feat: agent-aware links & agent_id in API responses (v4.6.0 / v4.6.1) - #104
Merged
Conversation
Notification links (email / Telegram) now include ?agent_id=X so that clicking them activates the correct agent context directly – even after session expiry, because the login-redirect preserves the parameter. - New agent endpoint PUT /settings/web-identity stores the web container's public URL and agent ID in agent_settings (section "web") - MailNotifier and TelegramNotifier read web.web_url / web.web_agent_id from the DB-backed config and append ?agent_id=X to all links - WEB_URL moves from the agent container to the web container (app.web_url in config.json); agents receive the value via push - AgentIdentityPusher pushes identity on web startup, agent create/update/select; BaseController::selectedAgent() auto-switches the session agent from ?agent_id= URL parameters - GET /api/v1/agents response gains web_url field - GET /api/v1/settings returns the new web section (read-only via API) - Tests: WebIdentityEndpointTest (9), NotificationUrlBuilderTest (8), 3 new cases in AgentsApiControllerTest; 288/288 green
Fixes 6 security advisories reported 2026-07-20 (all affecting <7.15.1): cookie disclosure/injection, URI fragment leaks in Referer, unbounded response cookies (DoS), host-only cookie scope bypass, Proxy-Authorization header leakage. The constraint ^7.8 in composer.json already allows this version; only composer.lock updated.
Job IDs are only unique per agent, not globally. Without agent_id context, shared links and API consumers cannot reliably identify which agent a job belongs to. - REST API: every agent-specific endpoint (jobs, maintenance, export/json, audit, settings, timeline, tags) now includes "agent_id" as the first field in its response. BaseApiController stores resolvedAgentId in agentClient() and controllers inject it via array_merge. - UI links: all internal links in layout, cron list/detail/form/ monitor/import/transfer, dashboard, timeline, audit, maintenance list/form, housekeeping and error templates now carry ?agent_id=X when an agent is active. Controller redirects use new BaseController::agentPath() helper. - Pagination and filter-reset links preserve agent_id via $agParam prefix pattern in list templates. - API.md: §5 documents the agent_id field; all response examples updated; §19 changelog entry for v4.6.1. - CHANGELOG.md: v4.6.1 entry added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
?agent_id=X, Web-Container pusht seine Identität an alle Agents (PUT /settings/web-identity),BaseController::selectedAgent()liest$_GET['agent_id']für Login-Redirects nach Session-Ablaufagent_idals erstes Feld in allen agent-spezifischen API-Antworten (Jobs, Maintenance, Export, Audit, Settings, Timeline, Tags); alle UI-Links (Sidebar, Breadcrumbs, Paginierung, Filter-Reset, Dashboard-Failure-Links) tragen?agent_id=X; Controller-Redirects nutzenagentPath()Motivation
Job-IDs sind nur pro Agent eindeutig, nicht global. Ohne
agent_id-Kontext landen geteilte Links, Benachrichtigungs-E-Mails und API-Antworten im Multi-Agent-Betrieb beim falschen Agent.Test plan
?agent_id=Xdurch Navigation