Repository navigation
feat(agent): add the v1 Connect foundation with AgentService and ProjectService - #57
Merged
Merged
Conversation
…ectService First slice of ADR 0004. proto/stackpanel/agent/v1 adds AgentService, whose GetAgentInfo reports the agent version and the procedure paths it serves so the Studio can gate features across agent versions, and ProjectService (list, add, remove and set-default over the user-level project registry; per ADR 0005, selecting a project is a client-side choice). The v1 services share one interceptor chain: Bearer-token auth, with GetAgentInfo public so the Studio can check compatibility before pairing, and panic recovery. The origin allowlist moves out of requireAuth into withAllowedOrigin so both API surfaces share it. The legacy JSON-schema and protobuf-ts generators skip the v1 package. Refs: stackpanel-thq.8.3, stackpanel-thq.8
cooper (czxtm)
had a problem deploying
to
docs-preview
September 23, 2026 13:17 — with 
GitHub Actions
Failure
GitHub Actions
Failure
Contributor
|
Preview |
connect-go reads and gzip-decompresses a unary request message before any interceptor runs, and it applies no size limit by default. The v1 handlers set none, so a caller without a token could make the agent buffer an arbitrarily large, or highly compressed, payload before the auth interceptor rejected it. GetAgentInfo and ListProjects are NO_SIDE_EFFECTS and accept GET, so a web page could send such a payload in the query string without an Origin header. Limit v1 request messages to 2 MiB, the cap REST applies to request bodies. The limit covers the bytes read, the decompressed message and GET query messages, and connect answers ResourceExhausted before auth or the handler runs. Refs: stackpanel-thq.8.3
cooper (czxtm)
had a problem deploying
to
docs-preview
September 23, 2026 13:31 — with
GitHub Actions
Failure
GitHub Actions
Failure
Contributor
|
Docs preview |
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First slice of ADR 0004. It adds the versioned
proto/stackpanel/agent/v1package:AgentService.GetAgentInforeturns the agent version and the procedure paths it serves, read from the registered descriptors. It is public, so the Studio can check compatibility before pairing.ProjectServicelists, adds and removes projects in the user project registry, and sets the default one. Per ADR 0005, selecting a project stays a client-side choice.It also adds:
withAllowedOrigin, which moves the origin allowlist out ofrequireAuthso both API surfaces share itcfg.Version, plumbed from the CLI build infoVerification by the implementer, in the devshell:
go build ./...,go vetandgofmtare clean.internal/agent/projectand 2 ininternal/agent/server, one of which covers 5 auth cases. All of them run through the generated Connect clients againsthttptest.TestSetupAcknowledgementRequiresAuthAndProjectEvidence, one of the 5 tests that already fail on main.Codegen:
nix fmt, and the order-only churn inconnect_entities_gen.gowas reverted.gen/gopb/stackpanel/**andgen/ts/stackpanel/**.buf.gen.yamlexcludesstackpanel.agent.v1from the legacy jsonschema and protobuf-ts plugins.Review follow-up (second commit): v1 request messages are now capped at 2 MiB with
connect.WithReadMaxBytes, the same cap REST applies. connect-go reads and decompresses a request before interceptors run, so without a limit a caller without a token could make the agent buffer an unbounded or gzip-inflated payload before auth rejected it.TestV1RejectsOversizedRequestsBeforeAuthsends an oversized request and a small gzip body that inflates past the limit. Both fail with ResourceExhausted without reaching auth or the handler, and the test fails without the fix.Refs stackpanel-thq.8.3, stackpanel-thq.8