Follow-up to the contract workstream: the mock handlers, the frontend
chat request type (conversationId now optional), the mock-adapter test
and the dc3-cli provider/session commands move to the new routes —
provider /add|update|delete without the config nesting, POST body
pagination for message/list and action/pending.
Co-Authored-By: Claude Code <noreply@anthropic.com>
every remaining document was either a living deployment guide, an
active design baseline, or an unimplemented proposal - all retrievable
from git history. the open work they carried now lives in issues:
#259 r2dbc acceptance gates, #260 comparison adoption candidates, plus
the design-direction issues referenced there. all inbound references
(agents, contributing, seven multilingual readmes, compose comments,
gateway config, module readmes, source comments) updated so nothing
points at the removed tree.
Co-Authored-By: Claude Code <noreply@anthropic.com>
the report served its purpose: every finding is fixed and guarded by
executable tests, the fix history lives in git, and the still-open
items moved to issues #251-#255.
Co-Authored-By: Claude Code <noreply@anthropic.com>
append the wsl docker rebuild campaign: 46 live checks, the two
failures root-caused (attachment identity, spa fallback), the on-disk
fixes, and the decision items observed against the real stack.
Co-Authored-By: Claude Code <noreply@anthropic.com>
adopts the remaining uncommitted work from the parallel session:
five new guardian test files (client-errors, device-import-template,
entity-id-guard, jwt-guard, option-hygiene) that lock in the error
taxonomy, id encoding, and cli option hygiene; an attachment file
cleaner in the agentic service; attachment controller and service
tests; a salt-type fix in the auth store; ci workflow typecheck step;
and the cli test report. 818 tests total across 37 files.
Co-Authored-By: Claude Code <noreply@anthropic.com>
the topology endpoint lives in the manager dashboard controller
(GET /manager/dashboard/topology), not the data center the cli was
calling, so every invocation returned 404.
Co-Authored-By: Claude Code <noreply@anthropic.com>
adds the provider model and attachment command groups to the readme
with usage examples for every subcommand, documents device
import-template and alert point-profile, corrects the point history
option name from --count to --limit, fixes the mcp example key from
transport to type, adds config profile create/delete to the multi-
profile section, and aligns the test suite with the updated command
surface. also updates ci to run typecheck alongside tests.
Co-Authored-By: Claude Code <noreply@anthropic.com>
alert point-profile fetches a single point's alert profile across its
peer cohort (the only dashboard alert endpoint not already covered by
the addgetanalysis factory). device import-template downloads the xlsx
bulk-import template shaped for a given driver and profile, writing
the binary to disk via the direct fetch seam since the json-decoding
client pipeline cannot carry spreadsheet bytes. also aligns the
package license with the repository (agpl-3.0-or-later).
Co-Authored-By: Claude Code <noreply@anthropic.com>
the core modules gain a proper error taxonomy (CliError with
kind/code/exitCode, classifyError for zod and commander bridges,
suppressFailureEnvelope for streaming commands), atomic config writes
(temp+fsync+rename with win32 acl tightening, lockfiles with stale
pid recovery, quarantine for corrupted files instead of silent reset),
a hardened transport client (rfc 7807 detail extraction, identity
mismatch warnings, epoch-guarded token renewal), credential store
security fixes (execfile without shell on all platforms, powershell
encodedcommand on win32, secret-tool stdin on linux), and 60 new
guardian tests covering every fix. 488 tests total.
Co-Authored-By: Claude Code <noreply@anthropic.com>
device status posted an id to the paginated status-list query body
which the facade ignores (it filters by drivername not id) — it now
calls the single-device GET path param endpoint. driver status hit
the same list endpoint with a bare empty body whose zero limit fails
the page-bounds validation; it now sends explicit pagination and
extracts the requested driver from the returned status map.
Co-Authored-By: Claude Code <noreply@anthropic.com>
spring webflux serversentevent emits data:{json} with no space after
the colon, but the streaming parser only matched 'data: ' (with the
optional space the sse spec allows) — every chunk was silently skipped
and the stream produced empty output. the parser now matches both
forms, restoring token-by-token streaming against the agentic service.
Co-Authored-By: Claude Code <noreply@anthropic.com>
attachment upload now sends multipart form-data (the spring
@requestpart contract) instead of an octet-stream body with a custom
header, matching the device import grammar. the profile schema allows
an empty username during bootstrap so config set gateway works on a
fresh install without a chicken-and-egg ordering, and getActiveProfile
enforces the username at consumption time with a clear actionable
message. fixes two pre-existing type errors in atomic-fs (pid possibly
null) and credential-encrypted (record type narrowing). 303 tests.
Co-Authored-By: Claude Code <noreply@anthropic.com>
provider update called a get_by_id endpoint that does not exist on the
provider controller, so the current record was always null and updates
missing required fields failed with 422 — it now resolves the current
provider from the list like model update. the streaming chat exit also
switched from process.exit to the silent-unwind pattern to avoid the
windows libuv assertion while the sse reader closes.
Co-Authored-By: Claude Code <noreply@anthropic.com>
process.exit crashed node on windows with a libuv assertion while fetch
keep-alive handles were open — printandexit and handlefatalerror now
set the exit code and throw a silentexit control-flow signal that the
entry point unwinds cleanly. detectformat rejected unknown --format
values but commander routes the flag to the program level, so
applyglobaloptions now validates it there too. model add/update gains
local temperature range and max-tokens validation (nan silently became
null before), and provider add/update/check validates the protocol
type enum locally with a clear message instead of a backend 400.
