Devin Robison ee316dbc4b fix(tlon): guard memex upload target (#69794) ...

* fix(tlon): guard memex upload target

* fix(tlon): harden guarded memex upload

* fix(tlon): validate hosted memex upload targets

* fix(tlon): tighten hosted domain matching

* fix(tlon): reject non-standard memex upload ports

* fix(tlon): disable memex upload redirects

* test(tlon): drop redundant mock resets in memex upload test

* chore(lint): update tlon raw-fetch allowlist for guarded memex upload

* fix(tlon): reject unparseable ship URLs in hosted-ship classifier

* fix(lint): point tlon raw-fetch allowlist at fetch callee lines

* fix(tlon): guard custom-S3 upload through fetchWithSsrFGuard

* fix(tlon): preserve scheme-less hosted ship routing and allow explicit :443

* docs(changelog): note tlon upload guard

* fix(tlon): guard memex lookup and private s3 opt-in

* fix(tlon): validate upload result URLs

2026-04-21 15:57:49 -06:00

..

acpx

fix: stage ACP and Codex runtime deps

2026-04-21 08:47:24 +01:00

active-memory

fix: gate max thinking by model support

2026-04-21 07:02:43 +01:00

alibaba

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

amazon-bedrock

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

amazon-bedrock-mantle

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

anthropic

test: optimize slow test hotspots

2026-04-21 22:42:08 +01:00

anthropic-vertex

refactor: share anthropic vertex provider helpers

2026-04-20 22:05:39 +01:00

arcee

test: share provider catalog fixtures

2026-04-21 00:32:42 +01:00

bluebubbles

fix(bluebubbles): add opt-in coalesceSameSenderDms for split-send DMs (#69258)

2026-04-21 01:43:17 -07:00

brave

build(deps): declare extension runtime dependencies

2026-04-20 16:07:14 +01:00

browser

fix(browser): clarify DevToolsActivePort attach failures

2026-04-21 08:11:41 +01:00

byteplus

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

chutes

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

cloudflare-ai-gateway

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

codex

fix(codex): exclude codex-app-server synthetic apiKey from secrets audit (#69581)

2026-04-21 21:38:26 +10:00

comfy

refactor: share ssrf policy merging

2026-04-21 00:54:08 +01:00

copilot-proxy

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

deepgram

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

deepseek

test: share provider catalog fixtures

2026-04-21 00:32:42 +01:00

device-pair

perf: avoid sort-for-single selection

2026-04-20 23:20:31 +01:00

diagnostics-otel

build: update dependencies

2026-04-20 13:18:32 +01:00

diffs

refactor: share plugin config issue formatting

2026-04-20 23:34:19 +01:00

discord

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

duckduckgo

refactor: share duckduckgo web search provider base

2026-04-20 22:05:39 +01:00

elevenlabs

test: share streaming error response helper

2026-04-21 00:32:42 +01:00

exa

fix(web-search): restore SecretRef runtime compatibility for bundled providers (#68424)

2026-04-21 02:34:24 +01:00

fal

refactor: share ssrf policy merging

2026-04-21 00:54:08 +01:00

feishu

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

firecrawl

fix(web-search): restore SecretRef runtime compatibility for bundled providers (#68424)

2026-04-21 02:34:24 +01:00

fireworks

feat(fireworks): add Kimi K2.6 model

2026-04-21 20:31:33 +01:00

github-copilot

fix: update Copilot Opus default to 4.7

2026-04-21 20:00:06 +01:00

google

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

googlechat

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

groq

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

huggingface

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

image-generation-core

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

imessage

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

irc

test(extensions): move remaining channel schema tests

2026-04-20 21:54:49 +01:00

kilocode

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

kimi-coding

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

line

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

litellm

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

llm-task

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

lmstudio

refactor: share ssrf base url policy

2026-04-20 23:15:58 +01:00

lobster

fix: support Lobster approvalId TaskFlow resumes (#69559)

2026-04-21 05:32:13 +01:00

matrix

perf(matrix): narrow register-time runtime surface (#69782)

2026-04-21 12:50:53 -04:00

mattermost

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

media-understanding-core

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

memory-core

fix: stabilize memory dreaming QA

2026-04-21 03:12:42 +01:00

memory-lancedb

test(extensions): fix shared test helper contracts

2026-04-20 21:56:17 +01:00

memory-wiki

refactor: share plugin config issue formatting

2026-04-20 23:34:19 +01:00

microsoft

test: share debug proxy reset helper

2026-04-21 00:24:18 +01:00

microsoft-foundry

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

minimax

fix(cli): keep channel status checks off plugin runtimes (#69479)

