browser/openspec/changes/implement-artifact-download-and-browser-transfer/tasks.md

1. Platform Artifact Download Contracts

• 1.1 Add domain and DTO contracts for browser artifact metadata, download references, range/content requests, progress, and safe errors.
• 1.2 Add validators for artifact IDs, owner/user/plugin scope, availability state, range bounds, response size, checksum metadata, and unsafe secret/path/socket content.
• 1.3 Add service methods for authorized artifact metadata lookup, download reference creation, and bounded content reads.

2. Platform Artifact Download API

• 2.1 Implement artifact metadata/download reference route using named DTOs and service methods.
• 2.2 Implement bounded artifact content/range route with safe headers and integrity metadata.
• 2.3 Integrate plugin bridge artifact actions with safe artifact references.
• 2.4 Update platform route/protocol documentation for browser artifact download and deferred storage backend behavior.
• 2.5 Add platform tests for successful download, range reads, unavailable artifacts, unauthorized scope, unsafe references, and no raw path/credential responses.

3. Frontend Browser Transfer

• 3.1 Add centralized platform_web/api artifact download types and client methods.
• 3.2 Add UI controls/state for artifact download/open flows from relevant server/job/plugin contexts.
• 3.3 Add bridge host handling for artifact references and browser-mediated download actions.
• 3.4 Add frontend tests for progress/success/error states, unauthorized failures, and no raw secret/path rendering.

4. Plugin SDK Artifact Helpers

• 4.1 Add or update plugin SDK helpers for artifact bridge request/reference parsing if bridge artifact actions need new helper types.
• 4.2 Add plugin tests for artifact reference helpers and forbidden direct run/storage access assumptions if helper code changes.

5. Verification

• 5.1 Run cd platform && go test ./... and record evidence.
• 5.2 Run cd platform_web && npm run typecheck && npm test && npm run build and record evidence.
• 5.3 Run relevant plugin tests/typecheck if plugin SDK helpers changed and record evidence.
• 5.4 Run browser walkthrough for artifact download/browser transfer and record evidence.
• 5.5 Run scripts/check-structure.sh and record evidence.
• 5.6 Run openspec validate implement-artifact-download-and-browser-transfer --strict and record evidence.

Evidence

• 1.1-2.5: cd platform && go test ./api -run TestArtifactDownload passed, covering browser-safe references, bounded content/range reads, unavailable artifact rejection, unauthorized scope denial, bridge artifacts.open, and forbidden fragment checks.
• 3.1-3.4: cd platform_web && npm run typecheck passed. cd platform_web && npm test -- --run api/client.test.ts utils/pluginBridgeHost.test.ts pages/ServerDetailPage.test.tsx passed, covering artifact client methods, chunk metadata, bridge artifact reference parsing/rejection, and server detail artifact workflow source checks.
• 4.1-4.2: cd plugins && npm run typecheck passed. cd plugins && npm test passed, covering createArtifactOpenRequest, parseArtifactReference, permission checks, and rejection of direct storage URL assumptions.
• 5.1: cd platform && go test ./... passed.
• 5.2: cd platform_web && npm run typecheck passed; cd platform_web && npm test passed; cd platform_web && npm run build passed.
• 5.3: cd plugins && npm run typecheck passed; cd plugins && npm test passed.
• 5.4: Browser walkthrough passed with a temporary local mock server and headless Chrome: opened server detail, selected 操作历史, clicked artifact 打开, observed 已打开 artifact-walk.bin, and checked rendered text for forbidden path/token/storage fragments. Temporary walkthrough files were removed.
• 5.5: scripts/check-structure.sh passed.
• 5.6: openspec validate implement-artifact-download-and-browser-transfer --strict reported Change 'implement-artifact-download-and-browser-transfer' is valid. PostHog telemetry flush logged DNS errors afterward, but validation exited 0.