Repository navigation

feat(agent): RSS-first production auth and workspace sessions - #4

Draft

fffonion wants to merge 169 commits into

feat/production-auth-workspace

Draft

feat(agent): RSS-first production auth and workspace sessions#4
fffonion wants to merge 169 commits into
masterfrom
feat/production-auth-workspace

Commits on Sep 29, 2026
Commits on Sep 30, 2026
Commits on Oct 1, 2026
- fix(auth): propagate owner cancellation to PKCE browser
  fffonion
  committed
  abf62cb
- feat(auth): bridge OAuth code verifier transport
  fffonion
  committed
  eda46e4
- fix(auth): reclaim inactive code flow on admission errors
  fffonion
  committed
  b9cc183
- feat(auth): add typed device-session transport resources
  fffonion
  committed
  ad0494b
- test(auth): align device transport cleanup contract
  fffonion
  committed
  9a55dc4
- test: align HTTP migration lexical scanner
  fffonion
  committed
  c6b17de
- Integrate approved OAuth timing and public JSON primitives
  fffonion
  committed
  25d6ed8
- feat(auth): add bounded secret request body encoder
  fffonion
  committed
  f1bf34c
- auth: capture opaque OAuth exchange pairs natively
  fffonion
  committed
  f5949c3
- Reject raw redirect userinfo delimiters
  fffonion
  committed
  f7f1150
- fix(auth): preserve public JSON number lexemes
  fffonion
  committed
  1104aac
- auth: integrate native device exchange prerequisites
  fffonion
  committed
  810b0eb
- Wire native selected OAuth request payloads
  fffonion
  committed
  01d189c
- fix(auth): reclaim admitted families on selected-body rejection
  fffonion
  committed
  11fef8d
Commits on Oct 2, 2026
- Add native exchange-pair VM resources
  fffonion
  committed
  7c4ab31
- feat(auth): bridge typed selected OAuth payloads
  fffonion
  committed
  e0168a5
- Integrate reviewed Task5 typed OAuth VM prerequisites
  fffonion
  committed
  1da8512
- feat(auth): add typed transport capture bridge
  fffonion
  committed
  53b027b
- test(auth): cover capture rollback and terminal lifecycle failures
  fffonion
  committed
  7b7a648
- feat(auth): admit explicit single-credential enrollment
  fffonion
  committed
  30e59f4
Commits on Oct 3, 2026
- auth: expose fallible RSS results and scoped cleanup
  fffonion
  committed
  9e68b6b
- test(auth): cover native capture and exchange failure rollback
  fffonion
  committed
  41f38db
Commits on Oct 4, 2026
- feat(auth): implement native-backed codex device rss login
  fffonion
  committed
  7d46684
- test(auth): exercise codex rss device login state machine
  fffonion
  committed
  77eaa93
- test(auth): cover device login evidence gaps
  fffonion
  committed
  a9cfbdc
- refactor(auth): remove unused device login helpers
  fffonion
  committed
  5e37a11
- Add native auth command snapshot results
  fffonion
  committed
  cd7986a
- feat(auth): compile closed RSS source bundles
  fffonion
  committed
  f1f3f82
- fix(auth): keep command diagnostics read-only
  fffonion
  committed
  02f99f5
- fix(auth): resolve qualified relative bundle imports
  fffonion
  committed
  0e4aed9
- feat(cli): add independent bounded native shell
  fffonion
  committed
  7baaadf
- feat(auth): add RSS admin command policy
  fffonion
  committed
  7a0fc1f
- fix(cli): respect option value positions
  fffonion
  committed
  cd12813
- Merge RSS admin policy and native CLI shell
  fffonion
  committed
  1671727
- feat(cli): wire RSS admin commands and cancellation
  fffonion
  committed
  34454b9
- fix(cli): fail closed when ctrl-c setup fails
  fffonion
  committed
  753ec51
- feat(auth): add bounded device instruction queue
  fffonion
  committed
  828304b
- fix(auth): observe direct OAuth cancellation tokens
  fffonion
  committed
  39051fd
- test(cli): remove descriptor-only coverage and normalize fixtures
  fffonion
  committed
  365db76
- test(auth): exclude fixture preparation from CPU helper deadline
  fffonion
  committed
  fb0625a
- Add native config-path host foundation
  fffonion
  committed
  ed40f09
Commits on Oct 5, 2026
- Route real config path through typed RSS report and no-store host
  fffonion
  committed
  8d81b81
- test(auth): durable executable config-path acceptance and exact malformed-report rejection
  fffonion
  committed
  6ce2f40
- test(auth): durable S1 executable config-path assertions (round2)
  fffonion
  committed
  b79866b
- fix(auth): sample owner flags once for path admission snapshot consistency
  fffonion
  committed
  5a18751
- Add configured-login auth admission
  fffonion
  committed
  2f4d371
- test(auth): cover configured existing login generation
  fffonion
  committed
  fc383fe
- Preserve legacy Codex callback compatibility
  fffonion
  committed
  ba1ca69
- test: cover RSS login admission and public queue limits
  fffonion
  committed
  67841b7
- test: exercise RSS login through configured auth factory
