235 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
AzuTear	144edf58fe	fix: restore production OpenClaw runtime health	2026-07-31 23:08:26 +02:00
AzuTear	6f21d9ba97	fix: harden production login and security headers	2026-07-31 22:56:55 +02:00
AzuTear	f5552218bc	feat: ship agent-first mission control v0.2.57	2026-07-31 22:39:47 +02:00
developer	3bc7622977	P1c: 5 mutierende MCP-Tools als ITaskBridgeService-Fassade mit State-Enum-Validation ... - nexus_create_task: Fassade → bridge.CreateTaskAsync() - nexus_create_child_task: Fassade → bridge.CreateChildTaskAsync() - nexus_update_status: Enum-validiert via NexusMcpTaskState (0-4) MCP SDK lehnt ungültige Integer-Werte vor Tool-Aufruf ab ToStateString() hat exhaustiven Switch + InvalidEnumArgumentException-Fallback Bridge erzwingt CanChangeState-Autorisierung (nur iris/bao/nexus-system) - nexus_append_activity: Fassade → bridge.AppendActivityAsync() - nexus_handoff: Fassade → bridge.HandoffAsync() Neue NexusMcpTaskStateHelper.IsDefined() für testbare State-Validierung. Alle 5 Tools via [McpServerTool] auf McpServerToolType-Klasse registriert. Keine Businesslogik-Duplizierung — volle Delegation an ITaskBridgeService. Build: 0w 0e.	2026-07-14 12:09:32 +02:00
developer	42e4ea4497	P1b: Document read-only MCP tools as TaskBridgeService facade ... Implementation verified (originally in aaec3eb): - nexus_get_board: pure facade → bridge.GetBoardAsync() - nexus_agent_overview: pure facade → bridge.GetAgentOverviewAsync() - nexus_get_task: pure facade → bridge.GetTaskAsync() + ToResponse() - nexus_get_children: pure facade → bridge.GetChildTasksAsync() - nexus_get_activity: pure facade → bridge.GetTaskActivityAsync() + DTO map All 5 tools register via [McpServerTool] attribute on McpServerToolType class. No business logic duplication — every tool delegates directly to ITaskBridgeService. Build: 0w 0e. MCP tests: 44/44 passed.	2026-07-13 20:05:19 +02:00
developer	1732fa97ad	P1a: Fix MapMcp to use explicit /mcp route pattern ... The parameterless MapMcp() overload did not register the endpoint correctly at the /mcp path. Changed to MapMcp("/mcp") which successfully registers the MCP Streamable HTTP endpoint. Verified: - POST /mcp with initialize request returns valid MCP response - tools/list returns all 10 NexusMcpTools - Health check passes - Build: 0w 0e	2026-07-13 19:10:42 +02:00
developer	c4270a4975	P1a: Ensure ApiKeyMiddleware skips /mcp endpoint ... The MCP endpoint handles its own authentication via X-Agent-Id and X-Nexus-Api-Key headers through NexusMcpTools. The ApiKeyMiddleware now skips the /mcp path to avoid interfering with MCP's own auth flow.	2026-07-13 16:11:09 +02:00
developer	6ba788bb6e	P2.1: Add GatewayConnector BackgroundService with WebSocket client ... - GatewayConnector: BackgroundService maintaining persistent WebSocket connection to OpenClaw Gateway with Bearer token auth from backend env only - IGatewayConnector: Interface exposing connection state, version info, health - Exponential backoff reconnect: 1s initial, max 5min, with jitter - Version pinning: RequiredVersion from config; fail-fast or warn on mismatch - Pre-flight HTTP version check before WebSocket connect - GatewayHealthController: GET /api/health/gateway with connection status - GatewayConnectorOptions: Configurable via GatewayConnector config section - Token never logged; read from Integrations:OpenClaw:Password/Token only - 16 tests: options defaults, config binding, health endpoint responses, connection states, DI registration, routing attributes	2026-07-13 14:13:39 +02:00
