dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
85b44ced45ec0d97f81e9344602e85025c6cd756
kandev/docs/public/coverage.json
T
João Salavisa 919a39e49a feat(auth): opt-in authentication & multi-user segregation (#1930) 
* feat(auth): add auth core — identities, sessions, PATs, invites, mode state machine

Phase 1 of opt-in authentication + multi-user segregation:
- internal/auth: argon2id password hashing (PHC), opaque session/PAT tokens
  (SHA-256 at rest), login rate limiter, auth-mode state machine
  (disabled/setup/enabled), setup-wizard promotion of the pre-auth
  default-user row into the admin account, invites, admin user management
  with last-admin guard.
- internal/auth/store: auth_identities (OIDC-ready), auth_sessions,
  auth_api_tokens, auth_invites tables (SQLite+Postgres dialects).
- internal/auth/authn: request-identity plumbing (gin + plain contexts),
  RequireAdmin middleware.
- users table: display_name/role/status columns via new MigrateLogger
  wiring; AccountRepository surface (consumer-scoped, keeps existing
  Repository fakes untouched).
- config: AuthConfig.Required/SessionTTLHours/CookieName
  (KANDEV_AUTH_REQUIRED), FeaturesConfig.Auth; profiles.yaml + runtime
  flag registry entry for KANDEV_FEATURES_AUTH.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(auth): enforce opt-in auth over HTTP — middleware, auth API, boot payload

Phase 2 of opt-in authentication + multi-user segregation:
- internal/auth/httpmw: global gin middleware after CORS. Disabled mode
  injects the synthetic single-user admin identity (behavior unchanged);
  enabled mode resolves session cookie then PAT bearer, with an explicit
  allowlist (health, SPA bootstrap reads, credential endpoints,
  self-authenticating webhooks), deferral for WS/proxy upgrades and
  office agent JWTs, and SPA shell availability for the login page.
- internal/auth/httpapi: full auth surface — setup wizard, login/logout,
  me, password change, sessions, PATs, invites (mint/preview/accept),
  auth settings (enable/disable), admin user management.
- Boot payload: initialState.auth block always present; unauthenticated
  visitors on auth-enabled instances get features+auth only (no data).
- External MCP: PAT required once auth is enabled (open while disabled).
- Admin guards on destructive system routes and runtime-flag overrides.
- Startup warning when bound non-loopback with auth disabled
  (ServerConfig.NonLoopbackBinds fail-closed nudge).
- Wiring: auth store in Repositories, auth service in Services,
  ClaimUnownedWorkspaces backfill on the task repository.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(auth): per-user workspace scoping across HTTP services

Phase 3 of opt-in authentication + multi-user segregation:
- Task service: workspaces, workflows, repositories, and tasks are scoped
  to the request identity (owner-only visibility; pre-auth unowned rows
  stay shared). Denials use *NotFound sentinels - no existence leak.
  Internal callers and the disabled-mode synthetic identity remain
  unscoped, preserving behavior exactly when auth is off.
- CreateWorkspace stamps the authenticated caller as owner.
- Session chokepoint: lifecycle Manager.GetOrEnsureExecution runs a
  settable session-access check covering shell/files/ports/vscode/LSP.
- Secrets: per-user user_id column, scoped CRUD/list, ClaimUnowned wired
  into the setup-wizard backfills.
- Boot payload inherits scoping automatically.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(auth): scope WebSocket gateway to authenticated users