  fffonion
  committed
  509a3ac
- feat(auth): acknowledge native device output
  fffonion
  committed
  d9e6d6e
- fix(auth): cfg-gate native device output
  fffonion
  committed
  1dcd129
- fix(auth): select bundle entry from root export
  fffonion
  committed
  7254bfb
- feat(auth): integrate acknowledged output and bundled login
  fffonion
  committed
  47b06fa
- feat(cli): wire native OAuth into auth login
  fffonion
  committed
  81b5337
- test(auth): cover native HTTPS login composition
  fffonion
  committed
  61a67ca
- test: fix cfgtest clippy warnings
  fffonion
  committed
  4e923a9
- feat(auth): add owned native callback sessions
  fffonion
  committed
  48429ed
- feat(auth): project configured public OAuth data
  fffonion
  committed
  9f3206d
- fix(auth): zeroize native callback read buffer
  fffonion
  committed
  cc90afe
- merge: integrate native callbacks and public OAuth config
  fffonion
  committed
  c94a739
- feat(auth): admit native callback bridge
  fffonion
  committed
  951ca84
- auth: add owned Linux browser launcher
  fffonion
  committed
  e336785
- Add bounded private native callback input
  fffonion
  committed
  3f74a3a
- merge: compose accepted native browser mechanism
  fffonion
  committed
  c806b32
- merge: compose accepted private manual mechanism
  fffonion
  committed
  f3e832a
- feat(auth): add typed callback result APIs
  fffonion
  committed
  6e85baf
- Add native composite OAuth callback inputs
  fffonion
  committed
  aa5301e
- feat(auth): queue capability-derived OAuth instructions
  fffonion
  committed
  63215c4
Commits on Oct 6, 2026
- merge: compose accepted typed callback results and native inputs
  fffonion
  committed
  b9c0120
- test(auth): cover RSS instruction failure branches
  fffonion
  committed
  f2e2b4e
- test(auth): verify native callback result composition
  fffonion
  committed
  1399913
- Add RSS PKCE session consumer tests
  fffonion
  committed
  c6d2dbb
- Merge commit 'c6d2dbb31923ba393d3200f72640676c553c4629' into HEAD
  fffonion
  committed
  cff702f
- Merge commit 'f2e2b4e7dd5f43016c114077290ef96cef3a6903' into HEAD
  fffonion
  committed
  c6ef5af
- test(auth): prepare owner-independent catalog before short deadline
  fffonion
  committed
  ad21c03
- Fix strict parsing of native OAuth responses
  fffonion
  committed
  ff3078b
- Add typed RSS token metadata transport parsing
  fffonion
  committed
  76a8b5a
- Add PKCE authorization instruction session
  fffonion
  committed
  18cb99b
- test(auth): qualify native PKCE cancellation cleanup
  fffonion
  committed
  2da0c49
- Add Linux bounded native authorization-instruction output and queue worker
  fffonion
  committed
  eb05e23
- Fix native authorization output signal and cancellation handling
  fffonion
  committed
  ce9c85f
- Add captured OAuth code generation bridge
  fffonion
  committed
  bacd051
- Add RSS token save result validation
  fffonion
  committed
  988eedc
- test(auth): cover native secret slot kind rejection
  fffonion
  committed
  9c18593
Commits on Oct 7, 2026
- Complete configured RSS PKCE login and native CLI delivery
  fffonion
  committed
  a903e16
- build: optimize pinned compiler in development profiles
  fffonion
  committed
  f1dbba4
- Preserve canonical request model in public profiles
  fffonion
  committed
  29bd99b
- Bind native auth hosts per RSS invocation
  fffonion
  committed
  53f085a
- test: verify native auth binding lifecycle
  fffonion
  committed
  7fd82b3
- Add bounded native HTTPS streaming API
  fffonion
  committed
  ab3febe
- test(auth): verify native stream socket closure
  fffonion
  committed
  ee4ae66
- Guard live auth resources at provider JSON boundary
  fffonion
  committed
  0d0d45c
- Implement RSS opaque buffered auth bridge
  fffonion
  committed
  d3c976d
- test: prove provider guard preserves native auth resources
  fffonion
  committed
  a66f7a3
- Merge commit 'a66f7a32c21a228fcea93d144b9463a43b5fa20f' into subagent/task7-buffered-guard-composition-1432c541
  fffonion
  committed
  535ea5f
- fix(provider): preserve public native metadata failures
  fffonion
  committed
  896d485
- feat: add opaque OpenAI Chat buffered adapter
  fffonion
  committed
  a134462
- fix(llm): preserve absent opaque metadata failure response
  fffonion
  committed
  06c0a3f
- Compose authenticated streaming, fallible access and RSS default dispatch
  fffonion
  committed
  9424ca8
- feat(auth): compose accepted access refresh and sanitized stream prerequisites
  fffonion
  committed
  41f7cae
Commits on Oct 8, 2026
- feat(auth): complete RSS opaque refresh transaction
  fffonion
  committed
  ccc70d1
- fix(auth): reject explicit null refresh token type
  fffonion
  committed
  8a1e2b1
- Task7: pure RSS OpenAI Chat public stream body and delta/DONE/EOF codec
  
