server

package
v0.63.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 9, 2026 License: AGPL-3.0 Imports: 94 Imported by: 0

Documentation

Index

Constants

View Source
const BuildHeader = "X-Stella-Build"

BuildHeader names the build serving a response. A single-page app never re-fetches its document on its own, so an open tab can run a superseded bundle for days; stamping every response lets the tab notice an upgrade from traffic it already makes, instead of polling an endpoint on a timer.

Variables

This section is empty.

Functions

func SetFeishuRegistrationEndpointForTesting added in v0.48.0

func SetFeishuRegistrationEndpointForTesting(endpoint string) func()

func WebhookCapabilityReservation added in v0.61.0

func WebhookCapabilityReservation(ingress, next http.Handler) http.Handler

WebhookCapabilityReservation owns the entire /webhooks/ namespace ahead of access logging and OTel. It is the single, deepened evolution of the Phase-1 reservation: nothing else guards this prefix.

  • A canonical POST /webhooks/<single-segment> — where the request path *literally* begins with "/webhooks/" (not after decoding, case-folding, slash-collapsing, or dot-segment resolution) — is admitted inward: the capability and typed wait/session options move into private context, every URL-bearing field is sanitized so the raw capability and query never reach the instrumented chain, and the request is dispatched to ingress.
  • Any other method, an empty or multi-segment suffix, gets an opaque 404 without touching ingress, access logging, or OTel.
  • Invalid or duplicate wait/session_mode values are a 400 before admission; the raw query is never forwarded.
  • A request that is NOT the literal canonical prefix but still carries a capability token anywhere in its path/raw-path/request-target (a prefix-equivalent malformed path: //webhooks/…, /Webhooks/…, dot-segment forms, percent/double-percent-encoded prefixes) gets an opaque 404 before the admin chain, so a capability can never reach admin telemetry. Malformed requests are never normalized-then-dispatched.
  • Every other request passes through unchanged to next (the admin chain).

A later phase deepens ingress behind this seam rather than replacing the guard.

Types

type AuthInfo

type AuthInfo struct {
	UserID   string `json:"user_id"`
	Username string `json:"username"`
	Role     string `json:"role"`
	IsAdmin  bool   `json:"is_admin"`
	// OIDC principal fields; empty for legacy (password-based) sessions.
	Email     string `json:"email,omitempty"`
	Name      string `json:"name,omitempty"`
	AvatarURL string `json:"avatar_url,omitempty"`
	// contains filtered or unexported fields
}

AuthInfo carries authenticated user data through request context.

func UserFromContext

func UserFromContext(ctx context.Context) *AuthInfo

UserFromContext extracts the AuthInfo from a request context. Returns nil if the user is not authenticated.

type DBPinger added in v0.60.0

type DBPinger interface {
	Ping(context.Context) error
}

DBPinger is the minimal database liveness surface the /healthz, /readyz, and admin status probes need. *pgxpool.Pool satisfies it; the composition root injects the pool as this narrow port so the probes can ping the database but never reach an application query. Tests inject a fake to exercise the failure branch without a real database.

type Deps added in v0.60.0

type Deps struct {
	// Pinger is the narrow database-liveness port backing the /healthz, /readyz,
	// and admin status probes. The composition root injects the pool as this
	// narrow port so the transport can never reach an application query — every
	// data access is routed through a domain service below.
	Pinger DBPinger
	// Account owns the user-account application boundary: admin/self user
	// reads/mutations, login/channel identities, sessions, password credential,
	// and agent assignments, with the role/deactivation revocation invariants.
	Account *account.Service

	// Profile owns the per-(user, agent) memory application boundary: profile,
	// soul, constraints, changelog, list, and reset, with the Agent-access gate
	// and change-source audit. The transport no longer reaches memory.Provider,
	// memorywrite, or the query layer for these.
	Profile *memprofile.Service

	// ProjectStore owns the Authority-bound project use cases (list/create/get/
	// update/delete) with the Agent gate, ownership, route-agent binding, and
	// workspace-containment invariant. Inbox is the cross-Goal/Scheduler inbox
	// read model. Both keep the query layer out of the transport.
	ProjectStore *agent.ProjectStore
	Inbox        *inbox.Service

	// Authorization. AgentAccess and SessionAccess own their domain rules over
	// trusted Authority values and durable state.
	AgentAccess   *agentaccess.Service
	SessionAccess *sessionaccess.Service
	// AgentManagement owns the Agent write use cases (create/update/delete, admin
	// assignment, conversation-activity read model). It layers on AgentAccess for
	// authorization and holds the durable write + runtime-reload ports so the HTTP
	// transport no longer orchestrates them.
	AgentManagement *agentaccess.Management
	// ToolOverrides persists per-agent tool-visibility overrides. The transport
	// holds this narrow domain store instead of the aggregate query handle.
	ToolOverrides *agent.ToolOverrideStore
	// SkillAccess is the DB-backed Skill enforcement point. When nil the
	// skill endpoints report 503 through the centralized unavailable mapping.
	SkillAccess *skillaccess.Service
	LinkCodes   *auth.LinkCodeStore
	OIDC        OIDCDeps

	// Agent runtime + plugins.
	PoolManager  *agent.PoolManager
	PluginHost   *pluginhost.Host
	BuiltinTools []agent.BuiltinTool

	// WeixinRegistrar reaches the iLink API for the WeChat QR/registration
	// handlers. The composition root supplies the concrete adapter (which wraps
	// the weixin plugin client) so internal/server never imports the plugin.
	WeixinRegistrar WeixinRegistrar

	// Public addressing, resolved once at the startup boundary. Never a
	// localhost placeholder mutated later.
	BaseURL string

	// Shared domain services — single, fully-wired instances built by the
	// composition root. The same instances back both the agent tools and the
	// HTTP endpoints, so there is one source of truth per capability.
	Credentials  *connections.Service
	ControlPlane *controlplane.Service
	// Webhooks is the personal invocation-capability domain used by both the
	// authenticated resource API and unauthenticated capability ingress.
	Webhooks            *webhook.Service
	Email               *email.Service
	Share               *sharepkg.Service
	Recally             *recally.Service
	CredentialFrontDoor *credential.Service
	OAuthAuthServer     *oidc.Service
	// Group owns the Web group/channel application boundary: authorized CRUD,
	// membership with the last-member invariant, message list, and the send path
	// (command interception, dedup append + outbox claim, synchronous dispatch).
	// It holds the event log and group dispatcher internally, so the transport no
	// longer reaches the query layer or sqlc for groups.
	Group *channel.GroupService
	// Assets is the authoritative asset persistence service. Session workspace
	// handlers use its narrow durable-write/restore/move/delete ports instead of a
	// raw blob store, so the HTTP transport never holds process-global blob state.
	Assets *asset.Store

	// Optional capabilities. A nil field is a supported configuration: the
	// matching endpoints report 503 through the centralized unavailable mapping
	// (see capabilityUnavailable). Presence is never inferred from the
	// environment inside the server.
	Vault          *vault.Service
	VaultRecipient *age.X25519Recipient
	MCP            *mcp.Service
	Scheduler      *scheduler.Service
	Goal           *goal.Service
	Workflow       *workflowpkg.Service
	Provisioning   *provisioning.Service
}

Deps is the immutable, validated dependency set for the admin Server. The composition root constructs every value exactly once — including the single shared credentials/email/share/recally instances and the credential front door, already resolved against the final base URL — and hands them here. Server.New reads no environment, constructs no shadow service, and chooses no implementation; it only wires these into HTTP routes. The struct is copied into the Server at construction and never mutated afterward: there are no post-construction setters.

type OIDCDeps added in v0.60.0

type OIDCDeps struct {
	Providers  []auth.AuthProvider
	AuthSvc    *auth.AuthService
	SessionMgr *auth.SessionManager
	StateMgr   *authoidc.StateManager
	LocalAuth  *local.Service
}