Co-Authored-By: Claude Code <noreply@anthropic.com>
eleven cases exercise the new agentic commands (provider list add
delete check with both saved-id and draft modes, model list config-list
add delete check) and extend the manager-write parameterized suite
with group and label update-delete, bringing the total to 99 tests
across 11 files with full coverage of every new subcommand.
Co-Authored-By: Claude Code <noreply@anthropic.com>
fixes session delete using POST against a DELETE endpoint (405) and
drops the dead point write --confirm option that never gated anything.
group gains update/delete and label gains add/update/delete, completing
their manager-domain crud. three new command groups wrap the agentic
service rest surface: provider (list add update delete check with the
connectivity probe), model (list config-list add update delete check),
and attachment (upload list), bringing the cli to full platform parity.
Co-Authored-By: Claude Code <noreply@anthropic.com>
All transport goes through one shared http seam with a 30s abort timeout and network or auth error mapping, add replaces create as the verb with a one-release alias, login and logout stop swallowing auth and network failures, the global --profile and --format options are actually honored together with the persisted output_format setting, config set validates numeric input instead of poisoning the schema and a corrupt config now warns, backs itself up and never silently reverts to defaults, paging and url parameters are validated and encoded, and the dead crypto helper is gone. The contract is pinned by a dedicated test suite.
Dependabot #232: esbuild below 0.28.1 lets the dev server read arbitrary
files on Windows. The dependency arrives transitively through vite, whose
range already admits 0.28.x, but pnpm kept resolving 0.27.7; pin the floor
in the workspace overrides (pnpm 11 no longer reads package.json#pnpm) so
the lockfile can never drift back into the vulnerable window. Verified with
the cli test suite, lint and a tsup build.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Mirror the backend checkstyle javadoc gate in eslint: exported
functions, interfaces, types and classes must carry jsdoc with
matching @param/@returns tags and descriptions. Backfill the full
cli surface so the gate starts green.
java headers are generated and enforced by spotless licenseHeader from
the root copyright file; the typescript surfaces had no such control -
dc3-cli carried zero headers across 32 files and dc3-web was missing
one hand-written file:
- add scripts/add-license-header.mjs (shared by both packages) that
reads the same root copyright and emits block comments for ts and
html-comment headers for vue, with a --check mode for ci
- wire headers / headers:check npm scripts; unplugin-generated ambient
d.ts files are exempt (the generator owns their file head)
- backfill all 32 dc3-cli sources and operation.ts / type.d.ts
verified: headers:check green on both packages, cli 67/67 tests +
build + lint, web 687/687 tests + lint + format
- command_history/get_by_record_id now binds the declared wire name
record_id instead of the raw parameter name recordId, matching the
event_history twin and the frontend/CLI clients
- point_command_history/get_by_command_id likewise binds command_id,
and the accepted statusUri built by point_command write now uses it
- openapi-data snapshot updated for both query params
- cli command history and web mock handlers aligned to the same names
- web mock registers command_history under the data service prefix
- migrate auth, manager, data, and agentic persistence to R2DBC
- hard cut pagination, facade, gateway, web, and CLI contracts
- remove legacy database and TSDB adapters and document validation gates
BREAKING CHANGE: platform persistence now requires PostgreSQL 18 with TimescaleDB and the new reactive API contracts.
dc3 session (list/get/messages/rename/delete) over the conversation
routes and dc3 action (pending/confirm/reject) for the high-risk
tool-call approval loop, closing the last P0 coverage gap from the
2026-08-27 audit. Six suites assert path shaping, query encoding and
method selection.
- dc3 analytics run <op> --args posts to the nine /api/v3/data/analytics
operations (S19 agent face); analytics list prints the catalog
- dc3 alert gains activity/storm-sources/flapping/correlation/
peer-deviation/aging/mtta/change-impact (GET), latency, silent-sources,
coverage-gap and bulk-confirm, with snake_case param mapping and
generic k=v passthrough
- seven new suites cover path shaping, param mapping, passthrough,
bulk body verbatim and op validation
- generate responses now acknowledge with data:"ok" and deliver the
ticket via the dc3-token cookie; extractTicket prefers a JWT-shaped
body (June-era builds) and falls back to the cookie
- setProfile validated an empty template instead of the merged value,
crashing every config write on profiles lacking username; validate
the merge instead. Live-verified end to end against auth+gateway
First Phase-3 slice: dc3 tools list/call speak JSON-RPC to POST /mcp
with the same Bearer ticket as REST, reading the live tool catalog
instead of hard-coded paths. Requires an oauth-type login; classic
tickets get a clean exit-code-3 auth error. Five unit suites cover
request shaping, scope rejection, rpc errors and the 401 challenge.
dc3 auth login --oauth exchanges a registered MCP client id/secret
for an RS256 access ticket at /oauth2/token and stores it as an
oauth-type state whose requests travel as Authorization: Bearer.
Renewal is intentionally not attempted without a stored secret;
expiry surfaces a clean auth error. Option is hidden from help until
gateway-side RS256 verification is enabled in deployments.
Revert the premature McpServer.vue change (implementation was not
requested). Record the onboarding UX contract in
token-unification-mcp-first-cli.md §4.1 instead, and rename the CLI
package back to dc3-cli per review.
Move the previously untracked TypeScript CLI into iot-dc3 as an
independently managed module next to dc3-web:
- pnpm workspace (pnpm@11.24.0) with esbuild build approval,
package renamed to iot-dc3-cli, npm lockfile dropped
- add eslint flat config; lint now runs green after removing
unused imports/vars and adding switch-case breaks in config.ts
- document CLI conventions and commands in AGENTS.md
