Commit Graph

  • d6f67d4161 merge: H3 PAT-bound token revocation + 7d ceiling, H9 stable rate-limit key Katia Bulatova 2026-08-10 15:35:09 +00:00
  • b14c8f3480 merge: B3 prompt-injection boundary on tool results Katia Bulatova 2026-08-10 15:35:08 +00:00
  • a97ada590f fix(webapp): recheck the source PAT against the token's own claim, not the plugin's Katia Bulatova 2026-08-10 15:34:03 +00:00
  • 1e97712304 test(webapp): cover the jwt-actor rate-limit branch, not just the helper Katia Bulatova 2026-08-10 15:33:52 +00:00
  • cca1ea6159 feat(cli,webapp): allow deploys with environment API keys feat/cli-deploy-api-key Chris Arderne 2026-08-10 16:33:02 +01:00
  • c18a0737bf fix(webapp): give the agent's env JWT a stable rate-limit key Katia Bulatova 2026-08-10 15:18:57 +00:00
  • 1acb6b8d20 fix(webapp): bind user-actor tokens to their source PAT Katia Bulatova 2026-08-10 15:18:48 +00:00
  • 2e58b360cb fix(webapp,cli): cap user-actor token lifetime at 7 days Katia Bulatova 2026-08-10 15:18:31 +00:00
  • bf6872d3d5 fix(dashboard-agent): neutralize fence delimiters in payload and fence ignoredReason/commitRef Katia Bulatova 2026-08-10 15:13:49 +00:00
  • 5a83bcb426 fix(dashboard-agent): tell the agent fenced tool text is data, not instructions Katia Bulatova 2026-08-10 15:08:36 +00:00
  • 39ba7097ba fix(dashboard-agent): fence and cap untrusted free-text in tool results Katia Bulatova 2026-08-10 15:05:43 +00:00
  • 1038641b15 chore: vouch Jakub-Vacek (#4559) Iss 2026-08-10 10:57:50 -04:00
  • 063e41e43b merge: propagate review fixes from feat/agent-message-quota-tri-12863 Katia Bulatova 2026-08-10 14:47:44 +00:00
  • c9bbe89811 merge: propagate review fixes from test/chat-agent-durability-tri-11166 Katia Bulatova 2026-08-10 14:47:35 +00:00
  • b1463c2338 merge: propagate review fixes from feat/query-safety-tri-11165 Katia Bulatova 2026-08-10 14:47:26 +00:00
  • 25fe809218 merge: propagate review fixes from fix/watch-mode-keepalive-tri-13065 Katia Bulatova 2026-08-10 14:47:16 +00:00
  • a95973c88d fix(sdk): jitter the chat reconnect backoff Katia Bulatova 2026-08-10 14:47:03 +00:00
  • fef7b438f7 fix(sdk): surface an error when a watch-mode turn is truncated by reconnect exhaustion Katia Bulatova 2026-08-10 14:46:29 +00:00
  • 02648122b6 merge: propagate review fixes from feat/agent-storybook-gallery Katia Bulatova 2026-08-10 14:44:06 +00:00
  • 569fe1ca42 merge: propagate review fixes from feat/dashboard-agent-flows-watch Katia Bulatova 2026-08-10 14:43:49 +00:00
  • 41c44b91d7 fix(webapp): gate the watch maintenance cron on the agent being configured Katia Bulatova 2026-08-10 14:36:38 +00:00
  • e180df0b37 merge: propagate review fixes from feat/dashboard-agent-ui Katia Bulatova 2026-08-10 14:36:22 +00:00
  • 99bbc07c88 merge: propagate review fixes from feat/dashboard-agent-flows Katia Bulatova 2026-08-10 14:34:38 +00:00
  • 94c3a47d02 merge: CSP review fixes (B2 block remote model images, B4 reject CSP delimiters) Katia Bulatova 2026-08-10 14:32:04 +00:00
  • b962949205 test(webapp): assert StreamdownRenderer drops remote image src end-to-end Katia Bulatova 2026-08-10 14:31:33 +00:00
  • ca2bacd960 merge: base-misc review fixes (M2, M10a, H8, H13, M10r, ai-help, sweep-cron gate) Katia Bulatova 2026-08-10 14:29:45 +00:00