OIDCDeps groups the login-authentication components produced by oidc.Setup. The account identity stores no longer live here: they are composed inside the Account service (Deps.Account). LocalAuth is nil in external-OIDC mode.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server provides HTTP handlers for the admin API and embedded web UI.

func New

func New(ctx context.Context, deps Deps) (*Server, error)

New creates an admin server with all API routes mounted. It validates deps and returns an error if any required dependency is missing. It reads no environment, constructs no shared/shadow service, and installs no setters — every dependency arrives through the immutable Deps. The server does not own the lifecycle of any injected dependency and never closes one.

func (*Server) AbandonGoal added in v0.49.4

func (s *Server) AbandonGoal(w http.ResponseWriter, r *http.Request, id string)

AbandonGoal is the human give-up on a budget-exhausted block.

func (*Server) ActivateGoal added in v0.38.0

func (s *Server) ActivateGoal(w http.ResponseWriter, r *http.Request, id string)

ActivateGoal runs the plan gate (draft → ready).

func (*Server) AddEdge added in v0.49.4

func (s *Server) AddEdge(w http.ResponseWriter, r *http.Request, id string)

AddEdge inserts an upstream dependency edge (cycle-checked).

func (*Server) AddGroupMember added in v0.43.0

func (s *Server) AddGroupMember(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) AddProfileConstraint added in v0.39.1

func (s *Server) AddProfileConstraint(w http.ResponseWriter, r *http.Request, agentID string)

AddProfileConstraint handles POST /api/users/me/memories/{agentID}/constraints.

func (*Server) ApprovePlan added in v0.50.0

func (s *Server) ApprovePlan(w http.ResponseWriter, r *http.Request, id string)

ApprovePlan approves a composite's proposed plan (blocked(needs_plan_approval)), materializing its children and resuming the tree.

func (*Server) AssignAgentUser

func (s *Server) AssignAgentUser(w http.ResponseWriter, r *http.Request, id string)

func (*Server) BeginDrain added in v0.60.0

func (s *Server) BeginDrain()

BeginDrain starts graceful shutdown from the server's side: /readyz flips to 503 and streaming handlers unwind. The shutdown orchestrator calls it before it touches the HTTP listener.

func (*Server) BeginFeishuRegistration added in v0.48.0

func (s *Server) BeginFeishuRegistration(w http.ResponseWriter, r *http.Request)

func (*Server) BeginWeixinRegistration added in v0.48.0

func (s *Server) BeginWeixinRegistration(w http.ResponseWriter, r *http.Request)

func (*Server) BindChannelAgent added in v0.62.0

func (s *Server) BindChannelAgent(w http.ResponseWriter, r *http.Request, id string)

BindChannelAgent points a channel at an agent, or unbinds it when agent_id is empty. It is the one channel write open to a non-admin, so it is deliberately separate from the admin PATCH: it never accepts (or returns) the channel config, and it answers with the same secret-free projection the public channel list serves.

func (*Server) CancelGoal added in v0.38.0

func (s *Server) CancelGoal(w http.ResponseWriter, r *http.Request, id string)

CancelGoal cancels a goal, cascading over its non-terminal subtree.

func (*Server) ChangePassword

func (s *Server) ChangePassword(w http.ResponseWriter, r *http.Request)

ChangePassword handles PATCH /api/users/me/password.

func (*Server) CreateAgent

func (s *Server) CreateAgent(w http.ResponseWriter, r *http.Request)

func (*Server) CreateAgentSkill added in v0.38.0

func (s *Server) CreateAgentSkill(w http.ResponseWriter, r *http.Request, id string)

func (*Server) CreateChannel

func (s *Server) CreateChannel(w http.ResponseWriter, r *http.Request)

func (*Server) CreateFeed

func (s *Server) CreateFeed(w http.ResponseWriter, r *http.Request)

func (*Server) CreateFeedEntry added in v0.43.0

func (s *Server) CreateFeedEntry(w http.ResponseWriter, r *http.Request, feedId string)

func (*Server) CreateGoal added in v0.38.0

func (s *Server) CreateGoal(w http.ResponseWriter, r *http.Request)

CreateGoal mints a root goal (goal). With activate=true a leaf is activated immediately (direct run); the flag is ignored for a composite, which is decomposed and materialized by the dispatcher first.

func (*Server) CreateGoalTimelineEvent added in v0.60.0

func (s *Server) CreateGoalTimelineEvent(w http.ResponseWriter, r *http.Request, id string)

CreateGoalTimelineEvent appends a human message and reattempts non-dep blocks.

func (*Server) CreateGroup added in v0.43.0

func (s *Server) CreateGroup(w http.ResponseWriter, r *http.Request)

func (*Server) CreateOAuthClient added in v0.60.0

func (s *Server) CreateOAuthClient(w http.ResponseWriter, r *http.Request)

CreateOAuthClient handles POST /api/users/me/oauth-clients. The plaintext secret is returned exactly once (empty for public clients).

func (*Server) CreatePersonalAccessToken added in v0.60.0

func (s *Server) CreatePersonalAccessToken(w http.ResponseWriter, r *http.Request)

CreatePersonalAccessToken handles POST /api/users/me/tokens. The plaintext token is returned exactly once here and is never retrievable again.

func (*Server) CreateProfileKnowledge added in v0.60.0

func (s *Server) CreateProfileKnowledge(w http.ResponseWriter, r *http.Request, agentID string)

CreateProfileKnowledge handles POST /api/users/me/memories/{agentId}/knowledge.

func (*Server) CreateProject added in v0.34.0

func (s *Server) CreateProject(w http.ResponseWriter, r *http.Request, agentID string)

func (*Server) CreateProvider

func (s *Server) CreateProvider(w http.ResponseWriter, r *http.Request)

func (*Server) CreateProvisionedUser added in v0.63.0

func (s *Server) CreateProvisionedUser(w http.ResponseWriter, r *http.Request)

CreateProvisionedUser handles POST /api/provisioned-users. The response is the only path that carries the minted plaintext token.

func (*Server) CreateProvisioningToken added in v0.63.0

func (s *Server) CreateProvisioningToken(w http.ResponseWriter, r *http.Request)

CreateProvisioningToken handles POST /api/admin/provisioning-tokens. The plaintext token is intentionally returned exactly once and always expires.

func (*Server) CreateSchedulerJob

func (s *Server) CreateSchedulerJob(w http.ResponseWriter, r *http.Request, agentID string)

func (*Server) CreateScopedMCPServer added in v0.60.0

func (s *Server) CreateScopedMCPServer(w http.ResponseWriter, r *http.Request)

CreateScopedMCPServer handles POST /api/mcp/servers.

func (*Server) CreateScopedSkill added in v0.48.0

func (s *Server) CreateScopedSkill(w http.ResponseWriter, r *http.Request)

CreateScopedSkill handles POST /api/skills.

func (*Server) CreateSession

func (s *Server) CreateSession(w http.ResponseWriter, r *http.Request, agentID string)

func (*Server) CreateShare added in v0.35.0

func (s *Server) CreateShare(w http.ResponseWriter, r *http.Request)

func (*Server) CreateWebhook added in v0.61.0

func (s *Server) CreateWebhook(w http.ResponseWriter, r *http.Request)

func (*Server) CreateWorkspaceFile

func (s *Server) CreateWorkspaceFile(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.CreateWorkspaceFileParams)

func (*Server) DeactivateProvisionedUser added in v0.63.0

func (s *Server) DeactivateProvisionedUser(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

DeactivateProvisionedUser handles POST /api/provisioned-users/{id}/deactivate.

func (*Server) DeleteAgent

func (s *Server) DeleteAgent(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteAgentProviderCredential added in v0.61.0

func (s *Server) DeleteAgentProviderCredential(w http.ResponseWriter, r *http.Request, id string, providerId string)

DeleteAgentProviderCredential idempotently restores the deployment-global key fallback for this Agent and canonical Provider.