Phase 4 of opt-in authentication + multi-user segregation:
- Connection auth: /ws, /terminal, /lsp, /vscode, /port-proxy routes are
  guarded when auth is enabled - session cookie (same-origin upgrade),
  resolved identity from the HTTP middleware, or ?token=<PAT> for
  headerless programmatic clients; JSON 401 before any upgrade.
- Client identity: every WS client carries its authn.Identity; dispatched
  RPC actions (workspace.list, task CRUD, ...) run under a context
  carrying it, so WS RPC gets the same per-user scoping as HTTP.
- Subscription checks: task/session subscribe+focus verify workspace
  visibility via the task service; user topic subscriptions are pinned to
  the client's own user.
- Broadcast routing: new Hub.BroadcastToWorkspace routes workspace-scoped
  events (task/workflow/repo/office/session-state) to the owner's clients
  only, with safe fallbacks (unowned/unresolvable -> broadcast) so events
  never vanish; instance-wide events (executors, environments, agent
  profiles, system jobs) stay global by design.
- Replaced the long-standing discarded-token TODO in HandleConnection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(auth): add feature spec and backend architecture notes for opt-in auth

- docs/specs/auth/spec.md: product behavior (opt-in, setup wizard,
  per-user workspaces, sessions/PATs, invites, public surface, v1 limits)
- apps/backend/AGENTS.md: internal/auth package layout + scoping rules
  for new service entry points and WS broadcast call sites

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(auth): public documentation for opt-in authentication

- New docs/public/authentication.md: enabling, users & invites, PATs,
  public endpoints, limitations, disabling
- run-as-a-service.md: network-security note now points at the real
  authentication boundary instead of reverse-proxy-only guidance
- meta.json: nav entry under Configure Kandev

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(auth): ADR for opt-in authentication architecture

Records the load-bearing choices: mode state machine + synthetic identity
in disabled mode, opaque DB-backed credentials over JWTs, default-user
promotion at setup, service-layer scoping with no-admin-bypass, and the
explicit public allowlist.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(web): auth UI — login, setup wizard, invites, users & account settings

Adds the frontend half of opt-in authentication: a pre-auth gate in
main.tsx that renders the setup wizard or login/invite pages instead of
the app shell whenever the boot payload's auth block says so, a new
`auth` store slice + feature flag mirroring the backend's StatePayload,
credentialed fetch (`credentials: "include"`) with a 401 handler that
clears the session and redirects to /login, and a full auth-api.ts
client for the /api/v1/auth and /api/v1/users routes.

Settings additions: a System > Users page (list/create/disable/promote
users, invite-link dialog) and System > Authentication page (enable/
disable with confirm + env-locked banner), gated on the `auth` feature
flag and admin role. A new Account sidebar group (Profile & Password,
API Tokens) is shown to signed-in users once auth is enabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(auth): E2E lifecycle suite + fix workspace event WS leak it caught

New dedicated Playwright auth project (backend restarts with
KANDEV_AUTH_REQUIRED=true, isolated from the tokenless default suite):
setup-mode boot gating, admin setup wizard, login/logout + bad
credentials, PATs, admin-surface authorization, anonymous WS rejection,
UI login flow, and the acceptance test - two-user segregation across
HTTP, boot payload, and WebSocket.

The segregation spec immediately caught a real leak: workspace.* event
payloads carry their ID as 'id' (the payload IS the workspace DTO), not
'workspace_id', so BroadcastToWorkspace fell back to broadcast-to-all
for workspace create/update/delete. Fixed with action-aware extraction
plus a unit regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): close cross-user access gaps found in security audit

Two independent security audits of the auth branch found several
authorization gaps where session/workspace-scoped surfaces were not wired
to the new per-user chokepoint. All fixed:

- IDOR on reverse-proxy/terminal routes (vscode, port-proxy, terminal):
  these resolve executions via GetExecutionBySessionID /
  GetOrEnsureExecutionForEnvironment / EnsurePassthroughExecution, which
  skipped the session-access check that only GetOrEnsureExecution ran. Added
  the check inside the env/passthrough resolvers (before the cache
  short-circuit) and an explicit CheckSessionAccess gate in the two bare-lookup
  proxy handlers. An authenticated non-owner can no longer reach another
  user's IDE, forwarded ports, or shell.
- Cross-user agent-conversation read: ListMessages / ListMessagesPaginated /
  SearchMessages now authorize the session.
- Cross-user repository-script read/inject: script CRUD now authorizes the
  parent repository's workspace.
- Office HTTP surface: a group middleware enforces workspace ownership on
  :wsId routes for real users (agent-JWT callers keep their claim scoping).
- Login rate-limit bypass: SetTrustedProxies(nil) so a spoofed
  X-Forwarded-For can't rotate the limiter key on a directly-reachable
  backend.
- Invite double-provisioning race: MarkInviteUsed is now the atomic
  serialization point (consumed before user creation).
- Setup wizard: serialized with a mutex so concurrent first-visitors can't
  corrupt the promoted admin profile.
- Log sanitizer: explicit kandev_pat_ redaction rule.

Regression tests added for message/script scoping and the
execution-access-before-cache invariant. Auth E2E (incl. two-user
segregation) still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): scope repository active-session-count endpoint

GET /api/v1/repositories/:id/active-session-count went through
CountActiveSessionsByRepository, which was not identity-scoped - a
cross-user info leak of another owner's active session counts. Added the
same authorizeRepositoryID gate the script routes use.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): add json tags to auth store models — omit digests, fix token UI

The auth store structs (APIToken, Invite, LoginIdentity, Session) had db:
tags but no json: tags, so the handlers that serialize them directly sent
Go-cased keys (CreatedAt, Name) AND leaked the SHA-256/password digests to
clients. Two consequences:
- The API-tokens UI showed 'Invalid Date' and an empty name (frontend reads
  created_at/name).
- token_sha256 / password_hash were serialized in list responses.

Added json tags with snake_case keys the frontend reads and json:"-" on
every credential digest. Regression test asserts digests never serialize and
the snake_case timestamp/name keys are present. Also adds the
auth-screenshots capture spec (artifacts gitignored).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(web): move auth enable into feature toggles; show current user in sidebar

Remove the standalone Authentication settings page and its dedicated
settings/get-auth-settings API surface now that enabling auth lives in the
Feature Toggles system, and drop env_required now that /auth/me no longer
returns it. Add a current-user chip with a logout action to the sidebar
footer, shown only in enabled auth mode.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(auth): make features.auth the single on/off control

Per review feedback: authentication configuration now lives entirely in
the existing Feature Toggles system rather than a separate Authentication
settings section.

- The auth mode is derived from the features.auth runtime flag
  (KANDEV_FEATURES_AUTH): off -> disabled, on+no-admin -> setup,
  on+admin -> enabled. Removed the parallel auth.mode system setting,
  the SetEnabled service method, GET/PATCH /api/v1/auth/settings, the
  AuthConfig.Required field, KANDEV_AUTH_REQUIRED, and the auth service's
  Settings-store dependency and EnvRequired/env_required.
- The features.auth registry entry is re-described as the actual enable
  switch (high-risk, restart-required) and defaults off in every profile
  (dev was previously true — that only revealed UI before; now it would
  enforce, so it must be an explicit opt-in).
- Setup no longer persists a mode; completing the wizard creates the admin
  and the mode auto-derives to enabled.
- Startup 'exposed without auth' warning + all docs (public guide,
  run-as-a-service, spec, ADR, AGENTS.md) point at the feature toggle.
- E2E: auth specs use KANDEV_FEATURES_AUTH; screenshot spec captures the
  Feature Toggles page instead of the removed Authentication page; the
  member-restriction assertion targets an admin invite route.
- Tests updated across service/httpmw/httpapi/profiles for the derived
  mode; full suite green (only pre-existing sandbox-FS failures remain).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): complete cross-user isolation — integrations, automation, plan/walkthrough, session reads

A follow-up isolation audit found that per-user scoping had been wired into
the task service, secrets, office, and the WS gateway — but several
workspace/task/session-scoped surfaces still resolved a caller-supplied ID
with no ownership gate. Closed all of them; cross-user access now returns
404 across the board.

