officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
39c1122651c47a9ce52bf820d96f365d906261ac
platform/TODO.md
T
pastilhasandClaude Opus 5 d273dc6a14 install a plugin from a git URL, with no registry involved 
the catalogue was the only way a remote plugin could arrive, so "build one and
give it to a friend" had no route. the first real case is a plugin that must
never be listed: fofos/fofos-admin is one website's admin panel, useful to
exactly one person.

MUCH smaller than the todo assumed. fetchPlugin already cloned, validated the
URL, refused to overwrite an existing directory, checked for a manifest and
removed a failed clone. exactly one line tied it to the marketplace — where the
string came from. so this is a source parameter threaded through, and a route.

THE NAME COMES FROM THE REPOSITORY, because appName is the DIRECTORY name and is
never declared in a manifest — the id cannot disagree with where the code sits.
that decision is inherited here rather than remade: the repo name becomes the
directory, the route segment, the table prefix and the sidecar suffix. so it is
checked against ^[a-z0-9]+(-[a-z0-9]+)*$ BEFORE anything is cloned; a half-clone
under an unusable name reads as a broken plugin rather than an absent one.

the URL is validated identically whether it came from the catalogue or from a
person, because the catalogue is not a trust boundary — it is just where a string
came from, and the same string reaches the same argv. what differs is who may
ask: this route is owner-only, and the owner is choosing what code runs rather
than choosing from a list somebody curated. validation is not review, and nothing
here reads what it cloned.

caught by testing: the source reached installPlugin and stopped there — the
fetchPlugin call still had the old two arguments, so a URL install fell back to
the catalogue and failed with "no catalogue entry". the guard tests are what
surfaced it, because the error named the wrong cause.

verified end to end against fofos-admin — cloned, schema applied, mounted, dock
pinned — then purged, since officer-dev is not that website's machine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
2026-08-28 23:12:54 +01:00

6.3 KiB
Raw Blame History

TODO — the index

Deferred work. The items live in todo/, one file each, grouped by theme; this file is the map over them and is GENERATED — run bun run todo:index after any change rather than editing it here. Format and the two-way-sync contract: todo/README.md. Browse and edit it at /todos in the app.

Context, corrected 2026-08-07. This list used to open by saying Officer was "collapsing from multi-tenant / open-source-ready to a single-user platform", and told you to treat multi-tenant indirection as accidental complexity. That direction was reversed. The permission model shipped on 2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed deleting it have been removed rather than left to mislead the next reader.

What did NOT reverse: execution permissions (terminal, chat, tasks, files, desktop, browser) run as the owner's OS user and can never be granted. Indirection there really is accidental complexity.

Urgent

Themes

106 open, 33 closed, across 34 themes.

Theme Open Closed
Affordances 2 0
Agents coordinating agents 5 0
Speaking into a session from the backend 1 1
Backburner 3 0
Background jobs 2 1
Calendar and contacts 1 0
Chat interface 1 0
Code editor 1 0
Components — the shared UI layer 1 0
Documentation conventions — AGENTS.md vs CLAUDE.md 2 0
File watchers 1 0
Fleet — one command across every server 6 2
Headscale 0 5
Infra (alpha) 7 0
Known bugs 6 4
Memory — one store instead of per-harness files 1 0
Mobile apps 5 0
Multi-user 17 5
Notifications 1 0
Plugin ecosystem — before it opens to third parties (2026-08-18) 4 1
Plugin infrastructure 2 1
Plugin repos — what writing their READMEs turned up 10 9
Plugin system — gaps the email extraction found (2026-08-18) 3 0
Prompt library 1 0
SendOff 1 0
Settings — portable, and readable by an agent 2 0
Shell — spotlight and the dock 4 1
Sub-agents — agents spawning agents 0 2
Sudo terminal modal 1 0
Tooling — the list about the list 0 1
Transmission 6 0
URL state — routing, query strings and selection 4 0
Waiting on the owner to run it 3 0
Workspaces & Panels 2 0

Records — no items, kept for the reasoning

Newest ten

Reference in New Issue View Git Blame Copy Permalink