func (*Server) DeleteAgentSkill

func (s *Server) DeleteAgentSkill(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.DeleteAgentSkillParams)

func (*Server) DeleteAgentSkillFile

func (s *Server) DeleteAgentSkillFile(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.DeleteAgentSkillFileParams)

func (*Server) DeleteArticle

func (s *Server) DeleteArticle(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteAuthSession added in v0.38.0

func (s *Server) DeleteAuthSession(w http.ResponseWriter, r *http.Request, id string)

DeleteAuthSession handles DELETE /api/auth/sessions/{id}.

func (*Server) DeleteAuthUserIdentity

func (s *Server) DeleteAuthUserIdentity(w http.ResponseWriter, r *http.Request, id string, identityId string)

DeleteAuthUserIdentity handles DELETE /api/users/{id}/identities/{identityId}.

func (*Server) DeleteChannel

func (s *Server) DeleteChannel(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteFeed

func (s *Server) DeleteFeed(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteGoal added in v0.49.4

func (s *Server) DeleteGoal(w http.ResponseWriter, r *http.Request, id string)

DeleteGoal archives a goal (audit-safe delete).

func (*Server) DeleteGroup added in v0.43.0

func (s *Server) DeleteGroup(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) DeleteManifestPlugin added in v0.63.2

func (s *Server) DeleteManifestPlugin(w http.ResponseWriter, r *http.Request, kind string, name string)

DeleteManifestPlugin removes an admin-added plugin. The id is addressed as kind/name, the same shape the builtin plugin routes use.

func (*Server) DeleteOAuthProviderConfig

func (s *Server) DeleteOAuthProviderConfig(w http.ResponseWriter, r *http.Request, id string)

DeleteOAuthProviderConfig handles DELETE /api/admin/oauth-providers/{id}/config.

func (*Server) DeleteProfileConstraint added in v0.39.1

func (s *Server) DeleteProfileConstraint(w http.ResponseWriter, r *http.Request, agentID string, constraintID string)

DeleteProfileConstraint handles DELETE /api/users/me/memories/{agentID}/constraints/{constraintID}.

func (*Server) DeleteProfileKnowledge added in v0.60.0

func (s *Server) DeleteProfileKnowledge(w http.ResponseWriter, r *http.Request, agentID string, factID string)

DeleteProfileKnowledge handles DELETE /api/users/me/memories/{agentId}/knowledge/{factId}.

func (*Server) DeleteProfileMemory

func (s *Server) DeleteProfileMemory(w http.ResponseWriter, r *http.Request, agentID string)

DeleteProfileMemory handles DELETE /api/users/me/memories/{agentID}.

func (*Server) DeleteProject added in v0.34.0

func (s *Server) DeleteProject(w http.ResponseWriter, r *http.Request, agentID string, projectID string)

func (*Server) DeleteProvider

func (s *Server) DeleteProvider(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteSchedulerJob

func (s *Server) DeleteSchedulerJob(w http.ResponseWriter, r *http.Request, agentID string, jobID string)

func (*Server) DeleteScopedMCPServer added in v0.60.0

func (s *Server) DeleteScopedMCPServer(w http.ResponseWriter, r *http.Request, id string, params apiserver.DeleteScopedMCPServerParams)

DeleteScopedMCPServer handles DELETE /api/mcp/servers/{id}.

func (*Server) DeleteScopedSkill added in v0.48.0

func (s *Server) DeleteScopedSkill(w http.ResponseWriter, r *http.Request, id string)

DeleteScopedSkill handles DELETE /api/skills/{id}.

func (*Server) DeleteScopedSkillFile added in v0.48.0

func (s *Server) DeleteScopedSkillFile(w http.ResponseWriter, r *http.Request, id string, params apiserver.DeleteScopedSkillFileParams)

DeleteScopedSkillFile handles DELETE /api/skills/{id}/file.

func (*Server) DeleteScopedVaultEntry added in v0.48.0

func (s *Server) DeleteScopedVaultEntry(w http.ResponseWriter, r *http.Request, name string, params apiserver.DeleteScopedVaultEntryParams)

DeleteScopedVaultEntry handles DELETE /api/vault/{name}.

func (*Server) DeleteSession added in v0.46.0

func (s *Server) DeleteSession(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) DeleteUserMemory

func (s *Server) DeleteUserMemory(w http.ResponseWriter, r *http.Request, id string, agentID string)

func (*Server) DeleteWebhook added in v0.61.0

func (s *Server) DeleteWebhook(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

func (*Server) DeleteWorkflow added in v0.60.0

func (s *Server) DeleteWorkflow(w http.ResponseWriter, r *http.Request, id string)

func (*Server) DeleteWorkspaceFile

func (s *Server) DeleteWorkspaceFile(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.DeleteWorkspaceFileParams)

func (*Server) DisableOAuthClient added in v0.60.0

func (s *Server) DisableOAuthClient(w http.ResponseWriter, r *http.Request, clientId string)

DisableOAuthClient handles DELETE /api/users/me/oauth-clients/{clientId}.

func (*Server) DisconnectOAuth

func (s *Server) DisconnectOAuth(w http.ResponseWriter, r *http.Request, provider string)

DisconnectOAuth handles DELETE /api/users/me/oauth/{provider}.

func (*Server) FetchProviderModels

func (s *Server) FetchProviderModels(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GenerateLinkCode

func (s *Server) GenerateLinkCode(w http.ResponseWriter, r *http.Request)

GenerateLinkCode handles POST /api/users/me/link-code.

func (*Server) GetAgent

func (s *Server) GetAgent(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GetAgentProviderCredential added in v0.61.0

func (s *Server) GetAgentProviderCredential(w http.ResponseWriter, r *http.Request, id string, providerId string)

GetAgentProviderCredential returns one safe metadata resource.

func (*Server) GetAgentSkill

func (s *Server) GetAgentSkill(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.GetAgentSkillParams)

func (*Server) GetAgentSkillFile

func (s *Server) GetAgentSkillFile(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.GetAgentSkillFileParams)

func (*Server) GetArticle

func (s *Server) GetArticle(w http.ResponseWriter, r *http.Request, id string, params apiserver.GetArticleParams)

func (*Server) GetAttempt added in v0.49.4

func (s *Server) GetAttempt(w http.ResponseWriter, r *http.Request, id string, attemptId string)

GetAttempt returns one attempt, scoped to its goal.

func (*Server) GetAuthUser

func (s *Server) GetAuthUser(w http.ResponseWriter, r *http.Request, id string)

GetAuthUser handles GET /api/users/{id}.

func (*Server) GetBuiltinResource

func (s *Server) GetBuiltinResource(w http.ResponseWriter, r *http.Request, kindStr string, id string)

func (*Server) GetChannel

func (s *Server) GetChannel(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GetClawhubSkill added in v0.47.0

func (s *Server) GetClawhubSkill(w http.ResponseWriter, r *http.Request, slug string)

GetClawhubSkill handles GET /api/clawhub/skills/{slug}, returning a single skill's metadata together with its README and file list (downloaded from ClawHub on demand).

func (*Server) GetCliToolLatest added in v0.45.0

func (s *Server) GetCliToolLatest(w http.ResponseWriter, r *http.Request, params apiserver.GetCliToolLatestParams)

GetCliToolLatest resolves the latest installable version for a mise tool key, letting the UI pin a tool to its current latest without the admin running mise.

func (*Server) GetDigest

func (s *Server) GetDigest(w http.ResponseWriter, r *http.Request)

func (*Server) GetEmailMessage added in v0.43.0

func (s *Server) GetEmailMessage(w http.ResponseWriter, r *http.Request, uid int, params apiserver.GetEmailMessageParams)

GetEmailMessage handles GET /api/email/messages/{uid}.

func (*Server) GetEmbeddingSettings added in v0.50.3

func (s *Server) GetEmbeddingSettings(w http.ResponseWriter, r *http.Request)

