saltbo
d7d1435e56
fix(workers): recover canceled cache initialization
2026-08-11 01:26:24 -04:00
saltbo
6f4182bb28
fix(agents): follow public profile discovery contract
...
Discover Realmroot Agent profiles from OAuth authorization-server metadata, validate the public profile response, and link resolved audit actors to their public profile pages.
2026-08-08 12:59:47 -04:00
Jasper Van
fa19323eda
feat: attribute files and downloads to actors ( #559 )
...
* feat: attribute files and downloads to actors
* chore: refresh preview after staging migration
* fix: use a dash for missing actor identity
* fix: complete actor attribution and file creator UI
* fix: refine file creator identity UI
2026-08-08 11:04:16 -04:00
Jasper Van
1b7d8d55f5
fix(audit): resolve agent api key and device actors ( #557 )
...
* fix(audit): resolve agent api key and device actors
* fix(deps): address high severity advisories
* test(audit): cover actor identity boundaries
* fix(audit): support Cloudflare agent info fetches
* docs: add audit actor preview evidence
* docs: add api key audit preview evidence
2026-08-07 23:55:22 -04:00
saltbo
a0b3d9cad6
fix(openapi): declare DPoP requirement for OAuth
2026-08-07 19:57:32 -04:00
saltbo
095daf8b30
fix(openapi): align OAuth security metadata
2026-08-07 13:33:57 -04:00
Jasper Van
b92df828ab
ci: parallelize and isolate test suites ( #556 )
...
* ci: parallelize and isolate test suites
* ci: avoid unavailable Playwright video runtime
* ci: shard coverage and cache docker smoke
* ci: balance Playwright shards by test
* ci: smoke test the CLI container
* ci: enforce merged coverage thresholds
* ci: ratchet canonical coverage baseline
* ci: make coverage ratchet lossless
* ci: organize parallel gates by responsibility
* perf(ci): reduce total runner time
* perf(ci): balance runner cost and latency
* perf(ci): suppress passing test logs
* fix(test): make coverage sorting proof deterministic
* perf(docker): exclude test-only build inputs
* perf(ci): scope Docker smokes to packaging changes
* refactor(test): enforce fast test boundaries
* test: isolate coverage ownership
* perf(test): run backend projects concurrently
* perf(ci): separate test layers by runtime
* perf(test): separate integration boundaries
* perf(ci): prioritize test runners
* docs(ci): clarify package scheduling
* test: restore shared Cloudflare mocks
* fix(preview): isolate Cloudflare E2E build config
* fix(auth): bind preview sessions to request origin
* revert: remove ineffective preview auth workaround
* fix(auth): stop signing JWTs on session reads
2026-08-05 15:01:12 -04:00
saltbo
3064403c92
fix(ids): make normalization optional
...
Keep historical identifiers readable and addressable while generating all new entity IDs with Base62. Reject unsafe external ID references and preserve API keys and device codes during optional normalization.
2026-08-05 13:06:41 -04:00
Jasper Van
3a4e739c9f
Refactor downloader bootstrap query execution ( #555 )
2026-08-05 02:24:07 -04:00
Jasper Van
17db813d1c
feat(ids)!: normalize persistent identifiers to Base62 ( #554 )
...
* feat(ids)!: normalize persistent identifiers to Base62
BREAKING CHANGE: historical ZPan-owned IDs and public tokens require the one-time normalization migration; old public links and stored credentials are invalidated without runtime fallback.
* fix(ids): namespace public redirect tokens
Generate share tokens as s plus 11 Base62 characters and image tokens as i plus 11 Base62 characters. Dispatch /r by namespace prefix, reuse the single resolved record, and update migration validation, contracts, documentation, and tests.
* fix(ids): guard future object storage keys
* fix(ids): normalize historical references safely
2026-08-05 00:36:18 -04:00
Jasper Van
4ab0b0922a
fix(openapi): whitelist Better Auth downloader Device Flow ( #552 )
...
Publish only explicitly registered Better Auth operations in the ZPan product OpenAPI contract while preserving runtime auth routes and discovery.
2026-08-04 16:39:54 -04:00
saltbo
50a9895fcf
fix(auth): add request diagnostics and correlation
2026-08-04 12:18:52 -04:00
saltbo
0be5c1b7e9
feat(agent): support workspace-scoped resource access
2026-08-03 19:13:50 -04:00
saltbo
0b997e52bf
fix(quota): resume duplicate cloud webhooks
2026-08-03 05:33:03 -04:00
Jasper Van
c82279f164
Merge commit from fork
2026-08-03 01:05:33 -04:00
saltbo
9b95117595
feat(oauth): manage dynamic client registrations
2026-08-02 22:04:43 -04:00
Jasper Van
8513b18a8e
feat(oauth): expose workspace authorization catalog ( #551 )
...
