Peter Steinberger
6016e22cc0
refactor(discord): compose native command routes
2026-03-08 01:27:05 +00:00
Peter Steinberger
547436bca7
refactor(discord): extract inbound context helpers
2026-03-08 01:27:05 +00:00
Peter Steinberger
08597e817d
fix(ci): stabilize detect-secrets baseline
2026-03-08 01:25:15 +00:00
Peter Steinberger
eb9e78d6d0
fix(discord): default missing native command args
2026-03-08 01:17:59 +00:00
Peter Steinberger
ad7399b6e6
refactor(sessions): add provider key normalizers
2026-03-08 01:17:06 +00:00
Peter Steinberger
8f719e541a
refactor(discord): extract native command session targets
2026-03-08 01:15:56 +00:00
Peter Steinberger
9d10697227
refactor(discord): extract native command context builder
2026-03-08 01:15:29 +00:00
Peter Steinberger
189cd99377
refactor(discord): require explicit outbound target hints
2026-03-08 01:15:29 +00:00
Peter Steinberger
74e3c071b2
refactor(discord): extract session key normalization
2026-03-08 01:15:29 +00:00
Peter Steinberger
c1d07b09ce
refactor(discord): extract route resolution helpers
2026-03-08 01:15:29 +00:00
Peter Steinberger
269cc22b61
refactor(telegram): split lane delivery modules
2026-03-08 01:14:16 +00:00
Peter Steinberger
1135b7f12f
refactor(telegram): precompute dm preview transport flag
2026-03-08 01:14:16 +00:00
Peter Steinberger
3987ca4099
refactor(retry): simplify telegram shouldRetry composition
2026-03-08 01:14:16 +00:00
Peter Steinberger
7b9a34939a
refactor(telegram): share error graph traversal helper
2026-03-08 01:14:16 +00:00
Peter Steinberger
f866e57de3
refactor(telegram): dedupe non-idempotent request setup
2026-03-08 01:14:16 +00:00
Peter Steinberger
7e59803df2
refactor(queue): use stable tuple key for recent message dedupe
2026-03-08 01:14:16 +00:00
Peter Steinberger
bebde34b98
refactor(sandbox): clarify fs bridge read and shell plans
2026-03-08 01:14:07 +00:00
Peter Steinberger
da88d92099
fix(gateway): fail closed for config-first secretrefs
2026-03-08 01:13:28 +00:00
Peter Steinberger
f236742dc1
fix(gateway): block cached device token override fallback
2026-03-08 01:13:28 +00:00
Peter Steinberger
a2cb80b9c4
fix(daemon): preserve envfile auth provenance
2026-03-08 01:13:28 +00:00
Peter Steinberger
ad052d661b
docs: note gateway auth follow-up hardening
2026-03-08 01:13:28 +00:00
Peter Steinberger
99cfd271d0
fix(sandbox): pin fs bridge readfile handles
2026-03-08 01:09:05 +00:00
Peter Steinberger
bc91ae9ca0
fix(discord): preserve native command session keys
2026-03-08 01:06:09 +00:00
Peter Steinberger
cf1c2cc208
fix(discord): normalize DM session keys
2026-03-08 01:06:09 +00:00
Peter Steinberger
6337666ac0
fix(telegram): restore named-account DM fallback routing (from #32426 )
...
Rebased and landed contributor work from @chengzhichao-xydt for the
Telegram multi-account DM regression in #32351 .
Co-authored-by: Zhichao Cheng <cheng.zhichao@xydigit.com >
2026-03-08 01:05:08 +00:00
Peter Steinberger
40dfba85d8
refactor(sandbox): split fs bridge path safety
2026-03-08 01:01:40 +00:00
Peter Steinberger
eb09d8dd71
fix(telegram): land #34238 from @hal-crackbot
...
Landed from contributor PR #34238 by @hal-crackbot.
Co-authored-by: Hal Crackbot <hal@crackbot.dev >
2026-03-08 00:56:58 +00:00
Peter Steinberger
09cfcf9dd5
fix(sandbox): anchor fs-bridge mkdirp
2026-03-08 00:55:34 +00:00
Peter Steinberger
a505be78ab
fix(telegram): land #38906 from @gambletan
...
Landed from contributor PR #38906 by @gambletan.
Co-authored-by: gambletan <ethanchang32@gmail.com >
2026-03-08 00:54:49 +00:00
Peter Steinberger
4869e24915
fix(telegram): land #34983 from @HOYALIM
...
Landed from contributor PR #34983 by @HOYALIM.