GetEmbeddingSettings returns the deployment-wide embedding configuration. The API key is never returned; has_api_key reports whether one is stored.

func (*Server) GetFeed

func (s *Server) GetFeed(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GetGoal added in v0.38.0

func (s *Server) GetGoal(w http.ResponseWriter, r *http.Request, id string)

GetGoal returns one goal.

func (*Server) GetGoalHealth added in v0.60.0

func (s *Server) GetGoalHealth(w http.ResponseWriter, r *http.Request, params apiserver.GetGoalHealthParams)

GetGoalHealth returns the aggregated execution health report for a time window. The report is computed only over goals the caller may read (Access.HealthReport authorizes every row under one evaluation), so a per-resource deny never leaks a hidden goal into the totals.

func (*Server) GetGoalReadiness added in v0.49.4

func (s *Server) GetGoalReadiness(w http.ResponseWriter, r *http.Request, id string)

GetGoalReadiness returns the computed dispatchability view.

func (*Server) GetGroup added in v0.43.0

func (s *Server) GetGroup(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) GetMe

func (s *Server) GetMe(w http.ResponseWriter, r *http.Request)

GetMe handles GET /api/auth/me.

func (*Server) GetOAuthConnected

func (s *Server) GetOAuthConnected(w http.ResponseWriter, r *http.Request, provider string)

GetOAuthConnected handles GET /api/users/me/oauth/{provider}/connected.

func (*Server) GetOAuthProviderConfig

func (s *Server) GetOAuthProviderConfig(w http.ResponseWriter, r *http.Request, id string)

GetOAuthProviderConfig handles GET /api/admin/oauth-providers/{id}/config.

func (*Server) GetPersonalAccessToken added in v0.60.0

func (s *Server) GetPersonalAccessToken(w http.ResponseWriter, r *http.Request, id string)

GetPersonalAccessToken handles GET /api/users/me/tokens/{id}. The lookup is scoped to the caller, so a token owned by another user is indistinguishable from a missing one (404) -- ownership is checked before existence is revealed.

func (*Server) GetPluginConfig

func (s *Server) GetPluginConfig(w http.ResponseWriter, r *http.Request, kind string, name string)

func (*Server) GetPluginConfigSchema

func (s *Server) GetPluginConfigSchema(w http.ResponseWriter, r *http.Request, kind string, name string)

func (*Server) GetPluginStatus

func (s *Server) GetPluginStatus(w http.ResponseWriter, r *http.Request, kind string, name string)

func (*Server) GetProfileMemory added in v0.39.1

func (s *Server) GetProfileMemory(w http.ResponseWriter, r *http.Request, agentID string)

GetProfileMemory handles GET /api/users/me/memories/{agentID}.

func (*Server) GetProject added in v0.34.0

func (s *Server) GetProject(w http.ResponseWriter, r *http.Request, agentID string, projectID string)

func (*Server) GetProvider

func (s *Server) GetProvider(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GetProvisionedUser added in v0.63.0

func (s *Server) GetProvisionedUser(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

GetProvisionedUser handles GET /api/provisioned-users/{id}.

func (*Server) GetSchedulerJob added in v0.36.0

func (s *Server) GetSchedulerJob(w http.ResponseWriter, r *http.Request, agentID string, jobID string)

func (*Server) GetScopedSkill added in v0.48.0

func (s *Server) GetScopedSkill(w http.ResponseWriter, r *http.Request, id string)

GetScopedSkill handles GET /api/skills/{id}.

func (*Server) GetScopedSkillFile added in v0.48.0

func (s *Server) GetScopedSkillFile(w http.ResponseWriter, r *http.Request, id string, params apiserver.GetScopedSkillFileParams)

GetScopedSkillFile handles GET /api/skills/{id}/file.

func (*Server) GetScopedVaultEntry added in v0.48.0

func (s *Server) GetScopedVaultEntry(w http.ResponseWriter, r *http.Request, name string, params apiserver.GetScopedVaultEntryParams)

GetScopedVaultEntry handles GET /api/vault/{name}.

func (*Server) GetSession

func (s *Server) GetSession(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) GetSessionContextItems added in v0.46.0

func (s *Server) GetSessionContextItems(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.GetSessionContextItemsParams)

func (*Server) GetSessionMedia added in v0.61.0

func (s *Server) GetSessionMedia(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, mediaID string)

GetSessionMedia returns immutable bytes only after the Session PEP proves the routed session can read a part that references them.

func (*Server) GetSessionMessages

func (s *Server) GetSessionMessages(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.GetSessionMessagesParams)

func (*Server) GetSessionSummary added in v0.46.0

func (s *Server) GetSessionSummary(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, summaryID string)

func (*Server) GetSessionSystemPrompt

func (s *Server) GetSessionSystemPrompt(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) GetSessionWorkspace

func (s *Server) GetSessionWorkspace(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.GetSessionWorkspaceParams)

func (*Server) GetShareContent added in v0.35.0

func (s *Server) GetShareContent(w http.ResponseWriter, r *http.Request, token string)

func (*Server) GetStatus

func (s *Server) GetStatus(w http.ResponseWriter, r *http.Request)

func (*Server) GetStoredDigest

func (s *Server) GetStoredDigest(w http.ResponseWriter, r *http.Request, date string)

func (*Server) GetVisionSettings added in v0.61.0

func (s *Server) GetVisionSettings(w http.ResponseWriter, r *http.Request)

GetVisionSettings returns the deployment-wide vision model.

func (*Server) GetWebhook added in v0.61.0

func (s *Server) GetWebhook(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

func (*Server) GetWorkflow added in v0.60.0

func (s *Server) GetWorkflow(w http.ResponseWriter, r *http.Request, id string)

func (*Server) GetWorkspaceFileContent

func (s *Server) GetWorkspaceFileContent(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.GetWorkspaceFileContentParams)

func (*Server) Handler

func (s *Server) Handler() http.Handler

Handler returns the HTTP handler with OTel instrumentation wrapping the access-log, CORS, JSON, and auth middleware chain. The OTel wrap is unconditional: it is a no-op when tracing is disabled. The access log sits directly inside it so log lines can carry the request's trace_id.

func (*Server) InitFeishuRegistration added in v0.48.0

func (s *Server) InitFeishuRegistration(w http.ResponseWriter, r *http.Request)

func (*Server) InstallAgentSkill

func (s *Server) InstallAgentSkill(w http.ResponseWriter, r *http.Request, id string)

func (*Server) InstallScopedSkill added in v0.48.0

func (s *Server) InstallScopedSkill(w http.ResponseWriter, r *http.Request)

InstallScopedSkill handles POST /api/skills/install.

func (*Server) InstantiateWorkflow added in v0.60.0

func (s *Server) InstantiateWorkflow(w http.ResponseWriter, r *http.Request, id string)

func (*Server) LinkAuthUserLoginIdentity added in v0.38.0

func (s *Server) LinkAuthUserLoginIdentity(w http.ResponseWriter, r *http.Request, id string)

LinkAuthUserLoginIdentity handles POST /api/users/{id}/identities/login.

func (*Server) LinkCodes

func (s *Server) LinkCodes() *auth.LinkCodeStore

LinkCodes returns the link code store for use by channel handlers.

func (*Server) ListAcceptanceEvents added in v0.49.4

func (s *Server) ListAcceptanceEvents(w http.ResponseWriter, r *http.Request, id string)

ListAcceptanceEvents lists the acceptance ledger (audit trail, in fold order).

func (*Server) ListAgentProviderCredentials added in v0.61.0

func (s *Server) ListAgentProviderCredentials(w http.ResponseWriter, r *http.Request, id string, params apiserver.ListAgentProviderCredentialsParams)

ListAgentProviderCredentials returns only write-safe credential state. Agent Management owns the Read authorization and persistence boundary; the handler never reaches the store, cipher, or control plane directly.

