feat(connection): add multi-deployment read-only Jenkins providers

[guoxianzhe]

Problem

Connection 当前只支持 GitHub、Bitbucket Server、Jira Server 和 Confluence Server，无法让 Direct MCP 或 Delegated Consumer 在不接触 Jenkins 凭证的前提下查询公司多个 Jenkins deployment 的 Job、Build 和 Queue 状态。每个公司 Jenkins deployment 必须进入独立的 ProviderRelease、Credential、Grant、受控 egress 和审计边界，不能共用授权槽位，也不能由调用方提交任意 endpoint 或认证信息。

Scope

• 建立多 Jenkins deployment 模型：每个经审核的实例使用独立稳定 Provider ID、ProviderRelease、固定 origin、Credential 和 Grant，共享同一个参数化只读 Adapter；不得把多个实例折叠成同一 providerId=jenkins。
• jenkins-ci 固定为 https://jenkins-ci.agoralab.co；因其现有 OAuth 网关尚无 Connection 机器认证契约，只保留 catalog/adapter 实现，不在 runtime 开放连接。
• jenkins-release 固定为 http://114.94.148.35:8010，仅在具名 LA3 supervised pilot 中按用户明确接受的残余风险开放；必须由 LA3 白名单直连，不使用代理，不扩展为任意 HTTP Provider，后续仍须迁移到 HTTPS。
• 使用用户独立提供的 Jenkins username + API Token credential，不接受 Jenkins 登录密码；通过 Jenkins whoAmI API 验证稳定外部账号身份，原始 credential 只在服务端执行边界使用。
• 提供只读 Action：读取当前用户、列出顶层 Jobs、读取指定 Job、Build、Queue item，以及按 start 游标分页读取 Build console log；Job full name 由服务端编码为 Jenkins folder path，调用方不能提交 URL、header 或 auth mode。
• 所有请求使用固定 origin、禁止 redirect、限制响应大小并映射认证、权限、404、限流和 Provider 错误；除具名 jenkins-release pilot 外禁止明文 HTTP。
• 将 Jenkins catalog、Adapter、运行时装配、Connection Web credential 表单和自动化测试接入现有 Provider 流程。
• Console log 按用户明确要求不做内容脱敏，单次最多返回 256 KiB；授权页面和 Action guide 必须明确日志可能包含敏感构建输出，该结果进入当前调用响应与既有审计/保留边界。
• ProviderRelease 升级且 auth profile、Credential scope 与稳定外部账号兼容时，用户通过“升级连接”复用服务端 current Credential完成 identity proof，不重新输入只展示一次的 API Token；Token 无效、scope 不足、认证方式变化、换号或主动轮换时才进入“更新凭证”。
• 不包含触发/停止/重放构建、artifact 内容下载、任意 URL 访问和 Shared Connection；写 Action 另行设计幂等与 reconciliation 契约。

Acceptance criteria

• AC-1: PRD 和 HLD 明确公司多个 Jenkins deployment 的建模规则，并记录两个固定 deployment、认证、identity proof、Action 范围、写操作排除项和 jenkins-release HTTP pilot 风险边界。
• AC-2: 用户可以在 Connection Web 用 Jenkins username + API Token 建立 Jenkins Connection；无效 credential、身份缺失或 redirect 均 fail closed，Secret 不出现在响应、日志或审计投影中。
• AC-3: 已授权 Consumer 可以对 runtime 开放的 jenkins-release 执行 deployment-scoped 的 get_current_user、list_jobs、get_job、get_build、get_build_console 和 get_queue_item Action，且所有网络请求只发往固定 LA3 白名单 origin；jenkins-ci 在机器认证契约确认前不开放连接。
• AC-7: get_build_console 使用固定 progressive log endpoint，要求 jobFullName、buildNumber 和非负 start，单次最多返回 256 KiB、nextStart 和 moreData；不做内容脱敏，不接受 URL 或任意请求头。
• AC-8: requiresReconnect 的个人 Connection 可以通过 credential-preserving upgrade 使用 current Credential验证并迁移到 current ProviderRelease；浏览器不接收 Credential，身份不一致、并发 Credential 轮换或 Provider 验证失败时 fail closed，新增 Action 仍单独 preview/consent。
• AC-4: 未授权 Consumer、其他 Principal、错误 ProviderRelease、任意 URL/路径注入及越权 Jenkins 响应均被拒绝，并且不产生旁路 Provider 请求。
• AC-5: jenkins-release catalog 可由 runtime 幂等发布并出现在受支持 Provider 列表中，不替换现有 Provider declaration；测试证明两个 Jenkins deployment profile 会产生不同 Provider/Release/Action identity，且共享 Adapter 行为而不共享 endpoint 或 Credential。
• AC-6: Adapter、runtime wiring、credential form 和核心负向路径具备自动化回归测试；真实环境验证记录实际 deployment、身份、read Action、reauth/revoke 和错误路径，缺少真实凭证时明确标记为人工验证而不声称上线。

