Agustin Rivera c8003f1b33 Harden Feishu webhook replay guards (#66707) ...

* fix(feishu): harden webhook replay guards

* changelog: note Feishu webhook + card-action fail-closed hardening (#66707)

* fix(feishu): move blank-token check above decodeFeishuCardAction

Run the early-return guard against a missing/blank card-action
token before decoding the card-action payload. Decoding is
side-effect-free so this is a readability + tiny-perf nit, not a
correctness change. Matches Greptile's P2 suggestion.

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>

2026-04-14 13:50:41 -06:00

..

acpx

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

active-memory

fix(active-memory): Move active memory recall into the hidden prompt prefix (#66144)

2026-04-13 16:05:43 -05:00

alibaba

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

amazon-bedrock

fix(plugin-sdk): share anthropic replay hook constants

2026-04-14 16:37:29 +01:00

amazon-bedrock-mantle

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

anthropic

fix(plugin-sdk): share anthropic replay hook constants

2026-04-14 16:37:29 +01:00

anthropic-vertex

fix(plugin-sdk): share anthropic replay hook constants

2026-04-14 16:37:29 +01:00

arcee

fix(plugin-sdk): share canonical replay hook families

2026-04-14 16:34:09 +01:00

bluebubbles

fix(bluebubbles): lazy-refresh Private API status on send (#43764) (#65447)

2026-04-13 11:03:47 -07:00

brave

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

browser

fix(browser): unblock loopback CDP readiness under strict SSRF defaults (#66354)

2026-04-14 16:30:43 +08:00

byteplus

fix: bound live video generation smoke

2026-04-14 14:59:01 +01:00

chutes

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

cloudflare-ai-gateway

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

codex

fix: include apiKey in codex provider catalog to unblock models.json loading (#66180)

2026-04-13 19:22:09 -07:00

comfy

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

copilot-proxy

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

deepgram

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

deepseek

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

device-pair

fix: disambiguate device-pair notify subscribers

2026-04-10 19:46:23 -05:00

diagnostics-otel

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

diffs

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

discord

fix(lint): clear masked main check failures

2026-04-14 18:58:36 +01:00

duckduckgo

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

elevenlabs

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

exa

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

fal

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

feishu

Harden Feishu webhook replay guards (#66707)

2026-04-14 13:50:41 -06:00

firecrawl

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

fireworks

fix(plugin-sdk): share canonical replay hook families

2026-04-14 16:34:09 +01:00

github-copilot

fix(github-copilot): enable xhigh for gpt-5.4 (#66437)

2026-04-14 09:58:19 +01:00

google

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

googlechat

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

groq

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

huggingface

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

image-generation-core

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

imessage

perf(channels): add lightweight doctor contract APIs

2026-04-14 17:20:46 +01:00

irc

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

kilocode

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

kimi-coding

fix(plugins): drop stale provider hook dead code

2026-04-14 16:16:34 +01:00

line

fix(line): make webhook replay retries explicit

2026-04-13 16:05:50 +01:00

litellm

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

llm-task

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

lmstudio

[codex] Fix LM Studio header-auth follow-ups (#65806)

2026-04-13 17:45:06 +08:00

lobster

Lobster: import published core runtime (#64755)

2026-04-13 20:38:46 +02:00

matrix

test(contracts): refresh plugin boundary expectations

2026-04-14 19:39:33 +01:00

mattermost

fix(mattermost): dedupe repeated model picker selects

2026-04-13 17:47:29 +01:00

media-understanding-core

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

memory-core

Align QMD memory reads with canonical memory paths (#66026)

2026-04-14 09:58:27 -06:00

memory-lancedb

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

memory-wiki

fix(lint): clear masked main check failures

2026-04-14 18:58:36 +01:00

microsoft

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

microsoft-foundry

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

minimax

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

mistral

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

moonshot

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

msteams

fix(msteams): enforce sender allowlist checks on SSO signin invokes [AI] (#66033)

