Conversation
github-actions
Bot
added
area:dashboard
added 7 commits
September 12, 2026 01:59
# Conflicts: # .agents/skills/tools-registry-context/MAP.md # dsh/skills/treg/SKILL.md # plugin/skills/treg/SKILL.md # plugins/minimax/skills/treg/SKILL.md # plugins/treg/skills/treg/SKILL.md # skills/treg/SKILL.md # src/treg/oauth_providers.py # tests/test_key_providers.py # tests/test_oauth_providers_m3.py
A real own-key account (2026-09-15) confirmed through the treg relay: - connection probe accepts a valid token (POST /api/info) - upload, demo search, paid search, status polling and image deletion - one full search deducts exactly 3 credits (12 -> 9); upload, demo search, polls and deletion deduct 0 - items[].url is a string in demo and paid responses, not the object the OpenAPI declares - appending to a submitted search is rejected; image deletion works only before submission (PIC_NOT_FOUND afterwards) Search, delete and account-info carry verified stamps with scrubbed example responses; upload keeps its example without a stamp because a verified endpoint needs a re-runnable test_request and the stock verifier cannot build multipart file parts.
External review flagged that the captured search example still carried real profile URLs produced by a biometric search. Examples exist to show the response shape; replace URLs, search/image IDs and hashes with placeholders.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Add FaceCheck.ID as an own-key provider with four native operations: photo upload, search/status, input-image removal and account info. The POST connection probe rejects FaceCheck's HTTP-200 invalid-token error and requires non-null account fields while accepting zero credits and false service flags. Incomplete responses return 502 before creating or replacing a credential. Relay calls preserve the raw Authorization token and native multipart/JSON/query protocol.
All four endpoints are platform-blocked and uncached. This PR adds no shared-key billing, automatic waiting or identity-enrichment claim.
Usable catalog commands and honest verification
--upload name=@/path/to/fileinstead of JSON. Required text fields stay multipart fields; ordinary JSON templates retain their behavior. No provider-specific relay branch is added.test_requestandverifiedstamp. Upload/search/delete retain their scrubbed examples and dated manual evidence in the FaceCheck context fragment, without placeholder verification requests. The verifier explicitly prints SKIP for operations that need prepared inputs. Deletion requires a separate upload that has not been submitted for search.Verification
d186f990:TZ=UTC uv run --frozen --group test --with pytest-xdist pytest -n auto -q— 4,395 passed, 9 skipped. Test databases used a task-local temporary directory.Historical live verification (2026-09-15): a real own-key account completed connection, upload, demo and paid search, status polling, deletion and account info through treg. One full search deducted exactly 3 credits; upload, demo, polls and deletion deducted 0. Bogus-token connection returned 422 without creating a credential or tool. This follow-up did not repeat biometric uploads or paid searches.
The follow-up adds regression coverage for generated command → actual CLI parser/HTTP encoding, exact multipart file bytes, paths containing spaces, missing-file rejection before network access, required multipart text/boolean fields, and verifier skips without upstream calls. A browser test renders the real Vue dashboard with synthetic HTTP responses, verifies the upload guard, and checks that a normal JSON endpoint still runs.
Updated context: FaceCheck, catalog, auth-secrets, expanding-a-category and dashboard; regenerated the context map. No deployment is included.