Commit Graph
65 Commits
Author SHA1 Message Date
4b537973f9 feat(plugin): upload debug plugin to LangBot Space with optional GitH… (#2612)
* feat(plugin): upload debug plugin to LangBot Space with optional GitHub sync

- SDK: reusable in-memory .lbpkg packaging + git sync helper (local git by default, optional repo/token override)
- routing: space-upload config/upload/git-sync endpoints; debug plugins resolved via OSS bridge without touching get_plugin_info
- frontend: debug-card entry + upload dialog with multi-language metadata, icon upload and changelog
- i18n across 8 locales; operation-trace + action allowlist entries

* fix(plugin-space-upload): stable dialog width, single-line locale tabs, broader error surfacing

- fixed dialog width so toggling the GitHub section no longer resizes it
- language tabs render on one line (horizontal scroll when needed)
- surface the real upload/git error message (msg field) instead of [object Object]
- hint that a missing GitHub repo is auto-created when a token is provided

* fix(plugin-space-upload): narrow dialog and reset sm:max-w clamp

The base DialogContent applies sm:max-w-lg at the sm breakpoint, which overrode the unprefixed max-w-none and clamped the upload card to 32rem on desktop. Set an explicit sm:max-width and size the card to ~36rem. Locale tabs now wrap instead of scrolling horizontally.

* fix

* fix(plugin-space-upload): address CI and UX feedback

- narrow the upload dialog to ~36rem and reset the sm:max-w clamp
- guide the publisher to the Space review page after a successful upload
- drop the redundant null comparison flagged by code quality
- update the operation-action expectation and Space/LangBot Account wording
- ruff format the touched API modules

* feat(plugin-space-upload): public repo, editable author/license, card red dot

* fix(market): replace yellow download count with update available badge

* style(market): unify installed and update indicators into badges

* feat(plugin): redesign debug card banner, style debug icon, and prioritize debug plugins

* feat(plugin-space-upload): simplify upload dialog layout, add creator verification and market redirection

* fix(i18n): use LangBot Account terminology in Space upload dialog

Co-authored-by: multica-agent <[email protected]>

* style(i18n): reflow reworded locale strings for prettier

Co-authored-by: multica-agent <[email protected]>

* test(utils): stop timing out the pattern-count cap test on loaded runners

Co-authored-by: multica-agent <[email protected]>

---------

Co-authored-by: Hyu <[email protected]>
Co-authored-by: RockChinQ <[email protected]>
Co-authored-by: multica-agent <[email protected]>
2026-10-28 18:23:09 +08:00
Li-john1021andLi-john1021 bd4e408d7e fix(plugin): honor display_plugin_debug_url port for managed Runtime (#2782)
Stdio and Windows launches always bound the SDK default debug port 5401,
so changing plugin.display_plugin_debug_url only updated the console URL
and a second Core instance hit Address already in use. Pass the configured
debug (and Windows control) ports into the Runtime CLI, and document the
behavior.

Fixes #2713

Co-authored-by: Li-john1021 <[email protected]>
2026-10-27 20:56:26 +08:00
huanghuoguoguo 7865ad51f7 perf(plugin): negotiate ordered batch event dispatch (#2778) 2026-10-27 11:36:47 +08:00
huanghuoguoguo cc19395f5c perf(core): reduce execution projection and dispatch overhead (#2746)
* perf(core): join execution projection and reuse authorized tool schemas

* perf(pipeline): avoid duplicate checks before stage output validation

* perf(plugin): reuse reconciled settings within event dispatch

* fix(workspace): keep execution projection reads free of unrelated flushes
2026-10-22 20:00:42 +08:00
RockChinQ b5fad9f04a feat(cloud): configure dedicated and shared worker quotas independently 2026-10-13 03:19:36 +00:00
Hyu 38d5750785 fix(plugin): report when an installation failure happened, not when it was sampled
The connector stored only uuid/code/message, so the ops reporter stamped every entry with its own sampling time and a stale failure looked freshly broken on each report. Failures now carry failed_at and the payload publishes it.
2026-10-02 01:34:46 +08:00
Hyu 4c71de5eca feat(plugin): push plugin runtime ops samples to the Space control plane
The shared Cloud deployment runs one Plugin Runtime for every Workspace, but
nothing reported its health: the instance only exposed two aggregate numbers on
its own health probe, and the per-installation failure registry, the desired
state registry and the reconcile outcome lived in memory with no reader.

