Skip to content

feat(config): #770 curated env section projection + control metadata - #1344

Open
mindfn wants to merge 1 commit into
zts212653:mainfrom
mindfn:fix/770-section-projection
Open

feat(config): #770 curated env section projection + control metadata#1344
mindfn wants to merge 1 commit into
zts212653:mainfrom
mindfn:fix/770-section-projection

Conversation

@mindfn

@mindfn mindfn commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

Implements the contract-only slice of clowder-ai#770: the canonical module-level env section projection and control metadata for curated System / module settings.

  • Rebased onto post-fix(#770): mark dead configs deprecated + restore owner trust-anchor to curated System view #1340 main (ffa2af696).
  • Trims MODULE_SECTION_PROJECTION to 42 non-system vars across 7 sections, removes empty mcp/concierge buckets, and adds the new plugins section.
  • Adds fail-closed control metadata for vars that are currently editable but should be read-only / opt-in editable in the curated UI.
  • Syncs ENV_SECTION_KEYS / ENV_SECTION_LABELS and updates env-registry tests.
  • Adds the reviewable inventory/rationale as docs/plans/770-env-config-inventory.md (locked digest 8b263ab09f33546a2a7be74f1ea15992ee57ac537064bcf4c5658efca429916d) so the 42-variable section ownership contract can be independently checked.

Scope boundary

This PR is intentionally contract-only, consistent with the staged #770 plan:

  • It defines which non-system vars belong to which module section.
  • It defines the control type / write-policy metadata that the future renderer will consume.
  • It does not wire new API surface parameters beyond surface=system, nor does it implement module UI cards/settings sections.

API/query consumers and module UI wiring are planned as follow-up slices under #770 and will reference this contract as the source of truth.

Follow-up tracking

Verification

  • pnpm --filter @cat-cafe/api build
  • pnpm --filter @cat-cafe/api lint
  • env-registry test: 92/92 pass ✅
  • pnpm check

Closes #770.

@mindfn
mindfn requested a review from zts212653 as a code owner August 12, 2026 11:29

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c34f4b1139

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* Module summaries are derived from the canonical `buildEnvSummary()` so that
* masking and visibility policy stay in one place.
*/
export function buildSectionEnvSummary(section: string): Array<EnvDefinition & { currentValue: string | null }> {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Wire the section projection into the product path

In the inspected target tree, repo-wide search finds buildSectionEnvSummary and the new projection exports referenced only by tests. routes/config.ts:272-284 still recognizes only surface=system and otherwise returns the full buildEnvSummary(), while SettingsContent.tsx:208-214 still mounts HubEnvFilesTab, which fetches the unscoped endpoint. Consequently none of the new module projections can be requested or displayed, and the System page continues showing the full registry despite this commit claiming to complete the curated, fail-closed migration; wire these projections through the endpoint and their corresponding settings sections.

Useful? React with 👍 / 👎.

@zts212653 zts212653 added enhancement New feature or request triaged Maintainer reviewed, replied, and made an initial triage decision labels Aug 12, 2026
@zts212653

Copy link
Copy Markdown
Owner

Maintainer direction: WELCOME into exact-HEAD formal review, but this is not merge approval.

The direction is anchored by accepted clowder-ai#770, with clowder-ai#1280 and clowder-ai#1340 already merged as its preceding slices. At current HEAD c34f4b1139b99dec0b37ba03e44dda542a82210b, the source risk classifier reports no 1224-class migration; env-registry.ts remains a high-risk/manual-port intake surface.

Three items need to be resolved in the review round:

  1. env-registry.test.js duplicates the existing clowder-ai#1340 deprecated metadata and DEFAULT_OWNER_USER_ID suites, inflating the focused count and reintroducing the already-corrected statement that MODE_SWITCH_REQUIRES_APPROVAL had “no consumer ever existed.” Keep the corrected fix(#770): mark dead configs deprecated + restore owner trust-anchor to curated System view #1340 provenance and remove the duplicate suites; the current PR should add only its new section/control contracts.
  2. The core 42-variable ownership map cites docs/plans/770-env-config-inventory.md plus digest dd91bc…, but that artifact is not present in the public target tree or linked from clowder-ai#770. Put the reviewable inventory/rationale in the PR or issue so the section ownership contract can be independently checked; a digest without the artifact is not provenance.
  3. Keep this slice contract-only, consistent with the staged clowder-ai#770 plan. Explicitly state that API/query consumers and module UI wiring are a later slice, link the follow-up tracking anchor, and resolve the current inline review concern on that basis. Do not widen this PR into seven UI migrations.

The public test check is still running. External author mindfn retains fix custody; the next step is formal review of the current or updated exact HEAD, followed by terminal CI. Merge remains separately gated.

[小太阳·砚砚/GPT-5.6 Sol🐾]

@mindfn
mindfn force-pushed the fix/770-section-projection branch from c34f4b1 to a4aeed4 Compare August 12, 2026 11:54
@mindfn

mindfn commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks for the formal review direction. All three items addressed in the updated HEAD a4aeed4b6:

  1. Removed duplicate test suites — the first #770: deprecated metadata and #770: DEFAULT_OWNER_USER_ID trust-anchor projection blocks (which still carried the stale “no consumer ever existed” wording) were deleted; the corrected fix(#770): mark dead configs deprecated + restore owner trust-anchor to curated System view #1340 provenance blocks remain.

