Commit Graph

451 Commits

Author SHA1 Message Date
Peter Steinberger
753183e081 build(deps): update workspace dependencies 2026-04-18 18:04:56 +01:00
Peter Steinberger
24431e5114 build: declare qa-lab aimock runtime dependency 2026-04-17 02:57:18 +01:00
Peter Steinberger
77e6e4cf87 refactor: move memory embeddings into provider plugins 2026-04-17 02:57:18 +01:00
Gustavo Madeira Santana
bb7e9823a8 QA Lab: add provider registry
Move mock and live provider behavior behind provider-owned definitions so suite, manual, Matrix, and transport lanes share defaults, auth staging, model config, and standalone server startup.

Add AIMock as a first-class local provider mode while keeping mock-openai as the scenario-aware deterministic lane.
2026-04-16 21:24:59 -04:00
Peter Steinberger
5c1c52f870 build: bump protobufjs override 2026-04-17 00:22:58 +01:00
Peter Steinberger
350aa6343a build: bump basic-ftp override 2026-04-16 23:28:56 +01:00
Gustavo Madeira Santana
988447ca24 QA Matrix: expand contract coverage 2026-04-16 16:18:54 -04:00
Mason Huang
fbccc18e74 fix(deps): bump hono to 4.12.14 and @hono/node-server to 1.19.14 (GHSA-458j-xx4x-4375) (#67613) 2026-04-16 18:23:53 +08:00
Mason Huang
2c2dc00fb4 fix(deps): bump dompurify to 3.4.0 (#67614) 2026-04-16 18:18:55 +08:00
Peter Steinberger
1bca9ba479 fix(release): mirror bundled runtime deps 2026-04-15 12:29:15 +01:00
Vincent Koc
c727388f93 fix(plugins): localize bundled runtime deps to extensions (#67099)
* fix(plugins): localize bundled runtime deps to extensions

* fix(plugins): move staged runtime deps out of root

* fix(packaging): harden prepack and runtime dep staging

* fix(packaging): preserve optional runtime dep staging

* Update CHANGELOG.md

* fix(packaging): harden runtime staging filesystem writes

* fix(docker): ship preinstall warning in bootstrap layers

* fix(packaging): exclude staged plugin node_modules from npm pack
2026-04-15 12:04:31 +01:00
Gustavo Madeira Santana
82a2db71e8 refactor(qa): split Matrix QA into optional plugin (#66723)
Merged via squash.

Prepared head SHA: 27241bd089
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-04-14 16:28:57 -04:00
Vincent Koc
a848ddaa7e fix(deps): patch follow-redirects vulnerability 2026-04-14 19:00:55 +01:00
Frank Yang
d86527d8c6 fix(whatsapp): harden Baileys media upload hotfix (#65966)
Merged via squash.

Prepared head SHA: b5db59b8fe
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com>
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com>
Reviewed-by: @frankekn
2026-04-14 21:34:23 +08:00
Peter Steinberger
3deea5a426 fix: mirror baileys root dependency 2026-04-13 20:49:39 -07:00
Peter Steinberger
67ffb6f6c2 fix: keep baileys plugin-local 2026-04-13 20:49:39 -07:00
Vincent Koc
9376f52419 fix(ci): mirror whatsapp runtime dependency 2026-04-14 00:01:44 +01:00
Vincent Koc
8ab89989c2 fix(ci): restore plugin-local whatsapp deps 2026-04-13 23:26:25 +01:00
Vincent Koc
cc2a377009 fix(ci): repair baileys lockfile snapshot 2026-04-13 22:49:26 +01:00
Vincent Koc
36a58e714c fix(ci): mirror whatsapp runtime dependency 2026-04-13 22:37:25 +01:00
Vincent Koc
f3283a330b fix(ci): repair extension boundary contracts 2026-04-13 22:37:25 +01:00
Val Alexander
9315302516 fix(ui): replace marked.js with markdown-it to fix ReDoS UI freeze (#46707) thanks @zhangfnf
Replace marked.js with markdown-it for the control UI chat markdown renderer
to eliminate a ReDoS vulnerability that could freeze the browser tab.