* feat(oauth): expose workspace authorization catalog
* fix(oauth): verify catalog tokens against canonical audience
* fix(auth): normalize Workers preview requests
* Revert "fix(auth): normalize Workers preview requests"
This reverts commit 02009f098f
2026-08-02 21:00:20 -04:00
saltbo
58b88b427b
fix(oauth): accept multi-workspace consent
2026-08-02 17:19:26 -04:00
saltbo
461becc3d3
fix(oauth): synchronize Realmroot client scopes
2026-08-02 17:15:17 -04:00
saltbo
b818facdab
fix(x402): report missing receiver as unavailable
2026-08-02 16:22:43 -04:00
saltbo
fa158cb11e
fix(oauth): log agent assertion verification failures
2026-08-02 15:43:01 -04:00
saltbo
bc4a71f691
fix(api-keys): restore legacy Better Auth keys
2026-08-02 15:08:51 -04:00
Jasper Van
2657f82ef1
feat(auth): add contextual OAuth workspace grants ( #550 )
...
* feat(auth): add contextual OAuth workspace grants
* fix(auth): register RFC 9396 detail types
* fix(openapi): restore delegated CLI auth profile
* fix(store): recover paid capacity fulfillment
* fix(auth): close OAuth contract gaps
* fix(store): resume verified x402 settlements
* chore(deps): update zpan cloud sdk to 2.5.2
* test(store): cover verified settlement recovery
* fix(auth): localize standard consent scopes
* fix(docker): include dependency patches before install
* fix(store): harden x402 purchase responses
* test(auth): cover OAuth authorization boundaries
* docs: add PR 550 verification screenshots
* chore: remove temporary verification screenshots
* docs(openapi): document exhausted capacity response
2026-08-02 13:33:15 -04:00
Jasper Van
1caa4e580c
refactor(oauth): replace agent access naming ( #549 )
2026-08-01 00:32:31 -04:00
Jasper Van
d15ca86226
fix(store): recover interrupted capacity purchases ( #548 )
...
* fix(store): recover interrupted capacity purchases
* test(store): cover inactive x402 receiver
2026-07-31 16:25:05 -04:00
saltbo
bde1bb4bc9
fix(auth): challenge invalid DPoP tokens
2026-07-31 11:34:20 -04:00
saltbo
bb25161011
fix(auth): backfill Better Auth account issuers
2026-07-31 10:16:58 -04:00
saltbo
4027f0c7a6
fix(auth): trust official worker preview origins
2026-07-31 09:42:25 -04:00
saltbo
8402844b5e
feat(store): add agent x402 capacity purchases
2026-07-31 09:27:24 -04:00
saltbo
a968f85d7c
fix(auth): persist delegated agent identity
2026-07-30 20:19:33 -04:00
saltbo
e740529ced
docs(openapi): describe storage selection override
2026-07-30 16:17:23 -04:00
saltbo
954aae5f9e
test(auth): set OAuth issuer in CF fixtures
2026-07-30 10:53:52 -04:00
saltbo
d7ba55b9da
feat(auth): support external agent resources
...
Replace bundled agent profiles, API keys, plugin, and skill surfaces with dynamic OAuth client registration, delegated DPoP tokens, discoverable scopes, and Arazzo-backed direct upload workflows.
Refs realmroot/realmroot#115
2026-07-30 10:41:39 -04:00
saltbo
09fc8de901
refactor(auth): model workspace binding explicitly
2026-07-30 00:07:15 -04:00
Jasper Van
a890e7bba2
refactor(auth): unify route authorization around scopes ( #544 )
2026-07-29 23:26:07 -04:00
e50c19051a
docs: publish ZPan Agent Skill ( #543 )
...
* docs: publish zpan agent skill
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
* test: cover openapi auth route metadata
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
* fix: align zpan skill restish commands
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
* docs: clarify zpan skill release boundaries
* docs: align zpan upload profile examples
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
* fix: select upload plugin profile via environment
* fix: return zpan upload plugin help
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
---------
Co-authored-by: Noah Reed <noah-reed@mails.agent-kanban.dev >
Co-authored-by: saltbo <saltbo@foxmail.com >
2026-07-29 20:19:16 -04:00
360237d069
feat: add restish zpan upload plugin ( #542 )
...
* feat: add restish zpan upload plugin
Agent-Profile: https://agent-kanban.dev/agents/f68cfbce6456edb5
* fix: restore single upload resume for restish plugin
Agent-Profile: https://agent-kanban.dev/agents/f68cfbce6456edb5
* ci(release): publish restish-zpan plugin assets
* fix(restish-zpan): accept restish operation aliases
---------
Co-authored-by: Ethan Cole <ethan-cole@mails.agent-kanban.dev >
Co-authored-by: saltbo <saltbo@foxmail.com >
2026-07-29 16:55:52 -04:00
agent-kanban[bot] and Iris Tan
88916f4f03
feat: add agent oauth consent management UI ( #541 )
...
