团子
a3b3c598ab
- Add agent selector dropdown in header (admin only) - Return role in GET /config response - Collect agents from both auth: and agent_tokens: KV prefixes - Show 'viewing <agent>' badge when viewing another agent - Non-admin users see only their own config (unchanged)
Config Service
Layered KV config store with scope-based override. Built on Cloudflare Workers + KV.
Concept
Like git config's system → global → local layering:
- shared — team-wide config (e.g.
CF_ACCOUNT_ID,AWS_REGION) - personal — per-agent overrides (e.g.
GITEA_TOKEN,GH_TOKEN)
Read: personal wins over shared. Write: must specify scope.
Auth
Each agent has a token. The service stores sha256(token) → agent_id mappings.
Agents can read/write their own personal scope and read (but not write) the shared scope.
Shared scope writes require an admin token.
API
GET /config/:key → returns personal value, fallback to shared
GET /config?scope=shared → list all shared keys
GET /config?scope=personal → list all personal keys
PUT /config/:key → write to personal scope (default)
PUT /config/:key?scope=shared → write to shared scope (admin only)
DELETE /config/:key → delete from personal scope
DELETE /config/:key?scope=shared → delete from shared (admin only)
POST /config/sync → returns all resolved keys (personal over shared)
Auth header: Authorization: Bearer <token>
Storage Layout (KV)
auth:<sha256(token)> → { "agent_id": "tuanzi", "role": "agent|admin" }
shared:<key> → { "value": "...", "updated_at": "..." }
personal:<agent_id>:<key> → { "value": "...", "updated_at": "..." }
CLI
cfg get <KEY> # read (personal > shared)
cfg set <KEY> <VALUE> # write to personal
cfg set --shared <KEY> <VALUE> # write to shared (admin)
cfg list # list all resolved
cfg list --scope shared # list shared only
cfg sync # sync all to local cache
cfg delete <KEY> # delete from personal