feat: ship agent-first mission control v0.2.57

.gitea/scripts/deploy-nexus.sh

@@ -60,9 +60,13 @@ JWT_KEY=${ENV_JWT_KEY}
 JWT_ISSUER=nexus
 JWT_AUDIENCE=nexus-web
 BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
+BOOTSTRAP_OWNER_PASSWORD=${ENV_BOOTSTRAP_OWNER_PASSWORD:-}
 OPENCLAW_BASE_URL=http://host.docker.internal:18789
+OPENCLAW_REQUIRED_VERSION=2026.7.1
 OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN:-}
 OPENCLAW_GATEWAY_PASSWORD=
+OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED=false
+OPENCLAW_ALLOW_COMMAND_CRON=false
 NEXUS_VERSION=${VERSION}
 NEXUS_GIT_SHA=${GIT_SHA}
 EOF_ENV
@@ -105,36 +109,6 @@ git archive --format=tar HEAD | docker run --rm -i \
     chown -R "$dest_owner" /dest
   '
 
-# ── Sanitized agents config for Nexus (no secrets) ──
-echo "Generating sanitized agents config for Nexus (no secrets from openclaw.json)"
-AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json"
-OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
-OPENCLAW_CONFIG_DIR="/home/projekte_bao/openclaw/data/openclaw"
-
-# Extract only "agents" key from openclaw.json using jq in an alpine container.
-# This ensures NO secrets (gateway, channels, auth, etc.) leak into the sanitized file.
-if docker run --rm \
-  -v "$OPENCLAW_CONFIG:/input/openclaw.json:ro" \
-  -v "$OPENCLAW_CONFIG_DIR:/output" \
-  alpine:3.20 \
-  sh -c '
-    if ! apk add --no-cache jq >/dev/null 2>&1; then
-      echo "WARNING: jq not available, agents-sanitized.json NOT regenerated" >&2
-      exit 1
-    fi
-    if [ ! -f /input/openclaw.json ]; then
-      echo "WARNING: openclaw.json not found — agents-sanitized.json NOT regenerated" >&2
-      exit 1
-    fi
-    jq "{agents: .agents}" /input/openclaw.json > /output/agents-sanitized.json
-    count=$(jq ".agents.list | length" /output/agents-sanitized.json 2>/dev/null || echo 0)
-    echo "Sanitized agents config written ($count agents)"
-  ' 2>&1; then
-  echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
-else
-  echo "WARNING: Failed to generate agents-sanitized.json — Nexus will use fallback agent IDs" >&2
-fi
-
 echo "Building and starting Docker compose stack"
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \

.gitea/workflows/ci.yaml

@@ -35,9 +35,27 @@ jobs:
       - name: Build
         run: dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
 
+      - name: Verify OpenAPI contract
+        run: |
+          test -f backend/openapi/Nexus.Api.json
+          test -z "$(git status --porcelain --untracked-files=all -- backend/openapi/Nexus.Api.json)"
+
       - name: Test
         run: dotnet test backend-tests/Nexus.Api.Tests.csproj --no-build --configuration Release --verbosity normal
 
+      - name: Docker integration tests
+        if: ${{ vars.NEXUS_RUN_DOCKER_INTEGRATION_TESTS == 'true' }}
+        timeout-minutes: 15
+        env:
+          NEXUS_RUN_DOCKER_INTEGRATION_TESTS: "true"
+          NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS: ${{ vars.NEXUS_RUN_TOXIPROXY_INTEGRATION_TESTS }}
+        run: >-
+          dotnet test backend-tests/Nexus.Api.Tests.csproj
+          --no-build
+          --configuration Release
+          --filter "Category=DockerIntegration"
+          --verbosity normal
+
   # ─── Frontend ──────────────────────────────────
   frontend:
     name: Frontend (Vue/TS)
@@ -61,7 +79,13 @@ jobs:
         working-directory: frontend
 
       - name: Type check
-        run: pnpm exec vue-tsc --noEmit
+        run: pnpm typecheck
+        working-directory: frontend
+
+      - name: Verify generated API types
+        run: |
+          pnpm openapi:generate
+          test -z "$(git status --porcelain --untracked-files=all -- src/api/generated/schema.d.ts)"
         working-directory: frontend
 
       - name: Test
@@ -72,6 +96,14 @@ jobs:
         run: pnpm build
         working-directory: frontend
 
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+        working-directory: frontend
+
+      - name: Browser end-to-end tests
+        run: pnpm test:e2e
+        working-directory: frontend
+
   # ─── Security ──────────────────────────────────
   security:
     name: Security Check
@@ -115,6 +147,7 @@ jobs:
       DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
     steps:
       - name: Checkout

.gitea/workflows/deploy.yaml

@@ -16,6 +16,7 @@ jobs:
       DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
     steps:
       - name: Checkout main

.gitea/workflows/rollback.yaml

@@ -46,6 +46,7 @@ jobs:
       ENV_TMPFILE: /tmp/nexus-rollback-env
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
+      ENV_BOOTSTRAP_OWNER_PASSWORD: ${{ secrets.ENV_BOOTSTRAP_OWNER_PASSWORD }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}
 
     steps:
@@ -112,6 +113,7 @@ jobs:
           JWT_ISSUER=nexus
           JWT_AUDIENCE=nexus-web
           BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
+          BOOTSTRAP_OWNER_PASSWORD=${ENV_BOOTSTRAP_OWNER_PASSWORD:-}
           OPENCLAW_BASE_URL=http://host.docker.internal:18789
           OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN}
           OPENCLAW_GATEWAY_PASSWORD=