Peter Steinberger
fe807e4bed
chore(release): bump 2026.2.27 and split changelog
2026-02-27 16:09:28 +01:00
Peter Steinberger
31c0b04c49
fix(nextcloud-talk): keep startAccount pending until abort ( #27897 )
2026-02-26 22:00:25 +00:00
Peter Steinberger
53575f2013
fix: add googlechat lifecycle regression test ( #27384 ) (thanks @junsuwhy)
2026-02-26 21:49:26 +00:00
Chang Shu-Huai
eb6fa0dacf
fix(googlechat): keep startAccount pending until abort to prevent restart loop
2026-02-26 21:49:26 +00:00
Peter Steinberger
564be6b402
refactor(channels): unify dm pairing policy flows
2026-02-26 22:36:20 +01:00
Peter Steinberger
c53b11dccd
test: fix pairing/daemon assertion drift
2026-02-26 21:24:50 +00:00
Peter Steinberger
a0c5e28f3b
refactor(extensions): use scoped pairing helper
2026-02-26 21:57:52 +01:00
Peter Steinberger
192df12d60
test(voice-call): cover verification key and header helpers
2026-02-26 21:54:09 +01:00
Peter Steinberger
535ef8991c
refactor(voice-call): enforce verified webhook key contract
2026-02-26 21:54:09 +01:00
Peter Steinberger
6f0b4caa26
refactor(voice-call): share header and guarded api helpers
2026-02-26 21:54:09 +01:00
Peter Steinberger
1aadf26f9a
fix(voice-call): bind webhook dedupe to verified request identity
2026-02-26 21:43:51 +01:00
Vincent Koc
5a453eacbd
chore(onboarding): add explicit account-risk warning for Gemini CLI OAuth and docs ( #16683 )
...
* docs: add account-risk caution to Google OAuth provider docs
* docs(plugin): add Gemini CLI account safety caution
* CLI: add risk hint for Gemini CLI auth choice
* Onboarding: require confirmation for Gemini CLI OAuth
* Tests: cover Gemini CLI OAuth risk confirmation flow
2026-02-26 15:25:42 -05:00
Vincent Koc
764cd5a310
fix(gemini-oauth): align OAuth project discovery metadata and endpoint fallbacks ( #16684 )
...
* fix(gemini-oauth): align loadCodeAssist metadata and endpoint fallback
* test(gemini-oauth): cover endpoint fallback and env project fallback
* fix(gemini-oauth): route timed fetches through ssrf guard
* test(gemini-oauth): mock guarded fetch in oauth tests
2026-02-26 15:24:35 -05:00
Peter Steinberger
8483e01a68
refactor(matrix): dedupe sender label resolution for inbound bodies
2026-02-26 20:57:05 +01:00
Peter Steinberger
01b4f42f9a
fix(matrix): preserve sender labels in Matrix BodyForAgent
2026-02-26 20:57:05 +01:00
Peter Steinberger
dc6e4a5b13
fix: harden dm command authorization in open mode
2026-02-26 19:49:36 +01:00
Peter Steinberger
d6eefe2e75
style: format auth boundary updates
2026-02-26 18:50:47 +01:00
Peter Steinberger
64de4b6d6a
fix: enforce explicit group auth boundaries across channels
2026-02-26 18:49:16 +01:00
Peter Steinberger
cd80c7e7ff
refactor: unify dm policy store reads and reason codes
2026-02-26 17:47:57 +01:00
Peter Steinberger
273973d374
refactor: unify typing dispatch lifecycle and policy boundaries
2026-02-26 17:36:16 +01:00
Shakker
b044c149c1
Mattermost: avoid raw fetch in monitor media download
2026-02-26 16:03:39 +00:00
Peter Steinberger
37a138c554
fix: harden typing lifecycle and cross-channel suppression
2026-02-26 17:01:09 +01:00
Peter Steinberger
57334cd7d8
refactor: unify channel/plugin ssrf fetch policy and auth fallback
2026-02-26 16:44:13 +01:00
Peter Steinberger
2e97d0dd95
fix: finalize teams file-consent timeout landing ( #27641 ) (thanks @scz2011)
2026-02-26 15:42:08 +00:00
AI Assistant
773ab319ef
fix(msteams): Fix code formatting
...
Remove trailing whitespace to pass oxfmt format check.
2026-02-26 15:42:08 +00:00
AI Assistant
ecbb3bcc1a
fix(msteams): Fix test timing for async file upload handling
...
Update tests to properly wait for async file upload operations:
- Use vi.waitFor() to wait for async upload completion in success case
- Use vi.waitFor() to wait for error message in cross-conversation case
- Add setTimeout delay for decline case to ensure async handler completes
- Adjust assertion order to match new execution flow (invokeResponse first)
The tests were failing because the file upload now happens asynchronously
after sending the invokeResponse, so we need to explicitly wait for the
async operations to complete before making assertions.
2026-02-26 15:42:08 +00:00
AI Assistant
09f4abdd61
fix(msteams): Send invokeResponse immediately to prevent Teams timeout ( #27632 )
...
