phptits
0d6cd37579
- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages - PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs) - Auth/RBAC/workspace isolation, credential vault (AES-256-GCM) - Servers/SSH, Docker discovery & lifecycle, Job Center - Websites & deployments (git provider credential clone, env, health verification) - Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring - Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools) - AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals) - Notes: Vditor WYSIWYG markdown editor, non-blocking autosave - Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)
96 lines
2.5 KiB
Markdown
96 lines
2.5 KiB
Markdown
# 12 — Codex Execution Plan
|
|
|
|
## Rules
|
|
- Continue from `/home/dev/bun/devos`.
|
|
- Do NOT recreate the project.
|
|
- Before changes, inspect current source and Prisma schema.
|
|
- Preserve working functionality.
|
|
- Make incremental migrations only.
|
|
- Do not reset/drop production-like databases.
|
|
- Do not expose secrets.
|
|
|
|
## Phase A — Audit and hardening
|
|
1. Inspect auth, workspace guard, credential vault, mask utilities.
|
|
2. Remove/disable default admin credential exposure.
|
|
3. Add production secret validation.
|
|
4. Disable public registration by default in production.
|
|
5. Remove test credential.
|
|
6. Upgrade webhook authentication to HMAC + timestamp.
|
|
7. Add security regression tests.
|
|
|
|
## Phase B — Resource graph
|
|
1. Extend ResourceRelation.
|
|
2. Build relation service.
|
|
3. Add resource relation endpoints.
|
|
4. Add relation UI.
|
|
5. Add project-centric overview.
|
|
|
|
## Phase C — Infrastructure
|
|
1. Complete server lifecycle.
|
|
2. Complete Docker operations.
|
|
3. Standardize Job Center.
|
|
4. Add monitoring/incident model.
|
|
|
|
## Phase D — Website/deployment
|
|
1. Git provider connection model.
|
|
2. Repository model.
|
|
3. Credential-based private repo access.
|
|
4. Deployment adapters.
|
|
5. Environment management.
|
|
6. Health verification.
|
|
7. Deployment timeline/logs.
|
|
|
|
## Phase E — Code/domain/productivity
|
|
1. GitHub/GitLab/Gitea adapters.
|
|
2. Domain/DNS provider abstraction.
|
|
3. Certificate model.
|
|
4. Project/Task completion.
|
|
5. Note/Document completion.
|
|
6. Email account/send/search foundation.
|
|
|
|
## Phase F — Automation
|
|
1. Event catalog.
|
|
2. Trigger/action schemas.
|
|
3. Sequential workflow executor.
|
|
4. HMAC webhook.
|
|
5. Job Center integration.
|
|
6. Automation UI.
|
|
|
|
## Phase G — AI
|
|
1. Tool registry.
|
|
2. Tool permission resolver.
|
|
3. Risk engine.
|
|
4. Approval model/UI.
|
|
5. Planner.
|
|
6. Executor.
|
|
7. Verification.
|
|
8. Execution report.
|
|
|
|
## Phase H — MCP
|
|
Expose selected stable tools through MCP, reusing the exact application services and authorization pipeline.
|
|
|
|
## Phase I — Unified UX
|
|
1. Global search.
|
|
2. Command palette.
|
|
3. Activity feed.
|
|
4. Job center.
|
|
5. AI command entry.
|
|
6. Project dashboard.
|
|
7. Resource relation navigation.
|
|
|
|
## Execution protocol
|
|
For each phase:
|
|
1. inspect current implementation
|
|
2. write/update design notes
|
|
3. implement backend
|
|
4. migrate DB safely
|
|
5. implement frontend
|
|
6. add tests
|
|
7. run typecheck
|
|
8. run unit/integration/E2E
|
|
9. update docs
|
|
10. report files changed and verification
|
|
|
|
## Important
|
|
Do not mark a feature complete merely because its endpoint returns 200. Acceptance requires a complete user-facing workflow and tests.
|