Commit Graph

6323 Commits

Author SHA1 Message Date
Diego Rodrigues de Sa e Souza
d7a7302ec8 fix(deps): bump nanoid, dompurify, mermaid, js-yaml on default branch
Closes 9 Dependabot alerts (#182-#190). npm audit → 0.
2026-08-08 08:10:11 -03:00
diegosouzapw
19666060b2 fix(deps): bump nanoid, dompurify, mermaid, js-yaml on default branch
Closes 9 Dependabot alerts (#182-#190) on the default branch
(release/v3.8.50):
- nanoid ^3.3.17 (3.3.16→3.3.18)
- dompurify ^3.4.13 (direct dep bump + monaco-editor scoped override)
- mermaid → 11.16.1
- js-yaml v4 nested copies → 4.3.1 (scoped overrides)

npm audit → 0 vulnerabilities.
2026-08-08 08:07:38 -03:00
backryun
d73a1e6fc8 fix(kiro): complete cache-only usage totals (#9753) 2026-08-08 07:15:34 -03:00
backryun
b0a377e66c fix(types): preserve narrowed Codex input arrays (#9748) 2026-08-08 07:15:31 -03:00
backryun
52a6b04f8e fix(types): preserve video URL override contracts (#9747) 2026-08-08 07:15:28 -03:00
backryun
4f8dccc8a3 test(types): use Vitest expectations in tier resolver (#9742) 2026-08-08 07:15:25 -03:00
Diego Rodrigues de Sa e Souza
71c85f31cd feat(guardrails): modality bridge core — vision mode/task-aware/cache/input_image + modalityBridge settings (#9759)
* feat(sse): unified media-part detection helper (image+audio, input_image)

* refactor(guardrails): extractImageParts/comboStructure delegate to unified media detector

* fix(sse): media detector — audio parts no longer shadow sibling/nested image indicators

* fix(guardrails): close extract↔replace contract for input_image (allowlist + splice)

* perf(guardrails): skip media traversal when bridge disabled; short-circuit combo image check

* feat(guardrails): in-memory LRU bridge cache (sha256 keyed)

* feat(settings): modalityBridge* schema with legacy visionBridge* fallback

* feat(db): migrate visionBridge* settings to modalityBridge* (idempotent)

* refactor(guardrails): harden bridge cache key/config + settings resolution (review minors)

* feat(guardrails): vision bridge mode selector (auto/describe/reroute) short-circuit

* feat(guardrails): task-aware vision description prompt (default on)

* feat(guardrails): describe-path cache integration

* docs(guardrails): review polish — cache-key coupling notes + helper header

* feat(guardrails): in-memory bridge stats + modality-bridge response header

* feat(api): modality bridge stats endpoint + header wiring in chat handler

* docs(guardrails): document modality bridge mode/task-aware/cache/header + stats endpoint

* chore: untrack _tasks symlink (inherited from base tip; blocks pre-commit tracked-artifacts gate)

* fix(db): renumber modality bridge migration 139->140 (base renumbered ccr_blocks to 139)

* docs(guardrails): migration filename touch-up 139->140

* docs(db): stale comment touch-ups after 139->140 renumber and #9688 landing

* fix(db): renumber modality bridge migration 140->141 (base renumbered connection_runtime_state to 140)

* test(db): migration test titles 139->141

---------

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
2026-08-08 01:59:11 -03:00
diegosouzapw
caf768e3c4 fix(repo): untrack the _tasks self-referential symlink
_tasks is a SEPARATE nested git repo (gitignored). A self-referential symlink
_tasks -> its own path was tracked here; every pull materialized it over the real
_tasks repo, destroying plans/specs/hands-off. Now untracked (and /_tasks in
.gitignore prevents re-capture).
2026-08-08 01:21:02 -03:00
diegosouzapw
fd0e8da8ff fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) 2026-08-08 01:20:35 -03:00
Markus Hartung
acfb844852 fix(db): resolve migration version 135 numbering collision (#9745)
Two files both claimed migration version 135:
135_connection_runtime_state.sql (#9449, landed 2026-08-07) and
135_migrate_model_capability_max_token.sql (#8908, landed 2026-08-05).
#9449 branched before #8908 merged and never got renumbered before
landing on release/v3.8.50.

This is not cosmetic: getMigrationFiles() throws "Migration version
collision detected" the moment ANY code path first touches the
database (getDbInstance() -> runMigrations()), which means a
completely fresh install/deploy from this branch cannot even boot —
confirmed live against a freshly built container while testing
unrelated live-verification tooling.

Renumbered the later-landing file to 140 (the next free slot) and
added the matching isSchemaAlreadyApplied("140") retroactive guard in
migrationRunner.ts, so a DB that already ran this migration under the
old 135 number isn't treated as needing a fresh application. This
matches the established pattern already used for the prior 135/136 ->
137/138 renumber in the same file (also caused by the same recurring
branch-before-merge numbering race).