func (*Server) ListAgentSkills

func (s *Server) ListAgentSkills(w http.ResponseWriter, r *http.Request, id string, params apiserver.ListAgentSkillsParams)

func (*Server) ListAgentTools added in v0.60.0

func (s *Server) ListAgentTools(w http.ResponseWriter, r *http.Request, id string)

func (*Server) ListAgentUsers

func (s *Server) ListAgentUsers(w http.ResponseWriter, r *http.Request, id string)

func (*Server) ListAgents

func (s *Server) ListAgents(w http.ResponseWriter, r *http.Request, params apiserver.ListAgentsParams)

func (*Server) ListArticles

func (s *Server) ListArticles(w http.ResponseWriter, r *http.Request, params apiserver.ListArticlesParams)

func (*Server) ListAttempts added in v0.49.4

func (s *Server) ListAttempts(w http.ResponseWriter, r *http.Request, id string)

ListAttempts lists a goal's attempts (newest first).

func (*Server) ListAuthProviders added in v0.38.0

func (s *Server) ListAuthProviders(w http.ResponseWriter, r *http.Request)

ListAuthProviders handles GET /api/auth/providers. Returns the list of configured OIDC providers so the frontend can build login buttons. Public endpoint — no authentication required.

func (*Server) ListAuthSessions added in v0.38.0

func (s *Server) ListAuthSessions(w http.ResponseWriter, r *http.Request)

ListAuthSessions handles GET /api/auth/sessions.

func (*Server) ListAuthUserAgents

func (s *Server) ListAuthUserAgents(w http.ResponseWriter, r *http.Request, id string)

ListAuthUserAgents handles GET /api/users/{id}/agents.

func (*Server) ListAuthUserChannelIdentities added in v0.38.0

func (s *Server) ListAuthUserChannelIdentities(w http.ResponseWriter, r *http.Request, id string)

ListAuthUserChannelIdentities handles GET /api/users/{id}/identities/channel.

func (*Server) ListAuthUserLoginIdentities added in v0.38.0

func (s *Server) ListAuthUserLoginIdentities(w http.ResponseWriter, r *http.Request, id string)

ListAuthUserLoginIdentities handles GET /api/users/{id}/identities/login.

func (*Server) ListAuthUsers

func (s *Server) ListAuthUsers(w http.ResponseWriter, r *http.Request, params apiserver.ListAuthUsersParams)

ListAuthUsers handles GET /api/users.

func (*Server) ListAuthorizedApps added in v0.60.0

func (s *Server) ListAuthorizedApps(w http.ResponseWriter, r *http.Request)

ListAuthorizedApps handles GET /api/users/me/authorized-apps.

func (*Server) ListBuiltinResources

func (s *Server) ListBuiltinResources(w http.ResponseWriter, r *http.Request, kindStr string)

func (*Server) ListChannels

func (s *Server) ListChannels(w http.ResponseWriter, r *http.Request)

func (*Server) ListClawhubSkills added in v0.47.0

func (s *Server) ListClawhubSkills(w http.ResponseWriter, r *http.Request, params apiserver.ListClawhubSkillsParams)

ListClawhubSkills handles GET /api/clawhub/skills. When q is absent it browses popular skills (paginated); when q is set it searches.

func (*Server) ListEdges added in v0.49.4

func (s *Server) ListEdges(w http.ResponseWriter, r *http.Request, id string)

ListEdges lists a goal's upstream dependency edges.

func (*Server) ListEmailAccounts added in v0.60.0

func (s *Server) ListEmailAccounts(w http.ResponseWriter, r *http.Request)

ListEmailAccounts handles GET /api/email/accounts.

func (*Server) ListEmailFolders added in v0.43.0

func (s *Server) ListEmailFolders(w http.ResponseWriter, r *http.Request, params apiserver.ListEmailFoldersParams)

ListEmailFolders handles GET /api/email/folders.

func (*Server) ListEmailMessages added in v0.43.0

func (s *Server) ListEmailMessages(w http.ResponseWriter, r *http.Request, params apiserver.ListEmailMessagesParams)

ListEmailMessages handles GET /api/email/messages.

func (*Server) ListFeedEntries

func (s *Server) ListFeedEntries(w http.ResponseWriter, r *http.Request, feedId string, params apiserver.ListFeedEntriesParams)

func (*Server) ListFeeds

func (s *Server) ListFeeds(w http.ResponseWriter, r *http.Request, params apiserver.ListFeedsParams)

func (*Server) ListGoalChildren added in v0.49.4

func (s *Server) ListGoalChildren(w http.ResponseWriter, r *http.Request, id string)

ListGoalChildren lists a composite's direct children.

func (*Server) ListGoalTimeline added in v0.60.0

func (s *Server) ListGoalTimeline(w http.ResponseWriter, r *http.Request, id string, params apiserver.ListGoalTimelineParams)

ListGoalTimeline lists a goal's L3 timeline in chronological order.

func (*Server) ListGoals added in v0.38.0

func (s *Server) ListGoals(w http.ResponseWriter, r *http.Request, params apiserver.ListGoalsParams)

ListGoals lists root goals (goals) by default; `?parent={id}` lists a composite's children and `?root={id}` lists a whole tree.

func (*Server) ListGroupMembers added in v0.43.0

func (s *Server) ListGroupMembers(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) ListGroupMessages added in v0.43.0

func (s *Server) ListGroupMessages(w http.ResponseWriter, r *http.Request, groupId string, params apiserver.ListGroupMessagesParams)

func (*Server) ListGroups added in v0.43.0

func (s *Server) ListGroups(w http.ResponseWriter, r *http.Request, params apiserver.ListGroupsParams)

func (*Server) ListInbox added in v0.46.0

func (s *Server) ListInbox(w http.ResponseWriter, r *http.Request, params apiserver.ListInboxParams)

func (*Server) ListJobTemplates added in v0.46.0

func (s *Server) ListJobTemplates(w http.ResponseWriter, r *http.Request)

ListJobTemplates returns all registered job templates with subscription status resolved for the current user. Returns 503 when the scheduler service is not available.

func (*Server) ListManifestPlugins

func (s *Server) ListManifestPlugins(w http.ResponseWriter, r *http.Request)

func (*Server) ListModels

func (s *Server) ListModels(w http.ResponseWriter, r *http.Request)

ListModels returns the models available for selection: enabled models from enabled providers plus the fetched cache, computed by the control-plane catalog read model. No provider API calls — reads only from the DB.

func (*Server) ListOAuthClientScopes added in v0.60.0

func (s *Server) ListOAuthClientScopes(w http.ResponseWriter, r *http.Request)

ListOAuthClientScopes handles GET /api/users/me/oauth-client-scopes: the single source of truth for the client-registration UI (catalog + OAuth exposability policy).

func (*Server) ListOAuthClients added in v0.60.0

func (s *Server) ListOAuthClients(w http.ResponseWriter, r *http.Request)

ListOAuthClients handles GET /api/users/me/oauth-clients.

func (*Server) ListOAuthProviders

func (s *Server) ListOAuthProviders(w http.ResponseWriter, r *http.Request)

ListOAuthProviders handles GET /api/users/me/oauth/providers.

func (*Server) ListPersonalAccessTokens added in v0.60.0

func (s *Server) ListPersonalAccessTokens(w http.ResponseWriter, r *http.Request)

ListPersonalAccessTokens handles GET /api/users/me/tokens.

func (*Server) ListPlugins

func (s *Server) ListPlugins(w http.ResponseWriter, r *http.Request)

func (*Server) ListProfileChangelog added in v0.39.1

func (s *Server) ListProfileChangelog(w http.ResponseWriter, r *http.Request, agentID string, params apiserver.ListProfileChangelogParams)

ListProfileChangelog handles GET /api/users/me/memories/{agentID}/changelog.