2026-04-13 23:52:30 +05:30

nextcloud-talk

fix: tighten inbound replay typing

2026-04-13 20:49:39 -07:00

nostr

fix(nostr): dedupe deterministic rejected events

2026-04-13 18:07:23 +01:00

nvidia

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

ollama

fix(plugin-sdk): share canonical replay hook families

2026-04-14 16:34:09 +01:00

open-prose

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

openai

refactor(openai): import base URL helpers directly

2026-04-14 21:52:16 +05:30

opencode

fix(plugin-sdk): share opencode catalog auth helper

2026-04-14 16:48:02 +01:00

opencode-go

fix(plugin-sdk): share opencode catalog auth helper

2026-04-14 16:48:02 +01:00

openrouter

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

openshell

test(e2e): repair OpenShell prerelease smoke

2026-04-13 00:20:51 +01:00

perplexity

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

phone-control

test: remove redundant phone control conversions

2026-04-10 21:55:28 +01:00

qa-channel

fix(ci): refresh qa-lab lockfile

2026-04-12 19:45:46 -07:00

qa-lab

test: harden qa-lab concurrent web scenarios

2026-04-14 13:42:02 +01:00

qianfan

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

qqbot

Agents: clarify local model context preflight (#66236)

2026-04-14 15:38:10 +10:00

qwen

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

runway

fix: accept optional runway source mime type

2026-04-14 15:14:26 +01:00

searxng

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

sglang

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

shared

test: trim whatsapp channel test barrels

2026-04-03 16:39:47 +01:00

signal

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

slack

fix(slack): fix slash commands with button arg menu errors

2026-04-14 12:39:56 -07:00

speech-core

fix(tts): correct tagged TTS syntax guidance (#65573)

2026-04-12 19:41:13 -03:00

stepfun

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

synology-chat

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

synthetic

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

talk-voice

chore: enable no-floating-promises

2026-04-10 20:14:49 +01:00

tavily

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

telegram

fix(ci): restore main typecheck

2026-04-14 18:53:14 +01:00

thread-ownership

refactor: simplify extension conversions

2026-04-11 01:37:23 +01:00

tlon

fix(tlon): release replay claims after handler failures

2026-04-13 16:45:58 +01:00

together

fix: bound live video generation smoke

2026-04-14 14:59:01 +01:00

twitch

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

venice

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

vercel-ai-gateway

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

video-generation-core

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

vllm

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

voice-call

fix(stream): tighten voice stream ingress guards (#66027)

2026-04-13 16:51:16 -06:00

volcengine

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

vydra

fix: bound live video generation smoke

2026-04-14 14:59:01 +01:00

webhooks

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

whatsapp

perf(whatsapp): add doctor contract fast path

2026-04-14 17:27:07 +01:00

xai

fix(plugin-sdk): share canonical replay hook families

2026-04-14 16:34:09 +01:00

xiaomi

chore: bump version to 2026.4.12

2026-04-12 10:37:18 -07:00

zai

fix(plugin-sdk): share canonical stream hook families

2026-04-14 17:13:31 +01:00

zalo

fix(zalo): make replay retries explicit

2026-04-13 15:36:35 +01:00

zalouser

perf(channels): add lightweight doctor contract APIs

2026-04-14 17:20:46 +01:00

.npmignore

…

AGENTS.md

docs(agents): split scoped workflow guidance (#65241)

2026-04-12 09:09:50 +01:00

CLAUDE.md

Docs: add boundary AGENTS guides (#56647)

2026-03-28 20:22:03 -04:00

music-generation-providers.live.test.ts

fix: stabilize media live provider coverage

2026-04-06 19:15:31 +01:00

tsconfig.package-boundary.base.json

refactor(cli): normalize route boundaries

2026-04-06 15:38:04 +01:00

tsconfig.package-boundary.paths.json

fix(ci): sync package boundary paths config

2026-04-09 23:59:00 +01:00

video-generation-providers.live.test.ts

fix: bound live video generation smoke

2026-04-14 14:59:01 +01:00