- Integrations (jira/linear/sentry/slack/azure-devops/gitlab/github/
  workflow-sync): a global middleware authorizes the workspace_id (query, or
  gitlab's /workspaces/:id/ path) on those route groups. Previously a member
  who knew another user's workspace ID could read/overwrite their integration
  connection config and watches.
- Automation: workspace-authorizer seam gates get/list/create/update/delete/
  enable/disable, triggers, run history, and — critically — the webhook
  secret. Was fully cross-tenant over WS before.
- Task plans (PlanService) and walkthroughs (WalkthroughService): task-
  authorizer seam on every read/write. These bypassed the task service.
- Session reads that hit the repo directly — session turns, task context,
  git snapshots, file reviews — now call AuthorizeSession/TaskAccess.

Internal callers (pollers, schedulers, MCP) carry no identity and stay
unscoped; disabled mode is unaffected. Regression tests added
(plan/walkthrough scoping, automation authorizer matrix, integration path
extraction) and the two-user E2E now asserts integration routes are shielded.
Docs (spec, ADR, public guide) updated to state what is isolated and that
filesystem/agent-credential isolation remains an OS-level limitation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(web): current-user chip uses border hover, not accent fill

The sidebar current-user chip used hover:bg-accent (a purpleish fill).
Switch to the border-hover idiom used elsewhere (border border-transparent
-> hover:border-border) with the neutral hover:bg-muted/50 the adjacent
workspace picker uses, so the hover reads as a subtle outline instead of a
colored background. Screenshot spec now captures the chip hover state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(web): right-align current-user chip in the sidebar footer

Push the user chip to the far right of the expanded footer (ml-auto) so it
sits opposite the left-aligned icon buttons; collapsed mode keeps the
centered vertical stack unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): reject synthetic identity on management routes and scope office run broadcasts

Address code-review findings on the opt-in authentication PR:

- P1: while auth is disabled the middleware injects a synthetic admin
  (RoleAdmin), and RequireAdmin alone let it through — so anyone hitting a
  not-yet-enabled instance could mint a PAT or plant an admin that survives
  enablement and hijacks first-run setup. Add authn.RequireRealIdentity and
  guard the credential/session/user-management routes with it (public
  bootstrap routes stay reachable). Responds 404 while disabled.
- P1: office run events carry task_id but no workspace_id, so they fell back
  to a global broadcast and leaked across users. Resolve the workspace from
  the task and route via the new Hub.BroadcastToWorkspaceOrDrop, which fails
  closed (drops rather than global-broadcasts) when the workspace is unknown
  and auth is enforced.
- nit: type createAuthSlice as a single-arg creator and call it with just set.

Also register the authentication docs page and its settings routes in
docs/public/coverage.json so the public-docs validator passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-25 00:10:22 +01:00