func (*Server) ListProfileConstraints added in v0.39.1

func (s *Server) ListProfileConstraints(w http.ResponseWriter, r *http.Request, agentID string)

ListProfileConstraints handles GET /api/users/me/memories/{agentID}/constraints.

func (*Server) ListProfileIdentities

func (s *Server) ListProfileIdentities(w http.ResponseWriter, r *http.Request)

ListProfileIdentities handles GET /api/users/me/identities.

func (*Server) ListProfileKnowledge added in v0.60.0

func (s *Server) ListProfileKnowledge(w http.ResponseWriter, r *http.Request, agentID string, params apiserver.ListProfileKnowledgeParams)

ListProfileKnowledge handles GET /api/users/me/memories/{agentId}/knowledge.

func (*Server) ListProfileMemories

func (s *Server) ListProfileMemories(w http.ResponseWriter, r *http.Request)

ListProfileMemories handles GET /api/users/me/memories.

func (*Server) ListProjects added in v0.34.0

func (s *Server) ListProjects(w http.ResponseWriter, r *http.Request, agentID string, params apiserver.ListProjectsParams)

func (*Server) ListProviderModels

func (s *Server) ListProviderModels(w http.ResponseWriter, r *http.Request, id string)

func (*Server) ListProviderTypes

func (s *Server) ListProviderTypes(w http.ResponseWriter, r *http.Request)

func (*Server) ListProviders

func (s *Server) ListProviders(w http.ResponseWriter, r *http.Request)

func (*Server) ListProvisionedUsers added in v0.63.0

func (s *Server) ListProvisionedUsers(w http.ResponseWriter, r *http.Request, params apiserver.ListProvisionedUsersParams)

ListProvisionedUsers handles GET /api/provisioned-users.

func (*Server) ListProvisioningTokens added in v0.63.0

func (s *Server) ListProvisioningTokens(w http.ResponseWriter, r *http.Request)

ListProvisioningTokens handles GET /api/admin/provisioning-tokens. Only an interactive admin session can inspect the provisioning credentials it owns.

func (*Server) ListPublicChannels

func (s *Server) ListPublicChannels(w http.ResponseWriter, r *http.Request)

func (*Server) ListSchedulerJobRuns

func (s *Server) ListSchedulerJobRuns(w http.ResponseWriter, r *http.Request, agentID string, jobID string, params apiserver.ListSchedulerJobRunsParams)

func (*Server) ListSchedulerJobs

func (s *Server) ListSchedulerJobs(w http.ResponseWriter, r *http.Request, agentID string)

func (*Server) ListScopedMCPServers added in v0.60.0

func (s *Server) ListScopedMCPServers(w http.ResponseWriter, r *http.Request, params apiserver.ListScopedMCPServersParams)

ListScopedMCPServers handles GET /api/mcp/servers.

func (*Server) ListScopedSkills added in v0.48.0

func (s *Server) ListScopedSkills(w http.ResponseWriter, r *http.Request, params apiserver.ListScopedSkillsParams)

ListScopedSkills handles GET /api/skills.

func (*Server) ListScopedVaultEntries added in v0.48.0

func (s *Server) ListScopedVaultEntries(w http.ResponseWriter, r *http.Request, params apiserver.ListScopedVaultEntriesParams)

ListScopedVaultEntries handles GET /api/vault.

func (*Server) ListSessions

func (s *Server) ListSessions(w http.ResponseWriter, r *http.Request, agentID string, params apiserver.ListSessionsParams)

func (*Server) ListShares added in v0.35.0

func (s *Server) ListShares(w http.ResponseWriter, r *http.Request, params apiserver.ListSharesParams)

func (*Server) ListStoredDigests

func (s *Server) ListStoredDigests(w http.ResponseWriter, r *http.Request, params apiserver.ListStoredDigestsParams)

func (*Server) ListUserMemories

func (s *Server) ListUserMemories(w http.ResponseWriter, r *http.Request, id string)

func (*Server) ListWebhooks added in v0.61.0

func (s *Server) ListWebhooks(w http.ResponseWriter, r *http.Request, params apiserver.ListWebhooksParams)

func (*Server) ListWorkflowRuns added in v0.60.0

func (s *Server) ListWorkflowRuns(w http.ResponseWriter, r *http.Request, id string, params apiserver.ListWorkflowRunsParams)

func (*Server) ListWorkflows added in v0.60.0

func (s *Server) ListWorkflows(w http.ResponseWriter, r *http.Request, params apiserver.ListWorkflowsParams)

func (*Server) LoginLocal added in v0.39.1

func (s *Server) LoginLocal(w http.ResponseWriter, r *http.Request)

func (*Server) Logout

func (s *Server) Logout(w http.ResponseWriter, r *http.Request)

Logout handles POST /api/auth/logout.

func (*Server) MarkEmailMessage added in v0.43.0

func (s *Server) MarkEmailMessage(w http.ResponseWriter, r *http.Request, uid int, params apiserver.MarkEmailMessageParams)

MarkEmailMessage handles POST /api/email/messages/{uid}/mark.

func (*Server) MarkSessionViewed added in v0.63.0

func (s *Server) MarkSessionViewed(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) MarkStartupComplete added in v0.60.0

func (s *Server) MarkStartupComplete()

MarkStartupComplete makes /readyz eligible to report ready. The gateway calls it once every subsystem has started, just before it blocks on shutdown.

func (*Server) MoveWorkspaceFile

func (s *Server) MoveWorkspaceFile(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.MoveWorkspaceFileParams)

func (*Server) OauthCallback

func (s *Server) OauthCallback(w http.ResponseWriter, r *http.Request, provider string, params apiserver.OauthCallbackParams)

OauthCallback handles GET /api/auth/oauth/{provider}/callback. This is intentionally a pass-through to the unexported helper so the generated interface signature is satisfied.

func (*Server) OauthCallbackLegacy added in v0.38.0

func (s *Server) OauthCallbackLegacy(w http.ResponseWriter, r *http.Request, provider string, params apiserver.OauthCallbackLegacyParams)

OauthCallbackLegacy handles the deprecated /api/auth/profile/oauth/{provider}/callback alias.

func (*Server) PollFeed

func (s *Server) PollFeed(w http.ResponseWriter, r *http.Request, id string, params apiserver.PollFeedParams)

func (*Server) PollFeishuRegistration added in v0.48.0

func (s *Server) PollFeishuRegistration(w http.ResponseWriter, r *http.Request)

func (*Server) PollOAuthFlow

func (s *Server) PollOAuthFlow(w http.ResponseWriter, r *http.Request, provider string, flowID string)

PollOAuthFlow handles GET /api/users/me/oauth/{provider}/status/{flowID}.

func (*Server) PollWeixinQRStatus

func (s *Server) PollWeixinQRStatus(w http.ResponseWriter, r *http.Request, params apiserver.PollWeixinQRStatusParams)

PollWeixinQRStatus polls the QR code scan status. On confirmed, it links the current user's identity to the weixin account. Provisioning the singleton channel credentials is an admin-only concern (see BeginWeixinRegistration / PollWeixinRegistration), so the credential write only happens for admins; a non-admin linking their identity must not overwrite the global channel. GET /api/channels/weixin/qr/status?qrcode=...

func (*Server) PollWeixinRegistration added in v0.48.0

func (s *Server) PollWeixinRegistration(w http.ResponseWriter, r *http.Request)

func (*Server) ReattemptGoal added in v0.49.4

func (s *Server) ReattemptGoal(w http.ResponseWriter, r *http.Request, id string)

ReattemptGoal raises the budget on a blocked goal and resumes it.

func (*Server) RegisterLocal added in v0.39.1

func (s *Server) RegisterLocal(w http.ResponseWriter, r *http.Request)

func (*Server) RejectPlan added in v0.50.0

func (s *Server) RejectPlan(w http.ResponseWriter, r *http.Request, id string)

RejectPlan rejects a composite's proposed plan, returning it to draft so the dispatcher re-decomposes it.

