@openacp/cli 2026.414.3 → 2026.414.5

package/dist/cli.js

@@ -2663,6 +2663,19 @@ function registerSetupRoutes(app, deps) {
       return service.getUser(entry.userId);
     }
     if (!body?.displayName) return reply.status(400).send({ error: "displayName is required" });
+    const USERNAME_RE = /^[a-zA-Z0-9_.-]+$/;
+    if (body.username !== void 0 && body.username !== null) {
+      const u = String(body.username);
+      if (!u || !USERNAME_RE.test(u)) {
+        return reply.status(400).send({ error: "Invalid username. Only letters, numbers, _ . - allowed." });
+      }
+    }
+    if (body.username) {
+      const existing = await service.getUserByUsername(String(body.username));
+      if (existing) {
+        return reply.status(409).send({ error: "Username already taken" });
+      }
+    }
     const { user } = await service.createUserWithIdentity({
       displayName: body.displayName,
       username: body.username,
@@ -9573,9 +9586,14 @@ async function sessionRoutes(app, deps) {
       const userId = request.auth?.tokenId ?? "api";
       const result = await deps.core.handleMessageInSession(
         session,
-        { channelId: sourceAdapterId, userId, text: body.prompt, attachments },
-        { channelUser: { channelId: "sse", userId } },
-        { externalTurnId: body.turnId, responseAdapterId: body.responseAdapterId }
+        { channelId: "api", userId, text: body.prompt, attachments },
+        { channelUser: { channelId: "api", userId } },
+        {
+          externalTurnId: body.turnId,
+          // Preserve null (suppress response) but fall back to sourceAdapterId when
+          // responseAdapterId is not specified, since 'api' has no adapter to route to.
+          responseAdapterId: body.responseAdapterId !== void 0 ? body.responseAdapterId : sourceAdapterId
+        }
       );
       if (!result) {
         throw new AuthError("MESSAGE_BLOCKED", "Message was blocked by a middleware plugin.", 403);
@@ -10750,7 +10768,7 @@ async function commandRoutes(app, deps) {
     const result = await deps.commandRegistry.execute(commandString, {
       raw: "",
       sessionId: body.sessionId ?? null,
-      channelId: "sse",
+      channelId: "api",
       userId: request.auth?.tokenId ?? "api",
       reply: async () => {
       }
@@ -12200,8 +12218,11 @@ async function sseRoutes(app, deps) {
       const userId = request.auth?.tokenId ?? "api";
       const { turnId, queueDepth } = await deps.core.handleMessageInSession(
         session,
-        { channelId: "sse", userId, text: body.prompt, attachments },
-        { channelUser: { channelId: "sse", userId } }
+        { channelId: "api", userId, text: body.prompt, attachments },
+        { channelUser: { channelId: "api", userId } },
+        // Route response back to the SSE adapter; 'api' is the identity namespace,
+        // not an adapter name, so responseAdapterId must be explicit.
+        { responseAdapterId: "sse" }
       );
       return { ok: true, sessionId, queueDepth, turnId };
     }
@@ -12262,7 +12283,7 @@ async function sseRoutes(app, deps) {
       const result = await deps.commandRegistry.execute(commandString, {
         raw: "",
         sessionId,
-        channelId: "sse",
+        channelId: "api",
         userId: request.auth?.tokenId ?? "api",
         reply: async () => {
         }
@@ -18459,7 +18480,6 @@ var init_adapter2 = __esm({
           return prev(method, payload, signal);
         });
         const onCommandsReady = ({ commands }) => {
-          this.core.eventBus.off(BusEvent.SYSTEM_COMMANDS_READY, onCommandsReady);
           this.syncCommandsWithRetry(commands);
         };
         this.core.eventBus.on(BusEvent.SYSTEM_COMMANDS_READY, onCommandsReady);
@@ -19995,8 +20015,6 @@ var init_core_plugins = __esm({
     corePlugins = [
       // Service plugins (no adapter dependencies)
       security_default,
-      identity_default,
-      // Must boot after security (blocked users rejected before identity records are created)
       file_service_default,
       context_default,
       speech_default,
@@ -20004,6 +20022,11 @@ var init_core_plugins = __esm({
       // Infrastructure plugins
       tunnel_default,
       api_server_default,
+      // Identity boots after api-server so it can register REST routes via
+      // apiServer.registerPlugin(). If booted before, ctx.getService('api-server')
+      // returns null and the /identity/setup route is never registered.
+      // Security is already up at this point, satisfying the priority-100 requirement.
+      identity_default,
       // Adapter plugins (depend on security, notifications, etc.)
       sse_adapter_default,
       telegram_default
@@ -30126,6 +30149,7 @@ async function startServer(opts) {
   const fieldRegistry = new PluginFieldRegistry();
   serviceRegistry.register("field-registry", fieldRegistry, "core");
   registerSystemCommands(commandRegistry, core);
+  let loadedDevPlugin;
   try {
     core.eventBus.emit(BusEvent.KERNEL_BOOTED);
     core.lifecycleManager.settingsManager = settingsManager;
@@ -30202,6 +30226,7 @@ async function startServer(opts) {
       try {
         const devPlugin = await devLoader.load();
         await core.lifecycleManager.boot([devPlugin]);
+        loadedDevPlugin = { name: devPlugin.name, version: devPlugin.version };
         log.info({ plugin: devPlugin.name, version: devPlugin.version }, "Dev plugin loaded");
         if (!opts.noWatch) {
           const distPath = devLoader.getDistPath();
@@ -30216,6 +30241,7 @@ async function startServer(opts) {
                 const reloaded = await devLoader.load();
                 await core.lifecycleManager.boot([reloaded]);
                 log.info({ plugin: reloaded.name, version: reloaded.version }, "Dev plugin reloaded");
+                core.eventBus.emit(BusEvent.SYSTEM_COMMANDS_READY, { commands: commandRegistry.getAll() });
               } catch (err) {
                 log.error({ err }, "Dev plugin reload failed");
               }
@@ -30375,6 +30401,9 @@ async function startServer(opts) {
     for (const [name] of core.adapters) {
       ok3(`${name.charAt(0).toUpperCase() + name.slice(1)} connected`);
     }
+    if (loadedDevPlugin) {
+      ok3(`Dev plugin: ${loadedDevPlugin.name} v${loadedDevPlugin.version}`);
+    }
     const apiSvc = core.lifecycleManager.serviceRegistry.get("api-server");
     let apiPort = apiSvc ? apiSvc.getPort() : 21420;
     if (apiSvc && apiPort === 0) {