  subagent
  authored and
  fffonion
  committed
  f3b2eaa
- style(llm): use edition 2024 codec test import ordering
  fffonion
  committed
  6d35d6d
- task7: guest sanitized authenticated stream binding + finish coverage
  fffonion
  committed
  f66f08d
- test(auth): prove foreign stream handle rejection
  fffonion
  committed
  48dc0e0
- rss: opaque OpenAI Chat streaming with counted stream regression suites
  fffonion
  committed
  546bc87
- task7: retire legacy RSS raw transport, migrate provider regressions to native auth
  fffonion
  committed
  d6f3d92
- test(rss): compile discovered corpus with exact host catalogs
  fffonion
  committed
  011e0a2
- task7: forward public credential_id in serial-loop provider requests
  fffonion
  committed
  63ec182
- task7: refresh expired OAuth before provider transport
  fffonion
  committed
  f610b2c
- test(task7): strengthen authenticated tool follow-up history and per-send model assertions
  fffonion
  committed
  2425326
Commits on Oct 9, 2026
- Integrate native auth with durable service provider
  fffonion
  committed
  4a15154
- fix(service): preserve provider timestamps across durable reopen
  fffonion
  committed
  290d409
- test(provider): compose accepted service durable and refresh scopes
  fffonion
  committed
  a18c7bd
- runtime: prepare default provider dispatcher
  fffonion
  committed
  947fb8c
- Prepare default provider dispatcher in service host
  fffonion
  committed
  2589e73
- Separate auth-only default provider construction
  fffonion
  committed
  47e7440
- build(agent): optimize embedded compiler in development
  fffonion
  committed
  a72f522
- feat(agent): add rss source selection policy
  fffonion
  committed
  2aa51fd
- test(agent): cover unicode source policy boundaries
  fffonion
  committed
  ed91101
- task9: compile-time embedded RSS resource catalog primitive
  hermes-agent
  committed
  7a4b48f
- style(packaging): trim embedded source catalog commentary
  fffonion
  committed
  d8b97dd
- test(auth): supply complete login import closure in bundle fixture
  fffonion
  committed
  2e73c1e
- runtime: extract generic closed-bundle compiler primitive
  fffonion
  committed
  54bb609
- Prove supplied closed bundle catalog native binding
  fffonion
  committed
  3f1b1c1
- task9: bundle embedded RSS runtime consumers over existing compiler
  fffonion
  committed
  9c3230d
- Bind admitted bundled callable and remove formal resource probes
  fffonion
  committed
  fd8a3e5
- task9: consume native bundled agent source through the RSS policy
  fffonion
  committed
  faa72e2
- task9: bound native policy replies and exercise bundled cache admission
  fffonion
  committed
  1906624
- task9: admit non-UTF8 selected source tokens through the RSS policy
  task9-subagent
  committed
  40241fe
- test(gateway): guard encoded-source child cleanup and privacy
  fffonion
  committed
  a0a7dc3
- task9: correct inherited default-gateway SSE auth contract expectations
  fffonion
  committed
  179a2f9
- storage: capture a coherent load.all snapshot via bounded TEMP staging
  
  task9-storage
  authored and
  fffonion
  committed
  ae6cc0d
- fix(storage): guard bounded snapshot regression process lifecycle
  fffonion
  committed
  de816cd
Commits on Oct 10, 2026
- docs: source-ground packaged setup and migration documentation
  fffonion
  committed
  c468ffd
- docs: use bundled source in gateway examples
  fffonion
  committed
  07aa274
- Complete scoped Codex Responses access path
  fffonion
  committed
  b59da88
- Keep strict depth bounds for Responses SSE
  fffonion
  committed
  63057b9
- Bound SSE JSON containers and assert canonical access output
  fffonion
  committed
  ee89a3b
- test: verify canonical Responses persistence
  fffonion
  committed
  a879d17
- fix: reject empty Responses completions
  fffonion
  committed
  eb857c9
- Fix Responses refusal text extraction and regressions
  fffonion
  committed
  be0cc07
- Add bounded live Responses shape diagnostics
  fffonion
  committed
  9d81cf1
- fix(rss): reconstruct compact completed outputs
  fffonion
  committed
  8650c7a
- Merge validated access-only Responses provider
  fffonion
  committed
  19603db
- Complete workspace session binding integration
  fffonion
  committed
  b8d46bd
- test: authorize lifecycle effects in private workspace
  fffonion
  committed
  6a68f4c
- Fix RSS workspace replay identity and transactional admission; verify consumers and bootstrap
  fffonion
  committed
  77f5ceb
- Fix documentation fixture compatibility with typed workspace config
  fffonion
  committed
  c7e931e
- style(workspace): align named-root validation formatting
  fffonion
  committed
  1d48f40