345 lines
16 KiB
JSON
Raw Blame History

{
"version": 1,
"areas": [
{
"id": "install-and-launch",
"audiences": ["user", "operator"],
"stability": "stable",
"docs": ["index", "use-kandev", "cli", "desktop-app", "run-as-a-service"],
"sources": ["apps/cli/bin/native-shim.js", "apps/cli/src/cli.ts", "apps/desktop/src-tauri/src/lib.rs"],
"tests": ["apps/cli/bin/native-shim.test.mjs", "apps/desktop/e2e/desktop-launch-smoke.test.mjs"]
},
{
"id": "backend-configuration",
"audiences": ["operator", "contributor"],
"stability": "stable",
"docs": ["configuration", "operations", "cli"],
"sources": ["apps/backend/internal/common/config/config.go", "apps/backend/internal/agentctl/server/config/config.go", "apps/backend/internal/profiles/profiles.go"],
"tests": ["apps/backend/internal/common/config/config_test.go", "apps/backend/internal/agentctl/server/config/config_test.go", "apps/backend/internal/profiles/profiles_test.go"]
},
{
"id": "workspaces-and-repositories",
"audiences": ["user"],
"stability": "stable",
"docs": ["use-kandev", "tasks-and-workflows", "configuration"],
"sources": ["apps/backend/internal/task/handlers/workspace_handlers.go", "apps/web/components/app-sidebar/app-sidebar-workspace-picker.tsx"],
"tests": ["apps/backend/internal/task/handlers/workspace_handlers_test.go", "apps/web/components/app-sidebar/app-sidebar-workspace-picker.test.tsx"],
"settingsRoutes": ["/settings/workspace"],
"mcpTools": ["list_repositories_kandev", "list_workspaces_kandev"]
},
{
"id": "tasks-and-workflows",
"audiences": ["user"],
"stability": "stable",
"docs": ["tasks-and-workflows", "workflow-tips", "workflow-import-export", "workflow-sync"],
"sources": ["apps/backend/internal/orchestrator/workflow_store.go", "apps/web/components/kanban-with-preview.tsx"],
"tests": ["apps/backend/internal/orchestrator/workflow_store_test.go", "apps/web/components/kanban-with-preview.test.ts"],
"mcpTools": [
"create_workflow_kandev",
"create_workflow_step_kandev",
"delete_workflow_kandev",
"delete_workflow_step_kandev",
"import_workflow_kandev",
"list_workflow_steps_kandev",
"list_workflows_kandev",
"reorder_workflow_steps_kandev",
"update_workflow_kandev",
"update_workflow_step_kandev"
]
},
{
"id": "task-lifecycle",
"audiences": ["user"],
"stability": "stable",
"docs": ["tasks-and-workflows", "coordination", "git-operations"],
"sources": [
"apps/backend/internal/orchestrator/task_operations.go",
"apps/backend/internal/mcp/handlers/config_task_handlers.go",
"apps/backend/internal/mcp/handlers/stop_task.go",
"apps/backend/internal/mcp/server/handlers.go",
"apps/backend/internal/mcp/server/server.go",
"apps/backend/internal/gateway/websocket/client.go"
],
"tests": [
"apps/backend/internal/orchestrator/task_operations_test.go",
"apps/backend/internal/orchestrator/coordinator_stop_test.go",
"apps/backend/internal/mcp/handlers/handlers_test.go",
"apps/backend/internal/mcp/handlers/stop_task_test.go",
"apps/backend/internal/mcp/server/handlers_test.go",
"apps/backend/internal/mcp/server/server_test.go",
"apps/backend/internal/mcp/server/sysprompt_sync_test.go",
"apps/backend/internal/backendapp/mcp_stop_composition_test.go",
"apps/backend/internal/integration/mcp_stop_task_test.go",
"apps/backend/internal/gateway/websocket/client_mcp_actions_test.go"
],
"mcpTools": [
"add_branch_to_task_kandev",
"archive_task_kandev",
"create_task_kandev",
"delete_task_kandev",
"list_tasks_kandev",
"move_task_kandev",
"step_complete_kandev",
"stop_task_kandev",
"update_repository_base_branch_kandev",
"update_task_kandev",
"update_task_state_kandev"
]
},
{
"id": "sessions-and-coordination",
"audiences": ["user"],
"stability": "stable",
