Repository navigation
refactor: native domains and bounded account bulk operations - #202
Merged
Merged
Conversation
The release-pinned official model capacity catalog and its product-scoped resolver now live in backend/internal/service instead of the model-policy plugin process. Capacity lookups resolve the official catalog in process and merge any remaining plugin catalog (Cindy) with the plugin manager rule: different capacities are ambiguous, otherwise the later equal entry wins. The admin catalog browser becomes a native settings panel backed by GET /api/v1/admin/settings/model-context-catalog. The plugin module, its bundle entry, go.mod replace and process contract test are removed; its three catalog tests move to the service package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e pages Image request policy (native Cindy image validation, Responses image bridge planning, Image Studio request plans and model choices) now runs in process instead of the image-tools plugin. The Image Studio and bridge switches live in the image_tools_config setting, fall back to the deploy-time rollout flags, load at startup, and are edited through a native settings panel (GET/PUT /api/v1/admin/settings/image-tools). Switching Image Studio off still cancels running executions, as the plugin policy lease did. The Image Studio page becomes a native view: the plugin Vue page moves to frontend/src/features/image-studio and calls the host routes through a native resource() with the same signature. The routes lose their plugin resource admission, the sidebar and route guard follow the public image_studio_enabled flag, and the plugin module, bundle entry, go.mod replace and process contract test are removed. Plugin-boundary privacy tests are dropped; policy tests move to the service package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…estore upstream Prompt Audit Account traffic telemetry no longer asks the admin-observability plugin for its policy. The telemetry and flat theme switches live in the admin_observability_config setting (default: the legacy gateway flag, theme on), load at startup and are edited through a native "Appearance and observations" panel (GET/PUT /api/v1/admin/settings/observability). The outcome rules are a static in-process table. The plugin's account-details traffic view was never rendered by the host, so no page replaces it; the existing GET /admin/accounts/:id/traffic-telemetry route stays. The flat theme and the MiSans fonts are bundled natively again (frontend/src/styles/flat-theme.css, frontend/src/assets/fonts/misans). The theme applies while <html> carries the flat-theme class, which follows the new public flat_theme_enabled setting and is set before mount from the injected config, so there is no flash. Upstream v0.2.8 ships Prompt Audit as a native page. Its files are restored (api.ts, types, EventDetailDialog, locales, route registration, sidebar entry) and only the improvements made while it lived in the plugin are kept: request generations and unmount guards, reconcileSavedDraft, the awaited delete confirmation, flat-theme class tweaks and a sticky save bar. The fork-only /admin/prompt-audit/groups route and group_plugin_options.go are removed; the page lists groups through /admin/groups/all as upstream does. The plugin module, bundle entry, go.mod replace, process contract test and the manifest fixture test are removed. A small JSON setting helper is shared with the image tools setting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The prompt application and skill registry policy moves from the prompt-skills plugin process into backend/internal/promptskills (policy, registry, source, including the embedded skill seed). The host calls it in process through invokePromptSkills; the account-scoped plan path, prompt management, source sync, seed loading and availability checks no longer go through the plugin manager, and the source fetch and skill sync lose their plugin execution binding. The 27 system prompt routes drop their plugin resource admission. The management page, advanced drawer, rules manager and account binding panel become native views again (views/admin/SystemPromptsView.vue, components/admin/systemPrompt, AccountPromptBindingPanel.vue). They use the existing admin system prompts API module and a new systemPromptRules API, and their messages return to the host locale modules removed in fe89731. The account action menu and bulk bar get a native "Account prompts" entry for the same OpenAI/Cindy accounts the plugin action accepted. The read-only plugin settings card that only showed the two fixed size limits is not recreated. Tests that asserted plugin rollout or lifecycle semantics are removed; the account failover, carrier restore and registry-profile limit tests now drive per-account decisions through invokePromptSkills. The .gitattributes LF rules and the release/verify workflow paths follow the seed to its new location, and the seed scripts directory keeps its .gitignore exception. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…manager model-policy was the only plugin that declared a model catalog, and it now resolves in process. The capacity lookup still asked the plugin manager first, so an unavailable plugin registry (for example a bundle that fails version admission) would also hide the built-in official catalog. The lookup now answers from the official catalog alone; the unused match merge helper and the host-lookup rollout test for plugin catalogs are removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The server started the Image Studio runtime only when the feature was on at boot, so enabling it later from the settings panel queued jobs that never ran until a restart. The server now registers the runtime start with the image tools switches, and switching Image Studio on starts it (a running runtime is left alone). Workers still refuse claims while the feature is off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removing the prompt-skills process test in b821bdb also cut the adjacent Cindy provider test. cindy-provider is still a bundled plugin and the plugin CI script still selects this test by name, and an unmatched -run pattern passes silently, so the coverage would have disappeared unnoticed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Switching Image Studio off now also cancels in-flight upstream image IO. That IO detaches from request cancellation and only honours policy signals, so the studio switch is registered as one, as the plugin policy lease was; before, the upstream kept running and was billed while the result could no longer be saved. - Saving the image tools or observability switches invalidates the served HTML public settings, and both panels refresh the public settings, so the Image Studio entry and the flat theme follow the saved value on reload. - The two settings endpoints reject unknown keys and non-boolean values like the former plugin validators, and their GET returns the switches this process applies. A failed settings read is logged instead of silently looking like an unset key. - Prompt Audit keeps upstream's rounded-* classes; the flat theme already zeroes the radius, so only the dark-mode contrast fixes stay different. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The account-tools policy package moves verbatim to backend/internal/accounttools/policy and is invoked in process through invokeAccountTools. Classification, batch test, test prompt/reasoning and import planning keep their validation, but no longer depend on a plugin process, binding or rollout. - Routes for folders, tags, taxonomy, batch tests and data import are plain admin routes again; the resource admission wrappers are gone. - Import, batch test and bulk classification jobs ignore a plugin owner recorded before the upgrade and run with the host executor; the unused owner plumbing between plans, handlers and job submission is removed. - The account import dialog is restored from upstream v0.2.8 with our folder/tag assignment and job extensions; taxonomy manager, folder bar, bulk classification, batch test and test prompt/reasoning controls are native host components again. - The plugin directory, bundle entry, go.mod replace, CI test binary and the plugin-frame layout checker are removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Sep 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Account bulk editing could apply filters to the whole list while rows were selected, and a late select-all response could overwrite a newer manual selection. This change keeps bulk operations as HTTP 202 background jobs and confines selected operations to their captured account IDs; invalid nonempty ID lists cannot fall back to filters. Filtered submissions retain their original JSON for idempotent replay, while each worker receives only its frozen account target.
The seven first-party domains now run in the host with native Vue pages. Existing Cindy fields, folders/tags, draft protection, progress/retry, flat theme and MiSans remain. The upstream third-party plugin framework remains available, with the retired first-party installation records protected from reuse or deletion.
Implementation and compatibility:
Local validation:
Required PR checks remain the merge gate. A legacy-plugin-host rollback additionally needs explicit compatibility restoration; it is not an automatic image-only fallback. Local comparison against
.4reports onlybackend/migrationschanged (migration 254); the moved prompt/skill tree hashes are identical. The existing preserve-rollback guard therefore does not authorize a.4downgrade. Details:.downstream/native-domains.md.