227 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
developer	a55951f315	P4: Agent-Identitäten ohne Secrets — sanitized config feed ... - Replace Python-based sanitizer in deploy script with lightweight jq/alpine - Add sync-agents-sanitized.mjs for on-demand and watch-mode sync - Add AgentConfigPath to appsettings.json (explicit default) - Extend /health/live endpoint to report agent count from sanitized config - Document architecture in docs/agent-identity-architecture.md - No openclaw.json secrets ever reach Nexus API containers Verification: - curl /api/v1/agents → 9 agents, zero secrets in response - agents-sanitized.json contains only 'agents' key, no gateway/auth - All C# code paths read from agents-sanitized.json (AgentConfigPath) - Bridge controller resolves agent IDs via AgentService.GetAllowedAgentIdsAsync()	2026-07-13 09:12:19 +02:00
developer	77b9587fa6	test: add comprehensive MCP tool and server configuration tests ... - McpToolsTests: 33 tests covering tool registration, enum validation, state transitions, auth resolution (JWT, API key, X-Agent-Id), create/read/update/activity/handoff workflows via McpToolsFixture - McpServerConfigurationTests: 5 tests verifying MCP server DI registration, tool type attribute, MapMcp endpoint wiring, service extensions, and NuGet package reference	2026-07-13 08:10:36 +02:00
developer	17dc84082c	feat: switch agent identity from openclaw.json to agents-sanitized.json ... Completes P4 migration: Nexus API no longer reads openclaw.json. Changes: - AgentService: default path -> agents-sanitized.json - OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels both now read from agents-sanitized.json - compose.yaml: mount agents-sanitized.json instead of openclaw.json The deploy script (.gitea/scripts/deploy-nexus.sh) already generates agents-sanitized.json during deployment, extracting only the section (list + defaults) without gateway/auth/password secrets. DoD: - No read access to openclaw.json from Nexus API container - No uid-1654 ACL dependency for agent identity resolution - No secrets in agent responses or config files	2026-07-12 22:07:11 +02:00
devops	8ad8c956eb	fix(deploy): sanitized agent config — use Docker to read openclaw.json ... The Gitea runner doesn't have direct filesystem access to /home/projekte_bao/openclaw/, so the previous python3 inline extraction would fail silently and no agents-sanitized.json would be generated. Now the deploy script uses a Docker container with bind mounts to read openclaw.json (readonly) and write agents-sanitized.json to the host. This completes the P4 migration: Nexus no longer needs read access to openclaw.json for any code path or deployment step.	2026-07-12 15:08:49 +02:00
devops	dbda764190	fix: execute Nexus deploy inside host-mounted workspace	2026-07-10 00:16:47 +02:00
devops	361a64f886	ops: move canonical workspace to projects root	2026-07-10 00:02:41 +02:00
devops	a104acf160	ci: consolidate Nexus deployment and provenance	2026-07-09 23:46:46 +02:00
devops	aaec3eb4ed	feat: complete Nexus mission-control workflows	2026-07-09 23:40:36 +02:00
devops	436ddfee0f	fix: stream deploy source snapshot	2026-06-24 07:56:18 +02:00
devops	38954feb8f	fix: snapshot deploy source before sync	2026-06-24 07:52:24 +02:00
devops	f30cce4fb3	fix: harden nexus deploy sync	2026-06-24 07:43:02 +02:00
devops	7216bfdeff	fix: repair gitea deploy pipeline	2026-06-24 07:33:10 +02:00
devops	16385d10cb	docs: update routing docs for Traefik	2026-06-24 06:43:33 +02:00
devops	250e730f33	fix: require auth for chat endpoint	2026-06-24 06:32:04 +02:00
devops	c9e22195ad	fix: assert forbidden workflow results	2026-06-24 01:36:18 +02:00
devops	8d8f8cc8a8	fix: assert task workflow result statuses	2026-06-24 01:30:59 +02:00
devops	873c5d586c	fix: repair agent model converter build	2026-06-24 01:26:56 +02:00
devops	95495a8332	feat: complete task board workflow gates	2026-06-24 01:23:49 +02:00
devops	68b428e411	fix: prioritize rollback over queued deploys	2026-06-24 01:22:55 +02:00
devops	1214cf9a4d	chore: simplify nexus cicd pipeline	2026-06-24 01:22:55 +02:00
devops	195c497c88	fix: route standalone views via route metadata	2026-06-24 01:22:55 +02:00
devops	a2272c5df6	fix: harden owner bootstrap and auth persistence	2026-06-24 01:22:55 +02:00
devops	5df5194651	fix: deploy GatewayBridge + Dashboard SSE live endpoints ... Root cause: /api/bridge/health and /api/dashboard/live returned 404 live because the source files existed on disk but were never committed to git. The CD pipeline deploys from committed main, so the deployed containers lacked these endpoints. Changes: - Add GatewayBridgeController with /api/bridge/health endpoint - Add DashboardController Live() SSE endpoint for /api/dashboard/live - Add LiveUpdateService (in-memory pub/sub for SSE updates) - Add TaskBridgeService (structured agent-to-backend bridge) - Add nginx routing blocks for /api/bridge/ and /api/dashboard/live - Add host-level nginx-nexus.conf blocks for bridge + live pass-through - Update ServiceCollectionExtensions with DI registrations - Update Dashboard.cs model with SSE-related DTOs Verification after deploy: curl https://nexus.noveria.net/api/bridge/health → 200 JSON curl https://nexus.noveria.net/api/dashboard/live → 200 SSE stream	2026-06-22 20:43:31 +02:00
