@openacp/cli 2026.414.4 → 2026.414.5

package/dist/cli.js

@@ -2663,6 +2663,19 @@ function registerSetupRoutes(app, deps) {
       return service.getUser(entry.userId);
     }
     if (!body?.displayName) return reply.status(400).send({ error: "displayName is required" });
+    const USERNAME_RE = /^[a-zA-Z0-9_.-]+$/;
+    if (body.username !== void 0 && body.username !== null) {
+      const u = String(body.username);
+      if (!u || !USERNAME_RE.test(u)) {
+        return reply.status(400).send({ error: "Invalid username. Only letters, numbers, _ . - allowed." });
+      }
+    }
+    if (body.username) {
+      const existing = await service.getUserByUsername(String(body.username));
+      if (existing) {
+        return reply.status(409).send({ error: "Username already taken" });
+      }
+    }
     const { user } = await service.createUserWithIdentity({
       displayName: body.displayName,
       username: body.username,
@@ -9573,9 +9586,14 @@ async function sessionRoutes(app, deps) {
       const userId = request.auth?.tokenId ?? "api";
       const result = await deps.core.handleMessageInSession(
         session,
-        { channelId: sourceAdapterId, userId, text: body.prompt, attachments },
-        { channelUser: { channelId: "sse", userId } },
-        { externalTurnId: body.turnId, responseAdapterId: body.responseAdapterId }
+        { channelId: "api", userId, text: body.prompt, attachments },
+        { channelUser: { channelId: "api", userId } },
+        {
+          externalTurnId: body.turnId,
+          // Preserve null (suppress response) but fall back to sourceAdapterId when
+          // responseAdapterId is not specified, since 'api' has no adapter to route to.
+          responseAdapterId: body.responseAdapterId !== void 0 ? body.responseAdapterId : sourceAdapterId
+        }
       );
       if (!result) {
         throw new AuthError("MESSAGE_BLOCKED", "Message was blocked by a middleware plugin.", 403);
@@ -10750,7 +10768,7 @@ async function commandRoutes(app, deps) {
     const result = await deps.commandRegistry.execute(commandString, {
       raw: "",
       sessionId: body.sessionId ?? null,
-      channelId: "sse",
+      channelId: "api",
       userId: request.auth?.tokenId ?? "api",
       reply: async () => {
       }
@@ -12200,8 +12218,11 @@ async function sseRoutes(app, deps) {
       const userId = request.auth?.tokenId ?? "api";
       const { turnId, queueDepth } = await deps.core.handleMessageInSession(
         session,
-        { channelId: "sse", userId, text: body.prompt, attachments },
-        { channelUser: { channelId: "sse", userId } }
+        { channelId: "api", userId, text: body.prompt, attachments },
+        { channelUser: { channelId: "api", userId } },
+        // Route response back to the SSE adapter; 'api' is the identity namespace,
+        // not an adapter name, so responseAdapterId must be explicit.
+        { responseAdapterId: "sse" }
       );
       return { ok: true, sessionId, queueDepth, turnId };
     }
@@ -12262,7 +12283,7 @@ async function sseRoutes(app, deps) {
       const result = await deps.commandRegistry.execute(commandString, {
         raw: "",
         sessionId,
-        channelId: "sse",
+        channelId: "api",
         userId: request.auth?.tokenId ?? "api",
         reply: async () => {
         }
@@ -19994,8 +20015,6 @@ var init_core_plugins = __esm({
     corePlugins = [
       // Service plugins (no adapter dependencies)
       security_default,
-      identity_default,
-      // Must boot after security (blocked users rejected before identity records are created)
       file_service_default,
       context_default,
       speech_default,
@@ -20003,6 +20022,11 @@ var init_core_plugins = __esm({
       // Infrastructure plugins
       tunnel_default,
       api_server_default,
+      // Identity boots after api-server so it can register REST routes via
+      // apiServer.registerPlugin(). If booted before, ctx.getService('api-server')
+      // returns null and the /identity/setup route is never registered.
+      // Security is already up at this point, satisfying the priority-100 requirement.
+      identity_default,
       // Adapter plugins (depend on security, notifications, etc.)
       sse_adapter_default,
       telegram_default