"docs": ["sessions-and-review", "coordination", "automation-and-mcp", "agent-communication"],
"sources": ["apps/backend/internal/mcp/handlers/spawn_session.go", "apps/web/components/task/dockview-session-tabs.ts"],
"tests": ["apps/backend/internal/mcp/handlers/spawn_session_test.go", "apps/web/components/task/dockview-session-tabs.test.ts"],
"mcpTools": [
"ask_user_question_kandev",
"get_task_conversation_kandev",
"get_task_document_kandev",
"list_related_tasks_kandev",
"list_task_documents_kandev",
"message_task_kandev",
"spawn_session_kandev",
"write_task_document_kandev"
]
},
{
"id": "plans-walkthroughs-and-review",
"audiences": ["user"],
"stability": "stable",
"docs": ["sessions-and-review", "developer-tools", "automation-and-mcp"],
"sources": ["apps/web/components/review/review-dialog.tsx", "apps/web/components/review/walkthrough-overlay.tsx"],
"tests": ["apps/web/components/review/review-dialog.build-files.test.ts", "apps/web/components/review/walkthrough-overlay.test.tsx"],
"mcpTools": [
"create_task_plan_kandev",
"delete_task_plan_kandev",
"delete_walkthrough_kandev",
"get_task_plan_kandev",
"get_walkthrough_kandev",
"show_walkthrough_kandev",
"update_task_plan_kandev"
]
},
{
"id": "developer-workbench-and-git",
"audiences": ["user"],
"stability": "stable",
"docs": ["developer-tools", "git-operations", "sessions-and-review"],
"sources": [
"apps/web/components/session-commands.tsx",
"apps/web/components/task/chat/messages/shell-output-disclosure.tsx",
"apps/web/components/task/chat/token-usage-display.tsx",
"apps/web/components/task/editors-menu.tsx",
"apps/backend/internal/agentctl/server/process/workspace_git_status.go"
],
"tests": [
"apps/web/e2e/tests/command-panel.spec.ts",
"apps/web/e2e/tests/task/editors-menu-worktree-picker.spec.ts",
"apps/web/hooks/domains/session/use-shell-command-output.test.ts",
"apps/web/components/task/chat/token-usage-display.test.tsx",
"apps/backend/internal/agentctl/server/process/workspace_git_status_test.go"
]
},
{
"id": "agents-profiles-and-prompts",
"audiences": ["user"],
"stability": "stable",
"docs": ["agents-and-profiles", "configuration", "add-agent-cli"],
"sources": [
"apps/backend/internal/profiles/profiles.go",
"apps/web/app/settings/agents/page.tsx",
"apps/web/components/settings/agent-usage-section.tsx",
"apps/web/hooks/domains/settings/use-dynamic-models.ts"
],
"tests": [
"apps/backend/internal/profiles/profiles_test.go",
"apps/web/components/settings/agent-profile-page.test.tsx",
"apps/web/components/settings/agent-usage-section.test.tsx",
"apps/web/hooks/domains/settings/use-dynamic-models.test.ts"
],
"settingsRoutes": ["/settings/agents", "/settings/prompts", "/settings/utility-agents"],
"mcpTools": [
"create_agent_profile_kandev",
"delete_agent_profile_kandev",
"list_agent_profiles_kandev",
"list_agents_kandev",
"update_agent_kandev",
"update_agent_profile_kandev"
]
},
{
"id": "executors-and-environments",
"audiences": ["user", "operator"],
"stability": "stable",
"docs": ["executors", "remote-cloud-environment", "docker", "k8s"],
"sources": ["apps/backend/internal/agent/executor/executor.go", "apps/web/app/settings/executors/page.tsx"],
"tests": ["apps/web/e2e/tests/docker/docker-launch.spec.ts", "apps/web/e2e/tests/ssh/executor-crud.spec.ts"],
"settingsRoutes": ["/settings/executor/new", "/settings/executors"],
"mcpTools": [
"create_executor_profile_kandev",
"delete_executor_profile_kandev",
"list_executor_profiles_kandev",
"list_executors_kandev",
"update_executor_profile_kandev"
]
},
{
"id": "provider-integrations",
"audiences": ["user", "operator"],
"stability": "stable",
"docs": ["integrations", "configuration"],