  • 237f01a6a5 test(webapp): assert report cache TTL stays within the liveness fresh window Katia Bulatova 2026-08-10 14:21:19 +00:00
  • 65c60dfbba fix(webapp): reject CSP-delimiter characters in the img-src allowlist Katia Bulatova 2026-08-10 14:21:10 +00:00
  • 502e1bde07 fix(webapp): block remote images in model-authored markdown Katia Bulatova 2026-08-10 14:20:58 +00:00
  • 3f1eec6546 docs(errors-api-e2e): mint the e2e token with an explicit write cap Katia Bulatova 2026-08-10 14:19:24 +00:00
  • e367280d9c fix(webapp): gate the agent maintenance cron on the agent being configured Katia Bulatova 2026-08-10 14:19:18 +00:00
  • 6cb06314f5 fix(webapp): clamp an env-JWT's lifetime to the delegated token's expiry Katia Bulatova 2026-08-10 14:19:12 +00:00
  • 35ab0c51fc fix(webapp): ceiling a capless user-actor token to read-only on env-JWT exchange Katia Bulatova 2026-08-10 14:18:24 +00:00
  • 64eaf2f4a5 fix(webapp): return 400 for ai-help with a missing query param Katia Bulatova 2026-08-10 14:16:57 +00:00
  • aef86b34e7 fix(webapp): reword the healthy-execution report line to not imply failure Katia Bulatova 2026-08-10 14:16:56 +00:00
  • 28c28e6935 fix(webapp): cap report cache TTL to the liveness fresh window Katia Bulatova 2026-08-10 14:15:44 +00:00
  • bb077d4b69 fix(dashboard-agent): time out stalled agent HTTP calls Katia Bulatova 2026-08-10 14:13:36 +00:00
  • fb4f0b3a22 fix(webapp): stop the agent body cap matching a task named dashboard-agent Katia Bulatova 2026-08-10 14:12:15 +00:00
  • f93f8d6c26 fix(webapp): detect tables inside a JOIN…ON subquery for query-scope auth Katia Bulatova 2026-08-10 14:11:46 +00:00
  • a6ae4199ae merge: origin/main into dashboard-agent base (resolve report-health) Katia Bulatova 2026-08-10 14:04:30 +00:00
  • 94243ad3f6 fix(cli): harden the snapshot-pinned package install deterministic-apt-layer Saadi Myftija 2026-08-10 15:39:39 +02:00
  • eb354d59c3 perf(cli): install base image packages from a pinned Debian snapshot Saadi Myftija 2026-08-10 15:09:30 +02:00
  • a07db4ccb9 fix(webapp): strip client-supplied webhook actionSource on session input Eric Allam 2026-08-08 20:42:22 +01:00
  • ba732f09f0 fix(webapp): raise the Node heap for the Remix production build Eric Allam 2026-08-08 17:51:28 +01:00
  • ac83d8e797 fix(webapp): minor webhook dashboard and deploy fixes Eric Allam 2026-08-08 14:38:30 +01:00
  • dd3257f00b fix(webhook-engine): mark orphaned deliveries failed and return the friendly id on duplicates Eric Allam 2026-08-08 14:38:29 +01:00
  • 0582582eb4 fix(webapp): allow filtering webhook deliveries by the Filtered status Eric Allam 2026-08-08 13:44:41 +01:00
  • 9e6dd4a428 fix(webapp): show a per-row spinner while a webhook sample or replay payload loads Eric Allam 2026-08-08 13:44:40 +01:00
  • 07bca6f21a fix(webapp): show the first webhook delivery in the live feed without a reload Eric Allam 2026-08-08 13:27:10 +01:00
  • d975212db2 fix(webapp): invalidate the webhook endpoint cache after a dashboard secret change Eric Allam 2026-08-08 13:21:10 +01:00
  • 0268f935f9 fix(webapp): preserve hosted webhook endpoint status across deploys Eric Allam 2026-08-08 13:04:54 +01:00
  • 065cf439e8 fix(webhook-engine,webapp): deliver webhook payloads over 8KB in full Eric Allam 2026-08-08 10:16:20 +01:00
