Commit Graph
7 Commits
Author SHA1 Message Date
GoonandGitHub 75c570e951 feat(security): credentialed exec + HTTP RBAC + API key cache (#197)
- Secure CLI credential injection via AES-256-GCM encrypted env vars
- API key management with fine-grained RBAC scopes
- resolveAuth/requireAuth middleware across all 25+ HTTP handlers
- In-memory API key cache with TTL, negative caching, pubsub invalidation
- Sandbox-first execution (fails if unavailable, no silent fallback)
- Credential scrubbing, constant-time token comparison, Admin-only CLI creds
- SQL migration 000020: secure_cli_binaries + api_keys tables
- 14 unit tests for cache and RBAC with race detector

Closes #197
2026-03-15 20:13:18 +07:00
viettranx 344e2ac7d1 feat(i18n): add full i18n support for backend and web UI
- Add i18next + react-i18next with namespace-split locale files (27 namespaces x 3 languages)
- Add language switcher in topbar (EN/VI/ZH) with localStorage persistence
- Replace hardcoded strings in 160+ React components with t() translations
- Add Go message catalog (internal/i18n) with T(locale, key, args...) function
- Replace 81 hardcoded error strings in gateway methods and HTTP handlers
- Add locale context propagation: WS connect param + HTTP Accept-Language header
- Keep technical terms in English: Agent, Session, Channel, Provider, Skill, Team, MCP, Cron
- Update CLAUDE.md and review-pr skill with i18n compliance checks
2026-03-09 22:22:42 +07:00
Songlin YangandGitHub af85b0c354 chore: remove unused code (#78) 2026-03-07 15:58:42 +07:00
viettranxandClaude Opus 4.6 1f8c98d3de fix: enforce revoke disconnect, group pairing, and agent disable cascade
- Revoke paired device now force-closes the active WebSocket connection
  via pubsub (EventPairingRevoked → Server.DisconnectByPairing)
- Add group-level pairing policy ("pairing") to Discord, WhatsApp, and
  Zalo Personal channels (matching existing Telegram/Feishu pattern)
- Block inactive agents at resolver level (chat, cron, delegation all
  reject with "agent is inactive")
- Cascade: setting agent status to "inactive" auto-disables linked
  channel instances via EventAgentStatusChanged pubsub

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 10:03:08 +07:00
viettranxandClaude Opus 4.6 b1d2e8982a fix: nil guard for QueryTodaySummary, correct remoteAddr comment and UI
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-04 23:25:34 +07:00
9cb73ac132 fix(dashboard): enrich overview with real stats, client tracking, and IP extraction (#51)
- Extract QueryTodaySummary to package-level so quota.usage returns
  requestsToday/tokensToday even when QuotaChecker is nil (standalone mode)
- Enrich health RPC: version, uptime, mode, DB ping, tool count,
  connected clients list with real IP and connectedAt
- Add handleStatus: sessions count, agentTotal from DB (managed mode)
- Extract client IP from X-Real-IP / X-Forwarded-For during WS upgrade
- Rebuild overview UI: live uptime, System Health panel, Connected Clients
  panel, inline channel status with dots, auto-refresh 30s

Co-authored-by: Luvu182 <208665161+Luvu182@users.noreply.github.com>
2026-03-04 23:24:07 +07:00
Viet TranandClaude Opus 4.6 f3f4c67b36 Initial commit: GoClaw AI agent gateway
Multi-agent AI gateway with WebSocket RPC, HTTP API, and messaging channel integrations.
Go port of OpenClaw with multi-tenant PostgreSQL, per-user isolation, security hardening,
and production observability.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22 14:58:07 +07:00