func (*Server) RemoveAgentUser

func (s *Server) RemoveAgentUser(w http.ResponseWriter, r *http.Request, id string, userId string)

func (*Server) RemoveGroupMember added in v0.43.0

func (s *Server) RemoveGroupMember(w http.ResponseWriter, r *http.Request, groupId string, agentId string)

func (*Server) ResetManifestPlugin added in v0.63.2

func (s *Server) ResetManifestPlugin(w http.ResponseWriter, r *http.Request, kind string, name string)

ResetManifestPlugin hands a builtin's definition back to the running server, either one field of it or, with no field named, all of it.

func (*Server) RestoreProfileKnowledge added in v0.60.0

func (s *Server) RestoreProfileKnowledge(w http.ResponseWriter, r *http.Request, agentID string, factID string)

RestoreProfileKnowledge handles POST /api/users/me/memories/{agentId}/knowledge/{factId}/restore.

func (*Server) RevokeAuthorizedApp added in v0.60.0

func (s *Server) RevokeAuthorizedApp(w http.ResponseWriter, r *http.Request, clientId string)

RevokeAuthorizedApp handles DELETE /api/users/me/authorized-apps/{clientId}.

func (*Server) RevokePersonalAccessToken added in v0.60.0

func (s *Server) RevokePersonalAccessToken(w http.ResponseWriter, r *http.Request, id string)

RevokePersonalAccessToken handles DELETE /api/users/me/tokens/{id}.

func (*Server) RevokeProvisioningToken added in v0.63.0

func (s *Server) RevokeProvisioningToken(w http.ResponseWriter, r *http.Request, id string)

RevokeProvisioningToken handles DELETE /api/admin/provisioning-tokens/{id}.

func (*Server) RevokeShare added in v0.35.0

func (s *Server) RevokeShare(w http.ResponseWriter, r *http.Request, id string)

func (*Server) RotateOAuthClientSecret added in v0.60.0

func (s *Server) RotateOAuthClientSecret(w http.ResponseWriter, r *http.Request, clientId string)

RotateOAuthClientSecret handles POST /api/users/me/oauth-clients/{clientId}/rotate-secret.

func (*Server) RotateProvisionedUserToken added in v0.63.0

func (s *Server) RotateProvisionedUserToken(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

RotateProvisionedUserToken handles POST /api/provisioned-users/{id}/rotate-token.

func (*Server) RotateWebhook added in v0.61.0

func (s *Server) RotateWebhook(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

func (*Server) SaveArticle

func (s *Server) SaveArticle(w http.ResponseWriter, r *http.Request)

func (*Server) SaveDigest

func (s *Server) SaveDigest(w http.ResponseWriter, r *http.Request)

func (*Server) SaveGoalAsWorkflow added in v0.60.0

func (s *Server) SaveGoalAsWorkflow(w http.ResponseWriter, r *http.Request, id string)

func (*Server) SaveManifestPluginDefinition added in v0.63.2

func (s *Server) SaveManifestPluginDefinition(w http.ResponseWriter, r *http.Request, kind string, name string)

SaveManifestPluginDefinition writes one plugin's definition. `fields` names what this request takes ownership of on a builtin; an admin-added plugin has no definition underneath it, so the body is the whole plugin.

func (*Server) SearchCliToolRegistry added in v0.45.0

func (s *Server) SearchCliToolRegistry(w http.ResponseWriter, r *http.Request, params apiserver.SearchCliToolRegistryParams)

SearchCliToolRegistry searches the mise tool registry so the UI can add a CLI tool by picking a name instead of hand-writing its mise backend key.

func (*Server) SearchSkills

func (s *Server) SearchSkills(w http.ResponseWriter, r *http.Request, params apiserver.SearchSkillsParams)

SearchSkills handles GET /api/skills/search?q=<query>&limit=<n>.

func (*Server) SendEmail added in v0.43.0

func (s *Server) SendEmail(w http.ResponseWriter, r *http.Request, params apiserver.SendEmailParams)

SendEmail handles POST /api/email/send.

func (*Server) SendGroupMessage added in v0.43.0

func (s *Server) SendGroupMessage(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) SendSessionMessage

func (s *Server) SendSessionMessage(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) SetManifestPluginEnabled added in v0.63.2

func (s *Server) SetManifestPluginEnabled(w http.ResponseWriter, r *http.Request, kind string, name string)

SetManifestPluginEnabled toggles one plugin without touching its definition.

func (*Server) SetOAuthProviderConfig

func (s *Server) SetOAuthProviderConfig(w http.ResponseWriter, r *http.Request, id string)

SetOAuthProviderConfig handles PUT /api/admin/oauth-providers/{id}/config.

func (*Server) SetProfileMemory

func (s *Server) SetProfileMemory(w http.ResponseWriter, r *http.Request, agentID string)

SetProfileMemory handles PATCH /api/users/me/memories/{agentID}.

func (*Server) SetProfileSoul

func (s *Server) SetProfileSoul(w http.ResponseWriter, r *http.Request, agentID string)

SetProfileSoul handles PATCH /api/users/me/soul/{agentID}.

func (*Server) SetScopedVaultEntry added in v0.48.0

func (s *Server) SetScopedVaultEntry(w http.ResponseWriter, r *http.Request, name string)

SetScopedVaultEntry handles PUT /api/vault/{name}.

func (*Server) SetUserMemory

func (s *Server) SetUserMemory(w http.ResponseWriter, r *http.Request, id string, agentID string)

func (*Server) StartOAuthFlow

func (s *Server) StartOAuthFlow(w http.ResponseWriter, r *http.Request, provider string)

StartOAuthFlow handles POST /api/users/me/oauth/{provider}/start.

func (*Server) StartWeixinQR

func (s *Server) StartWeixinQR(w http.ResponseWriter, r *http.Request)

StartWeixinQR initiates the WeChat QR login flow by requesting a QR code from the iLink API. Any authenticated user can call this. POST /api/channels/weixin/qr

func (*Server) StopSession added in v0.63.0

func (s *Server) StopSession(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

StopSession explicitly cancels an in-flight turn. Transport disconnects never call this endpoint; they only detach an SSE observer.

func (*Server) StreamSessionEvents added in v0.49.3

func (s *Server) StreamSessionEvents(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

StreamSessionEvents subscribes to a session's in-flight turn and streams its events read-only, regardless of who initiated the turn. This lets the web UI watch server-driven turns (scheduler/task/delegate) or a turn started in another tab in real time, since those turns carry no HTTP request of their own.

func (*Server) SubmitVerdict added in v0.49.4

func (s *Server) SubmitVerdict(w http.ResponseWriter, r *http.Request, id string)

SubmitVerdict appends a human verdict against a contract item and re-folds.

func (*Server) SyncManifestPlugins

func (s *Server) SyncManifestPlugins(w http.ResponseWriter, r *http.Request)

func (*Server) TogglePlugin

func (s *Server) TogglePlugin(w http.ResponseWriter, r *http.Request, kind string, name string)

func (*Server) TriggerSchedulerJob

func (s *Server) TriggerSchedulerJob(w http.ResponseWriter, r *http.Request, agentID string, jobID string)

func (*Server) UnarchiveGoal added in v0.49.4

func (s *Server) UnarchiveGoal(w http.ResponseWriter, r *http.Request, id string)

UnarchiveGoal restores an archived goal to default lists.

func (*Server) UnlinkProfileIdentity

func (s *Server) UnlinkProfileIdentity(w http.ResponseWriter, r *http.Request, id string)

UnlinkProfileIdentity handles DELETE /api/users/me/identities/{id}.

func (*Server) UpdateAgent

func (s *Server) UpdateAgent(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateAgentProviderCredential added in v0.61.0

func (s *Server) UpdateAgentProviderCredential(w http.ResponseWriter, r *http.Request, id string, providerId string)