"sources": ["apps/web/components/app-sidebar/sections/integrations-section.tsx", "apps/backend/internal/integrations/workspacescope/workspacescope.go", "apps/backend/internal/azuredevops/service.go", "apps/web/app/azure-devops/azure-devops-page-client.tsx"],
"tests": ["apps/web/components/app-sidebar/sections/integrations-section.test.tsx", "apps/backend/internal/integrations/workspacescope/workspacescope_test.go", "apps/backend/internal/azuredevops/service_test.go", "apps/web/e2e/tests/integrations/azure-devops.spec.ts"],
"settingsRoutes": [
"/settings/integrations",
"/settings/integrations/azure-devops",
"/settings/integrations/github",
"/settings/integrations/gitlab",
"/settings/integrations/jira",
"/settings/integrations/linear",
"/settings/integrations/sentry",
"/settings/integrations/slack"
]
},
{
"id": "automations-and-external-mcp",
"audiences": ["user", "operator"],
"stability": "stable",
"docs": ["automation-and-mcp", "integrations", "workflow-tips"],
"sources": ["apps/backend/internal/automation/service.go", "apps/backend/internal/mcp/server/server.go"],
"tests": ["apps/backend/internal/automation/service_test.go", "apps/backend/internal/mcp/server/server_test.go"],
"settingsRoutes": ["/settings/automations", "/settings/external-mcp"],
"mcpTools": ["get_mcp_config_kandev", "update_mcp_config_kandev"]
},
{
"id": "personal-settings-and-secrets",
"audiences": ["user"],
"stability": "stable",
"docs": ["security", "configuration", "developer-tools", "operations", "sessions-and-review"],
"sources": ["apps/web/src/settings-routes.tsx", "apps/web/components/settings/general-settings.tsx", "apps/web/components/settings/layouts/layout-settings.tsx"],
"tests": ["apps/web/src/settings-routes.test.ts", "apps/web/components/settings/terminal-settings.test.ts", "apps/web/lib/layout/layout-profiles.test.ts"],
"settingsRoutes": [
"/settings/general",
"/settings/general/appearance",
"/settings/general/editors",
"/settings/general/keyboard-shortcuts",
"/settings/general/layouts",
"/settings/general/notifications",
"/settings/general/secrets",
"/settings/general/sprites",
"/settings/general/task-actions",
"/settings/general/terminal",
"/settings/voice-mode"
]
},
{
"id": "security-and-trust",
"audiences": ["user", "operator"],
"stability": "stable",
"docs": ["security", "configuration", "executors", "automation-and-mcp", "operations"],
"sources": ["apps/backend/internal/backendapp/middleware.go", "apps/backend/internal/gateway/websocket/origin.go", "apps/backend/internal/secrets/crypto.go"],
"tests": ["apps/backend/internal/backendapp/middleware_test.go", "apps/backend/internal/gateway/websocket/origin_test.go"]
},
{
"id": "authentication-and-access",
"audiences": ["user", "operator"],
"stability": "beta",
"docs": ["authentication"],
"sources": ["apps/backend/internal/auth/httpmw/middleware.go", "apps/backend/internal/auth/service.go", "apps/backend/internal/auth/httpapi/handlers.go", "apps/web/components/app-sidebar/current-user-chip.tsx"],
"tests": ["apps/backend/internal/auth/httpapi/handlers_test.go", "apps/backend/internal/auth/httpmw/middleware_test.go", "apps/web/lib/state/slices/auth/auth-slice.test.ts"],
"settingsRoutes": ["/settings/system/users", "/settings/account/security", "/settings/account/tokens"]
},
{
"id": "system-health-and-maintenance",
"audiences": ["operator"],
"stability": "stable",
"docs": ["operations", "configuration", "feature-status"],
"sources": [
"apps/backend/internal/system/settings/store.go",
"apps/backend/internal/system/storage/handler.go",
"apps/web/components/settings/system/feature-toggles-settings.tsx",
"apps/web/components/settings/system/storage/storage-maintenance-settings.tsx"
],
"tests": [
"apps/backend/internal/system/settings/store_test.go",
"apps/backend/internal/system/storage/handler_test.go",