2026-04-21 13:53:08 -04:00

mistral

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

moonshot

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

msteams

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

nextcloud-talk

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

nostr

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

nvidia

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

ollama

fix(ollama): register media-understanding provider so image tool can route ollama/* models

2026-04-21 22:25:45 +01:00

open-prose

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

openai

feat(openai): default images to gpt-image-2

2026-04-21 21:49:16 +01:00

opencode

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

opencode-go

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

openrouter

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

openshell

fix(openshell): pin host writes to sandbox root (#69797)

2026-04-21 15:18:28 -06:00

perplexity

fix(web-search): restore SecretRef runtime compatibility for bundled providers (#68424)

2026-04-21 02:34:24 +01:00

phone-control

test(plugins): fix sync register call sites

2026-04-17 10:14:00 +05:30

qa-channel

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

qa-lab

fix: remap thinking levels on model switch

2026-04-21 18:53:49 +01:00

qa-matrix

refactor: share matrix qa event matcher

2026-04-20 21:03:13 +01:00

qianfan

test: add Kimi and Qianfan extension coverage

2026-04-21 02:41:26 +01:00

qqbot

feat(qqbot): extract self-contained engine/ architecture with QR-code onboarding, approval handling (#67960)

2026-04-22 01:05:12 +08:00

qwen

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

runway

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

searxng

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

sglang

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

shared

test: trim whatsapp channel test barrels

2026-04-03 16:39:47 +01:00

signal

perf(channels): narrow slow bundled channel entry imports

2026-04-20 22:34:11 +01:00

skill-workshop

feat(plugins): add experimental skill workshop

2026-04-21 21:29:44 +01:00

slack

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

speech-core

test: share speech tts payload fixture

2026-04-20 17:11:33 +01:00

stepfun

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

synology-chat

fix(synology): validate webhook file urls (#69784)

2026-04-21 12:00:28 -06:00

synthetic

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

talk-voice

test(plugins): fix sync register call sites

2026-04-17 10:14:00 +05:30

tavily

fix(web-search): restore SecretRef runtime compatibility for bundled providers (#68424)

2026-04-21 02:34:24 +01:00

telegram

refactor(channels): decouple presentation rendering

2026-04-21 21:29:44 +01:00

test-support

test: share provider catalog fixtures

2026-04-21 00:32:42 +01:00

thread-ownership

test(plugins): fix sync register call sites

2026-04-17 10:14:00 +05:30

tlon

fix(tlon): guard memex upload target (#69794)

2026-04-21 15:57:49 -06:00

together

refactor: share provider polling helper

2026-04-20 23:04:10 +01:00

twitch

test(ci): reduce channel contract import cost

2026-04-21 00:40:07 +01:00

venice

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

vercel-ai-gateway

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

video-generation-core

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

vllm

test(extensions): move provider contracts to owners

2026-04-20 20:55:39 +01:00

voice-call

test: share voice call notify fixtures

2026-04-20 17:05:16 +01:00

volcengine

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

voyage

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

vydra

test: share vydra provider fixtures

2026-04-20 16:34:48 +01:00

webhooks

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

whatsapp

test: decouple outbound tests from bundled plugins

2026-04-20 22:44:38 +01:00

xai

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

xiaomi

chore: release 2026.4.20

2026-04-20 13:16:40 +01:00

zai

fix: centralize provider thinking profiles

2026-04-21 09:13:35 +01:00

zalo

test(zalo): use preferred tmp dir in outbound media test

2026-04-21 07:28:52 -07:00

zalouser

test(extensions): split outbound payload contracts

2026-04-20 19:37:20 +01:00

.npmignore

…

AGENTS.md

Docs: add test performance guardrails

2026-04-17 02:23:49 -04:00

CLAUDE.md

…

music-generation-providers.live.test.ts

test(extensions): keep generation helper out of discovery

2026-04-20 22:09:16 +01:00

tsconfig.package-boundary.base.json

refactor(cli): normalize route boundaries

2026-04-06 15:38:04 +01:00

tsconfig.package-boundary.paths.json

fix(ci): sync package boundary paths config

2026-04-09 23:59:00 +01:00

video-generation-providers.live.test.ts

test(extensions): keep generation helper out of discovery

2026-04-20 22:09:16 +01:00