agent-builders.md: cite the Dify console code for the plugin debug permission (TODO 1.283 in part)

CHANGELOG.md

@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- `agent-builders.md`: the Dify plugin debug-permission remedy now cites the pinned console web code that reads and writes the setting, alongside the API remedy already cited; which roles can reach it and where the console shows it stay open under TODO row 1.283 (#695)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `workflow-orchestrators.md`, already in the layout, now lists Temporal, Flower and Argo with its other headline tools in its header; no guide body or digest changes. Guides: `host.md`, `cloud-firewalls.md`, `egress-metadata.md`, `cloudflare.md`, `tunnels.md`, `tailscale.md`, `cloud-identity-proxies.md`, `fronting-auth.md`, `mfa.md`, `identity-providers.md`, `oidc-integration.md`, `self-hosted-idp.md`, `secrets.md`, `machine-auth.md`, `connection-poolers.md`, `neo4j.md`, `surrealdb.md`, `nodejs.md`, `go.md`, `java.md` (#697)
 - `authentication.md`: the transport-authentication rule now labels its requirements (authenticate and check each of WebSockets, SSE, GraphQL, gRPC, webhooks, inference and management APIs on its own, not through the HTML login; verify webhook signatures and reject replays) as this guide's, keeps the Stripe signature and timestamp citations, and states that the HTML-login boundary, GraphQL, inference and management API coverage, and replay rejection beyond those checks are not established by the cited sources; those parts stay open under TODO row 1.294 (#696)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; the header now says "1 more recorded basis" rather than "bases", and the headers of guides already in the layout are regenerated where that changes them; no guide body or digest changes. Guides: `firebase-supabase.md`, `pocketbase.md`, `ray.md`, `gitops-controllers.md`, `nomad-consul.md`, `self-hosted-ci-runners.md`, `workflow-orchestrators.md`, `kubernetes.md`, `nginx.md`, `apache.md`, `caddy.md`, `traefik.md`, `haproxy.md`, `lighttpd.md`, `free-certificates.md`, `self-signed.md`, `headers.md`, `cors.md`, `docker.md`, `container-hardening.md` (#693)

DONE.md

@@ -10,6 +10,7 @@ because an item that simply vanishes gets proposed again six months later.
 
 | ID | Item | Ended |
 | --- | --- | --- |
+| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the canSetPermissions flag (RBAC off plus the plugin.plugin_preferences key) that the settings-access hook returns beside the write; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. |
 | 1.294 | `authentication.md`: transport-authentication: qualify the transport checks, HTML-login boundary and webhook replay requirement. (M, M) | Done, #696. Labelled the requirements and source limits, retained the Stripe signature and timestamp citations, and shortened the claim; evidence for the HTML-login boundary, GraphQL/inference/management coverage and comprehensive replay rejection remains open in TODO.md under 1.294. |
 | 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. |
 | 1.292 | `authentication.md`: cloudflare-access: source or narrow the claim that Cloudflare Access can front any application unchanged, including the One-time PIN and SSO options still not established by the cited pages. (M, M) | Done, #692. Cited the pinned one-time PIN, identity-provider options and generic OIDC pages for the login methods, narrowed the fronting statement to a self-hosted web application published through Access, and labelled unchanged any-application use as not established and this guide's assessment. |

TODO.md

@@ -57,7 +57,7 @@ A real surface the guide never covers. Correct as far as it goes, and not far en
 | 1.268 | `paas.md`: remaining https-redirect/verify-redirect evidence: establish Render's redirect status, Railway's HEAD redirect behaviour and POST status, and Heroku's redirect policy, configuration/application responsibility and status; cited header descriptions do not establish sanitization. (M, M) | `[gap]` |
 | 1.273 | `nodejs.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` |
 | 1.276 | `python.md`: bind, remaining source gaps: establish Railway's listener address, injected port and TLS termination location, and Heroku Cedar's listener address. (M, M) | `[gap]` |
-| 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | `[gap]` |
+| 1.283 | `agent-builders.md`: debug-remedy, remaining UI gap: establish which roles hold the `plugin.plugin_preferences` workspace permission key and where the console renders the plugin-permission control; the console UI read/write data path, paired payload and choices are cited. (M, M) | `[gap]` |
 | 1.290 | `firebase-supabase.md`: local-guards: establish the unrecorded bash and other tool/parser versions for the historical authoring guard and syntax runs; the ShellCheck v0.11.0 release is cited, but does not attest to the historical host binary. (M, M) | `[gap]` |
 | 1.291 | `pocketbase.md`: source-limits, remaining dependency gap: trace how utopia-php/database matches requester roles against stored collection/document permissions (including documentSecurity) for document reads and what the disabled default authorization status bypasses; the Appwrite-repository call sites, PocketBase CLI wrapper and `--dev` default are cited. (M, M) | `[gap]` |
 | 1.294 | `authentication.md`: transport-authentication, remaining source gaps: establish the HTML-login boundary for non-HTTP transports and authentication coverage for GraphQL, inference and management APIs; establish comprehensive webhook replay rejection beyond signature and timestamp-tolerance checks, including repeats within the accepted window. These remain guide requirements, not established deployment behaviour. (M, M) | `[gap]` |