devops	39aeab62d6	revert: remove image tag experiment	2026-06-22 20:14:08 +02:00
devops	8b1400da17	fix: tag api image to force rebuild	2026-06-22 20:12:31 +02:00
devops	dd17cefa3b	fix: add --no-cache to deploy-now build step; revert temp cache bust changes	2026-06-22 20:10:04 +02:00
devops	2aa41e6366	fix: remove package-lock.json again	2026-06-22 20:07:46 +02:00
devops	696e9daf4d	chore: add DEPLOY_TIMESTAMP build arg for cache busting	2026-06-22 20:07:43 +02:00
devops	701e15ee9b	fix: restore pnpm-lock.yaml (CI requires it) and remove package-lock.json	2026-06-22 20:05:27 +02:00
devops	fe97d1aaf0	chore: force backend Docker cache bust for deploy	2026-06-22 20:04:22 +02:00
devops	df94ed3cd4	feat: board-first orchestration with Gateway Bridge, live-update, and flow-board ... - GatewayBridgeController: MCP-artiger Kommando-Adapter für Agent-zu-Backend - TaskBridgeService + LiveUpdateService: SSE Live-Sync + Bridge-Kommandos - FlowBoard.vue: Board-first orchestration dashboard panel - live-sync.ts store + live.ts service: SSE-basierte Live-Updates - Nullability-Warnung in HealthController.cs gefixt - nginx.conf: SSE-Proxy + CORS für Bridge-Endpunkte - .gitignore: pnpm/corepack local caches ausgeschlossen - docs: architecture-board-first-orchestration.md hinzugefügt - README: Backend Bridge API dokumentiert	2026-06-22 19:56:45 +02:00
devops	de1fc198cb	chore: restore deploy.yaml name, keep deploy-now.yaml as working fallback	2026-06-21 21:41:26 +02:00
devops	f33e8c8b58	chore: remove deploy diagnostic test workflows	2026-06-21 21:41:22 +02:00
devops	dd38570c7b	fix: read OWNER_PASSWORD via docker instead of direct filesystem	2026-06-21 21:39:50 +02:00
devops	5dc00c1142	fix: deploy-now without heredocs — Gitea 1.26.3 compat	2026-06-21 21:38:09 +02:00
devops	cf10ca3ed8	test: no heredoc, echo-based	2026-06-21 21:37:38 +02:00
devops	1f8b45a327	test: heredoc quoted	2026-06-21 21:37:21 +02:00
devops	b1dcf51218	test: heredoc	2026-06-21 21:37:02 +02:00
devops	0fdc40a95c	test: checkout + GITEA_OUTPUT	2026-06-21 21:36:45 +02:00
devops	071cbe8ce5	test: checkout only	2026-06-21 21:36:29 +02:00
devops	c750a5abcd	test: checkout + version + heredoc	2026-06-21 21:36:12 +02:00
devops	dd81070afd	test: env with secrets	2026-06-21 21:35:55 +02:00
devops	be5c3884a0	test: minimal dispatch test	2026-06-21 21:35:38 +02:00
devops	7a2d5ded20	feat: add deploy-now workflow as dispatch-only fallback	2026-06-21 21:35:15 +02:00
devops	784cb4eeee	fix: replace broken deploy workflow with deploy-v2	2026-06-21 21:34:47 +02:00
devops	6b2ab04f8d	fix: remove workflow_dispatch inputs to unblock dispatch endpoint	2026-06-21 21:34:15 +02:00
devops	ca4bad2ba7	fix: repair deploy pipeline — boolean type and unterminated quoted string ... - Changed no_cache input type from boolean to string (Gitea 1.26.3 compat) - Fixed multi-line double-quoted string in DEPLOYSCRIPT heredoc - Hardened inputs.* references with proper short-circuit fallbacks	2026-06-21 21:32:25 +02:00
devops	ac131f7f53	feat: Parent-Child TaskFlow — Delegated durch sichtbare Child-Tasks ersetzt ... - Delegated State aus Board, Entities, DTOs, Frontend-Spalten und Tests entfernt - Parent-Tasks bleiben InProgress waehrend delegierter Agentenarbeit - Child-Tasks laufen sichtbar mit normalen States und parentTaskId - Doku: README, Phase 3, Changelog, Controller-Kommentare angepasst - openclaw-task-board-flow.md als Referenzdoku hinzugefuegt - 73/73 Backend-Tests gruen, Frontend-Build gruen	2026-06-21 21:30:52 +02:00
devops	b89289989a	docs: document owner password persistence fix in deployment.md and changelog	2026-06-21 10:28:53 +02:00
devops	f95463ef50	fix: permanent owner password persistence with SeedAudit guard ... Root cause: Dual-source architecture for owner password (Gitea secret ENV_OWNER_PASSWORD vs host .env OWNER_PASSWORD) caused drift when the DB was ever re-seeded or the volume recreated. Changes: - Add SeedAudit entity + migration to track one-time seed operations - EnsureDatabaseAsync checks SeedAudit BEFORE seeding — owner is never re-created even if the Users table is wiped - Deploy and rollback workflows now read OWNER_PASSWORD from the host's persistent .env (single source of truth) instead of Gitea secrets - compose.yaml documented: OWNER_PASSWORD only used during initial seed - Cleanup: .gitignore extended for core dumps, changelog/deployment.md updated with 2026-06-20 session notes After this fix the DB is the single source of truth for the owner password after initial seed. The host .env is the single reference for the initial value.	2026-06-21 10:15:36 +02:00