first commit

2026-07-11 14:56:10 +08:00
commit 7e05d0a4e7
660 changed files with 78119 additions and 0 deletions
@@ -0,0 +1,46 @@
+## 1. Platform Bridge Execution Contracts
+
+- [x] 1.1 Add platform domain and DTO contracts for bridge execution requests, responses, result refs, and safe errors.
+- [x] 1.2 Add validators for action support, required permissions, page route scope, server scope, payload bounds, AI purposes, and unsafe path/secret/socket content.
+- [x] 1.3 Add service methods that authorize and execute supported bridge actions through existing platform services.
+
+## 2. Platform Bridge Execution API
+
+- [x] 2.1 Implement bridge execution route using named DTOs and service methods.
+- [x] 2.2 Map supported actions to safe service calls for server context, job dispatch, logs, artifacts, scoped files, and platform-mediated AI where available.
+- [x] 2.3 Update platform route/protocol documentation for plugin bridge execution and deferred unsupported actions.
+- [x] 2.4 Add platform tests for allowed execution, denied permissions, unsupported actions, unsafe payloads, safe errors, and no-secret responses.
+
+## 3. Frontend Host Execution
+
+- [x] 3.1 Add centralized frontend API types/client methods for bridge execution.
+- [x] 3.2 Add plugin page host session and request dispatcher utilities that construct safe context and return typed envelopes.
+- [x] 3.3 Update plugin page host UI flow to use bridge execution utilities for embedded plugin actions.
+- [x] 3.4 Add frontend tests for session safety, permission filtering, allowed dispatch, denied dispatch, cancellation/error states, and no raw secret rendering.
+
+## 4. Plugin SDK And Example
+
+- [x] 4.1 Extend plugin SDK helpers and example plugin page code to exercise bridge execution envelopes.
+- [x] 4.2 Add plugin tests for execution request builders, safe error parsing, and forbidden direct transport assumptions.
+
+## 5. Verification
+
+- [x] 5.1 Run `cd platform && go test ./...` and record evidence.
+- [x] 5.2 Run `cd platform_web && npm run typecheck && npm test && npm run build` and record evidence.
+- [x] 5.3 Run `cd plugins && npm run typecheck && npm test` and record evidence.
+- [x] 5.4 Run browser walkthrough for plugin page bridge execution and record evidence.
+- [x] 5.5 Run `scripts/check-structure.sh` and record evidence.
+- [x] 5.6 Run `openspec validate implement-plugin-page-bridge-execution --strict` and record evidence.
+
+## Evidence
+
+- 2026-07-06: `cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./... -run TestPluginBridgeExecuteAPI -count=1` passed for bridge execution route, service mappings, safe errors, unsafe payload rejection, and no-secret response checks.
+- 2026-07-06: `cd platform_web && npm run typecheck` passed after adding bridge execution API types/client, host dispatcher, and server detail execution panel.
+- 2026-07-06: `cd platform_web && npm test -- --run utils/pluginBridgeHost.test.ts api/client.test.ts` passed, covering safe host context, permission filtering, allowed dispatch, unsafe/denied/cancelled states, and API client routing.
+- 2026-07-06: `cd plugins && npm run typecheck` and `cd plugins && npm test -- --run tests/manifest-validation.test.ts` passed for SDK execution envelope helpers and no direct transport assumptions.
+- 2026-07-06: `cd platform && GOCACHE=/private/tmp/browser-go-build-cache go test ./...` passed.
+- 2026-07-06: `cd platform_web && npm run typecheck`, `cd platform_web && npm test`, and `cd platform_web && npm run build` passed.
+- 2026-07-06: `cd plugins && npm run typecheck` and `cd plugins && npm test` passed.
+- 2026-07-06: Browser walkthrough passed using a local mock platform API plus headless Chrome: logged in, opened `#/servers/server-bridge-walkthrough`, switched to `插件控制`, clicked `读取上下文`, and verified `服务器上下文 server-bridge-walkthrough 已返回` with no forbidden fragments rendered.
+- 2026-07-06: `scripts/check-structure.sh` passed.
+- 2026-07-06: `openspec validate implement-plugin-page-bridge-execution --strict` passed (`Change 'implement-plugin-page-bridge-execution' is valid`; PostHog DNS flush warnings were non-fatal telemetry failures).