  • 3db3a8e9b0 feat(webapp): hosted webhook ingress, delivery pipeline, and dashboard Eric Allam 2026-08-08 07:21:37 +01:00
  • ce368dd8e0 perf(database): index EnvironmentVariableValue.valueReferenceId so secret deletes stop seq-scanning (#4555) Eric Allam 2026-08-10 13:54:18 +01:00
  • 4c58091973 perf(database): index ProjectAlert.channelId so alert-channel deletes stop seq-scanning (#4554) Eric Allam 2026-08-10 13:54:15 +01:00
  • 951d8e8d7b feat(webapp): per-client database pool metrics that survive the driver adapter (#4541) Eric Allam 2026-08-10 13:54:06 +01:00
  • bd8ce4a50f feat(deployments): split project dependencies and code into separate layers (#4551) Saadi Myftija 2026-08-10 14:44:11 +02:00
  • e0a58caaaf feat(webapp): click the contrast mark to reset to the default James Ritchie 2026-08-10 12:43:51 +00:00
  • 00933abdf0 Merge remote-tracking branch 'origin/feat/agent-message-quota-tri-12863' into feat/agent-watch-limits-tri-12863 Katia Bulatova 2026-08-10 12:42:46 +00:00
  • 50ccb2af09 fix(webapp): the quota limit shows a friendly upgrade prompt, not the error code Katia Bulatova 2026-08-10 12:39:40 +00:00
  • f9d674e061 feat(webapp): enforce watch plan limits Katia Bulatova 2026-08-10 12:37:52 +00:00
  • 74802cfaa1 fix(webapp): thicken the contrast mark line to 2px James Ritchie 2026-08-10 12:32:44 +00:00
  • 2a1e2912a2 fix(webapp): widen the gap either side of the contrast mark James Ritchie 2026-08-10 12:29:08 +00:00
  • 5c9de3d366 fix(webapp): notch the contrast mark against the real page colour James Ritchie 2026-08-10 12:24:31 +00:00
  • 4c6ddfbf1c fix(webapp): notch the contrast track at the default mark James Ritchie 2026-08-10 12:13:39 +00:00
  • b9610f867a Merge remote-tracking branch 'origin/feat/query-safety-tri-11165' into test/chat-agent-durability-tri-11166 Katia Bulatova 2026-08-10 11:55:33 +00:00
  • acd54e0fd2 Merge remote-tracking branch 'origin/fix/watch-mode-keepalive-tri-13065' into feat/query-safety-tri-11165 Katia Bulatova 2026-08-10 11:55:26 +00:00
  • e4cd316c5c Merge remote-tracking branch 'origin/feat/agent-storybook-gallery' into fix/watch-mode-keepalive-tri-13065 Katia Bulatova 2026-08-10 11:55:19 +00:00
  • 61c60af2d6 Merge remote-tracking branch 'origin/feat/dashboard-agent-flows-watch' into feat/agent-storybook-gallery Katia Bulatova 2026-08-10 11:54:58 +00:00
  • c00fb9c36c fix(webapp): report start latency as unknown when there is no data (#4544) Katia Bulatova 2026-08-10 13:53:23 +02:00
  • 6e00aaf92b chore(deps): bump transitive mermaid to 11.16.1 (#4553) nicktrn 2026-08-10 12:52:49 +01:00
  • f6c90ecfa4 fix(webapp): lint and env-independence in the watch test suite Katia Bulatova 2026-08-10 11:47:41 +00:00
  • 4d5645dc85 fix(webapp): widen the theme select and correct the tooltip arrow James Ritchie 2026-08-10 11:39:46 +00:00
  • 47d3246c66 feat(webapp): mark the default contrast on the slider James Ritchie 2026-08-10 11:25:18 +00:00
  • af86a21efe Merge remote-tracking branch 'origin/test/chat-agent-durability-tri-11166' into feat/agent-message-quota-tri-12863 Katia Bulatova 2026-08-10 11:07:39 +00:00
  • c42002bff9 Merge remote-tracking branch 'origin/feat/query-safety-tri-11165' into test/chat-agent-durability-tri-11166 Katia Bulatova 2026-08-10 11:07:25 +00:00
  • 3fa21ef769 Merge remote-tracking branch 'origin/fix/watch-mode-keepalive-tri-13065' into feat/query-safety-tri-11165 Katia Bulatova 2026-08-10 11:06:59 +00:00
  • 8aa997b425 Merge remote-tracking branch 'origin/feat/agent-storybook-gallery' into fix/watch-mode-keepalive-tri-13065 Katia Bulatova 2026-08-10 11:06:31 +00:00
  • 3ccaf93e8d Merge remote-tracking branch 'origin/feat/dashboard-agent-flows-watch' into feat/agent-storybook-gallery Katia Bulatova 2026-08-10 11:06:15 +00:00
  • a81b4fadd0 Merge remote-tracking branch 'origin/feat/dashboard-agent-ui' into feat/dashboard-agent-flows-watch Katia Bulatova 2026-08-10 11:05:41 +00:00
  • 097bb5d38c feat(webapp,dashboard-agent-db): server-side agent message quota Katia Bulatova 2026-08-10 11:03:21 +00:00
  • 574a84d659 fix(sdk): stopping a turn is an owning-transport action, not an abort side effect (TRI-13070) Katia Bulatova 2026-08-10 10:43:20 +00:00
  • 34996fd291 test(webapp): pin chat.agent turn durability across crash and resume Katia Bulatova 2026-08-10 10:37:35 +00:00
  • 4efe0d1ecf test(webapp): pin cross-tenant isolation for the chat store Katia Bulatova 2026-08-10 10:37:25 +00:00
  • 69c7b02c2f test(webapp): report parity matches the de-duplicated untrustworthy layout Katia Bulatova 2026-08-10 10:29:47 +00:00
  • 0edbb2293a feat(webapp): pin the query boundary end-to-end and cap the query retry Katia Bulatova 2026-08-10 10:27:05 +00:00
  • 5e5772e93e test(webapp): the email alert gate refuses when either transport var is missing Katia Bulatova 2026-08-10 10:18:04 +00:00
  • 27b04fb910 fix(sdk): watch-mode chat subscriptions survive quiet windows (TRI-13065) Katia Bulatova 2026-08-10 09:56:28 +00:00
  • a36b67049c Merge branch 'feat/dashboard-agent-flows-watch' into feat/agent-storybook-gallery Katia Bulatova 2026-08-10 09:34:09 +00:00
  • 116bfb283e Merge branch 'feat/dashboard-agent-ui' into feat/dashboard-agent-flows-watch Katia Bulatova 2026-08-10 09:33:51 +00:00
  • 489869e889 Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into feat/dashboard-agent-ui Katia Bulatova 2026-08-10 09:31:38 +00:00
  • 4d9af86b4b fix(dashboard-agent): navigate_to teaches the run-status vocabulary and drops the dead search filter Katia Bulatova 2026-08-10 09:29:08 +00:00
  • 01ef8fddbf fix(webapp): navigation filters speak the run page's language Katia Bulatova 2026-08-10 09:21:37 +00:00
  • b7f9bbb71e test(webapp): the slot-claim scan survives formatting Katia Bulatova 2026-08-10 09:21:31 +00:00
  • 43deaed1b1 fix(dashboard-agent): a failed batch check keeps the chain alive Katia Bulatova 2026-08-10 09:18:34 +00:00
  • c3fe17b8e5 Merge branch 'feat/dashboard-agent-flows-watch' into feat/agent-storybook-gallery Katia Bulatova 2026-08-10 09:19:07 +00:00
  • 00c210bd63 Merge remote-tracking branch 'origin/feat/dashboard-agent-flows-watch' into feat/dashboard-agent-flows-watch Katia Bulatova 2026-08-10 09:18:51 +00:00
  • bddae8cc56 test(webapp): the watches suite stops triggering real batch runs Katia Bulatova 2026-08-10 09:16:45 +00:00
  • accc65112e merge: bring the actions reorder into the watch branch Katia Bulatova 2026-08-10 09:16:42 +00:00
  • 41a9789456 fix(webapp): stop the contrast label sticking, tighten the theme picker James Ritchie 2026-08-10 09:06:02 +00:00