Test plan:
- TDD: new tests/unit/migration-135-numbering-collision.test.ts (2/2)
  — spins up a hermetic fresh DB and confirms getDbInstance() applies
  every real on-disk migration without throwing, plus confirms both
  formerly-135 migrations' effects are present. Confirmed failing
  (reproducing the exact live crash) with the pre-fix colliding
  filenames restored, passing after the rename.
- npm run typecheck:core — clean
- npm run lint — clean
- npm run check:file-size — clean (migrationRunner.ts rebaselined
  1084->1094 for the new guard case)
- Full migration-runner + migration-numbering test suites (64 tests
  across 6 files) — all pass, no regressions
2026-08-08 00:42:29 -03:00
Diego Rodrigues de Sa e Souza
ee0f4298ca feat(plugins): expose client request headers in plugin context (#9570) (#9668)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:32 -03:00
Markus Hartung
0082ac5113 fix(openrouter): scope model failures per-model instead of poisoning the whole connection (#9635)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:29 -03:00
Arnav Rastogi
e224165689 fix(providers): mint a Zed LLM token for zed-hosted model discovery (#9628)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:26 -03:00
stanley
552f2e1563 fix(backend): stop reasoning replay placeholder from self-poisoning (#9573) (#9610)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:23 -03:00
vinogradovnet
8cb51b7922 feat(compression): add Russian language pack (#9581)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:20 -03:00
Maxim Seshuk
8da0aa5ba8 fix(standalone): don't await the WebDAV check before Next's listener (#9580)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:17 -03:00
Maxim Seshuk
7a369ba6e3 feat(audio): add Soniox STT + TTS provider (#9579)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:14 -03:00
backryun
e60d7f81b8 fix(types): preserve streaming PII choice keys (#9566)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:11 -03:00
backryun
e62516364c fix(types): validate Vision Bridge combo names (#9565)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:08 -03:00
backryun
c4f37ab01b fix(types): preserve sanitized tool array contracts (#9564)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:05 -03:00
backryun
250ea5e849 fix(types): validate Azure OpenAI base URLs (#9563)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:03 -03:00
backryun
8b4240831b fix(types): narrow chatCore local contracts (#9562)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:54:00 -03:00
backryun
4da8ef47c3 fix(types): align stream failure callback contracts (#9561)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:57 -03:00
Shixi Li
0a1f84f83f fix(classify): honor upstream retry windows on Gemini free-tier 429s (#9513)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:54 -03:00
nguyenha935
20a4ab6f55 fix(api): stop rejecting long chat histories by default (#9494)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:51 -03:00
Bob.Hou
765fd71aea feat(lib): make MODELS_DEV_SYNC_ENABLED actually control the sync (#9483)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:47 -03:00
Bob.Hou
29d97ac328 fix(sse): take the Antigravity output ceiling from the model, not a constant (#9482)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:44 -03:00
dependabot[bot]
1f77f75b69 deps: bump undici from 8.9.0 to 8.10.0 (#9472)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:41 -03:00
Poid-ZA
d22839626b chore(db): raise sqlite cache_size/mmap_size defaults (#9467)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:38 -03:00
dependabot[bot]
cd97ce5c2c chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#9462)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:35 -03:00
dependabot[bot]
656526bc8d chore(deps): bump github/codeql-action/init from 4.37.3 to 4.37.4 (#9461)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:33 -03:00
dependabot[bot]
9f9ff3911a chore(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.4 (#9459)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:30 -03:00
dependabot[bot]
7b7b22cec4 chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4 (#9458)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:27 -03:00
小妍儿 ✨
6aa9d90067 fix(ui): preserve request log position (#9452)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:24 -03:00
Bob.Hou
217ac4c829 feat(warmup): proactive Claude warmup scheduler (#8848) (#9449)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:21 -03:00
Diego Rodrigues de Sa e Souza
2f5df569b5 feat(api): add plugins marketplace install API (#6752) (#9445)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:18 -03:00
Diego Rodrigues de Sa e Souza
348102a114 feat(api): add response content encoding verification (#6736) (#9444)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:15 -03:00
Wahyu Hidayatulloh Pamungkas
e6bf92ad65 fix(usage): stop double-counting cache-read tokens in Command Code executor (#9438)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:12 -03:00
Pixma
99be4474b6 fix(providers): correct Codex GPT-5.6 context limits (#9432)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:08 -03:00
dependabot[bot]
6287caa5b3 deps: bump the npm_and_yarn group across 1 directory with 2 updates (#9427)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:05 -03:00
Diego Rodrigues de Sa e Souza
babc75f058 feat(chatgpt-web): harden prompt-emulated tool contract for thinking models (#7679) (#9422)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:02 -03:00
Chewji
062d48b1ad fix(combo): keep operator-defined model order for deterministic strategies (#9420)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:53:00 -03:00
Diego Rodrigues de Sa e Souza
74cf860ccc feat(providers): make video_url passthrough configurable per provider/model (#9248) (#9419)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:57 -03:00
Diego Rodrigues de Sa e Souza
915b383a71 fix(qoder): surface qodercli stderr in error message instead of generic 502 (#9319) (#9412)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:54 -03:00
Bob.Hou
7857e0ac6d refactor(sse): move the thinking-budget helpers out of base.ts (#9381)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:51 -03:00
Bob.Hou
f22b81c2d2 fix(sse): drop the localDb barrel imports from chat and auth (#9380)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:48 -03:00
Bob.Hou
c32818e738 test(quota): wait for the hot-path consumption instead of sleeping (#9365)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:45 -03:00
Milan Soni
696435efa8 fix(routing): normalize time remaining in reset-window strategy (#9330) (#9353)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:42 -03:00
Bob.Hou
a57e4ab873 fix(auth): let an agy request find the connection it authorized (#9340)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:38 -03:00
Diego Rodrigues de Sa e Souza
9dd6251361 feat(dashboard): render provider API key registration links (#9270) (#9336)
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679).
2026-08-07 20:52:35 -03:00