thin-channel-thick-runner: strangler-fig collection refactor + AuthManager + per-domain limits

.github/workflows/ci.yml

@@ -1,152 +1,97 @@
-name: CI
+name: ci
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - develop
+      - codex/**
   pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  workflow_dispatch:
 
 jobs:
-  # ── 前端检查 ─────────────────────────────────────────────
-  web-lint:
-    name: Web Lint
+  frontend:
     runs-on: ubuntu-latest
+    name: Frontend (Vite)
     defaults:
       run:
-        working-directory: apps/web
+        working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
         with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: apps/web/package-lock.json
-
-      - run: npm ci --legacy-peer-deps
-      - run: npm run lint
-
-  web-typecheck:
-    name: Web Type Check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/web
-    steps:
-      - uses: actions/checkout@v4
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
 
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: apps/web/package-lock.json
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
 
-      - run: npm ci --legacy-peer-deps
-      - run: npm run type-check
+      - name: Test
+        run: npm run test
 
-  web-test:
-    name: Web Test
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: apps/web
-    steps:
-      - uses: actions/checkout@v4
+      - name: Build
+        run: npm run build
 
-      - uses: actions/setup-node@v4
+      - name: Upload frontend dist
+        uses: actions/upload-artifact@v4
+        if: success()
         with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: apps/web/package-lock.json
-
-      - run: npm ci --legacy-peer-deps
-      - run: npm test -- --coverage
+          name: frontend-dist
+          path: frontend/dist
 
-  web-build:
-    name: Web Build
+  extension:
     runs-on: ubuntu-latest
-    needs: [web-lint, web-typecheck]
+    name: Browser Extension
     defaults:
       run:
-        working-directory: apps/web
+        working-directory: chrome/extension-src
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
         with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: apps/web/package-lock.json
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: chrome/extension-src/package-lock.json
 
-      - run: npm ci --legacy-peer-deps
-      - run: npm run build
+      - name: Install dependencies
+        run: npm ci
 
-  # ── Python 后端检查 ──────────────────────────────────────
-  backend-test:
-    name: Backend Test
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: backend
-    steps:
-      - uses: actions/checkout@v4
+      - name: Build
+        run: npm run build
 
-      - uses: actions/setup-python@v5
+      - name: Upload extension dist
+        uses: actions/upload-artifact@v4
+        if: success()
         with:
-          python-version: '3.11'
-          cache: 'pip'
-          cache-dependency-path: pyproject.toml
-
-      - run: pip install .[dev]
-      - run: pytest --cov=backend --cov-fail-under=80
+          name: extension-dist
+          path: chrome/extension-src/dist
 
-  backend-lint:
-    name: Backend Lint
+  backend:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: backend
+    name: Backend Quality
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
-
-      - run: pip install ruff
-      - run: ruff check .
+          python-version: "3.11"
 
-  # ── Docker 构建 ──────────────────────────────────────────
-  docker-build:
-    name: Docker Build
-    runs-on: ubuntu-latest
-    needs: [web-build, backend-test]
-    steps:
-      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e .[dev]
 
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Backend syntax check
+        run: python -m compileall backend
 
-      - name: Build Web
-        uses: docker/build-push-action@v5
-        with:
-          context: ./apps/web
-          push: false
-          tags: ghcr.io/${{ github.repository }}/web:${{ github.sha }}
-
-      - name: Build API
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: false
-          tags: ghcr.io/${{ github.repository }}/api:${{ github.sha }}
+      - name: Unit tests
+        run: pytest tests/unit -m "not live" --no-cov

.gitignore

@@ -21,6 +21,7 @@ env/
 htmlcov/
 *.coveragerc
 coverage.xml
+.tmp-smoke/
 
 # Database files
 *.db
@@ -37,9 +38,11 @@ coverage.xml
 # backend/migrations/versions/*.py
 
 # Node / frontend
+node_modules/
 frontend/node_modules/
 frontend/dist/
 frontend/tsconfig.tsbuildinfo
+.nx/
 
 # macOS
 .DS_Store
@@ -55,6 +58,8 @@ frontend/tsconfig.tsbuildinfo
 # Logs
 *.log
 logs/
+.omx/
+.serena/
 
 # Docker volumes / data
 data/
@@ -70,3 +75,5 @@ chrome/extension-src/store-assets/
 
 # Rust build
 odp-rs/target/
+.gstack/
+.repowise/

.gitleaks.toml

@@ -0,0 +1,17 @@
+title = "opencli-admin gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Ignore generated local artifacts that are not part of the repository."
+paths = [
+  '''(^|/)\.venv/''',
+  '''(^|/)venv/''',
+  '''(^|/)env/''',
+  '''(^|/)\.tmp-smoke/''',
+  '''(^|/)node_modules/''',
+  '''(^|/)frontend/node_modules/''',
+  '''(^|/)frontend/dist/''',
+  '''(^|/)chrome/extension-src/node_modules/''',
+]

.nvmrc

@@ -0,0 +1 @@
+20.12.2

CONTEXT.md

@@ -0,0 +1,23 @@
+# OpenCLI Admin Context
+
+OpenCLI Admin is an operations console for collection work that needs browser session control, scheduled collection, and operator review.
+
+## Language
+
+**Collection Operations Console**: The primary operator surface for turning collection work into captured, triaged, owned, stateful, and closed work. It is the product shape that contains Run Inbox, Data Sources, Live Collection View, and Diagnostic Canvas without making any one visualization the whole product.
+_Avoid_: Dashboard wall, canvas-first app
+
+**Collection Operations**: The operator-facing domain for deciding what should be collected, when collection should run, what recently happened, and which actions are currently safe. It groups Data Sources, Collection Plans, Recent Runs, and Node Actions without making a canvas the primary operating surface.
+_Avoid_: Source Workflow Workbench, canvas-first operations
+
+**Diagnostic Canvas**: A secondary view for understanding relationships among collection entities when troubleshooting or explaining system state. It is not the default place to configure routine collection work.
+_Avoid_: Main workflow, primary operating surface
+
+**Live Collection View**: The operator-facing view of an active collection run as it happens, including streamed progress, rendered browser or pipeline state, and run-specific artifacts. It is anchored to a Recent Run, not to the default configuration surface.
+_Avoid_: Static task log, canvas-only monitoring
+
+**Adaptive Run Surface**: The on-demand layout that opens the right Live Collection View panels for the active run type. It should reveal pipeline events, browser or adapter rendering, and artifacts only when they help the operator understand that run.
+_Avoid_: Clock shop, always-on dashboard wall
+
+**Run Inbox**: The operator-facing queue of collection runs that need observation, review, retry, acknowledgement, or dismissal. It treats a run as work to triage and close, not as a passive row in a log table.
+_Avoid_: Recent tasks table, static run history