mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-08-20 01:10:59 +00:00
Junyan Chin
e9dd584792
* feat(api): support global API key from config.yaml (api.global_api_key) Accept a config-defined global API key anywhere a web-UI key is accepted (X-API-Key / Bearer), with no login session and no DB record. Useful for automated deployments and AI agents (HTTP API + MCP). Defaults to empty (disabled); does not require the lbk_ prefix. - templates/config.yaml: add api.global_api_key with security notes - service/apikey.py: verify_api_key checks global key first (constant-time) - docs/API_KEY_AUTH.md: document the global key + security guidance - tests: cover global-key match, prefix-free, fallback-to-db, disabled * feat(mcp): expose LangBot management as an MCP server at /mcp Add an MCP (Model Context Protocol) server so external AI agents can manage a LangBot instance. Reuses the same API-key auth as the HTTP API (including the config.yaml global API key). - pkg/api/mcp/server.py: FastMCP server wrapping the service layer; 21 curated tools across system/bots/pipelines/models/knowledge/mcp-servers/skills - pkg/api/mcp/mount.py: ASGI dispatcher fronting Quart; authenticates /mcp requests with an API key, runs the streamable-HTTP session manager lifespan - controller/main.py: serve the wrapped ASGI app via hypercorn (was run_task) - web: new 'MCP' tab in the API integration dialog showing endpoint, auth, and client config; i18n for 8 locales - tests/manual/mcp_smoke.py: e2e check (401 unauth, list tools, call tools) Tool surface is intentionally curated (not all ~25 route groups) to keep the agent surface small, safe, and maintainable. Extend deliberately. * feat(skills): add in-repo skills/ as the single source of truth Migrate the agent skills + QA/e2e test harness from the (now archived) langbot-app/langbot-skills repo into LangBot/skills/, and add four new skills. Migrated: - langbot-plugin-dev, langbot-testing (e2e), langbot-env-setup, langbot-skills-maintenance, langbot-eba-adapter-dev - the bin/lbs CLI (src/, test/, scripts/, schemas/, qa-agent-docs/) New: - langbot-dev core backend + web development - langbot-deploy Docker/K8s deployment + config.yaml + global API key - langbot-mcp-ops operating the LangBot MCP server (/mcp) - langbot-space-ops operating the Space marketplace MCP server - src/cli.ts repoRoot(): recognize the skills assets root (skills.index.json + bin/lbs) so the CLI works when nested inside the LangBot repo - README.md: unified skill catalog; skills.index.json regenerated Parity with source verified: bin/lbs validate + node test suite match the source repo (only the uncommitted .lbpkg build-artifact fixture differs). * docs(agents): document agent-facing surfaces + API/MCP/skills sync rule * docs(readme): add 'Built for AI Agents' section across all locales Highlight MCP server, in-repo skills (single source of truth), AGENTS.md sync rule, and llms.txt. Cross-link LangBot Space MCP marketplace. * style(mcp): fix ruff format + prettier lint in MCP server and API panel * style(web): prettier format MCP i18n locale entries * docs(skills): note MCP instance control in dev/testing skills All development-guidance skills now point to the LangBot instance MCP server (/mcp) and the Space marketplace MCP server, reusing API keys.
1.7 KiB
1.7 KiB
OAuth Browser Profile
Use this reference when LangBot or LangBot Space needs GitHub OAuth login and the agent must reuse the authenticated browser state later.
Read skills/.env first for LANGBOT_BACKEND_URL, LANGBOT_FRONTEND_URL, LANGBOT_BROWSER_PROFILE, LANGBOT_CHROMIUM_EXECUTABLE, and proxy defaults.
Rules
- Never handle the user's GitHub password, passkey, recovery code, or 2FA secret.
- Open a visible browser and let the user complete credential steps.
- Reuse a fixed browser profile path.
- Do not print token values. It is acceptable to report localStorage key names.
Manual Visible Login Flow
- Verify LangBot backend is reachable with
service-startup.md. - Launch a visible Chromium window with the persistent profile:
setsid "$LANGBOT_CHROMIUM_EXECUTABLE" \
--no-sandbox \
--ozone-platform=x11 \
--user-data-dir="$LANGBOT_BROWSER_PROFILE" \
--proxy-server="$LANGBOT_PROXY_SOCKS" \
--proxy-bypass-list="$LANGBOT_NO_PROXY" \
"$LANGBOT_BACKEND_URL/login" \
>/tmp/langbot-visible-chrome.log 2>&1 < /dev/null &
- The user completes:
Login with Space -> Login with GitHub -> GitHub credentials / 2FA -> authorize
- The agent can then reuse the same profile for automated checks.
Expected Successful State
After login, LangBot should redirect away from /login, for example to a /home/... URL on the selected origin.
Expected visible signals:
LangBot
Dashboard
Home
Bots
Pipelines
Knowledge
Extensions
Expected localStorage key names:
token
userEmail
langbot_language
If the user logged in on one origin but LANGBOT_FRONTEND_URL still shows /login, copy only the auth state needed between origins. Do not print token values.