developer	a55951f315	P4: Agent-Identitäten ohne Secrets — sanitized config feed ... - Replace Python-based sanitizer in deploy script with lightweight jq/alpine - Add sync-agents-sanitized.mjs for on-demand and watch-mode sync - Add AgentConfigPath to appsettings.json (explicit default) - Extend /health/live endpoint to report agent count from sanitized config - Document architecture in docs/agent-identity-architecture.md - No openclaw.json secrets ever reach Nexus API containers Verification: - curl /api/v1/agents → 9 agents, zero secrets in response - agents-sanitized.json contains only 'agents' key, no gateway/auth - All C# code paths read from agents-sanitized.json (AgentConfigPath) - Bridge controller resolves agent IDs via AgentService.GetAllowedAgentIdsAsync()	2026-07-13 09:12:19 +02:00
developer	77b9587fa6	test: add comprehensive MCP tool and server configuration tests ... - McpToolsTests: 33 tests covering tool registration, enum validation, state transitions, auth resolution (JWT, API key, X-Agent-Id), create/read/update/activity/handoff workflows via McpToolsFixture - McpServerConfigurationTests: 5 tests verifying MCP server DI registration, tool type attribute, MapMcp endpoint wiring, service extensions, and NuGet package reference	2026-07-13 08:10:36 +02:00
developer	17dc84082c	feat: switch agent identity from openclaw.json to agents-sanitized.json ... Completes P4 migration: Nexus API no longer reads openclaw.json. Changes: - AgentService: default path -> agents-sanitized.json - OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels both now read from agents-sanitized.json - compose.yaml: mount agents-sanitized.json instead of openclaw.json The deploy script (.gitea/scripts/deploy-nexus.sh) already generates agents-sanitized.json during deployment, extracting only the section (list + defaults) without gateway/auth/password secrets. DoD: - No read access to openclaw.json from Nexus API container - No uid-1654 ACL dependency for agent identity resolution - No secrets in agent responses or config files	2026-07-12 22:07:11 +02:00
devops	8ad8c956eb	fix(deploy): sanitized agent config — use Docker to read openclaw.json ... The Gitea runner doesn't have direct filesystem access to /home/projekte_bao/openclaw/, so the previous python3 inline extraction would fail silently and no agents-sanitized.json would be generated. Now the deploy script uses a Docker container with bind mounts to read openclaw.json (readonly) and write agents-sanitized.json to the host. This completes the P4 migration: Nexus no longer needs read access to openclaw.json for any code path or deployment step.	2026-07-12 15:08:49 +02:00
devops	dbda764190	fix: execute Nexus deploy inside host-mounted workspace	2026-07-10 00:16:47 +02:00
devops	361a64f886	ops: move canonical workspace to projects root	2026-07-10 00:02:41 +02:00
devops	a104acf160	ci: consolidate Nexus deployment and provenance	2026-07-09 23:46:46 +02:00
devops	aaec3eb4ed	feat: complete Nexus mission-control workflows	2026-07-09 23:40:36 +02:00
devops	436ddfee0f	fix: stream deploy source snapshot	2026-06-24 07:56:18 +02:00
devops	38954feb8f	fix: snapshot deploy source before sync	2026-06-24 07:52:24 +02:00
devops	f30cce4fb3	fix: harden nexus deploy sync	2026-06-24 07:43:02 +02:00
devops	7216bfdeff	fix: repair gitea deploy pipeline	2026-06-24 07:33:10 +02:00
devops	16385d10cb	docs: update routing docs for Traefik	2026-06-24 06:43:33 +02:00
devops	250e730f33	fix: require auth for chat endpoint	2026-06-24 06:32:04 +02:00
devops	c9e22195ad	fix: assert forbidden workflow results	2026-06-24 01:36:18 +02:00
devops	8d8f8cc8a8	fix: assert task workflow result statuses	2026-06-24 01:30:59 +02:00
devops	873c5d586c	fix: repair agent model converter build	2026-06-24 01:26:56 +02:00
