João Salavisa
b20047b3eb
* feat(plugins): add auth capability for plugin-provided OIDC/SAML login Plugins can now authenticate a visitor against an external IdP (OIDC/SAML) and contribute a login button to the pre-auth screen: - new `auth` manifest capability + a capability-gated X-Kandev-Auth-Login webhook-response directive; the host mints the kandev_session (ADR 0050), the plugin never receives the raw token. Plugin-set Set-Cookie is dropped. - auth.Service.AuthenticateExternal: existing-identity / link-by-email / JIT member provisioning; refuses to auto-link to an admin; verified-email is the plugin's contract. - auth_providers manifest block + plugins.SSOProviders() populate the anonymous boot payload (auth.ssoProviders); the login page renders a "Continue with <provider>" button per provider. - ADR 0050 + plugin-manifest / plugin-authoring / auth spec docs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: exclude publish_review_findings_kandev from public-docs coverage The native code-review agent (#1957) added the publish_review_findings_kandev MCP tool but did not update docs/public/coverage.json; that PR did not touch docs/public so the path-filtered validator never ran. It's an internal review reporting tool, not a user-facing feature, so record it as an exclusion. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins,auth): address review on SSO directive and JIT provisioning - takeAuthLoginDirective strips every case variant of X-Kandev-Auth-Login and rejects (403) when a plugin sends more than one, so no variant leaks to the browser and login never uses a nondeterministically-picked assertion. - provisionExternalUser rolls back the just-created user when the identity insert fails (transient error or a lost UNIQUE(provider,subject) race) and resolves to the winning identity, so no account is left without a login and no email is reserved by an unusable row. Adds userstore.DeleteUser. - auth spec: mark the login-page SSO buttons + provider discovery as landed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: drop redundant coverage exclusion; main now covers publish_review_findings_kandev Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
15 KiB
15 KiB
Decision Log
Architecture Decision Records (ADRs) for the Kandev project. Each decision captures the context, choice, consequences, and alternatives for significant architectural or design decisions.
Read individual ADRs for full context. Create new ones via /record decision or manually following the template in 0001-file-based-knowledge-system.md.
| ID | Title | Status | Area | Date |
|---|---|---|---|---|
| 0001 | File-based knowledge system | accepted (amended 2026-07-16) | infra | 2026-03-28 |
| 0002 | Host utility agentctl for sessionless ACP flows | accepted | backend | 2026-04-08 |
| 0003 | executors_running as the single source of truth for agent_execution_id | accepted | backend | 2026-05-03 |
| 0004 | Task model unification — shared base, per-strategy meta, shared kernel | proposed | backend, frontend | 2026-05-05 |
| 0005 | Agent model unification — one agents table |
proposed | backend, frontend | 2026-05-06 |
| 0006 | Tier routing vs cheap_agent_profile_id coexistence | superseded | backend | 2026-05-11 |
| 0007 | profiles.yaml — runtime defaults for prod / dev / e2e | accepted | backend, frontend | 2026-05-16 |
| 0008 | DB upgrade safety - meta table, pre-migration backup, migration logging | accepted | backend | 2026-05-16 |
| 0009 | Fail-closed GC semantics for filesystem and container cleanup | accepted | backend | 2026-05-16 |
| 0010 | Worktree copy-files — per-repo, idempotent, host-local | accepted | backend, frontend | 2026-05-19 |
| 0011 | Transient provider errors (529 Overloaded) auto-retry with visible backoff | accepted | backend, frontend | 2026-05-30 |
| 0012 | Service-only UI self-update | accepted | backend, frontend, cli | 2026-05-29 |
| 0013 | Multi-branch task support — N (repo, branch) pairs per task | accepted | backend, frontend | 2026-06-01 |
| 0014 | Per-CLI MCP server injection for passthrough mode | accepted | backend | 2026-05-29 |
| 0015 | Explicit completion signal for auto-advance | proposed | backend, frontend | 2026-06-04 |
| 0016 | Read-only absolute file paths | accepted | backend | 2026-06-14 |
| 0017 | Resource metrics sampling | accepted | backend, frontend, protocol | 2026-06-14 |
| 0018 | Runtime settings overrides | accepted | backend, frontend, cli | 2026-06-14 |
| 0019 | Restart supervisor owns backend restarts | accepted | backend, frontend, cli | 2026-06-14 |
| 0020 | Pi project MCP config injection | accepted | backend | 2026-06-16 |
| 0021 | Go-served SPA with boot state | accepted | backend, frontend, cli | 2026-06-15 |
| 0022 | Embedded Vite assets | accepted | backend, frontend, cli | 2026-06-17 |
| 0023 | Active workspace cookie for boot state | accepted | backend, frontend | 2026-06-18 |
| 0024 | Go-fronted Vite dev mode | accepted | backend, frontend, cli | 2026-06-18 |
| 0025 | Runtime cleanup uses executors_running |
accepted (amended 2026-07-06) | backend | 2026-06-22 |
| 0026 | Tauri desktop shell over native runtime | accepted (amended 2026-07-15) | frontend, backend, cli, infra | 2026-06-23 |
| 0027 | Replayable schema migrations across SQLite and Postgres | accepted | backend | 2026-06-24 |
| 0028 | Backend-owned task-create last-used preferences | accepted (amended by 0041) | backend, frontend | 2026-06-29 |