Add RuntimeOpsReporter, which every 30 seconds reads the Runtime ``/healthz``
probe over HTTP (derived from ``plugin.runtime_ws_url``), merges it with the
connector's desired-state, failure and reconcile summaries, and posts one
sample to the Space control plane on the existing authenticated direction.
Delivery is best-effort and bounded: a single in-flight request, a ten second
timeout, dropped samples counted in ``runtime_ops`` on the instance health
probe, and a failed probe recorded as a drop so the dashboard shows staleness
instead of grading a stale sample as healthy.

Cloud-only: a non-cloud deployment never enables the reporter, and the channel
is independent of product telemetry so ``space.disable_telemetry`` cannot blind
the ops dashboard.
2026-10-01 19:01:16 +08:00
RockChinQ 30585c8657 refactor: remove beta diagnostics collection and reporting (#2616) 2026-09-30 20:24:35 +08:00
RockChinQ 1fde3b4283 fix(certification): align certified sharing and unsigned dedicated admission (#2610)
Integrate certification policy, SDK/Core semantics, and documentation on canonical branch. Resolve duplicated documentation and keep invalid Cloud signatures rejected.
2026-09-29 00:56:18 +08:00
RockChinQ b51a448b1e feat: stateless certified shared worker
Implements stateless singleton component model for certified shared Workers, integrating with SDK 0.7.0.
2026-09-28 13:25:40 +08:00
RockChinQ d1a0ae9b26 fix(plugin): bound shared install readiness 2026-09-27 00:55:58 +00:00
RockChinQ 9f296bd57e feat(plugin): route certified installs to shared workers 2026-09-25 12:48:55 +00:00
RockChinQ 5d9684731e merge(4.11): integrate master marketplace updates preserving Runner lifecycle 2026-09-21 16:58:35 +00:00
RockChinQ 27871e4363 merge: integrate master certification and document identity fixes into 4.11 2026-09-21 10:55:40 +00:00
TyperBody efc28747d5 Merge origin/master into feat/marketplace-installed-state-and-search
Resolved one conflict in src/langbot/pkg/plugin/connector.py. Master added
archive admission (`_admit_plugin_archive` + the certification digest check
before Runtime apply) at the same points this branch added install-stage
reporting, so both sides are kept:

- the archive is admitted first, then the 'inspecting plugin package' stage is
  reported
- the certification digest is verified before Runtime apply, then the
  'installing or starting plugin' stage is reported

Verified after merge: py_compile + ruff, tsc --noEmit, 98/98 unit tests.
2026-09-21 00:48:20 +08:00
TyperBody 163dac48b0 fix(plugins): correct install progress bounds, skill identity, and stage accuracy
Addresses review feedback on the marketplace installed-state change.

- Progress: byte-derived progress no longer has time-based drift layered on
  top, and fallback drift is clamped to the current stage range, so the bar
  cannot exceed the download band. 90/100 bytes at 40s elapsed used to report
  61% against a declared 5-45% band; it now reports 41%. Drift is measured
  from when the stage was entered rather than from task start.
- Skills: a marketplace skill is no longer reported installed from a bare
  skill name. The backend names skills from their own SKILL.md and records no
  publisher, so alice/review and bob/review install identically; matching the
  bare name marked every publisher's skill as installed. Skill cards now
  resolve to not-installed until the installed skill carries a publisher.
- Stages: "installing plugin dependencies" and "launching plugin" described
  work this task context cannot observe (installation persistence ran under
  the former; the runtime installs dependencies and starts the plugin inside
  apply_plugin_installation under the latter). They become "persisting the
  installation" and "installing or starting plugin", and the frontend maps
  that combined step to the dependency stage rather than the launch stage.
- Removed the per-dependency progress fields: the backend never populated
  them, so the UI could never have displayed them.

