Log
Architecture Decision Records (ADRs) for the Kandev project. Each decision captures the context, choice, consequences, and alternatives for significant architectural or design decisions.
Read individual ADRs for full context. Create new ones via /record decision or manually following the template in 0001-file-based-knowledge-system.md.
| ID | Title | Status | Area | Date |
|---|---|---|---|---|
| 0001 | File-based knowledge system | accepted (amended 2026-07-16) | infra | 2026-03-28 |
| 0002 | Host utility agentctl for sessionless ACP flows | accepted | backend | 2026-04-08 |
| 0003 | executors_running as the single source of truth for agent_execution_id | accepted | backend | 2026-05-03 |
| 0004 | Task model unification — shared base, per-strategy meta, shared kernel | proposed | backend, frontend | 2026-05-05 |
| 0005 | Agent model unification — one agents table |
proposed | backend, frontend | 2026-05-06 |
| 0006 | Tier routing vs cheap_agent_profile_id coexistence | superseded | backend | 2026-05-11 |
| 0007 | profiles.yaml — runtime defaults for prod / dev / e2e | accepted | backend, frontend | 2026-05-16 |
| 0008 | DB upgrade safety - meta table, pre-migration backup, migration logging | accepted | backend | 2026-05-16 |
| 0009 | Fail-closed GC semantics for filesystem and container cleanup | accepted | backend | 2026-05-16 |
| 0010 | Worktree copy-files — per-repo, idempotent, host-local | accepted | backend, frontend | 2026-05-19 |
| 0011 | Transient provider errors (529 Overloaded) auto-retry with visible backoff | accepted | backend, frontend | 2026-05-30 |
| 0012 | Service-only UI self-update | accepted | backend, frontend, cli | 2026-05-29 |
| 0013 | Multi-branch task support — N (repo, branch) pairs per task | accepted | backend, frontend | 2026-06-01 |
| 0014 | Per-CLI MCP server injection for passthrough mode | accepted | backend | 2026-05-29 |
| 0015 | Explicit completion signal for auto-advance | proposed | backend, frontend | 2026-06-04 |
| 0016 | Read-only absolute file paths | accepted | backend | 2026-06-14 |
| 0017 | Resource metrics sampling | accepted | backend, frontend, protocol | 2026-06-14 |
| 0018 | Runtime settings overrides | accepted | backend, frontend, cli | 2026-06-14 |
| 0019 | Restart supervisor owns backend restarts | accepted | backend, frontend, cli | 2026-06-14 |
| 0020 | Pi project MCP config injection | accepted | backend | 2026-06-16 |
| 0021 | Go-served SPA with boot state | accepted | backend, frontend, cli | 2026-06-15 |
| 0022 | Embedded Vite assets | accepted | backend, frontend, cli | 2026-06-17 |
| 0023 | Active workspace cookie for boot state | accepted | backend, frontend | 2026-06-18 |
| 0024 | Go-fronted Vite dev mode | accepted | backend, frontend, cli | 2026-06-18 |
| 0025 | Runtime cleanup uses executors_running |
accepted (amended 2026-07-06) | backend | 2026-06-22 |
| 0026 | Tauri desktop shell over native runtime | accepted (amended 2026-07-15) | frontend, backend, cli, infra | 2026-06-23 |
| 0027 | Replayable schema migrations across SQLite and Postgres | accepted | backend | 2026-06-24 |
| 0028 | Backend-owned task-create last-used preferences | accepted (amended by 0041) | backend, frontend | 2026-06-29 |
| 0029 | Release backfill and desktop diagnostics | accepted (amended 2026-07-16) | infra, workflow | 2026-07-01 |
| 0030 | Workspace-scoped integration settings | accepted | backend, frontend | 2026-07-01 |
| 0031 | Office skill reference files | accepted | backend | 2026-07-06 |
| 0032 | Configurable worktree branch names | accepted | backend, frontend | 2026-07-07 |
| 0033 | Durable plan implementation start marker | accepted | backend, frontend | 2026-07-09 |
| 0034 | Agent Client Protocol Codex ACP Bridge | accepted | backend, protocol | 2026-07-10 |
| 0035 | Version AgentReady events by prompt generation | accepted | backend | 2026-07-14 |
| 0036 | Normalize ACP shell output at the adapter boundary | accepted | backend, frontend, protocol | 2026-07-14 |
| 0037 | Resource-aware frontend unit tests | accepted | frontend, infra | 2026-07-14 |
| 0038 | Quick Chat Repository Isolation | accepted | backend, frontend | 2026-07-14 |
| 0039 | Native desktop integration boundary | accepted | desktop, frontend, backend, infra | 2026-07-15 |
| 0040 | Separate updater integrity from OS publisher identity | accepted | desktop, infra, workflow | 2026-07-15 |
| 0041 | Backend-owned portable user settings | accepted | backend, frontend | 2026-07-15 |
| 0042 | Project shell output and fetch it on demand | accepted | backend, frontend, protocol | 2026-07-16 |
| 0043 | Plugins read/write kandev data via capability-gated Host gRPC RPCs | accepted | backend, protocol | 2026-07-17 |
| 2026-07-14-typed-utility-chat-sessions | Typed Utility Chats Share the Quick Chat Session Model | accepted | backend, frontend | 2026-07-14 |
| 2026-07-15-office-agent-execution-profile-routing | Separate Office identity from routed execution profiles | proposed | backend, frontend | 2026-07-15 |
| 0044 | ACP agent compatibility dialects | accepted | backend, protocol | 2026-07-16 |
| 0045 | Install-wide storage maintenance uses typed ownership providers and quarantine | accepted (amended 2026-07-19) | backend, frontend, infra | 2026-07-14 |
| 0046 | Settings route save coordinator | accepted | frontend | 2026-07-14 |
| 0047 | Plugins read conversation content via a capability-gated Host RPC | accepted | backend, protocol | 2026-07-21 |
| 0048 | Plugins invoke a settings-selectable utility agent | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-18-turn-configuration-snapshots | Attribute runtime configuration to turns | accepted | backend, frontend | 2026-07-18 |
| 2026-07-19-reject-mcp-actions-on-raw-websocket | Reject MCP Actions on the Raw WebSocket | accepted | backend, protocol | 2026-07-19 |
| 2026-07-19-workspace-symlink-entries | Treat Nested Workspace Symlinks as Entries | accepted | backend, infra | 2026-07-19 |
| 2026-07-20-explicit-local-repository-trust | Explicit Local Repository Trust | accepted | backend, frontend | 2026-07-20 |
| 2026-07-20-provider-neutral-remote-repositories | Provider-neutral remote repositories | accepted | backend, frontend, protocol | 2026-07-20 |
| 2026-07-20-repository-provider-origin-identity | Persist Provider Origin In Repository Identity | accepted | backend, frontend | 2026-07-20 |