Fix file upload 'Something went wrong' error by sending the invoke
acknowledgement before performing the file upload, rather than after.
Changes:
- Move invokeResponse to fire immediately upon receiving fileConsent/invoke
- Handle file upload asynchronously without blocking the response
- Update test to wait for async upload completion using vi.waitFor
This prevents Teams from timing out while waiting for the HTTP 200
acknowledgement during slow file uploads to OneDrive.
Fixes #27632
2026-02-26 15:42:08 +00:00
Peter Steinberger
7d9397099b
fix(bluebubbles): allow configured host for attachment SSRF guard
...
Co-authored-by: damaozi <1811866786@qq.com >
2026-02-26 16:40:57 +01:00
Peter Steinberger
051fdcc428
fix(security): centralize dm/group allowlist auth composition
2026-02-26 16:35:33 +01:00
Peter Steinberger
d8477cbb3f
fix(ci): sync protocol models and acpx version
2026-02-26 16:10:03 +01:00
Vincent Koc
6daf40d3f4
Gemini OAuth: resolve npm global shim install layouts ( #27585 )
...
* Changelog: credit session path fixes
* test(gemini-oauth): cover npm global shim credential discovery
* fix(gemini-oauth): resolve npm global shim install roots
2026-02-26 09:43:05 -05:00
Peter Steinberger
125dc322f5
refactor(feishu): unify account-aware tool routing and message body
2026-02-26 13:19:25 +01:00
Peter Steinberger
892a9c24b0
refactor(security): centralize channel allowlist auth policy
2026-02-26 13:06:33 +01:00
Peter Steinberger
cf4853e2b8
fix: avoid duplicate feishu permission-error dispatch replies ( #27381 ) (thanks @byungsker)
2026-02-26 12:03:41 +00:00
lbo728
736ec9690f
fix(feishu): merge permission error notice into main dispatch instead of separate agent turn
...
When the sender-name lookup fails with a Feishu permission error (code
99991672), the bot was dispatching two separate agent turns:
1. A dedicated permission-error notification turn
2. The regular inbound user message turn
This caused two bot replies for a single user message, degrading UX and
wasting tokens.
Fix: instead of a separate dispatch, append the permission error notice
directly to the main messageBody. The agent receives both the user's
message and the system notice in a single turn, and responds once.
Fixes #27372
2026-02-26 12:03:41 +00:00
Peter Steinberger
d671d7a0a2
fix: preserve feishu message_id in agent-visible body ( #27253 ) (thanks @xss925175263)
2026-02-26 12:02:00 +00:00
xianshishan
6d52b47076
feishu: send message_id in BodyForAgent ( fix #27218 )
2026-02-26 12:02:00 +00:00
咸士山 0668001391
db6c513d1e
feishu: include message_id in agent message body ( fix #27218 )
2026-02-26 12:02:00 +00:00
Peter Steinberger
39b5ffdaa6
fix: route feishu doc tools by agent account context ( #27338 ) (thanks @AaronL725)
2026-02-26 12:00:45 +00:00
root
58c100f66f
fix(feishu): remove hook registration, fix docx getClient call
2026-02-26 12:00:45 +00:00
root
10d9549764
fix(feishu): fix hook types and docx client call
2026-02-26 12:00:45 +00:00
root
151ee6014a
fix(feishu): route doc tools by agent account
...
Previously feishu_doc always used accounts[0], so multi-account setups created docs under the first bot regardless of the calling agent.
This change resolves accountId via a before_tool_call hook (defaulting from agentAccountId) and selects the Feishu client per call.
Fixes #27321
2026-02-26 12:00:45 +00:00
Peter Steinberger
8bdda7a651
fix(security): keep DM pairing allowlists out of group auth
2026-02-26 12:58:18 +01:00
echoVic
d08dafb08f
fix(feishu): bitable tools use listEnabledFeishuAccounts for multi-account mode ( #27244 )
...
The bitable tool registration was reading credentials directly from
top-level feishuCfg.appId/appSecret, missing the accounts.* path used
in multi-account mode. Align with drive.ts and wiki.ts by using
listEnabledFeishuAccounts() which handles both legacy and multi-account
configurations.
2026-02-26 11:56:18 +00:00
Peter Steinberger
fec3fdf7ef
test(msteams): align silent-prefix expectation with exact NO_REPLY semantics
2026-02-26 11:42:38 +00:00
Peter Steinberger
caace61ba1
chore: bump versions to 2026.2.26
2026-02-26 12:11:02 +01:00
Ayaan Zaidi
e7b600e318
chore(acpx): bump package version to 2026.2.25
2026-02-26 16:29:12 +05:30
Onur Solmaz
a7d56e3554
feat: ACP thread-bound agents ( #23580 )
...