The stage mapping and progress maths move to install-progress.ts, and the
installed-state matching to a React-free marketplace-installed.ts, so both
are covered by executable tests (+9).

Verified: ruff, tsc --noEmit, prettier --check, eslint (0 errors), 98/98 unit
tests.
2026-09-21 00:40:23 +08:00
RockChinQ 52f5699533 fix(plugin): honor requested marketplace version (#2555) 2026-09-20 23:59:50 +08:00
RockChinQ 20a04a77bf feat(plugin): enforce certified archive admission (#2553)
* feat(plugin): add certified admission policy

* feat(plugin): enforce certified archive admission

* chore(plugin): pin certified SDK beta

* fix(plugin): consume SDK beta 5

* style(plugin): format certification admission
2026-09-20 18:54:45 +08:00
RockChinQ 60606e1997 fix(migration): improve runner migration and plugin installation feedback 2026-09-18 13:10:32 +08:00
RockChinQ b264d46d77 feat: delegate sandbox policy to runners and simplify pipeline migration 2026-09-17 23:05:27 +08:00
TyperBody 4535a21cb5 feat(plugins): show installed state in marketplace and search installed extensions
Marketplace cards now reflect whether an extension is already installed in
the current workspace, and the installed-extension list gains a search box.

Backend (stream install progress):
- _read_httpx_response_limited gains an optional task_context: it publishes
  download_total from Content-Length before the first chunk and updates
  download_current / download_speed per chunk. The marketplace download path
  previously had no progress reporting; it now matches the GitHub path.
- _marketplace_get forwards task_context to that helper.
- install_plugin resets the per-install counters so re-installing the same
  plugin cannot inherit stale metadata, and reports human-readable stages:
  preparing -> downloading -> inspecting -> storing -> installing
  dependencies -> launching -> waiting for plugin to become ready.

Frontend (installed state):
- New marketplace-installed helper normalises the sidebar identities
  (plugin: author/name, mcp: author__name, skill: bare name) into one
  type:author/name index and resolves a card's installed state from it.
  useMarketplaceInstalledIndex memoises on the sidebar lists, so a finished
  install (which refreshes the sidebar) re-evaluates the cards automatically.
- PluginMarketCardVO carries installed / hasUpdate. An installed extension
  turns its download affordance into a hollow green ring with a green check
  in place, instead of adding a separate badge; the count slot switches to
  the installed label. Cards with an available update use amber.
- PluginMarketComponent derives the annotated list and shares the index with
  RecommendationLists.

Frontend (install task UI):
- mapActionToStage matches the new connector stage strings. The pre-download
  stages are checked before the generic "install" match, because
  "preparing plugin install" also contains "install".
- Stage progress ranges are non-overlapping; overall progress interpolates on
  real byte counts while downloading and drifts monotonically elsewhere,
  capped at 99%.
- The progress dialog and task queue expose the launching stage.

Frontend (installed list search):
- The installed list had no search at all. A query box in the page header
  filters by label / name / author / description, case-insensitively, applied
  before grouping so grouped and flat views both honour it.
- Search misses and an empty list now show distinct empty states, with a
  clear action on a search miss.
- AsyncTask entity gains the optional created_at field.

i18n: new marketplace / install / search strings across all 8 locales.

