mirror of
https://github.com/multica-ai/multica.git
synced 2026-06-17 03:38:32 +02:00
8d6b7663df
Double-review (Eve) caught a fixed_args-shaped hole: visibility=private was a user-facing toggle (Web form + detail + CLI), but the three server read paths (ListRuntimeProfiles, daemon ListEnabledRuntimeProfilesForWorkspace, DaemonRegister) never enforce it — so a "private" profile's name/command would leak to other members and could be registered by other machines' daemons (lateral data leak). Same "don't paint a pie" fix as fixed_args: hide the control everywhere and force the stored value. - Server (runtime_profile.go): drop `visibility` from the create + update request structs; CreateRuntimeProfile always stores 'workspace' (runtimeProfileDefaultVisibility); UpdateRuntimeProfile no longer accepts it; removed validRuntimeProfileVisibility. The column + response field stay (always 'workspace') as the carried-but-not-exposed layer. - Web (runtime-profiles-dialog.tsx): removed the visibility form fieldset, the VisibilityOption component, the detail row, the visibility state, and the create/update submit fields. - i18n: removed the profile visibility strings from all four locales (profiles.detail.visibility, profiles.visibility.*, profiles.form.visibility_*). Top-level runtime/agent visibility strings are untouched. - CLI (cmd_runtime_profile.go): removed `--visibility` from create/update and the VISIBILITY list column; removed validateVisibility; stopped sending the field. - Tests: new TestCreateRuntimeProfile_ForcesWorkspaceVisibility (POST visibility:"private" -> response and DB row are 'workspace'); CLI create test now asserts visibility is never sent. Follow-up MUL-3308 tracks implementing real creator-visibility (and wiring fixed_args to the launch path); TODOs left in server/Web/CLI point to it. Verified: turbo typecheck+lint+test pass (@multica/core, @multica/views); go build/vet pass; go test ./cmd/multica/... and the full ./internal/handler/ suite pass against a migrated Postgres 17. Co-authored-by: multica-agent <github@multica.ai>