npc0-hue
292b380f3c
Compile-time run auth replaces zip sidecars, lengthens run keys, revokes active sessions on reset, and exposes run-key reset in the server list.
48 lines
3.1 KiB
Markdown
48 lines
3.1 KiB
Markdown
## Prompt Boundaries
|
|
|
|
正向提示词: Deliver a secure single-file Run distribution flow for 服务器管理, where generated Run artifacts are raw executables with compile-time platform URL and authorization, self-update accepts raw executables, and server-list run-key reset is available with confirmation.
|
|
|
|
方向提示词: Preserve existing platform/run/platform_web boundaries; use platform distribution build input and Run Go `-ldflags -X` injection; keep Client Manager packaging unchanged; verify with focused Go/frontend tests, OpenSpec validation, and `scripts/check-structure.sh`.
|
|
|
|
任务边界: Do not add device authorization binding, billing, cloud host sales, AI-provider changes, plugin marketplace expansion, Client Manager packaging changes, raw credential exposure in APIs/UI, or unrelated visual-system changes.
|
|
|
|
## 1. OpenSpec
|
|
|
|
- [x] 1.1 Define proposal, design, requirements, and task boundaries for single-file Run distribution.
|
|
- [x] 1.2 Validate the OpenSpec change before implementation completion.
|
|
|
|
## 2. Platform
|
|
|
|
- [x] 2.1 Add Run-only raw executable package format, artifact filename/content-type presentation, and build-input platform URL.
|
|
- [x] 2.2 Generate longer Run component keys without changing global token generation.
|
|
- [x] 2.3 Revoke active Run control sessions when Run key reset succeeds.
|
|
- [x] 2.4 Update platform tests for raw Run artifacts, key length, build input, reset revocation, and self-update input.
|
|
|
|
## 3. Run
|
|
|
|
- [x] 3.1 Add compile-time config variables with environment override precedence.
|
|
- [x] 3.2 Inject Run identity and authorization through Go `-ldflags -X` and upload raw executable bytes for Run builds.
|
|
- [x] 3.3 Support raw executable self-update staging while preserving archive handling for compatibility/tests where needed.
|
|
- [x] 3.4 Update Run tests for raw build output, compiled smoke identity, config precedence, and raw self-update.
|
|
|
|
## 4. platform_web
|
|
|
|
- [x] 4.1 Add run-key reset to the server-list `运行操作` dangerous menu with confirmation and API execution.
|
|
- [x] 4.2 Update frontend tests and fixtures for raw Run download metadata and reset action coverage.
|
|
|
|
## 5. Verification
|
|
|
|
- [x] 5.1 Run focused `run`, `platform`, and `platform_web` verification.
|
|
- [x] 5.2 Run `scripts/check-structure.sh`.
|
|
|
|
|
|
## Verification Evidence
|
|
|
|
- `openspec validate secure-single-file-run-distribution --strict`: passed
|
|
- `cd platform && go test ./service -run 'TestCoreService(ResetRunKey|GeneratesRun|RunDistribution|DistributionBuild)' -count=1`: passed
|
|
- `cd platform && go test ./validator ./domain ./dto -count=1`: passed
|
|
- `cd run && go test ./config ./protocol ./runtime -run 'TestLoad|TestWorkerDistribution|TestDistributionBuild|TestValidateDistribution|TestRunSelfUpdate|TestPrepareSelfUpdate|TestWorkerDispatchesSelfUpdate' -count=1`: passed
|
|
- `cd platform_web && npm test -- --run pages/ConsolePages.test.tsx api/client.test.ts`: passed, 2 files / 25 tests
|
|
- `scripts/check-structure.sh`: passed
|
|
- Note: full `run/runtime` suite still needs network bind permissions for unrelated Source RCON/httptest fixtures; focused distribution/self-update coverage was used for this change.
|