Verified: ruff format + check, tsc --noEmit, prettier --check, eslint
(0 errors), and 89/89 frontend unit tests.
2026-09-16 02:03:57 +08:00
dadachann f8123ead0a feat(telemetry): add isolated beta quality diagnostics and release identity 2026-09-15 09:35:01 +00:00
Hyu d497defbf7 fix(runner): keep installation context within each stream resume 2026-09-15 13:51:27 +08:00
RockChinQ f24a7c9bb2 feat(runner): unify plugin execution across agents and event processors 2026-09-10 18:04:38 +08:00
RockChinQ 812eb09ee4 fix(pipeline): apply returned plugin event contexts 2026-09-07 23:51:34 +08:00
Hyu a87c814dae feat(web): improve marketplace install workflows 2026-09-01 16:43:50 +08:00
Hyu e5e62c8fe9 fix(plugin): keep status responsive during installation 2026-09-01 12:46:16 +08:00
Hyu fde04e64f6 Merge remote-tracking branch 'origin/master' into dev/4.11.x
# Conflicts:
#	src/langbot/pkg/api/http/controller/groups/pipelines/pipelines.py
#	src/langbot/pkg/api/http/service/bot.py
#	src/langbot/pkg/provider/runners/localagent.py
#	src/langbot/templates/metadata/pipeline/ai.yaml
#	tests/unit_tests/api/service/test_bot_service.py
#	tests/unit_tests/provider/runners/test_difysvapi_runner.py
#	tests/unit_tests/utils/test_safe_regex.py
#	web/src/app/infra/entities/adapter-categories.ts
#	web/src/app/wizard/page.tsx
#	web/src/i18n/locales/en-US.ts
#	web/src/i18n/locales/ja-JP.ts
#	web/src/i18n/locales/zh-Hans.ts
#	web/tests/e2e/plugin-page-auth.spec.ts
2026-08-31 17:17:47 +08:00
RockChinQandHyu 1b7ae791b3 fix(plugin): return not found after removal (#2483)
Co-authored-by: Hyu <[email protected]>
2026-08-31 13:40:03 +08:00
dadachann 0559d9d441 Merge master into dev/4.11.x
# Conflicts:
#	pyproject.toml
#	uv.lock
2026-08-24 02:34:14 +00:00
dadachann 6bf1546df2 style: format Cloud runtime readiness fixes 2026-08-20 19:08:41 +00:00
dadachann c4bad508d2 fix(runtime): honor configured cold reconcile timeout 2026-08-20 18:55:24 +00:00
Junyan Qin f94243c725 chore: merge master into dev/4.11.x 2026-08-14 16:04:52 +08:00
HyuandChan 97428310b9 fix(runtime): require Cloud control secrets (#2418)
Co-authored-by: Chan <[email protected]>
2026-08-12 18:42:23 +08:00
HyuandChan 7dc9dafb7c fix(plugin): validate runtime timeout before startup (#2407)
Co-authored-by: Chan <[email protected]>
2026-08-07 11:26:42 +08:00
HyuandChan ddb6dbf593 fix(cloud): tolerate slow plugin runtime reconciliation (#2405)
Co-authored-by: Chan <[email protected]>
2026-08-06 20:39:20 +08:00
Hyuanddadachann d78546967c feat: expose Workspace-scoped rotating plugin debug keys (#2395)
* feat: add Workspace-scoped rotating plugin debug tokens

* chore: pin formatted Workspace debug runtime

* chore: pin merged Workspace debug runtime

* chore: pin tenant-safe debug runtime

---------

Co-authored-by: dadachann <[email protected]>
2026-08-04 19:20:06 +08:00
huanghuoguoguo 79611a5513 fix(agent): harden runner integration and QA 2026-08-01 09:23:41 +08:00
huanghuoguoguo 55f42a4ebc chore(merge): sync master into dev/4.11.x 2026-07-31 19:29:38 +08:00
RockChinQanddadachann e1ac5e0fc8 feat(tenancy): add Workspace multi-tenant foundation (#2353)
* Document multi-tenant workspace architecture