* feat: add agent oauth consent management UI
Agent-Profile: https://agent-kanban.dev/agents/7b0ab18fa695f04a
* test: cover agent oauth consent edge paths
Agent-Profile: https://agent-kanban.dev/agents/7b0ab18fa695f04a
* fix: route agent oauth consent through rpc
Agent-Profile: https://agent-kanban.dev/agents/7b0ab18fa695f04a
* test: cover agent oauth consent rpc on workers
Agent-Profile: https://agent-kanban.dev/agents/7b0ab18fa695f04a
* test: cover agent oauth grant-use middleware
Agent-Profile: https://agent-kanban.dev/agents/7b0ab18fa695f04a
---------
Co-authored-by: Iris Tan <iris-tan@mails.agent-kanban.dev >
2026-07-29 16:52:17 -04:00
agent-kanban[bot] and Marina Zhou
00d298627c
feat: publish Restish OpenAPI security bindings ( #540 )
...
Agent-Profile: https://agent-kanban.dev/agents/1dc839c09b5ee5e5
Co-authored-by: Marina Zhou <marina-zhou@mails.agent-kanban.dev >
2026-07-29 14:26:37 -04:00
d22227ed2f
feat: add delegated agent OAuth provider ( #539 )
...
* feat: add delegated agent oauth provider
Agent-Profile: https://agent-kanban.dev/agents/e0a1ce35687e48ef
* test(auth): cover delegated OAuth configuration
* fix(auth): route OAuth metadata through worker
* fix(auth): advertise canonical OAuth issuer
* test: cover agent oauth provider integration
Agent-Profile: https://agent-kanban.dev/agents/e0a1ce35687e48ef
* test(auth): cover managed OAuth consent flow
---------
Co-authored-by: Ravi Shah <ravi-shah@mails.agent-kanban.dev >
Co-authored-by: saltbo <saltbo@foxmail.com >
2026-07-29 13:26:44 -04:00
agent-kanban[bot]
f2aea1bedb
feat: stabilize multipart upload protocol ( #537 )
...
Preserve legacy upload clients while adding explicit resumable parts, safe completion recovery, idempotent cleanup, and downloader-bound authorization.
2026-07-29 10:37:31 -04:00
agent-kanban[bot]
1b1b1db772
feat: add workspace agent API keys ( #538 )
...
Enforce owner/admin management, terminal expired/revoked lifecycle, explicit workspace scopes, current membership rechecks, and authenticated management UI.
2026-07-29 10:08:44 -04:00
agent-kanban[bot] and Noah Reed
4817afecdb
feat: migrate content APIs to unified authorization ( #534 )
...
Agent-Profile: https://agent-kanban.dev/agents/b0abe6cd7aeba133
Co-authored-by: Noah Reed <noah-reed@mails.agent-kanban.dev >
2026-07-29 02:11:08 -04:00
agent-kanban[bot] and Ethan Cole
bba443817a
fix: harden legacy downloader bootstrap ( #536 )
...
* fix: harden legacy downloader bootstrap
Agent-Profile: https://agent-kanban.dev/agents/f68cfbce6456edb5
* fix: cover downloader bootstrap hardening
Agent-Profile: https://agent-kanban.dev/agents/f68cfbce6456edb5
* fix: document downloader bootstrap auth policy
Agent-Profile: https://agent-kanban.dev/agents/f68cfbce6456edb5
---------
Co-authored-by: Ethan Cole <ethan-cole@mails.agent-kanban.dev >
2026-07-29 01:42:47 -04:00
agent-kanban[bot] and Marina Zhou
da286e9db3
feat: declare explicit route authorization policies ( #535 )
...
Agent-Profile: https://agent-kanban.dev/agents/1dc839c09b5ee5e5
Co-authored-by: Marina Zhou <marina-zhou@mails.agent-kanban.dev >
2026-07-29 00:30:22 -04:00
038e23172b
feat: establish unified authorization kernel ( #533 )
...
* feat: establish unified authorization kernel
Agent-Profile: https://agent-kanban.dev/agents/e0a1ce35687e48ef
* docs(v2.9): sync confirmed agent access plan
---------
Co-authored-by: Ravi Shah <ravi-shah@mails.agent-kanban.dev >
Co-authored-by: saltbo <saltbo@foxmail.com >
2026-07-28 21:34:11 -04:00
saltbo
c66590a51b
feat(image-hosting): gate custom domains and support origins
2026-07-28 14:48:53 -04:00
saltbo
808f8611e4
fix(events): rotate long-lived SSE connections
2026-07-28 10:53:21 -04:00
Jasper Van
20feaa6c91
fix(image-hosting): bypass auth on custom domains ( #532 )
...
* fix(image-hosting): bypass auth on custom domains
* test(image-hosting): cover traffic compensation
2026-07-28 10:03:47 -04:00
Jasper Van
faea00d025
feat(image-hosting): improve custom-domain image links ( #531 )
2026-07-28 02:38:03 -04:00
saltbo