Merge remote-tracking branch 'origin/master' into feat/rework-agent-onboarding

src/langbot/pkg/api/http/controller/groups/plugins.py

@@ -398,7 +398,16 @@ class PluginsRouterGroup(group.RouterGroup):
 
             # Get debug URL from config
             plugin_config = self.ap.instance_config.data.get('plugin', {})
-            debug_url = plugin_config.get('display_plugin_debug_url', 'http://localhost:5401')
+            debug_url = plugin_config.get(
+                'display_plugin_debug_url',
+                'ws://localhost:5401/plugin/debug/ws',
+            )
+            parsed_debug_url = urlparse(debug_url)
+            if parsed_debug_url.scheme in {'http', 'https'}:
+                debug_url = parsed_debug_url._replace(
+                    scheme='wss' if parsed_debug_url.scheme == 'https' else 'ws',
+                    path=parsed_debug_url.path or '/plugin/debug/ws',
+                ).geturl()
 
             return self.success(
                 data={

src/langbot/pkg/api/http/controller/groups/user.py

@@ -14,13 +14,6 @@ from ...service.user import ControlPlaneDirectoryRequiredError, PublicRegistrati
 
 @group.group_class('user', '/api/v1/user')
 class UserRouterGroup(group.RouterGroup):
-    @staticmethod
-    def _origin(value: str) -> tuple[str, str, int | None] | None:
-        parsed = urlsplit(value)
-        if parsed.scheme not in {'http', 'https'} or not parsed.hostname:
-            return None
-        return parsed.scheme, parsed.hostname.casefold(), parsed.port
-
     def _validate_space_redirect_uri(self, redirect_uri: str, *, bind: bool) -> str:
         parsed = urlsplit(redirect_uri)
         if (
@@ -38,17 +31,8 @@ class UserRouterGroup(group.RouterGroup):
             if query != {'mode': ['bind']}:
                 raise ValueError('Invalid Space binding redirect_uri')
         elif query:
-            raise ValueError('Invalid Space login redirect_uri')
+            raise ValueError('Invalid LangBot Account login redirect_uri')
 
-        redirect_origin = self._origin(redirect_uri)
-        api_config = self.ap.instance_config.data.get('api', {})
-        trusted_origins = {
-            self._origin(str(api_config.get(config_key, '') or '').strip())
-            for config_key in ('webui_url', 'webhook_prefix')
-        }
-        trusted_origins.discard(None)
-        if redirect_origin not in trusted_origins:
-            raise ValueError('Untrusted redirect_uri origin')
         return redirect_uri
 
     async def initialize(self) -> None:
@@ -338,6 +322,7 @@ class UserRouterGroup(group.RouterGroup):
             if cloud_mode:
                 capabilities['password_login_enabled'] = False
             capabilities['authenticated_invitation_acceptance_enabled'] = cloud_mode
+            capabilities['invitation_registration_enabled'] = not cloud_mode
             return self.success(data={'initialized': True, **capabilities})
 
         @self.route('/set-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
@@ -416,7 +401,7 @@ class UserRouterGroup(group.RouterGroup):
                     'Bind the LangBot Account with the same email as this local Account',
                 )
             except ValueError:
-                return self.http_status(400, -1, 'Space account binding failed')
+                return self.http_status(400, -1, 'LangBot Account binding failed')
             except Exception:
                 raise
 

src/langbot/pkg/api/http/service/user.py

@@ -114,7 +114,7 @@ class UserService:
         if purpose == 'login' and account_uuid is not None:
             raise ValueError('Login state cannot be bound to an Account')
         if purpose != 'login' and launch_workspace_uuid is not None:
-            raise ValueError('Launch Workspace state is only valid for Space login')
+            raise ValueError('Launch Workspace state is only valid for LangBot Account login')
         if ttl_seconds <= 0:
             raise ValueError('OAuth state lifetime must be positive')
 
@@ -327,7 +327,7 @@ class UserService:
         normalized_email = normalize_email(user_email)
         if self._uses_control_plane_directory():
             raise ControlPlaneDirectoryRequiredError(
-                'Cloud invitation registration must use a Space account to preserve control-plane identity'
+                'Cloud invitation registration must use a LangBot Account to preserve control-plane identity'
             )
         invitation, _ = await self.ap.workspace_collaboration_service.inspect_invitation(invitation_token)
         if invitation.normalized_email != normalized_email:
@@ -394,7 +394,7 @@ class UserService:
 
         # Check if this user has a local password set
         if not user_obj.password:
-            raise ValueError('请使用 Space 账户登录')
+            raise ValueError('请使用 LangBot 账号登录')
 
         await self._verify_password(user_obj.password, password)
 
@@ -825,7 +825,7 @@ class UserService:
         # Check if this Space account is already bound to another user
         existing_space_user = await self.get_user_by_space_account_uuid(space_account_uuid)
         if existing_space_user and existing_space_user.normalized_email != normalize_email(user_email):
-            raise ValueError('This Space account is already bound to another user')
+            raise ValueError('This LangBot Account is already bound to another user')
 
         # Update local account to Space account
         normalized_email = normalize_email(user_email)