Validation

• pnpm install --frozen-lockfile
• pnpm check
• pnpm check-types
• pnpm test
• pnpm build
• pnpm smoke
• pnpm docker:build
• Markdown lint、link check、workflow policy、actionlint 和 git diff --check
• 使用公司 Jenkins 测试账号执行 credential validation、至少一个 Job/Build/Queue read、reauth、revoke、401/403/404 和 redirect 拒绝验证；不执行任何构建写操作。

Blocked by

None

[github-actions]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[guoxianzhe]

已发布并部署 supervised pilot：

• commit: 7d91650d4617b8d50e18a3d2eb4bfe3615fe96f2
• tag/images: v0.0.31
• GHCR run: https://github.com/AgoraIO-Extensions/agent-infra/actions/runs/35197119827
• Helm release: connection-local revision 71，API/Web v0.0.31 均 1/1 Ready，API /healthz 200
• bootstrap: connection-bootstrap-1 succeeded，catalog/migration 无错误

真实 Jenkins E2E 暂时受网络白名单阻塞：旧 API Pod 位于节点 98.96.227.14 时访问 http://114.94.148.35:8010/whoAmI/api/json 返回 200；升级后的 API Pod 位于节点 98.96.227.24，同一请求 10 秒超时。说明白名单只覆盖部分 LA3 节点出口，需覆盖 Connection workload 的稳定出口/全部可能节点后再输入 API Token完成成功路径、reauth/revoke 和 read Action 验证。未输出或使用真实 Jenkins Token。

[guoxianzhe]

已完成与线上 v0.0.32 的 GitHub OAuth v8/Reviewer health 改动合并并部署：

• merged commit: 974f15979a9e4318ebd086be13caea6d83c1a3a0
• tag/images: v0.0.33
• GHCR run: https://github.com/AgoraIO-Extensions/agent-infra/actions/runs/35200847941
• bootstrap job: connection-bootstrap-v0-0-33 succeeded
• Helm: connection-local revision 75, API/Web v0.0.33 均 1/1 Ready
• 新 API Pod: connection-api-7c9c88589d-gtsvc，出口 98.96.227.4
• API health: 200
• Jenkins http://114.94.148.35:8010/whoAmI/api/json: 200，X-Jenkins: 2.544，271ms

滚动部署后出口从 98.96.227.19 变为 98.96.227.4，仍可访问 Jenkins，证明当前 98.96.227.0/26 网段白名单已生效。真实 API Token 成功路径仍需用户在 Connection Web 输入后验证。

[guoxianzhe]

真实 Jenkins Provider E2E 已通过（Connection MCP / Codex grant）：

• Connection: connection-c042e69b-f0c3-479c-9b54-9262b1b33a5f, ACTIVE, account guoxianzhe
• Grant: grant-41604755-2f81-445b-baf7-4dbba6f371d4
• jenkins-release.get_current_user@v1: SUCCEEDED, call call-25c8e5b7-2ed7-4e5e-a102-222091013422, identity guoxianzhe
• jenkins-release.list_jobs@v1: SUCCEEDED, call call-c0a5c2bb-7709-43b5-a86b-916dc3d3267f, returned authorized top-level Jenkins metadata
• jenkins-release.get_job@v1 with jobFullName=bb: SUCCEEDED, call call-29d35425-2d0c-4c9b-aee0-38b29e7ea49e, exact job bb, buildable=true
• All calls were READ; no console log, artifact, queue mutation, or build trigger executed. Provider credential was resolved server-side and not exposed.
• Runtime: v0.0.33, Helm revision 75; new Pod egress 98.96.227.4 reached Jenkins 2.544 with HTTP 200 after rollout.

Remaining AC-6 evidence: reauth/revoke and explicit 401/403/404 paths have automated coverage but were not destructively exercised against this live personal Connection.

[guoxianzhe]

Console log capability delivered:

• commit: 1dd0ab5
• tag/images: v0.0.34
• GHCR run: https://github.com/AgoraIO-Extensions/agent-infra/actions/runs/35205523899
• bootstrap: connection-bootstrap-v0-0-34 succeeded
• Helm revision 76; API/Web v0.0.34 1/1 Ready
• new immutable catalog: jenkins-release-connection-v2, six @v2 READ actions including get_build_console
• console contract: fixed progressiveText endpoint, required byte cursor start, 256 KiB stream cap, returns text/nextStart/moreData/truncated; no content redaction per explicit owner decision

Post-rollout boundaries: existing v1 Connection reports requiresReconnect=true and Codex still sees five v1 actions until user reconnects/re-authorizes v2. New API Pod egress is 98.96.227.24; Jenkins request currently times out although API health is 200, showing the Jenkins network range allowlist remains inconsistent across LA3 node exits.

