Changeset 0.29.0 (#195)

CHANGELOG.md

@@ -1,5 +1,109 @@
 # Changelog
 
+## [0.29.0] — 2026-03-17
+
+### Summary
+
+Starlark sandbox + permission model. Server-side extension runtime
+with pre-completion filter chain, permission-gated modules, and
+admin review workflow. Six changesets (CS0–CS5) on top of Phase 0
+store cleanup (12 changesets, CS0–CS7b).
+
+Phase 0 migrated ~242 raw SQL calls into the store interface layer,
+giving the Starlark sandbox a clean API surface. Phase 1 builds the
+runtime: sandboxed eval loop, permission model, secrets/notifications
+modules, task executor integration, and pre-completion filter chain
+with extension discovery.
+
+**DB rebuild required.** Migration 016 rewritten in-place (adds
+`status` column to `packages`, `extension_permissions` table).
+
+### New
+
+- **Pre-completion filter chain** (`server/filters/`) — composable
+  `PreCompletionFilter` interface with ordered execution, error
+  isolation, and logging. `Chain.Register()` / `Chain.Execute()`.
+  Built-in filters use order 0–99; extension filters use 100+.
+- **KB auto-inject filter** — `KBInjectFilter` (order 10) replaces
+  inline `BuildKBHint()`. Scans persona, project, channel, and
+  personal KBs. Reference implementation for the filter model.
+- **Starlark sandbox** (`server/sandbox/`) — `go.starlark.net`
+  interpreter with step limits (1M ops default), context timeout,
+  captured print output, disabled `load()`. `MakeModule()` helper
+  for exposing Go functions to Starlark scripts.
+- **Sandbox runner** — `Runner.ExecPackage()` loads script from
+  manifest `_starlark_script`, assembles module set from granted
+  permissions. `CallEntryPoint()` for event-driven invocation.
+- **Permission model** — `extension_permissions` table tracks
+  declared capabilities from package manifests. Admin grant/revoke
+  controls which modules the sandbox injects at runtime. Lifecycle:
+  `install → pending_review → grant-all → active`, revoke →
+  `suspended`. Auto-transitions on grant/revoke.
+- **Extension permission constants** — `secrets.read`,
+  `notifications.send`, `filters.pre_completion`, `db.read`,
+  `db.write`, `api.http`. Validated against manifest declarations.
+- **Secrets module** — `secrets.get(key)` / `secrets.list()`.
+  Per-package key-value store backed by GlobalConfig
+  (`ext_secrets:{packageID}`). Admin CRUD endpoints.
+- **Notifications module** — `notifications.send(user_id, title,
+  body?, type?)`. Wraps platform notification service. Extensions
+  cannot send email or bypass user preferences.
+- **Starlark filter** — `StarlarkFilter` bridges the filter chain
+  to extension scripts. Calls `on_pre_completion(ctx)`, parses
+  return `[{"role": "system", "content": "..."}]`.
+- **Starlark filter discovery** — `DiscoverStarlarkFilters` scans
+  active packages with `filters.pre_completion` grant at startup.
+- **`task_type: "starlark"`** — executor `executeStarlark` loads
+  package by `system_function` (package ID), calls `on_run()`
+  entry point. Output to channel/webhook/run record.
+- **Extension secrets admin** — `GET/PUT/DELETE
+  /admin/extensions/:id/secrets`. GET returns keys only (not values).
+- **Extension permission admin** — `GET .../permissions`,
+  `GET .../review`, `POST .../grant`, `POST .../revoke`,
+  `POST .../grant-all`.
+- **ICD runner packaging tier** — 18 tests: permission lifecycle
+  (install → pending_review → grant → active → revoke → suspended),
+  secrets CRUD, invalid permission rejection.
+
+### Changed
+
+- **`BuildKBHint` deprecated** — replaced by `KBInjectFilter` in
+  the pre-completion filter chain. Kept for backward compatibility;
+  removal scheduled for v0.30.0.
+- **`packages` table** — `status` column added (`active`,
+  `pending_review`, `suspended`). `PackageStore.SetStatus()` method.
+- **`CompletionHandler`** — `filterChain` field + `SetFilterChain()`
+  setter. Filter chain runs between system prompts and message history.
+- **`Executor`** — `runner` field + `SetRunner()`. Starlark dispatch
+  branch between action and prompt types.
+- **`AdminInstallExtension`** — calls `SyncManifestPermissions()`
+  after package creation. Parses `"permissions"` from manifest.
+- **Starlark task validation** — `task.starlark` RBAC gate enforced.
+  `system_function` required (holds package ID). Package must exist
+  and be starlark tier.
+
+### Phase 0 — Store Cleanup
+
+- **~242 raw SQL calls eliminated** — every handler, tool, and
+  middleware file now goes through the store interface.
+- **Constructor signature changes** —
+  `enforcePrivateProviderPolicy(ctx, stores, ...)`,
+  `ResolveProviderConfig(stores, vault, ...)`,
+  `NewChannelHandler(stores)`.
+- **30+ new store methods** across NoteStore, MessageStore, FileStore,
+  ProjectStore, TeamStore, ProviderStore, CatalogStore,
+  GlobalConfigStore, AuditStore, ChannelStore.
+
+### Fixed
+
+- **`API._delete` alias** — `delete` is a JS reserved word; added
+  `_delete` as alias for `_del` on the API client.
+- **`safeString` nil handling** — returns Go `nil`, not `""`.
+- **nil JSONMap → PG jsonb** — `ToolCalls`/`Metadata` initialized
+  to `models.JSONMap{}` before store calls.
+- **`GetByID` vs `GetParentAndRole`** — cursor update uses
+  `GetParentAndRole` (matches original raw SQL deleted_at filter).
+
 ## [0.28.8] — 2026-03-15
 
 ### Summary