A Host API token lived a fixed five minutes, but a data source sync
streams on one call for up to two hours and a parse may take ten
minutes, so every KV or data source call after the fifth minute failed
with 401.
A token now lives until the call's deadline plus a minute, at least
five minutes (also the lifetime for calls without a deadline) and at
most six hours.
- Host API scope "datasources": a plugin lists the workspace's data
sources of its own connectors and starts incremental syncs (skipped
while one is running). Go Host.DataSources / SyncDataSource, Python
data_sources / sync_data_source. The Jira example's issues webhook uses
it to sync the affected projects at once, checking Jira's X-Hub-Signature
when a secret is set.
- Events: deleting a whole knowledge base now publishes knowledge.deleted
per document; documents the wiki drain completes and stalled documents
housekeeping fails publish ingested / failed.
- Instance lists (data sources, web search, models, IM channels) tag
instances whose plugin is switched off in the workspace, and name
plugin types from the contribution listing when the type list no
longer has them.
- Plugin cards show icons: the package icon as manifest.iconData (a data
URI filled when the package opens), builtin model vendors' logos, and
the app's brand logos for other builtins.
- Instance editors: connectors and webSearch contributions may name an
editor page shown below the generated form; it reads the instance and
sets values through the new form.set bridge call and "values" event.
Plugin connector settings now stay editable while stored credentials
are kept.
- WEKNORA_PLUGIN_NETNS=1 (Linux) runs host plugins in their own user and
network namespace through the plugin-sandbox helper, which relays the
egress proxy and the Host API over unix sockets; plugins cannot bypass
the proxy. Starting fails, clearly, where user namespaces are refused.
Plugins can call back into WeKnora. Each call to a plugin that asked for
Host API scopes (permissions.hostApi, accepted at install) carries the
Host API URL and a five-minute token bound to the plugin, its version,
the calling tenant and those scopes. Tokens are HS256 JWTs with their own
audience, keyed from the cluster secrets (SYSTEM_AES_KEY, else
JWT_SECRET), and are checked by /api/v1/plugin-host/* itself, outside
user and API-key auth.
The first scope is kv: a key-value store partitioned by plugin and tenant
(plugin_kv, migrations 000117 / sqlite 000036), so plugins keep state
without a database of their own. Get, put with an optional TTL, delete and
paged prefix listing; keys up to 256 bytes, JSON values up to 64 KB,
10,000 keys per plugin and tenant; expired entries read as missing and are
swept every ten minutes.
The SDK exposes it as call.Host().KVGet / KVPut / KVDelete / KVList. Host
plugins reach this node on loopback, which their environment now excludes
from the egress proxy.
wizardchen