| 0029 | Release backfill and desktop diagnostics | accepted (amended 2026-07-16) | infra, workflow | 2026-07-01 |
| 0030 | Workspace-scoped integration settings | accepted | backend, frontend | 2026-07-01 |
| 0031 | Office skill reference files | accepted | backend | 2026-07-06 |
| 0032 | Configurable worktree branch names | accepted | backend, frontend | 2026-07-07 |
| 0033 | Durable plan implementation start marker | accepted | backend, frontend | 2026-07-09 |
| 0034 | Agent Client Protocol Codex ACP Bridge | accepted | backend, protocol | 2026-07-10 |
| 0035 | Version AgentReady events by prompt generation | accepted | backend | 2026-07-14 |
| 0036 | Normalize ACP shell output at the adapter boundary | accepted | backend, frontend, protocol | 2026-07-14 |
| 0037 | Resource-aware frontend unit tests | accepted | frontend, infra | 2026-07-14 |
| 0038 | Quick Chat Repository Isolation | accepted | backend, frontend | 2026-07-14 |
| 0039 | Native desktop integration boundary | accepted (amended 2026-07-24) | desktop, frontend, backend, infra | 2026-07-15 |
| 0040 | Separate updater integrity from OS publisher identity | accepted | desktop, infra, workflow | 2026-07-15 |
| 0041 | Backend-owned portable user settings | accepted | backend, frontend | 2026-07-15 |
| 0042 | Project shell output and fetch it on demand | accepted | backend, frontend, protocol | 2026-07-16 |
| 0043 | Plugins read/write kandev data via capability-gated Host gRPC RPCs | accepted | backend, protocol | 2026-07-17 |
| 2026-07-14-typed-utility-chat-sessions | Typed Utility Chats Share the Quick Chat Session Model | accepted | backend, frontend | 2026-07-14 |
| 2026-07-15-office-agent-execution-profile-routing | Separate Office identity from routed execution profiles | proposed | backend, frontend | 2026-07-15 |
| 0044 | ACP agent compatibility dialects | accepted | backend, protocol | 2026-07-16 |
| 0045 | Install-wide storage maintenance uses typed ownership providers and quarantine | accepted (amended 2026-07-22) | backend, frontend, infra | 2026-07-14 |
| 0046 | Settings route save coordinator | accepted | frontend | 2026-07-14 |
| 0047 | Plugins read conversation content via a capability-gated Host RPC | accepted | backend, protocol | 2026-07-21 |
| 0048 | Plugins invoke a settings-selectable utility agent | accepted | backend, frontend, protocol | 2026-07-21 |
| 0049 | Fine-grained foreground-idle busy signal | accepted (amended 2026-07-26) | backend, frontend, protocol | 2026-07-11 |
| 0050 | Plugins provide OIDC/SAML login via a capability-gated, host-minted session | accepted | backend, security, protocol | 2026-07-26 |
| 2026-07-23-opencode-review-evidence-trust | Trusted OpenCode Review Evidence | accepted | workflow, infra | 2026-07-23 |
| 2026-07-23-planner-direct-small-work | Planner Direct Small Work | accepted | workflow | 2026-07-23 |
| 2026-07-23-post-commit-hook-aware-verification | Post-Commit Hook-Aware Verification | accepted | workflow | 2026-07-23 |
| 2026-07-23-workspace-source-root-move-boundary | Workspace Source Root Move Boundary | accepted | backend | 2026-07-23 |
| 2026-07-24-operator-owned-agent-launcher-settings | Operator-Owned Agent Launcher Settings | accepted | backend, frontend, protocol | 2026-07-24 |
| 2026-07-18-turn-configuration-snapshots | Attribute runtime configuration to turns | accepted | backend, frontend | 2026-07-18 |
| 2026-07-22-gpg-signed-release-tags | GPG-signed release tags | accepted | infra, workflow | 2026-07-22 |
| 2026-07-19-reject-mcp-actions-on-raw-websocket | Reject MCP Actions on the Raw WebSocket | accepted | backend, protocol | 2026-07-19 |
| 2026-07-19-workspace-symlink-entries | Treat Nested Workspace Symlinks as Entries | accepted | backend, infra | 2026-07-19 |
| 0047 | Separate GitHub deployment, workspace automation, and personal identities | accepted | backend, frontend, security | 2026-07-19 |
| 2026-07-20-managed-github-app-registration | Manage Self-Hosted GitHub App Registration at Runtime | superseded | backend, frontend, security | 2026-07-20 |
| 2026-07-20-explicit-local-repository-trust | Explicit Local Repository Trust | accepted | backend, frontend | 2026-07-20 |
| 2026-07-20-provider-neutral-remote-repositories | Provider-neutral remote repositories | accepted | backend, frontend, protocol | 2026-07-20 |
| 2026-07-21-workspace-selectable-github-app-registrations | Select GitHub App Registrations Per Workspace | accepted | backend, frontend, security | 2026-07-21 |
| 2026-07-20-repository-provider-origin-identity | Persist Provider Origin In Repository Identity | accepted | backend, frontend | 2026-07-20 |
| 2026-07-21-portable-status-bar-order | Portable Status Bar Order | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-21-work-item-reference-search | Backend-normalized work-item references | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-22-runtime-mutable-task-workspace-sources | Runtime-Mutable Task Workspace Sources | accepted | backend, frontend, protocol | 2026-07-22 |
| 2026-07-24-opt-in-authentication | Opt-in Authentication and Per-User Workspace Scoping | accepted | backend, frontend, protocol, security | 2026-07-24 |
| 2026-07-24-semantic-notification-events | Semantic notification events come from domain occurrences | accepted | backend, frontend, desktop | 2026-07-24 |