[guoxianzhe]

Credential-preserving Provider Connection Upgrade delivered:

• commit: 7fdfb7c
• tag/images: v0.0.35
• GHCR run: https://github.com/AgoraIO-Extensions/agent-infra/actions/runs/35207614962
• Helm revision 77; API/Web v0.0.35 1/1 Ready
• new API: POST /api/v1/connection/connections/{connectionId}/upgrade
• server decrypts current Credential, validates new ProviderRelease identity and exact scope, requires stable external account, and writes with expected Connection/CredentialVersion CAS; browser never receives or resubmits Token
• UI separates 升级连接 from explicit 更新凭证; GitHub OAuth retains 重新连接 behavior
• new Pod health 200, egress 98.96.227.14, Jenkins 2.544 HTTP 200

Current Jenkins v1 Connection still reports requiresReconnect=true until the user clicks 升级连接; after successful upgrade, the newly added console Action must be separately previewed/confirmed.

[guoxianzhe]

Provider upgrade error diagnosed and fixed:

• v0.0.35 attempts returned RESULT_UNCERTAIN before any account/credential/grant mutation; DB showed three browser commands stuck STARTED while Connection remained v1 revision 1 with original active Credential/Grant.
• root cause: PostgreSQL rejects LEFT JOIN ... FOR UPDATE OF credential because the nullable side of an outer join cannot be row-locked.
• fix commit: f001f63 splits Account and active Credential locks, preserving expected Connection/CredentialVersion CAS.
• tag/images: v0.0.36; GHCR run https://github.com/AgoraIO-Extensions/agent-infra/actions/runs/35210180363
• deployed Helm revision 78; API/Web v0.0.36 1/1 Ready.

The failed commands had no effect and need no rollback. Retry once with the new UI-generated idempotency key.

[guoxianzhe]

Draft implementation PR: #602. The Jenkins delivery remains pending final human validation for reauth/revoke and deployment error paths; the regional migration work is stacked separately in #603.

[guoxianzhe]

LA3 has been redeployed with combined image v0.0.38 (commit 9756ac5), which contains current connection v0.0.37, Jenkins v0.0.36, and the regional transport slice.

Deployment evidence:

• Helm revision 86 is deployed.
• API/Web are v0.0.38, 1/1 Ready; public /healthz returns 200.
• Web bundle contains jenkins-release.
• Bootstrap Job connection-bootstrap-v0-0-38 completed successfully.

Current provider network caveat: the new API Pod egress is 98.96.227.24; http://114.94.148.35:8010/whoAmI/api/json timed out after 10 seconds. Jenkins is restored in the product/catalog, but live execution remains subject to the unresolved LA3 Jenkins allowlist path until GZ3 cutover.

[guoxianzhe]

Local/deployed Jenkins routing is now explicit and fixed (commit 29f24a6): JENKINS_RELEASE_ROUTE=internal maps only the reviewed public origin to http://10.80.1.129:8080; public remains http://114.94.148.35:8010. Arbitrary URLs are rejected, and Provider/Release/Credential/Grant identity is unchanged. Local direct probe returned Jenkins 2.544 HTTP 200 in 5 ms. API tests 48 passed, Jenkins tests 7 passed, typecheck/build/smoke passed. Helm defaults deployed environments to public.

[guoxianzhe]

Local internal-route Jenkins E2E passed against http://10.80.1.129:8080 using the real Connection authorization path:

• Connection, Credential, and Codex Grant are ACTIVE for jenkins-release-connection-v2.
• Grant contains exactly six Jenkins v2 READ ActionVersions.
• get_current_user@v2 returned external account guoxianzhe.
• get_build@v2 and get_build_console@v2 successfully read EP/build_all #901 and its failed child builds.
• Parent #901 result is FAILURE; failed children are EP/build_ios #1004 and EP/build_android #1158.
• Android decisive errors: only virtual member functions can be marked 'override' and only virtual member functions can be marked 'final' at IAgoraRtcEngine_wrapper_gen.h:122.
• iOS terminates while compiling iris_rtc_json_serializer_gen.cc for armv7 and exits through hudson.AbortException: script returned exit code 65; the available console projection did not expose a more specific compiler diagnostic.

All calls used connection-local; the LA3 MCP server was explicitly disabled for the isolated CLI run. No Jenkins write Action was invoked.

[guoxianzhe]

Upgrade UX follow-up shipped in commit f50ca3f: the selected card now disables the action and shows 正在升级 while pending; success renders an explicit status banner 连接已升级，可以重新确认客户端授权。; failures retain the existing error surface. Connection Web tests: 29 passed; typecheck/build and focused Biome passed.