UpdateAgentProviderCredential accepts a write-only key and delegates all validation, authorization, encryption, persistence, and invalidation to Agent Management. No request value is logged or used in an error response.

func (*Server) UpdateAgentSkill

func (s *Server) UpdateAgentSkill(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.UpdateAgentSkillParams)

func (*Server) UpdateAgentTool added in v0.60.0

func (s *Server) UpdateAgentTool(w http.ResponseWriter, r *http.Request, id string, toolName string)

func (*Server) UpdateArticle

func (s *Server) UpdateArticle(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateAuthUserActive

func (s *Server) UpdateAuthUserActive(w http.ResponseWriter, r *http.Request, id string)

UpdateAuthUserActive handles PATCH /api/users/{id}/active.

func (*Server) UpdateAuthUserAgents

func (s *Server) UpdateAuthUserAgents(w http.ResponseWriter, r *http.Request, id string)

UpdateAuthUserAgents handles PATCH /api/users/{id}/agents.

func (*Server) UpdateAuthUserRole

func (s *Server) UpdateAuthUserRole(w http.ResponseWriter, r *http.Request, id string)

UpdateAuthUserRole handles PATCH /api/users/{id}/role.

func (*Server) UpdateChannel

func (s *Server) UpdateChannel(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateEmbeddingSettings added in v0.50.3

func (s *Server) UpdateEmbeddingSettings(w http.ResponseWriter, r *http.Request)

UpdateEmbeddingSettings persists the embedding configuration. The change takes effect at runtime: the embedding service re-reads this config on its next query and backfill pass, so no restart is needed. The api_key is write-only — an omitted or empty key keeps the stored one, since the GET never echoes it back.

func (*Server) UpdateFeed

func (s *Server) UpdateFeed(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateFeedEntry

func (s *Server) UpdateFeedEntry(w http.ResponseWriter, r *http.Request, feedId string, id string)

func (*Server) UpdateGoal added in v0.49.4

func (s *Server) UpdateGoal(w http.ResponseWriter, r *http.Request, id string)

UpdateGoal applies a partial metadata edit (PATCH).

func (*Server) UpdateGroup added in v0.43.0

func (s *Server) UpdateGroup(w http.ResponseWriter, r *http.Request, groupId string)

func (*Server) UpdatePluginConfig

func (s *Server) UpdatePluginConfig(w http.ResponseWriter, r *http.Request, kind string, name string)

func (*Server) UpdateProfileKnowledge added in v0.60.0

func (s *Server) UpdateProfileKnowledge(w http.ResponseWriter, r *http.Request, agentID string, factID string)

UpdateProfileKnowledge handles PATCH /api/users/me/memories/{agentId}/knowledge/{factId}.

func (*Server) UpdateProject added in v0.34.0

func (s *Server) UpdateProject(w http.ResponseWriter, r *http.Request, agentID string, projectID string)

func (*Server) UpdateProvider

func (s *Server) UpdateProvider(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateSchedulerJob

func (s *Server) UpdateSchedulerJob(w http.ResponseWriter, r *http.Request, agentID string, jobID string)

func (*Server) UpdateScopedMCPServer added in v0.60.0

func (s *Server) UpdateScopedMCPServer(w http.ResponseWriter, r *http.Request, id string, params apiserver.UpdateScopedMCPServerParams)

UpdateScopedMCPServer handles PATCH /api/mcp/servers/{id}.

func (*Server) UpdateScopedSkill added in v0.48.0

func (s *Server) UpdateScopedSkill(w http.ResponseWriter, r *http.Request, id string)

UpdateScopedSkill handles PATCH /api/skills/{id}.

func (*Server) UpdateSession added in v0.46.0

func (s *Server) UpdateSession(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) UpdateUserDefaultAgent

func (s *Server) UpdateUserDefaultAgent(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateUserNotifyIdentity

func (s *Server) UpdateUserNotifyIdentity(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UpdateVisionSettings added in v0.61.0

func (s *Server) UpdateVisionSettings(w http.ResponseWriter, r *http.Request)

UpdateVisionSettings persists the vision model. The change takes effect on the next agent snapshot, so a running runner keeps its current model until it reloads.

func (*Server) UpdateWebhook added in v0.61.0

func (s *Server) UpdateWebhook(w http.ResponseWriter, r *http.Request, id openapi_types.UUID)

func (*Server) UpdateWorkspaceFileContent

func (s *Server) UpdateWorkspaceFileContent(w http.ResponseWriter, r *http.Request, agentID string, sessionID string, params apiserver.UpdateWorkspaceFileContentParams)

func (*Server) UpgradeAgentSkill added in v0.49.0

func (s *Server) UpgradeAgentSkill(w http.ResponseWriter, r *http.Request, id string, skillId string, params apiserver.UpgradeAgentSkillParams)

UpgradeAgentSkill re-fetches a DB-backed skill from its recorded install source and updates it in place when the source has a newer version. It is the check-and-update behind the inspector's "check for updates" button.

func (*Server) UploadAgentSkill

func (s *Server) UploadAgentSkill(w http.ResponseWriter, r *http.Request, id string)

func (*Server) UploadScopedSkill added in v0.48.0

func (s *Server) UploadScopedSkill(w http.ResponseWriter, r *http.Request)

UploadScopedSkill handles POST /api/skills/upload.

func (*Server) UploadWorkspaceFile

func (s *Server) UploadWorkspaceFile(w http.ResponseWriter, r *http.Request, agentID string, sessionID string)

func (*Server) WaiveEdge added in v0.49.4

func (s *Server) WaiveEdge(w http.ResponseWriter, r *http.Request, id string, upstreamId string)

WaiveEdge waives a hard edge so a blocked(dep) downstream can proceed.

func (*Server) WebhookIngressHandler added in v0.60.0

func (s *Server) WebhookIngressHandler() http.Handler

WebhookIngressHandler returns the capability-authenticated inbound webhook ingress handler. The composition root mounts it behind the capability reservation at the HTTP root, in front of the admin middleware chain, because the opaque URL capability (not a session or Authorization header) is the sole credential: the webhook module resolves and revalidates the resource's fixed owner→Agent authority, so any Authorization header is ignored and the handler must never be wrapped by the session authMiddleware. It stays in internal/server, with its Server-field dependencies, because it is transport code — not a plugin implementation.

type WeixinQRCode added in v0.60.0

type WeixinQRCode struct {
	QRCode           string `json:"qrcode,omitempty"`
	QRCodeImgContent string `json:"qrcode_img_content,omitempty"`
}

WeixinQRCode is the server-local result of a WeChat (iLink) QR-code request. Its JSON tags mirror the wire contract the QR endpoints have always emitted so the HTTP response body is unchanged after routing through the registrar port.

type WeixinQRCodeStatus added in v0.60.0

type WeixinQRCodeStatus struct {
	Status      string `json:"status,omitempty"`
	BotToken    string `json:"bot_token,omitempty"`
	ILinkBotID  string `json:"ilink_bot_id,omitempty"`
	ILinkUserID string `json:"ilink_user_id,omitempty"`
	BaseURL     string `json:"baseurl,omitempty"`
}

WeixinQRCodeStatus is the server-local result of a WeChat (iLink) QR-code scan poll. Its JSON tags mirror the existing wire contract for PollWeixinQRStatus.

type WeixinRegistrar added in v0.60.0

type WeixinRegistrar interface {
	// GetQRCode requests a fresh login QR code from the iLink API.
	GetQRCode() (WeixinQRCode, error)
	// GetQRCodeStatus polls the scan status of a previously issued QR code.
	GetQRCodeStatus(qrcode string) (WeixinQRCodeStatus, error)
}

WeixinRegistrar is the narrow port the WeChat registration/QR handlers use to reach the iLink API. The concrete adapter lives in the composition root (it wraps the weixin plugin's client), so internal/server never imports the plugin. Results are mapped to the server-local types above at the boundary.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL