2eaf5a695e
Mattermost: guard probe fetches ( #58529 )
2026-04-02 10:30:33 +01:00
2c45b06afd
fix(qqbot): restrict structured payload local paths ( #58453 )
...
* fix(qqbot): restrict structured payload local paths
* fix(qqbot): narrow structured payload file access
* test(qqbot): cover payload path traversal guards
* fix(qqbot): reduce structured payload log exposure
* fix(qqbot): preserve inline image payload URLs
2026-04-02 10:20:52 +01:00
5c36c2d0d2
fix: install devDependencies during ui:build ( #59267 ) (thanks @juliabush)
...
* fix(ui): install devDependencies during ui:build
* fix: keep ui:build self-heal documented (#59267 ) (thanks @juliabush)
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
2026-04-02 14:35:05 +05:30
304da2cbd7
fix: keep ACP prompts alive across gateway reconnects ( #59473 )
...
* fix: keep acp prompts alive across gateway reconnects
* fix: bound ACP prompts after disconnect grace
* fix: preserve ACP send timeout semantics
* fix: defer pre-ack ACP disconnect failures
* fix: reconcile ACP runs after reconnect
* fix: keep ACP reconnect deadlines monotonic
* fix: keep pre-ack ACP deadlines after reconnect
* fix: keep ACP prompts alive across gateway reconnects (#59473 )
* fix: reject superseded ACP pre-ack prompts (#59473 )
* style: format ACP reconnect regression updates (#59473 )
* style: format ACP reconnect regression updates (#59473 )
* fix: guard ACP send acceptance by run id (#59473 )
* fix: scope ACP reconnect deadline by prompt (#59473 )
* fix: recheck ACP prompts at reconnect deadline (#59473 )
* fix: key ACP reconnect deadline by run (#59473 )
2026-04-02 14:34:11 +05:30
c27b45fd12
fix: strip antml thinking tags ( #59550 )
2026-04-02 14:28:54 +05:30
176ff18d18
fix: strip antml thinking tags
2026-04-02 14:28:54 +05:30
251ba9b4d2
docs(changelog): note invalid exec approvals policy fix
2026-04-02 01:46:16 -07:00
a597938be8
fix(exec): strip invalid approval policy enums during config normalization ( #59112 )
...
* fix(exec): strip invalid security/ask enum values during config normalization
* fix(exec): narrow invalid approvals config cleanup
---------
Co-authored-by: scoootscooob <zhentongfan@gmail.com>
2026-04-02 01:40:10 -07:00
d90c8db491
fix(plugin-sdk): narrow discord and matrix core seam imports ( #59557 )
2026-04-02 17:40:06 +09:00
331e835dab
fix(providers): centralize stream request headers ( #59542 )
...
* fix(providers): centralize stream request headers
* Update src/agents/provider-request-config.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-04-02 17:21:46 +09:00
08962b6812
fix(browser): keep static helper seams cold ( #59471 )
...
* fix(browser): keep static helper seams cold
* fix(browser): narrow sandbox helper facade imports
* fix(browser): harden host inspection helpers
2026-04-02 17:12:32 +09:00
b441cd2f4f
fix: normalize kimi anthropic tool payloads ( #59440 )
...
* fix: normalize kimi anthropic tool payloads
* fix: normalize kimi anthropic tool payloads (#59440 )
2026-04-02 13:39:51 +05:30
53f1c9968a
fix(ci): restore model override and trash-path fallbacks
2026-04-02 16:59:27 +09:00
68bb76519a
Matrix: fix delayed draft block boundaries
2026-04-02 03:47:57 -04:00
8748b7c54c
Matrix: keep partial previews aligned with block streaming ( #59384 )
...
Merged via squash.
Prepared head SHA: 981aa35a7c
2026-04-02 03:39:27 -04:00
ce0ff42ff5
fix: harden Feishu comment-thread delivery ( #59129 )
...
* fix: harden Feishu comment-thread delivery
* fix: harden Feishu comment-thread delivery (#59129 ) (thanks @wittam-01)
---------
Co-authored-by: George Zhang <georgezhangtj97@gmail.com>
2026-04-02 00:31:52 -07:00
a5cd921053
revert: remove TinyFish bundled plugin
2026-04-02 03:07:33 -04:00
c15cfeb21c
fix(qqbot): lazy-load silk-wasm to avoid hard failure when package is missing ( #58829 )
...
* fix(qqbot): lazy-load silk-wasm to avoid hard failure when package is missing
Replace the static top-level import with a cached dynamic import helper.
If silk-wasm is unavailable the plugin loads normally; voice encode/decode
degrades gracefully instead of crashing the module at load time.
* fix(qqbot): store in-flight Promise in loadSilkWasm to prevent duplicate imports
Concurrent cold-start calls to loadSilkWasm() before the first import()
resolves would each fire a separate dynamic import. Storing the Promise
instead of the resolved value (matching the detectFfmpeg pattern in
platform.ts) ensures all concurrent callers await the same import,
keeping the codebase consistent and avoiding redundant parallel loads.
* QQBot: add changelog for silk-wasm lazy load
* QQBot: move changelog entry for PR #58829
---------
Co-authored-by: sliverp <870080352@qq.com>
Co-authored-by: Sliverp <38134380+sliverp@users.noreply.github.com>
2026-04-02 14:46:53 +08:00
0809c8d29a
fix(matrix): preserve legacy mention edits
2026-04-02 02:33:00 -04:00
3e52f5a021
docs(changelog): add TinyFish PR number and attribution
2026-04-02 15:29:36 +09:00
f28f0f29ba
fix(providers): centralize media request shaping ( #59469 )
...
* fix(providers): centralize media request shaping
* style(providers): normalize shared request imports
* fix(changelog): add media request shaping entry
* fix(google): preserve private network guard
2026-04-02 15:28:57 +09:00
9786946b2d
fix(matrix): restore guided setup flow ( #59462 )
...
Merged via squash.
Prepared head SHA: 9b29023c68
2026-04-02 02:15:32 -04:00
5c331687ff
fix(matrix): ignore escaped backticks in mention masking
2026-04-02 02:06:50 -04:00
be52594766
fix(matrix): emit spec-compliant mentions ( #59323 )
...
Merged via squash.
Prepared head SHA: 4b641e35a2
2026-04-02 02:00:24 -04:00
7b748a57f0
fix(contracts): activate runtime-backed binding suites
2026-04-02 14:57:11 +09:00
b880118d2d
feat: add TinyFish as bundled browser automation plugin ( #58645 )
...
* feat: add TinyFish as bundled browser automation plugin
Add a default-off bundled `tinyfish` plugin with one tool
(`tinyfish_automation`) for hosted browser automation of complex public
web workflows. Follows the existing plugin architecture pattern.
- Plugin entry, manifest with contracts, config schema, SecretRef support
- SSE stream parser with COMPLETE-terminal, SSRF guards, credential rejection
- Bundled skill with escalation guidance (web_fetch -> web_search -> tinyfish -> browser)
- Docs page, labeler rule, glossary entry, changelog entry
- 21 tests covering request serialization, auth, security, streaming, and error paths
Closes #41300
* plugins: address review feedback and regenerate baselines
- Split API_INTEGRATION into TINYFISH_API_INTEGRATION and CLIENT_SOURCE
for semantic clarity (Greptile P2)
- Wrap post-finally parseEventBlock in try/catch so trailing malformed
data does not mask "stream ended before COMPLETE" error (Greptile P2)
- Regenerate config-baseline and plugin-sdk-api-baseline for new plugin
---------
Co-authored-by: Simantak Dabhade <simantak@mac.local>
2026-04-02 01:46:05 -04:00
93fa6920b4
perf(memory): lazy-load telegram message context runtime
2026-04-02 14:44:14 +09:00
16c5bd466c
perf(memory): split telegram body helper surface
2026-04-02 14:41:26 +09:00
52a018680d
fix(plugins): guard runtime facade activation ( #59412 )
...
* fix(plugins): guard runtime facade activation
* refactor(plugin-sdk): localize facade load policy
* fix(plugin-sdk): narrow facade activation guards
* fix(browser): keep cleanup helpers outside activation guard
* style(browser): apply formatter follow-ups
* chore(changelog): note plugin activation guard regressions
* fix(discord): keep cleanup thread unbinds outside activation guard
* fix(browser): fallback when trash exits non-zero
2026-04-02 14:37:12 +09:00
ed6012eb5b
fix(agents): honor cacheRetention for custom anthropic providers ( #59049 )
...
* fix(agents): honor cacheRetention for custom anthropic providers
* docs(changelog): add cache retention entry
* Update CHANGELOG.md
* test(agents): add direct cache retention assertions
2026-04-02 14:34:01 +09:00
41aac73590
chore(docs): sync config baseline ( #59461 )
2026-04-02 01:33:21 -04:00
703a363589
perf(memory): lazy-load telegram context session helpers
2026-04-02 14:31:48 +09:00
1707493be4
refactor(providers): add internal request config seam ( #59454 )
2026-04-02 14:28:25 +09:00
f69570f820
Exec approvals: fix policy source attribution ( #59367 )
...
Merged via squash.
Prepared head SHA: 974945a9f0
2026-04-02 01:28:14 -04:00
ad6e42906f
chore(docs): sync generated baselines ( #59450 )
2026-04-02 01:26:45 -04:00
0e8e986c95
perf(memory): narrow telegram bot deps skill/runtime imports
2026-04-02 14:16:13 +09:00
7dc065dab0
docs(changelog): add missing PR numbers
2026-04-02 14:12:28 +09:00
5b952836e3
perf(memory): trim telegram command runtime imports
2026-04-02 14:11:28 +09:00
1a037ff6cd
refactor(providers): centralize request attribution policy ( #59433 )
...
* refactor(providers): centralize request attribution policy
* style(providers): normalize request policy formatting
* style(providers): normalize request policy formatting
* style(providers): normalize request policy formatting
* docs(changelog): note provider request policy fix
* fix(providers): tighten request policy gates
2026-04-02 14:10:53 +09:00
4309dc6d5e
perf(memory): lazy-load telegram monitor runtime graphs
2026-04-02 14:07:35 +09:00
fcfb9ddb1d
fix(matrix): preserve mocked auth context in bootstrap
2026-04-02 14:03:07 +09:00
e718493ae6
test(matrix): cover draft overflow fallback
2026-04-02 01:02:18 -04:00
85928e29f1
perf(memory): lazy-load matrix bootstrap and probe runtimes
2026-04-02 13:57:03 +09:00
be1b4e6683
fix(ci): route matrix config helper through local barrel
2026-04-02 13:52:54 +09:00
4fd1e1c64f
perf(memory): lazy-load matrix client runtime deps
2026-04-02 13:51:48 +09:00
9bbbee32e1
Docs: replace personal device names with generic placeholders ( #50825 )
2026-04-02 00:50:25 -04:00
6dbdcbda58
perf(memory): lazy-load matrix shared client creation
2026-04-02 13:48:20 +09:00
bfa561b1a7
perf(memory): lazy-load matrix secret config input
2026-04-02 13:46:06 +09:00
a398520ac8
perf(memory): trim matrix resolved config imports
2026-04-02 13:42:58 +09:00
b9c74fc884
fix(image-tool): resolve relative paths against workspaceDir ( #57222 )
...
Relative paths like "inbox/receipt.png" were resolved against
process.cwd() instead of the agent's workspaceDir, causing the
allowlist check to fail with "Local media path is not under an
allowed directory". This matches how the read tool already behaves.
Fixes #57215
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-02 00:41:09 -04:00
mappel-nv
Jacob Tomlinson
Julia Bush
Ayaan Zaidi
scoootscooob
wangchunyue
Vincent Koc
Gustavo Madeira Santana
wittam-01
Mingkuan
Simantak Dabhade
Sally O'Malley
Scott Glover
Priyansh Gupta