* docs: add ACP thread-bound agents plan doc
* docs: expand ACP implementation specification
* feat(acp): route ACP sessions through core dispatch and lifecycle cleanup
* feat(acp): add /acp commands and Discord spawn gate
* ACP: add acpx runtime plugin backend
* fix(subagents): defer transient lifecycle errors before announce
* Agents: harden ACP sessions_spawn and tighten spawn guidance
* Agents: require explicit ACP target for runtime spawns
* docs: expand ACP control-plane implementation plan
* ACP: harden metadata seeding and spawn guidance
* ACP: centralize runtime control-plane manager and fail-closed dispatch
* ACP: harden runtime manager and unify spawn helpers
* Commands: route ACP sessions through ACP runtime in agent command
* ACP: require persisted metadata for runtime spawns
* Sessions: preserve ACP metadata when updating entries
* Plugins: harden ACP backend registry across loaders
* ACPX: make availability probe compatible with adapters
* E2E: add manual Discord ACP plain-language smoke script
* ACPX: preserve streamed spacing across Discord delivery
* Docs: add ACP Discord streaming strategy
* ACP: harden Discord stream buffering for thread replies
* ACP: reuse shared block reply pipeline for projector
* ACP: unify streaming config and adopt coalesceIdleMs
* Docs: add temporary ACP production hardening plan
* Docs: trim temporary ACP hardening plan goals
* Docs: gate ACP thread controls by backend capabilities
* ACP: add capability-gated runtime controls and /acp operator commands
* Docs: remove temporary ACP hardening plan
* ACP: fix spawn target validation and close cache cleanup
* ACP: harden runtime dispatch and recovery paths
* ACP: split ACP command/runtime internals and centralize policy
* ACP: harden runtime lifecycle, validation, and observability
* ACP: surface runtime and backend session IDs in thread bindings
* docs: add temp plan for binding-service migration
* ACP: migrate thread binding flows to SessionBindingService
* ACP: address review feedback and preserve prompt wording
* ACPX plugin: pin runtime dependency and prefer bundled CLI
* Discord: complete binding-service migration cleanup and restore ACP plan
* Docs: add standalone ACP agents guide
* ACP: route harness intents to thread-bound ACP sessions
* ACP: fix spawn thread routing and queue-owner stall
* ACP: harden startup reconciliation and command bypass handling
* ACP: fix dispatch bypass type narrowing
* ACP: align runtime metadata to agentSessionId
* ACP: normalize session identifier handling and labels
* ACP: mark thread banner session ids provisional until first reply
* ACP: stabilize session identity mapping and startup reconciliation
* ACP: add resolved session-id notices and cwd in thread intros
* Discord: prefix thread meta notices consistently
* Discord: unify ACP/thread meta notices with gear prefix
* Discord: split thread persona naming from meta formatting
* Extensions: bump acpx plugin dependency to 0.1.9
* Agents: gate ACP prompt guidance behind acp.enabled
* Docs: remove temp experiment plan docs
* Docs: scope streaming plan to holy grail refactor
* Docs: refactor ACP agents guide for human-first flow
* Docs/Skill: add ACP feature-flag guidance and direct acpx telephone-game flow
* Docs/Skill: add OpenCode and Pi to ACP harness lists
* Docs/Skill: align ACP harness list with current acpx registry
* Dev/Test: move ACP plain-language smoke script and mark as keep
* Docs/Skill: reorder ACP harness lists with Pi first
* ACP: split control-plane manager into core/types/utils modules
* Docs: refresh ACP thread-bound agents plan
* ACP: extract dispatch lane and split manager domains
* ACP: centralize binding context and remove reverse deps
* Infra: unify system message formatting
* ACP: centralize error boundaries and session id rendering
* ACP: enforce init concurrency cap and strict meta clear
* Tests: fix ACP dispatch binding mock typing
* Tests: fix Discord thread-binding mock drift and ACP request id
* ACP: gate slash bypass and persist cleared overrides
* ACPX: await pre-abort cancel before runTurn return
* Extension: pin acpx runtime dependency to 0.1.11
* Docs: add pinned acpx install strategy for ACP extension
* Extensions/acpx: enforce strict local pinned startup
* Extensions/acpx: tighten acp-router install guidance
* ACPX: retry runtime test temp-dir cleanup
* Extensions/acpx: require proactive ACPX repair for thread spawns
* Extensions/acpx: require restart offer after acpx reinstall
* extensions/acpx: remove workspace protocol devDependency
* extensions/acpx: bump pinned acpx to 0.1.13
* extensions/acpx: sync lockfile after dependency bump
* ACPX: make runtime spawn Windows-safe
* fix: align doctor-config-flow repair tests with default-account migration (#23580 ) (thanks @osolmaz)
2026-02-26 11:00:09 +01:00
Peter Steinberger
e915b4c64a
refactor: unify monitor abort lifecycle handling
2026-02-26 04:36:25 +01:00
SidQin-cyber
243e28df4f
fix(line): keep startAccount pending until abort signal to prevent restart loop
...
monitorLineProvider() registers the webhook HTTP route and returns
immediately. Because startAccount() directly returned that resolved
promise, the channel supervisor interpreted it as "provider exited"
and triggered auto-restart up to 10 times.
Await a promise gated on ctx.abortSignal so startAccount stays alive
for the full provider lifecycle, matching the contract expected by the
channel supervisor.
Closes #26478
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-26 03:20:57 +00:00