Co-authored-by: Ho Lim <subhoya@gmail.com >
2026-03-08 00:53:19 +00:00
Vincent Koc
d6d04f361e
fix(ollama): preserve local limits and native thinking fallback ( #39292 )
...
* fix(ollama): support thinking field fallback in native stream
* fix(models): honor explicit lower token limits in merge mode
* fix(ollama): prefer streamed content over fallback thinking
* changelog: note Ollama local model fixes
2026-03-07 16:53:02 -08:00
Peter Steinberger
5edcab2eee
fix(queue): land #33168 from @rylena
...
Landed from contributor PR #33168 by @rylena.
Co-authored-by: Rylen Anil <rylen.anil@gmail.com >
2026-03-08 00:51:11 +00:00
Peter Steinberger
149ae45bad
fix(cron): preserve manual timeoutSeconds on add
2026-03-08 00:48:57 +00:00
Peter Steinberger
e66c418c45
refactor(cron): normalize legacy delivery at ingress
2026-03-08 00:48:57 +00:00
Peter Steinberger
9b99787c31
refactor(cron): extract delivery tool policy helpers
2026-03-08 00:48:57 +00:00
Peter Steinberger
45d3e62f50
refactor(cron): extract agent defaults merge helpers
2026-03-08 00:48:56 +00:00
Peter Steinberger
6b18ec479c
refactor(cron): centralize initial delivery defaults
2026-03-08 00:48:56 +00:00
Peter Steinberger
e758d49361
refactor(plugins): extract alias candidate resolution
2026-03-08 00:48:56 +00:00
Peter Steinberger
7ac7b39eff
refactor(daemon): extract gateway token drift helper
2026-03-08 00:48:56 +00:00
Edward
02eef1d45a
fix(telegram): use group allowlist for native command auth in groups ( #39267 )
...
* fix(telegram): use group allowlist for native command auth in groups
Native slash commands (/status, /model, etc.) in Telegram supergroups
and forum topics reject authorized senders with "not authorized" even
when the sender is in groupAllowFrom.
The bug is in resolveTelegramCommandAuth — the final commandAuthorized
check only passes DM allowFrom as an authorizer, so senders who are
authorized via groupAllowFrom get rejected. Regular messages don't have
this problem because they go through evaluateTelegramGroupPolicyAccess
which correctly uses effectiveGroupAllow.
Add effectiveGroupAllow as a second authorizer when the message comes
from a group. resolveCommandAuthorizedFromAuthorizers uses .some(), so
either DM or group allowlist matching is sufficient.
Fixes #28216
Fixes #29135
Fixes #30234
* fix(test): resolve TS2769 type errors in group-auth test
Remove explicit tuple type annotations on mock.calls.filter() callbacks
that conflicted with vitest's mock call types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
* test(telegram): cover topic auth rejection routing
* changelog: note telegram native group command auth fix
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-03-07 16:47:57 -08:00
Vincent Koc
0d66834f94
Daemon: scope relaxed systemd probes to install flows
2026-03-07 16:45:18 -08:00
Vincent Koc
fcb990e369
Node Host: allowlist password precedence labels
2026-03-07 16:43:22 -08:00
Vincent Koc
ac02529844
Gateway Auth: allowlist connection auth precedence fixtures
2026-03-07 16:43:22 -08:00
Vincent Koc
83290c5cef
Discord: format exec approval tests
2026-03-07 16:43:22 -08:00
Vincent Koc
60441c8ced
Systemd: allowlist environment file fixtures
2026-03-07 16:43:21 -08:00
Vincent Koc
a56841b98c
Daemon: harden WSL2 systemctl install checks ( #39294 )
...
* Daemon: harden WSL2 systemctl install checks
* Changelog: note WSL2 daemon install hardening
* Daemon: tighten systemctl failure classification
2026-03-07 16:43:19 -08:00
Peter Steinberger
f195af0b22
fix(sandbox): anchor fs-bridge destructive ops
2026-03-08 00:41:12 +00:00
Peter Steinberger
9d2b292998
fix(exec-approvals): honor allow-always for bash script invocations
...
Landed from contributor PR #35137 by @yuweuii.
Co-authored-by: yuweuii <82372187+yuweuii@users.noreply.github.com >
2026-03-08 00:39:54 +00:00
Vincent Koc
ca37a4e82e
changelog: note telegram groupAllowFrom sender validation fix
2026-03-07 16:36:16 -08:00
Peter Steinberger
c6575891c7
fix(exec): inherit ask from exec-approvals.json when tools.exec.ask unset
...
Landed from contributor PR #29187 by @Bartok9.
Co-authored-by: Bartok9 <259807879+Bartok9@users.noreply.github.com >
2026-03-08 00:35:50 +00:00
