Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

A coworker can arrive as an endpoint, but not as a file

未關閉
  • 哪裡不對？
#398 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
35/100
Issue 類型
功能
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
typescript
領域
backend-api-design, security

研究方向

先閱讀 tenant-package.ts 第 535 行和第 556 行附近的內容，然後追蹤現有的 coworker、skills、grant 和 consent-screen 流程。判斷是否能在不進行環境展開、不使用特權欄位，且不需要 migration 或新增資料表的情況下解析外部設定檔。完成的標準是定義好 ingress 決策，以及其不需 grant、逐字預覽的行為。

由索引模型根據 Issue 內容生成。

描述

#299 was right to close and I am not reopening it. The scope argument holds: a catalogue that fetches
from pinned repositories presumes a population of deployments trading with each other, and a starting
point somebody clones once does not have one.

This is the narrower piece, and it is a different kind of thing.

The gap

The first hurdle after setup is "what now?" — see #397 for the half of that answer which is
just better examples in the box. This is the other half: somebody hands you a coworker.

The README already offers ingress for a coworker's runtime: "any AG-UI endpoint is a Bot, on a
framework or hand-written", validated with the same target checks as browser navigation. What a
deployment cannot do is take in a coworker's configuration. Somebody sends you a file describing a
coworker — its prose, its skills, what it wants to reach — and there is nothing to do with it but
read the YAML yourself and retype it into the dialog.

Editing examples/ and redeploying covers that for a repository you own. It does not cover a
deployment that is already running and that you would rather not restart, and it does not cover
somebody who is not the person with filesystem access.

Why this is not the catalogue

Distribution leaves the repository entirely. No pinned sources, no OPENBOT_TEMPLATE_SOURCES, no
server-side fetch, no allowlist, no URL to configure — and no code here that knows any list exists.
awesome-openbot-agents is a list a person
reads in a browser; getting a file out of it is a copy button.

That matters beyond scope. The product fetches nothing today and the posture is "runs on your
machine". A fetcher aimed at a URL somebody typed is the same class of problem checkAgentEndpoint
exists for, and adding one to justify a convenience is a bad trade. So: no fetch. You already have
the file.

What it costs

Against #299's 123 files and two migrations: no catalogue, no pinned sources, no gallery, no
categories, no shipped catalogue for a clone to inherit, and — the part I want to be held to — no
migration and no new table. Installing writes a coworker, its skills, and the one grant that pairs
them, into tables that already exist. On the order of fifteen files.

The safety argument, which you said was the reusable part

It is reusable precisely here, because the file arrives from outside. The format refuses what must
never travel — no endpoint, no credential, no grant, no component source, no policy rule — by not
having those fields, so a file carrying one fails to parse rather than being quietly stripped. The
consent screen renders every word the file would give a model, verbatim, before anything runs.

And it must not go through the tenant package loader. expandEnvironment runs over agents.yaml and
skills.yaml at load (tenant-package.ts:535,556), so a role description containing ${…} would be
interpolated out of the server's own environment. That is the concrete reason the package cannot be
the mechanism for a file you did not write — and the same reason a clone should be careful what it
points examples/ at.

Not #322

That asks for sharing configurations between deployments, and its acceptance criteria include
carrying grants across on import. This deliberately does not: what a coworker asks for arrives as an
ask and stays unanswered until somebody with the authority decides it. A file that can carry a grant
is a file that can grant.

Two questions, rather than a diff

  1. Is ingress the piece that belongs, or is even one import screen more than a template should carry
    once #397 has made the in-box examples good?
  2. If it belongs — is "grant nothing, and show what was asked" enough without a table to record the
    asks in? Dropping that record is what gets this to zero migrations. The cost is that the asks are
    on screen once and not afterwards.
主要語言
TypeScript
星號
6.6k
分支
914
平均合併
19 小時 22 分鐘
30 天內合併 PR
140

環境準備

  • 提供 Dockerfile 或 Docker Compose 檔案
  • 有 Pull Request 範本
  • 沒有貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

CopilotKit/OpenBot 的其他 Issue

查看 CopilotKit/OpenBot 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。