mirror of
https://github.com/penpot/penpot.git
synced 2026-11-12 13:00:37 +00:00
ca616a39ed
Dashboard actions made by a plugin or the MCP through penpotMgmt reached the backend audit log without event origin, so they looked like actions made by hand in the dashboard. The backend reads the origin from the x-event-origin header, which rp/cmd! only sends when the params carry ::ev/origin in their meta. Tag the params of every penpotMgmt mutation with the same meta that se/add-event sets (mcp or plugin). The rename, share and team update events now keep that meta on the RPC params, so setters send it too, and set-file-variants-shared takes the caller origin instead of a fixed dashboard one. Closes #12901 AI-assisted-by: claude-opus-5-5