- Configure markdown-it with custom renderers matching marked.js output
- Add GFM www-autolink with trailing punctuation stripping per spec
- Escape raw HTML via html_block/html_inline overrides
- Flatten remote images to alt text, preserve base64 data URI images
- Add task list support via markdown-it-task-lists plugin
- Trim trailing CJK characters from auto-linked URLs (RFC 3986)
- Keep marked dependency for agents-panels-status-files.ts usage

Co-authored-by: zhangfan49 <zhangfan49@baidu.com>
Co-authored-by: Nova <nova@openknot.ai>
2026-04-13 16:08:35 -05:00
mazhe-nerd
9e2ac8a1cb feat: Streamline Feishu channel onboarding with QR code scan-to-create flow (#65680)
Add QR-based app registration, improve Feishu onboarding flows, support direct login entry, add group chat policy setup, reduce log noise, and update docs.
2026-04-13 18:03:44 +08:00
Peter Steinberger
ee601ae993 fix(matrix): mirror staged runtime dependencies 2026-04-13 10:32:22 +01:00
Peter Steinberger
45f800f4f8 fix(matrix): sync runtime dependency lockfile 2026-04-13 10:29:08 +01:00
Rugved Somwanshi
0cfb83edfa feat: LM Studio Integration (#53248)
* Feat: LM Studio Integration

* Format

* Support usage in streaming true

Fix token count

* Add custom window check

* Drop max tokens fallback

* tweak docs

Update generated

* Avoid error if stale header does not resolve

* Fix test

* Fix test

* Fix rebase issues

Trim code

* Fix tests

Drop keyless

Fixes

* Fix linter issues in tests

* Update generated artifacts

* Do not have fatal header resoltuion for discovery

* Do the same for API key as well

* fix: honor lmstudio preload runtime auth

* fix: clear stale lmstudio header auth

* fix: lazy-load lmstudio runtime facade

* fix: preserve lmstudio shared synthetic auth

* fix: clear stale lmstudio header auth in discovery

* fix: prefer lmstudio header auth for discovery

* fix: honor lmstudio header auth in warmup paths

* fix: clear stale lmstudio profile auth

* fix: ignore lmstudio env auth on header migration

* fix: use local lmstudio setup seam

* fix: resolve lmstudio rebase fallout

---------

Co-authored-by: Frank Yang <frank.ekn@gmail.com>
2026-04-13 15:22:44 +08:00
Peter Steinberger
5da237c887 fix(ci): refresh qa-lab lockfile 2026-04-12 19:45:46 -07:00
Peter Steinberger
910a0e40d2 chore: update dependencies 2026-04-12 19:19:06 +01:00
Vincent Koc
5b6667ef97 fix(ci): gate static import cycles with madge 2026-04-12 12:41:18 +01:00
HDYA
26f633b604 feat(msteams): add federated credential support (certificate + managed identity) (#53615)
* feat(msteams): add federated authentication support (certificate + managed identity + workload identity)

* msteams: fix vitest 4.1.2 compat, type errors, and regenerate config baseline

* msteams: fix lint errors, update fetch allowlist, regenerate protocol Swift

* fix(msteams): gate secret-only delegated auth flows

* fix(ci): unblock gateway watch and install smoke

* fix(ci): restore mergeability for pr 53615

* fix(ci): restore channel registry helper typing

* fix(ci): refresh raw fetch guard allowlist

---------

Co-authored-by: Chudi Huang <Chudi.Huang@microsoft.com>
Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
2026-04-11 13:29:22 -05:00
Peter Steinberger
40beb68fb0 chore: remove legacy shim packages 2026-04-11 14:07:29 +01:00
Peter Steinberger
3b6fac85ea chore: prepare 2026.4.10 release 2026-04-11 03:22:18 +01:00
sudie-codes
0f19271092 msteams: add message actions — pin, unpin, read, react, reactions (#53432)
* msteams: add pin/unpin, list-pins, and read message actions

Wire up Graph API endpoints for message read, pin, unpin, and list-pins
in the MS Teams extension, following the same patterns as edit/delete.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* msteams: address PR review comments for pin/unpin/read actions

- Handle 204 No Content in postGraphJson (Graph mutations may return empty body)
- Strip conversation:/user: prefixes in resolveConversationPath to avoid Graph 404s
- Remove dead variable in channel pin branch
- Rename unpin param from messageId to pinnedMessageId for semantic clarity
- Accept both pinnedMessageId and messageId in unpin action handler for compat

