browser/openspec/changes/secure-single-file-run-distribution/tasks.md

Prompt Boundaries

正向提示词: Deliver a secure single-file Run distribution flow for 服务器管理, where generated Run artifacts are raw executables with compile-time platform URL and authorization, self-update accepts raw executables, and server-list run-key reset is available with confirmation.

方向提示词: Preserve existing platform/run/platform_web boundaries; use platform distribution build input and Run Go -ldflags -X injection; keep Client Manager packaging unchanged; verify with focused Go/frontend tests, OpenSpec validation, and scripts/check-structure.sh.

任务边界: Do not add device authorization binding, billing, cloud host sales, AI-provider changes, plugin marketplace expansion, Client Manager packaging changes, raw credential exposure in APIs/UI, or unrelated visual-system changes.

1. OpenSpec

• 1.1 Define proposal, design, requirements, and task boundaries for single-file Run distribution.
• 1.2 Validate the OpenSpec change before implementation completion.

2. Platform

• 2.1 Add Run-only raw executable package format, artifact filename/content-type presentation, and build-input platform URL.
• 2.2 Generate longer Run component keys without changing global token generation.
• 2.3 Revoke active Run control sessions when Run key reset succeeds.
• 2.4 Update platform tests for raw Run artifacts, key length, build input, reset revocation, and self-update input.

3. Run

• 3.1 Add compile-time config variables with environment override precedence.
• 3.2 Inject Run identity and authorization through Go -ldflags -X and upload raw executable bytes for Run builds.
• 3.3 Support raw executable self-update staging while preserving archive handling for compatibility/tests where needed.
• 3.4 Update Run tests for raw build output, compiled smoke identity, config precedence, and raw self-update.

4. platform_web

• 4.1 Add run-key reset to the server-list 运行操作 dangerous menu with confirmation and API execution.
• 4.2 Update frontend tests and fixtures for raw Run download metadata and reset action coverage.

5. Verification

• 5.1 Run focused run, platform, and platform_web verification.
• 5.2 Run scripts/check-structure.sh.

Verification Evidence

• openspec validate secure-single-file-run-distribution --strict: passed
• cd platform && go test ./service -run 'TestCoreService(ResetRunKey|GeneratesRun|RunDistribution|DistributionBuild)' -count=1: passed
• cd platform && go test ./validator ./domain ./dto -count=1: passed
• cd run && go test ./config ./protocol ./runtime -run 'TestLoad|TestWorkerDistribution|TestDistributionBuild|TestValidateDistribution|TestRunSelfUpdate|TestPrepareSelfUpdate|TestWorkerDispatchesSelfUpdate' -count=1: passed
• cd platform_web && npm test -- --run pages/ConsolePages.test.tsx api/client.test.ts: passed, 2 files / 25 tests
• scripts/check-structure.sh: passed
• Note: full run/runtime suite still needs network bind permissions for unrelated Source RCON/httptest fixtures; focused distribution/self-update coverage was used for this change.