"apps/web/components/settings/system/feature-toggles-settings.test.tsx",
"apps/web/components/settings/system/storage/storage-maintenance-settings.test.tsx"
],
"settingsRoutes": [
"/settings/system/about",
"/settings/system/backups",
"/settings/system/database",
"/settings/system/feature-toggles",
"/settings/system/licenses",
"/settings/system/logs",
"/settings/system/status",
"/settings/system/storage",
"/settings/system/updates"
]
},
{
"id": "deployment-and-platforms",
"audiences": ["operator"],
"stability": "stable",
"docs": ["docker", "k8s", "run-as-a-service", "windows-support", "operations"],
"sources": ["Dockerfile", "apps/cli/src/service/index.ts"],
"tests": ["apps/web/e2e/tests/docker/docker-launch.spec.ts", "apps/cli/src/service/install_helpers.test.ts"]
},
{
"id": "office-mode",
"audiences": ["user", "operator"],
"stability": "experimental",
"docs": ["coordination", "feature-status", "office-provider-routing"],
"sources": ["apps/backend/internal/office/routes.go", "apps/web/src/office-routes.tsx"],
"tests": ["apps/backend/internal/office/onboarding/service_test.go", "apps/web/src/office-routes.test.ts"]
},
{
"id": "plugin-system",
"audiences": ["operator", "contributor"],
"stability": "experimental",
"docs": ["plugins", "plugins-authoring", "plugins-manifest"],
"sources": ["apps/backend/internal/plugins/handlers.go", "apps/backend/pkg/pluginsdk/host.go", "apps/web/lib/plugins/host-api.ts"],
"tests": ["apps/backend/internal/plugins/service_test.go", "apps/backend/internal/plugins/manifest/manifest_test.go", "apps/web/lib/plugins/host-api.test.ts"]
},
{
"id": "plugin-marketplace",
"audiences": ["operator", "contributor"],
"stability": "experimental",
"docs": ["plugins-marketplace"],
"sources": ["apps/backend/internal/plugins/marketplace/catalog.go", "apps/backend/internal/plugins/marketplace/sourcestore.go", "apps/web/lib/api/domains/marketplace-api.ts"],
"tests": ["apps/backend/internal/plugins/marketplace/catalog_test.go", "apps/backend/internal/plugins/marketplace/sourcestore_test.go", "apps/web/hooks/domains/plugins/use-marketplace.test.ts"]
},
{
"id": "websocket-protocol",
"audiences": ["contributor", "integrator"],
"stability": "stable",
"docs": ["websocket-api", "architecture", "extending-kandev"],
"sources": ["apps/backend/pkg/websocket/actions.go", "apps/backend/pkg/websocket/handler.go"],
"tests": ["apps/backend/pkg/websocket/handler_test.go", "apps/backend/pkg/websocket/handler_race_test.go"]
},
{
"id": "contributor-workflow",
"audiences": ["contributor"],
"stability": "stable",
"docs": ["contributing", "architecture", "backend-development", "web-development", "testing", "remote-cloud-environment", "extending-kandev", "release-process"],
"sources": ["CONTRIBUTING.md", "Makefile"],
"tests": ["scripts/lint-harness-files.test.py", ".github/scripts/lint-action-pinning_test.py"]
}
],
"exclusions": {
"settingsRoutes": [
{ "route": "/settings", "reason": "Alias for General settings." },
{ "route": "/settings/changelog", "reason": "Redirect to System updates." },
{ "route": "/settings/general/changes-panel", "reason": "Legacy redirect to Appearance." },
{ "route": "/settings/general/chat-input", "reason": "Legacy redirect to Keyboard Shortcuts." },
{ "route": "/settings/general/resource-metrics", "reason": "Legacy redirect to Appearance." },
{ "route": "/settings/general/shell", "reason": "Legacy redirect to Terminal." },
{ "route": "/settings/plugins", "reason": "Experimental feature intentionally omitted until its public contract stabilizes." },
{ "route": "/settings/system", "reason": "Redirect to System status." }
],
"mcpTools": []
}
}
Reference in New Issue View Git Blame Copy Permalink