* Add OSS and commercial workspace boundaries

* docs: redesign multi-tenant workspace architecture

* feat(tenancy): implement workspace isolation

* docs(tenancy): record verification evidence

* docs(tenancy): revise single-instance SaaS topology

* docs(tenancy): refine architecture options

* docs: finalize cloud v2 multi-tenant decisions

* feat(tenancy): establish cloud isolation foundations

* feat(tenancy): harden shared cloud runtime boundaries

* docs(tenancy): record final isolation verification

* fix(tenancy): close isolation and permission gaps

* docs(tenancy): record final isolation verification

* feat(tenancy): connect cloud workspace control plane

* fix(build): install git for pinned SDK

* docs(cloud): update control plane verification

* chore: update multi-tenant SDK pin

* fix(cloud): skip legacy model sync during startup

* test(cloud): preserve minimal model manager fixtures

* fix(cloud): preserve authenticated account context

* fix(cloud): reuse authenticated account for user info

* feat(cloud): complete Workspace settings navigation

* test(web): cover Workspace dropdown menu

* feat(web): place workspace controls in sidebar

* refactor(web): streamline workspace controls

* style(web): format workspace layout test

* fix(cloud): surface runtime and workspace plan status

* fix(plugin): keep runtime identity stable across restarts

* fix(ui): widen and center workspace switcher

* fix(ui): hide roles from workspace switcher

* fix(ui): align workspace switcher with sidebar entries

* feat(workspace): add in-product collaboration and direct Cloud launch

* style: format collaboration changes

* fix(workspace): bind collaboration APIs to tenant UoW

* fix(cloud): preserve Core-owned collaboration state

* test(cloud): require Space identity for invite registration

* feat(cloud): complete secure invitation experience

* style(web): format invitation flows

* fix(cloud): recover box runtime without unscoped skill reload

* feat(oss): enforce invitation account and owner billing flows

* style: format OSS account service

* test(oss): cover invitation logout handoff

* fix(oss): resolve workspace owner in scoped session

* feat(cloud): harden multi-tenant runtime resources

* fix(cloud): bound runtime restart storms

* fix(cloud): eliminate periodic runtime CPU spikes

* fix(cloud): enforce instance capacity ceilings

* fix(cloud): scope public login capability discovery

* fix(cloud): bound tenant maintenance and monitoring work

* fix(runtime): bound tenant resource amplification

* fix(deps): pin green multi-tenant plugin SDK

* fix(cloud): handle unavailable skill capability

* fix(security): require authentication for image file endpoint (H-2)

- Changed /api/v1/files/image from AuthType.NONE to USER_TOKEN_OR_API_KEY
- Added Permission.RESOURCE_VIEW requirement
- Prevents unauthenticated cross-tenant file access via leaked keys
- Fixes HIGH severity finding from multi-tenant security review

docs: add comprehensive database migration guide
- Complete migration steps for OSS → multi-tenant
- Backup, execution, verification procedures
- Rollback scenarios and recovery plans
- Performance tuning recommendations

* test: add comprehensive cross-tenant isolation tests

Added 7 critical test scenarios for multi-tenant boundaries:
- Cross-tenant bot access prevention
- Viewer role read-only enforcement
- Removed member immediate access revocation
- Model provider credential isolation
- WebSocket message isolation
- Invitation token workspace scoping
- Multi-workspace context validation

These tests address P0-2 coverage gaps for:
- workspaces.py (membership & invitation flows)
- user.py (authentication & authorization)
- websocket_chat.py (real-time isolation)
- plugins.py (resource access control)

docs: finalize database migration guide

* fix(security): resolve M-1, M-2, M-3 security findings

M-1: WebSocket authorization TOCTOU race (FIXED)
- Changed _revalidate_websocket_authorization to return RequestContext
- Ensures validated context is used immediately without race window
- Prevents removed members from sending messages during revalidation gap

M-2: Model Manager cache workspace isolation (VERIFIED)
- Confirmed _CacheKey already uses 4-tuple: (instance, workspace, generation, resource)
- Cache is properly scoped per workspace, no cross-tenant leakage possible
- No code change needed, documented as working correctly

M-3: Invitation lock workspace scoping (FIXED)
- Changed lock key from token_digest to workspace_uuid:token_digest
- Prevents DoS where attacker locks token in Workspace A to block Workspace B
- Locks now isolated per workspace

All MEDIUM severity findings from security review now resolved.