devops	95495a8332	feat: complete task board workflow gates	2026-06-24 01:23:49 +02:00
devops	68b428e411	fix: prioritize rollback over queued deploys	2026-06-24 01:22:55 +02:00
devops	1214cf9a4d	chore: simplify nexus cicd pipeline	2026-06-24 01:22:55 +02:00
devops	195c497c88	fix: route standalone views via route metadata	2026-06-24 01:22:55 +02:00
devops	a2272c5df6	fix: harden owner bootstrap and auth persistence	2026-06-24 01:22:55 +02:00
devops	5df5194651	fix: deploy GatewayBridge + Dashboard SSE live endpoints ... Root cause: /api/bridge/health and /api/dashboard/live returned 404 live because the source files existed on disk but were never committed to git. The CD pipeline deploys from committed main, so the deployed containers lacked these endpoints. Changes: - Add GatewayBridgeController with /api/bridge/health endpoint - Add DashboardController Live() SSE endpoint for /api/dashboard/live - Add LiveUpdateService (in-memory pub/sub for SSE updates) - Add TaskBridgeService (structured agent-to-backend bridge) - Add nginx routing blocks for /api/bridge/ and /api/dashboard/live - Add host-level nginx-nexus.conf blocks for bridge + live pass-through - Update ServiceCollectionExtensions with DI registrations - Update Dashboard.cs model with SSE-related DTOs Verification after deploy: curl https://nexus.noveria.net/api/bridge/health → 200 JSON curl https://nexus.noveria.net/api/dashboard/live → 200 SSE stream	2026-06-22 20:43:31 +02:00
devops	39aeab62d6	revert: remove image tag experiment	2026-06-22 20:14:08 +02:00
devops	8b1400da17	fix: tag api image to force rebuild	2026-06-22 20:12:31 +02:00
devops	dd17cefa3b	fix: add --no-cache to deploy-now build step; revert temp cache bust changes	2026-06-22 20:10:04 +02:00
devops	2aa41e6366	fix: remove package-lock.json again	2026-06-22 20:07:46 +02:00
devops	696e9daf4d	chore: add DEPLOY_TIMESTAMP build arg for cache busting	2026-06-22 20:07:43 +02:00
devops	701e15ee9b	fix: restore pnpm-lock.yaml (CI requires it) and remove package-lock.json	2026-06-22 20:05:27 +02:00
devops	fe97d1aaf0	chore: force backend Docker cache bust for deploy	2026-06-22 20:04:22 +02:00
devops	df94ed3cd4	feat: board-first orchestration with Gateway Bridge, live-update, and flow-board ... - GatewayBridgeController: MCP-artiger Kommando-Adapter für Agent-zu-Backend - TaskBridgeService + LiveUpdateService: SSE Live-Sync + Bridge-Kommandos - FlowBoard.vue: Board-first orchestration dashboard panel - live-sync.ts store + live.ts service: SSE-basierte Live-Updates - Nullability-Warnung in HealthController.cs gefixt - nginx.conf: SSE-Proxy + CORS für Bridge-Endpunkte - .gitignore: pnpm/corepack local caches ausgeschlossen - docs: architecture-board-first-orchestration.md hinzugefügt - README: Backend Bridge API dokumentiert	2026-06-22 19:56:45 +02:00
devops	de1fc198cb	chore: restore deploy.yaml name, keep deploy-now.yaml as working fallback	2026-06-21 21:41:26 +02:00
devops	f33e8c8b58	chore: remove deploy diagnostic test workflows	2026-06-21 21:41:22 +02:00
devops	dd38570c7b	fix: read OWNER_PASSWORD via docker instead of direct filesystem	2026-06-21 21:39:50 +02:00
devops	5dc00c1142	fix: deploy-now without heredocs — Gitea 1.26.3 compat	2026-06-21 21:38:09 +02:00
devops	cf10ca3ed8	test: no heredoc, echo-based	2026-06-21 21:37:38 +02:00
devops	1f8b45a327	test: heredoc quoted	2026-06-21 21:37:21 +02:00
devops	b1dcf51218	test: heredoc	2026-06-21 21:37:02 +02:00
devops	0fdc40a95c	test: checkout + GITEA_OUTPUT	2026-06-21 21:36:45 +02:00
devops	071cbe8ce5	test: checkout only	2026-06-21 21:36:29 +02:00
devops	c750a5abcd	test: checkout + version + heredoc	2026-06-21 21:36:12 +02:00
devops	dd81070afd	test: env with secrets	2026-06-21 21:35:55 +02:00