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* msteams: resolve user targets + add User-Agent to Graph helpers

- Resolve user:<aadId> targets to actual conversation IDs via conversation
  store before Graph API calls (fixes 404 for DM-context actions)
- Add User-Agent header to postGraphJson/deleteGraphRequest for consistency
  with fetchGraphJson after rebase onto main

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* msteams: resolve DM targets to Graph chat IDs + expose pin IDs

- Prefer cached graphChatId over Bot Framework conversation IDs for user
  targets; throw descriptive error when no Graph-compatible ID is available
- Add `id` field to list-pins rows so default formatters surface the pinned
  resource ID needed for the unpin flow

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* msteams: add react and reactions (list) message actions

* msteams: fix reaction count undercount and remove unpin messageId fallback

* msteams: wire pinnedMessageId through CLI/tool schema, add channel pin beta warnings, add list-pins pagination

* msteams: address PR #53432 remaining review feedback

* fix(msteams): route channel actions via teamId/channelId path (#53432)

* msteams: add unpin pinnedMessageId test coverage (#53432)

* fix(msteams): keep graph routing scoped to graph actions

* fix(msteams): align graph routing context types

* msteams: route fetchGraphAbsoluteUrl through fetchWithSsrFGuard

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
2026-04-10 20:25:57 -05:00
Peter Steinberger
796ea57378 test: validate Codex app-server config 2026-04-10 22:43:44 +01:00
Peter Steinberger
31a0b7bd42 feat: add Codex app-server controls 2026-04-10 22:19:00 +01:00
Peter Steinberger
e892def77c chore: bump basic-ftp override 2026-04-10 21:44:16 +01:00
Peter Steinberger
b174d8aed4 build: refresh pi-ai lockfile snapshot 2026-04-10 21:22:16 +01:00
Peter Steinberger
2bd56b8c38 build: refresh Codex harness lockfile 2026-04-10 21:22:16 +01:00
Peter Steinberger
b79f9f965e fix: address Codex harness review issues 2026-04-10 21:22:16 +01:00
Peter Steinberger
59925c1a74 chore: update dependencies and oxc tooling 2026-04-10 19:28:42 +01:00
Peter Steinberger
8127c6cc15 build(deps): update workspace dependencies 2026-04-10 19:17:39 +01:00
Shadow
d5b25f81cf update carbon 2026-04-10 01:53:36 -05:00
sudie-codes
a59a9bfb07 fix(msteams): accept Bot Framework audience in JWT validation (#58249) (#62674)
* fix(msteams): use jsonwebtoken directly for JWT validation with correct audience (#58249)

* chore(msteams): regenerate lockfile for jwt deps

* fix(msteams): clean up unused serviceUrl parameter in JWT validator

* test(msteams): cover STS issuer in JWT validation

* fix(msteams): type jwt verify audiences and issuers

---------

Co-authored-by: Brad Groux <bradgroux@users.noreply.github.com>
2026-04-09 22:05:54 -05:00
Altay
004bab53fa fix(ci): repair protocol drift and audit failures (#63917)
* CI: fix protocol drift and audit failures

* CI: narrow axios release-age exception

* CI: drop ineffective feishu override

* test: fix workspace-root guard mock typing
2026-04-09 22:07:51 +01:00
Peter Steinberger
0fce013ebf build: mirror bundled plugin runtime deps 2026-04-09 00:31:08 +01:00
Peter Steinberger
9286de5d95 fix(deps): patch basic-ftp advisory 2026-04-08 22:49:45 +01:00
Peter Steinberger
1979a28803 fix: patch hono security advisories 2026-04-08 18:02:54 +01:00
Peter Steinberger
edf6b490a6 fix: harden bundled plugin dependency release checks 2026-04-08 15:15:44 +01:00
scoootscooob
d52d5ad6ff release: mirror bundled channel deps at root (#63065)
Merged via squash.

Prepared head SHA: ac26799a54
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Co-authored-by: scoootscooob <167050519+scoootscooob@users.noreply.github.com>
Reviewed-by: @scoootscooob
2026-04-08 04:00:17 -07:00
Peter Steinberger
b4034b32c3 fix: honor Slack Socket Mode env proxies (#62878) (thanks @mjamiv) 2026-04-08 05:38:45 +01:00