* fix(cloud): unblock tenant CI and enforce knowledge quotas

* fix(tenancy): scope rerank model sync

---------

Co-authored-by: dadachann <[email protected]>
2026-07-30 21:43:35 +08:00
Junyan Qin 8511178666 fix(runtime): harden connector lifecycle 2026-07-23 16:03:26 +08:00
Junyan Qin 998b76d53a fix(runtime): make plugin and box connectors resilient 2026-07-21 18:43:24 +08:00
Junyan Qin 1765c43262 Revert "fix(runtime): make plugin and box connectors resilient"
This reverts commit 0b461e5830.
2026-07-21 18:43:01 +08:00
Junyan Qin 0b461e5830 fix(runtime): make plugin and box connectors resilient 2026-07-21 18:41:22 +08:00
huanghuoguoguo 1af106aa92 fix(agent-runner): validate clean marketplace onboarding 2026-07-19 22:46:01 +08:00
huanghuoguoguo cb9930c9e4 feat(agent-runner): add plugin runner host integration 2026-07-19 22:41:30 +08:00
彼方andRockChinQ 48905ea080 feat(plugin): report deferred response delivery failures (#2287)
* feat(plugin): report deferred response delivery failures

* style: fix ruff format issues in plugin_diagnostics and test_handler_actions

---------

Co-authored-by: RockChinQ <[email protected]>
2026-06-26 23:45:10 +08:00
RockChinQ 64ed6d994b feat(mcp): simplify external MCP server config to local/remote modes
Replace the three-way transport choice (stdio / sse / httpstream) for
connecting LangBot to external MCP servers with two modes: local (stdio)
and remote. Remote servers only require a URL; the runtime auto-detects
the transport (tries Streamable HTTP, falls back to SSE).

- provider/tools/loaders/mcp.py: add _init_remote_server() with
  Streamable-HTTP-then-SSE probing; dispatch 'remote' lifecycle, keep
  legacy sse/http branches for back-compat
- plugin/connector.py: normalize legacy http/sse marketplace modes to
  'remote' on Space install, preserving connection params
- entity/persistence/mcp.py: document mode as stdio, remote (legacy: sse, http)
- alembic 0006: idempotent data migration mapping existing sse/http rows
  to remote (downgrade maps back to http)
- api/http/service/mcp.py: stash runtime_info (status + tool list) into
  test task metadata before tearing down the temp session
- web: collapse mode dropdown to local/remote, remote renders URL+timeout
  only, edit auto-maps legacy sse/http to remote; show tools after test in
  create mode from task metadata; remove dead plugins/mcp-server/ tree
- i18n: local/remote labels + mode/url hints across 8 locales
2026-06-21 11:20:32 -04:00
RockChinQ 5bfa38cbf2 feat(plugins): show plugin logs on detail page via Docs/Logs tablist
Add a Logs tab beside Documentation on the plugin detail page, showing
the output a plugin prints through the standard Python logger (per the
wiki style guide). Logs are captured from the plugin's stderr by the
plugin runtime and fetched on demand.

- Bump langbot-plugin pin to 0.4.4 (adds GET_PLUGIN_LOGS action)
- plugin_connector/handler: get_plugin_logs RPC client
- HTTP route GET /api/v1/plugins/<author>/<name>/logs (limit + level)
- Frontend: wrap detail right panel in Docs/Logs Tabs; PluginLogs
  component with level filter, manual + 3s auto refresh, bottom-follow
- i18n: 7 new keys across all 8 locales
2026-06-13 08:01:18 -04:00
RockChinQ f54ae4b91c feat(mcp): persist and display marketplace README
Capture the README markdown from LangBot Space when installing an MCP
server and store it on the mcp_servers record (new readme column +
alembic migration 0004). The detail page can then render docs offline,
independent of the server's runtime/connection state.
2026-06-06 03:52:00 -04:00