  2. Added reviewable inventorydocs/plans/770-env-config-inventory.md is now part of this PR with required frontmatter. It pins the baseline / overlay SHAs and contains the full 42-variable section ownership contract, coverage evidence, and sync delta from ff67390aa.

  3. Scope explicitly contract-only — updated PR body and this comment state that API/query consumers and module UI wiring are follow-up slices under Proposal: narrow System env settings and move connector/service config to owner stores #770. This PR only establishes the allowlist/metadata contract; it does not migrate seven UI surfaces.

Re: the inline Codex comment on routes/config.ts / SettingsContent.tsx — acknowledged. Wiring buildSectionEnvSummary(section) into the endpoint and mounting per-module settings sections is intentionally out of scope here and will reference this contract as the source of truth.

Verification re-run after changes:

  • pnpm --filter @cat-cafe/api build
  • pnpm --filter @cat-cafe/api lint
  • env-registry test: 88/88 pass ✅
  • pnpm check

@mindfn
mindfn force-pushed the fix/770-section-projection branch from a4aeed4 to 3b83cdc Compare August 12, 2026 12:12
@mindfn

mindfn commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@chatgpt-codex-connector 返修已 push(HEAD 3b83cdc82)。

本轮变更:

  • targetWritePolicy: 'read-only-opt-in' 元数据 + fail-closed gate:isEditableEnvVar 在有 policy 且非 editable 时直接返回 false,覆盖 runtimeEditable
  • 对 6 项应用 read-only-opt-in:WEIXIN_VOICE_ITEM_MODEWEIXIN_ENABLE_UNSAFE_VOICE_MODESWEIXIN_CAPTURE_INBOUND_VOICE_MEDIAGITHUB_WEBHOOK_SECRETGITHUB_SELF_LOGINF102_API_KEY
  • 新增 PATCH /api/config/env 拒绝回归测试,确保这 6 项从 Hub 写入被拒且 .env 不被修改。
  • 新增 exact allowlist 回归测试:MODULE_SECTION_PROJECTION 与锁定盘点表 7 sections 逐项相等;ENV_SECTION_KEYS exact set。
  • F102_API_KEY 不再被识别为 sensitive-editable,直到 accounts consumer cutover 完成。

验证(在 PR 分支 worktree 运行):

  • pnpm --filter @cat-cafe/api build
  • pnpm --filter @cat-cafe/api lint
  • env-registry 测试 92/92 pass ✅
  • pnpm check

请基于新 HEAD 做 delta review。

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 3b83cdc828

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

… curated env UI

Why:
- The System Settings tab currently shows the full env registry via
  HubEnvFilesTab. We need a fail-closed section projection so module-level
  configuration can migrate to module pages while the System tab shows only
  curated system vars.
- Directory-type vars and LOG_LEVEL need explicit UI control hints so the
  frontend can render directory pickers and dropdowns instead of plain text.

What:
- Add packages/api/src/config/env-sections.ts with MODULE_SECTION_PROJECTION
  for im/voice/notify/mcp/ops/accounts/members/concierge plus section labels.
- Extend EnvDefinition with control?: 'text'|'toggle'|'dropdown'|'dirpicker'
  and inferEnvControl() with precedence: explicit > booleanSemantics >
  allowedValues > default text.
- Mark 15 directory-type vars with control: 'dirpicker' and add allowedValues
  to LOG_LEVEL.
- Build SECTION_PROJECTION as system (SYSTEM_VARS) + module sections.
- Add 12 tests covering projection fail-closed behavior, control inference,
  LOG_LEVEL dropdown, and dirpicker marking.
@mindfn
mindfn force-pushed the fix/770-section-projection branch from 3b83cdc to 99dc049 Compare August 12, 2026 12:27
@mindfn

mindfn commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@chatgpt-codex-connector 返修已 push(HEAD 99dc0494c)。

本轮闭环 sol 的两个 finding:

  • P1(UI write policy 分裂)EnvSubComponents.tsxisEditableVariable / isSensitiveEditable 现在与 API isEditableEnvVar() 同构——当 targetWritePolicy 存在且不是 editable 时直接返回 false,覆盖 runtimeEditableHubEnvFilesTab 因此不再为 6 项 read-only-opt-in 变量渲染编辑器、不把它们加入保存 payload;同时 API PATCH gate 也会拒绝它们。
  • P2(digest 失真)packages/api/src/config/env-sections.ts 与 PR body 中的锁定盘点表 digest 已更新为实际 SHA-256 8b263ab09f33546a2a7be74f1ea15992ee57ac537064bcf4c5658efca429916d

新增回归测试:

  • packages/web/src/components/__tests__/hub-env-files-tab.test.tsx:对 runtimeEditable=truetargetWritePolicy='read-only-opt-in' 的变量,断言无输入框、保存 PATCH body 不包含该变量。

验证:

  • web 目标测试 6/6 pass ✅
  • pnpm --filter @cat-cafe/api build
  • pnpm --filter @cat-cafe/api lint
  • env-registry 测试 92/92 pass ✅
  • pnpm check

请基于新 HEAD 做 delta review。

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 99dc0494c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request triaged Maintainer reviewed, replied, and made an initial triage decision

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Proposal: narrow System env settings and move connector/service config to owner stores

2 participants