Merge master into dev/4.11.x and preserve plugin runner architecture

Reconcile migration branches without rewriting published revisions; retain additive Codex, monitoring, provider and platform fixes. Keep dynamic runner schemas and Host ownership, restore compatibility regressions, and preserve safe model-test error handling.

src/langbot/pkg/core/app.py

@@ -653,9 +653,9 @@ class Application:
         frontend_path = paths.get_frontend_path()
 
         if not os.path.exists(frontend_path):
-            self.logger.warning('WebUI 文件缺失，请根据文档部署：https://docs.langbot.app/zh')
+            self.logger.warning('WebUI 文件缺失，请根据文档部署：https://langbot.app/docs/zh')
             self.logger.warning(
-                'WebUI files are missing, please deploy according to the documentation: https://docs.langbot.app/en'
+                'WebUI files are missing, please deploy according to the documentation: https://langbot.app/docs/en'
             )
             return
 

src/langbot/pkg/core/bootutils/deps.py

@@ -43,6 +43,7 @@ required_deps = {
     'slack_sdk': 'slack_sdk',
     'asyncpg': 'asyncpg',
     'litellm': 'litellm',
+    'xxhash': 'xxhash',
 }
 
 

src/langbot/pkg/core/stages/genkeys.py

@@ -1,9 +1,18 @@
 from __future__ import annotations
 
+import logging
 import secrets
 
 from .. import stage, app
 
+# This stage runs before SetupLoggerStage, so ap.logger is still None here;
+# the module logger falls back to the stderr lastResort handler.
+_logger = logging.getLogger(__name__)
+
+# 32 symbols without 0/O or 1/I; eight independent draws provide 40 random bits.
+_RECOVERY_KEY_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ'
+_RECOVERY_KEY_LENGTH = 8
+
 
 @stage.stage_class('GenKeysStage')
 class GenKeysStage(stage.BootingStage):
@@ -20,5 +29,15 @@ class GenKeysStage(stage.BootingStage):
             ap.instance_config.data['system']['recovery_key'] = ''
 
         if not ap.instance_config.data['system']['recovery_key']:
-            ap.instance_config.data['system']['recovery_key'] = secrets.token_hex(3).upper()
+            # Keep recovery practical to type. Security also requires the reset
+            # endpoint's concurrency-safe quota (five admissions per 15 minutes).
+            ap.instance_config.data['system']['recovery_key'] = ''.join(
+                secrets.choice(_RECOVERY_KEY_ALPHABET) for _ in range(_RECOVERY_KEY_LENGTH)
+            )
             await ap.instance_config.dump_config()
+        elif len(ap.instance_config.data['system']['recovery_key']) < _RECOVERY_KEY_LENGTH:
+            _logger.warning(
+                'Low-entropy legacy recovery key detected (length < 8); '
+                'regenerate system.recovery_key in the configuration file '
+                'with a strong random value (#2392)'
+            )

src/langbot/pkg/core/taskmgr.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+import json
 import typing
 import datetime
 import time
@@ -197,6 +198,41 @@ class TaskWrapper:
             },
         }
 
+    def to_public_dict(self) -> dict:
+        """Return the stable task projection exposed to API-key callers."""
+        if self.task.cancelled():
+            status = 'cancelled'
+            error = {'type': 'task_cancelled', 'message': 'Task was cancelled'}
+            result = None
+        elif not self.task.done():
+            status = 'running'
+            error = None
+            result = None
+        else:
+            exception = self.assume_exception()
+            if exception is not None:
+                status = 'failed'
+                error = {'type': 'task_failed', 'message': 'Task execution failed'}
+                result = None
+            else:
+                status = 'succeeded'
+                error = None
+                result = self.assume_result()
+                try:
+                    json.dumps(result)
+                except (TypeError, ValueError):
+                    result = None
+
+        return {
+            'id': self.id,
+            'task_type': self.task_type,
+            'kind': self.kind,
+            'status': status,
+            'error': error,
+            'result': result,
+            'created_at': self.created_at,
+        }
+
     def cancel(self):
         self.task.cancel()
 
@@ -325,19 +361,20 @@ class AsyncTaskManager:
         instance_uuid: str | None = None,
         workspace_uuid: str | None = None,
         placement_generation: int | None = None,
+        public: bool = False,
     ) -> dict:
-        return {
-            'tasks': [
-                t.to_dict()
-                for t in self.tasks
-                if (type is None or t.task_type == type)
-                and (kind is None or t.kind == kind)
-                and (instance_uuid is None or t.instance_uuid == instance_uuid)
-                and (workspace_uuid is None or t.workspace_uuid == workspace_uuid)
-                and (placement_generation is None or t.placement_generation == placement_generation)
-            ],
-            'id_index': TaskWrapper._id_index,
-        }
+        tasks = [
+            t.to_public_dict() if public else t.to_dict()
+            for t in self.tasks
+            if (type is None or t.task_type == type)
+            and (kind is None or t.kind == kind)
+            and (instance_uuid is None or t.instance_uuid == instance_uuid)
+            and (workspace_uuid is None or t.workspace_uuid == workspace_uuid)
+            and (placement_generation is None or t.placement_generation == placement_generation)
+        ]
+        if public:
+            return {'tasks': tasks}
+        return {'tasks': tasks, 'id_index': TaskWrapper._id_index}
 
     def get_stats(self) -> dict:
         completed = sum(1 for t in self.tasks if t.task.done())