Ensure runtime plugins are loaded before resolving cron delivery context,
preventing multi-channel ambiguity errors when using external channels.
Implemented via a lazy facade to preserve fast isolated agent startup.
Threads the runtime config through buildKnownAgentRunFailureReplyPayload
into resolveExternalRunFailureTextForConversation so the documented
agents.defaults.silentReply / surfaces.<id>.silentReply policy is
consulted before silencing failure copy in groups/channels. Default
policy (group: allow, direct: disallow, internal: allow) preserves the
existing 'groups stay quiet on generic runner failure' behavior; opting
into silentReply.group: disallow now lets the run-failure copy reach
the chat instead of disappearing.
Resolves an internal inconsistency: route-reply.ts already routes
NO_REPLY-style payloads through resolveSilentReplyPolicy(), but the
failure-fallback path in agent-runner-execution.ts hardcoded silence on
chat type alone, ignoring the operator-visible knob.
Refs #82060.
* feat: attach recent inbound history images
* fix: bound recent history media downloads
* fix: preserve sticker history media
* fix: enforce history media cap for stickers
* refactor: name agent turn attachments generically
* refactor: share pending history media recording
* fix: gate historical media attachment visibility
* fix: avoid media runtime on text-only turns
* fix: preserve fallback history media selection
* fix: avoid sparse media history index collisions
* fix: skip history images for current non-image media
* test: import history media type directly
* test: satisfy agent media runtime mock lint
* fix: respect mocked Slack media fetches
* fix: settle history media recording races
Keep queued system-event owner downgrades as structured runtime metadata while rendering the model-visible prompt as plain `System:` lines.
This preserves least-privilege wakeups for webhook/node/exec/cron/reaction/hook producers, keeps legacy `trusted: false` compatibility for installed plugins and older hosts, and updates representative gateway, agent, cron, plugin, and OpenGrep coverage.
* fix(agents): scope provider SSRF trust by origin
* fix(provider): preserve explicit private-network deny
* docs(provider): document exact-origin SSRF trust
* test(provider): cover exact-origin SSRF edges
* docs(provider): align local model private-origin guidance
* refactor(ssrf): keep policy merging in infra
* test(ssrf): cover exact-origin trust through guard
* test(ssrf): block sibling private-origin redirects
* fix(provider): keep loopback trust origin-scoped
* fix(provider): block metadata origin trust
* fix(ssrf): keep metadata rebinding blocked
* fix(ssrf): block cloud metadata origins
* fix(ssrf): block ipv6 metadata origins
* fix(ssrf): block embedded metadata origins
* test(ssrf): cover embedded link-local metadata
* test(provider): cover custom anthropic proxy classification
* test(provider): widen transport policy mock
* test(plugin-sdk): assert metadata-IP allowedOrigins entries are rejected
Plugin authors can construct an SsrFPolicy that lists any well-formed
http(s) origin in allowedOrigins. The abuse-resistance lives one layer
deeper, in resolvePinnedHostnameWithPolicy's metadata/link-local block.
Add an SDK-level smoke test asserting that contract directly:
- AWS/Alibaba IMDS IPv4 literals, GCP metadata canonical hostname,
IPv6 ULA metadata literal, and non-metadata link-local IPv4 entries
build a policy via ssrfPolicyFromHttpBaseUrlAllowedOrigin and are
then rejected at resolvePinnedHostnameWithPolicy.
- DNS rebinding from a trusted private DNS origin to a metadata IP is
rejected even when the request hostname is origin-trusted.
This would fail if the SDK helper or resolveSsrFPolicyForUrl ever
short-circuited past the metadata block.
* chore(docs): regenerate baselines after upstream rebase
upstream/main moved between rebases; the merged source state for the
PR's `src/config/schema.help.ts` change and the upstream plugin-sdk
surface changes both produce different hashes than the committed
baselines, so `config:docs:check` and `plugin-sdk:api:check` would fail.
Regenerated via `pnpm config:docs:gen` + `pnpm plugin-sdk:api:gen` on
Crabbox; both baselines verified with their respective `--check`
generators.
* test(plugin-sdk): assert SSRF blocked error class
* fix(lint): satisfy exact-origin PR lint rules
* docs: clarify custom provider origin trust
* chore(docs): refresh plugin sdk api baseline
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
