Changeset 0.28.0.6 (#178)
This commit is contained in:
@@ -181,6 +181,11 @@ v0.27.5 Team Tasks ✅
|
||||
v0.28.0 Platform Polish
|
||||
(virtual scroll, KB auto-inject,
|
||||
Helm chart, provider model prefs)
|
||||
│
|
||||
v0.29.0 Starlark Extensions
|
||||
(permissioned server-side plugins,
|
||||
capability-gated module access,
|
||||
admin grant/revoke per-extension)
|
||||
```
|
||||
|
||||
---
|
||||
@@ -1025,6 +1030,51 @@ TBD pull-forward: high-value items whose dependencies are met post-tasks.
|
||||
|
||||
---
|
||||
|
||||
## v0.29.0 — Starlark Extensions: Permissioned Server-Side Plugins
|
||||
|
||||
Server-side extension runtime with capability-gated module access.
|
||||
Depends on: v0.28.0 (platform polish), extension infrastructure (v0.11.0).
|
||||
|
||||
Manifest declares requested permissions (flatpak/Android model):
|
||||
```json
|
||||
{
|
||||
"permissions": ["http", "store.read", "files.read", "notifications"]
|
||||
}
|
||||
```
|
||||
|
||||
Admin reviews and grants/revokes per-permission. Runtime enforces:
|
||||
only approved modules are injected into the Starlark sandbox.
|
||||
|
||||
- [ ] `go.starlark.net` integration (eval loop, timeout, memory ceiling)
|
||||
- [ ] Permission model: manifest declarations, admin grant/revoke, DB schema
|
||||
(`extension_permissions` table: extension_id, permission, granted, granted_by)
|
||||
- [ ] Privileged module library:
|
||||
- `http` — outbound HTTP requests (allowlist/blocklist per extension)
|
||||
- `store` — key/value read/write (extension-namespaced, quota-limited)
|
||||
- `files` — project-scoped file read/write
|
||||
- `notifications` — emit notifications to users
|
||||
- `secrets` — vault-backed per-extension secret storage
|
||||
- [ ] Runtime enforcement: sandbox loader checks granted permissions, injects
|
||||
only approved modules. Denied permissions → clean error, not silent no-op.
|
||||
- [ ] Admin UI: permission review on install, per-extension grant/revoke toggle,
|
||||
audit log of permission changes
|
||||
- [ ] Server-side tool execution in completion handler (Starlark tools run
|
||||
server-side, browser tools run client-side — unified tool schema)
|
||||
- [ ] Extension lifecycle: `install → pending_review → approved → active`
|
||||
- [ ] Migration: `extension_permissions` table
|
||||
- [ ] ICD: update `extensions.md` with Starlark-specific endpoints
|
||||
- [ ] Multi-file asset routing: `ServeExtensionAsset` currently ignores `*path` param
|
||||
and returns inline `_script` for all requests. Starlark extensions need multi-file
|
||||
bundles (source + manifest + static assets). Implement path-based lookup or
|
||||
replace inline `_script` with filesystem/blob serving.
|
||||
- [ ] Deduplicate tool schema extraction: `ListBrowserToolSchemas` (extensions.go) and
|
||||
`ListTools` (completion.go) both independently iterate user extensions, parse
|
||||
manifests, and extract tool schemas. Unify into a shared helper that handles
|
||||
both browser and server-side tool types. The completion handler also has a
|
||||
`hub.IsConnected` guard that the extension handler lacks — reconcile.
|
||||
|
||||
---
|
||||
|
||||
## TBD (unscheduled — real features, no immediate need)
|
||||
|
||||
Items that are real but don't yet have a version assignment. Pull left
|
||||
@@ -1036,9 +1086,9 @@ based on need.
|
||||
- Code execution sandbox (server-side, container isolation)
|
||||
|
||||
**Extension System — Server Tiers**
|
||||
- Starlark runtime integration (Tier 1 — server sandbox)
|
||||
- ~~Starlark runtime integration (Tier 1 — server sandbox)~~ → scheduled v0.29.0
|
||||
- ~~Server-side tool execution in completion handler~~ → scheduled v0.29.0
|
||||
- Sidecar HTTP tool protocol (Tier 2 — container isolation)
|
||||
- Server-side tool execution in completion handler
|
||||
|
||||
**Desktop + Mobile**
|
||||
- Desktop app (Tauri)
|
||||
@@ -1096,6 +1146,31 @@ based on need.
|
||||
- Surface IDE: built-in surface for building surfaces — Go template editor for server-rendered shells, JS/CSS editor for client behavior, live preview in sandboxed region
|
||||
- Surface marketplace: share custom surfaces across instances (presentation mode, kanban, form builder, dashboard, etc.)
|
||||
- Project-bound surface/pane defaults: project config specifies which panes are available and default layout
|
||||
|
||||
---
|
||||
|
||||
## Pre-1.0 — Code Quality Sweeps
|
||||
|
||||
Codebase-wide refactors required before 1.0. Not tied to a feature version —
|
||||
pull left when touching the affected code, or schedule a dedicated pass.
|
||||
|
||||
**`SELECT *` → Explicit Column Lists**
|
||||
All store implementations use `SELECT * FROM <table>` with positional `rows.Scan()`.
|
||||
If a migration adds a column, every scan breaks silently at runtime (wrong column
|
||||
mapped to wrong field). Every `scanOne`/`scanMany` helper needs explicit column lists.
|
||||
Scope: every store file in `store/postgres/` and `store/sqlite/`.
|
||||
|
||||
**Raw SQL Hunt**
|
||||
Several handlers execute raw SQL via `database.DB.Exec` / `database.TestDB.Exec`
|
||||
instead of going through the store interface. These bypass the dialect abstraction
|
||||
and are a source of PG/SQLite divergence bugs. Known instances:
|
||||
- `handlers/channels.go` — inline channel queries with `pq.Array`
|
||||
- `handlers/workflows.go` — inline unique constraint string matching
|
||||
- `handlers/participants.go` — `isDuplicateErr` string matching (should use `database.IsUniqueViolation`)
|
||||
- `knowledge/` handlers — direct `database.DB.ExecContext` for storage key updates
|
||||
Full sweep: grep for `database.DB.Exec`, `database.TestDB.Exec`, `DB.QueryRow` outside
|
||||
of `store/` packages. Move to store methods or use existing dialect-safe helpers.
|
||||
|
||||
---
|
||||
|
||||
## v0.27.5 — Team Tasks ✅
|
||||
|
||||
Reference in New Issue
Block a user