Diego Rodrigues de Sa e Souza
d7a7302ec8
fix(deps): bump nanoid, dompurify, mermaid, js-yaml on default branch
...
Closes 9 Dependabot alerts (#182-#190). npm audit → 0.
2026-08-08 08:10:11 -03:00
diegosouzapw
19666060b2
fix(deps): bump nanoid, dompurify, mermaid, js-yaml on default branch
...
Closes 9 Dependabot alerts (#182-#190) on the default branch
(release/v3.8.50):
- nanoid ^3.3.17 (3.3.16→3.3.18)
- dompurify ^3.4.13 (direct dep bump + monaco-editor scoped override)
- mermaid → 11.16.1
- js-yaml v4 nested copies → 4.3.1 (scoped overrides)
npm audit → 0 vulnerabilities.
2026-08-08 08:07:38 -03:00
backryun
d73a1e6fc8
fix(kiro): complete cache-only usage totals ( #9753 )
2026-08-08 07:15:34 -03:00
backryun
b0a377e66c
fix(types): preserve narrowed Codex input arrays ( #9748 )
2026-08-08 07:15:31 -03:00
backryun
52a6b04f8e
fix(types): preserve video URL override contracts ( #9747 )
2026-08-08 07:15:28 -03:00
backryun
4f8dccc8a3
test(types): use Vitest expectations in tier resolver ( #9742 )
2026-08-08 07:15:25 -03:00
Diego Rodrigues de Sa e Souza
71c85f31cd
feat(guardrails): modality bridge core — vision mode/task-aware/cache/input_image + modalityBridge settings ( #9759 )
...
* feat(sse): unified media-part detection helper (image+audio, input_image)
* refactor(guardrails): extractImageParts/comboStructure delegate to unified media detector
* fix(sse): media detector — audio parts no longer shadow sibling/nested image indicators
* fix(guardrails): close extract↔replace contract for input_image (allowlist + splice)
* perf(guardrails): skip media traversal when bridge disabled; short-circuit combo image check
* feat(guardrails): in-memory LRU bridge cache (sha256 keyed)
* feat(settings): modalityBridge* schema with legacy visionBridge* fallback
* feat(db): migrate visionBridge* settings to modalityBridge* (idempotent)
* refactor(guardrails): harden bridge cache key/config + settings resolution (review minors)
* feat(guardrails): vision bridge mode selector (auto/describe/reroute) short-circuit
* feat(guardrails): task-aware vision description prompt (default on)
* feat(guardrails): describe-path cache integration
* docs(guardrails): review polish — cache-key coupling notes + helper header
* feat(guardrails): in-memory bridge stats + modality-bridge response header
* feat(api): modality bridge stats endpoint + header wiring in chat handler
* docs(guardrails): document modality bridge mode/task-aware/cache/header + stats endpoint
* chore: untrack _tasks symlink (inherited from base tip; blocks pre-commit tracked-artifacts gate)
* fix(db): renumber modality bridge migration 139->140 (base renumbered ccr_blocks to 139)
* docs(guardrails): migration filename touch-up 139->140
* docs(db): stale comment touch-ups after 139->140 renumber and #9688 landing
* fix(db): renumber modality bridge migration 140->141 (base renumbered connection_runtime_state to 140)
* test(db): migration test titles 139->141
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com >
2026-08-08 01:59:11 -03:00
diegosouzapw
caf768e3c4
fix(repo): untrack the _tasks self-referential symlink
...
_tasks is a SEPARATE nested git repo (gitignored). A self-referential symlink
_tasks -> its own path was tracked here; every pull materialized it over the real
_tasks repo, destroying plans/specs/hands-off. Now untracked (and /_tasks in
.gitignore prevents re-capture).
2026-08-08 01:21:02 -03:00
diegosouzapw
fd0e8da8ff
fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks)
2026-08-08 01:20:35 -03:00
Markus Hartung
acfb844852
fix(db): resolve migration version 135 numbering collision ( #9745 )
...
Two files both claimed migration version 135:
135_connection_runtime_state.sql (#9449 , landed 2026-08-07) and
135_migrate_model_capability_max_token.sql (#8908 , landed 2026-08-05).
#9449 branched before #8908 merged and never got renumbered before
landing on release/v3.8.50.
This is not cosmetic: getMigrationFiles() throws "Migration version
collision detected" the moment ANY code path first touches the
database (getDbInstance() -> runMigrations()), which means a
completely fresh install/deploy from this branch cannot even boot —
confirmed live against a freshly built container while testing
unrelated live-verification tooling.
Renumbered the later-landing file to 140 (the next free slot) and
added the matching isSchemaAlreadyApplied("140") retroactive guard in
migrationRunner.ts, so a DB that already ran this migration under the
old 135 number isn't treated as needing a fresh application. This
matches the established pattern already used for the prior 135/136 ->
137/138 renumber in the same file (also caused by the same recurring
branch-before-merge numbering race).
Test plan:
- TDD: new tests/unit/migration-135-numbering-collision.test.ts (2/2)
— spins up a hermetic fresh DB and confirms getDbInstance() applies
every real on-disk migration without throwing, plus confirms both
formerly-135 migrations' effects are present. Confirmed failing
(reproducing the exact live crash) with the pre-fix colliding
filenames restored, passing after the rename.
- npm run typecheck:core — clean
- npm run lint — clean
- npm run check:file-size — clean (migrationRunner.ts rebaselined
1084->1094 for the new guard case)
- Full migration-runner + migration-numbering test suites (64 tests
across 6 files) — all pass, no regressions
2026-08-08 00:42:29 -03:00
Diego Rodrigues de Sa e Souza
ee0f4298ca
feat(plugins): expose client request headers in plugin context ( #9570 ) ( #9668 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:32 -03:00
Markus Hartung
0082ac5113
fix(openrouter): scope model failures per-model instead of poisoning the whole connection ( #9635 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:29 -03:00
Arnav Rastogi
e224165689
fix(providers): mint a Zed LLM token for zed-hosted model discovery ( #9628 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:26 -03:00
stanley
552f2e1563
fix(backend): stop reasoning replay placeholder from self-poisoning ( #9573 ) ( #9610 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:23 -03:00
vinogradovnet
8cb51b7922
feat(compression): add Russian language pack ( #9581 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:20 -03:00
Maxim Seshuk
8da0aa5ba8
fix(standalone): don't await the WebDAV check before Next's listener ( #9580 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:17 -03:00
Maxim Seshuk
7a369ba6e3
feat(audio): add Soniox STT + TTS provider ( #9579 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:14 -03:00
backryun
e60d7f81b8
fix(types): preserve streaming PII choice keys ( #9566 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:11 -03:00
backryun
e62516364c
fix(types): validate Vision Bridge combo names ( #9565 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:08 -03:00
backryun
c4f37ab01b
fix(types): preserve sanitized tool array contracts ( #9564 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:05 -03:00
backryun
250ea5e849
fix(types): validate Azure OpenAI base URLs ( #9563 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:03 -03:00
backryun
8b4240831b
fix(types): narrow chatCore local contracts ( #9562 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:54:00 -03:00
backryun
4da8ef47c3
fix(types): align stream failure callback contracts ( #9561 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:57 -03:00
Shixi Li
0a1f84f83f
fix(classify): honor upstream retry windows on Gemini free-tier 429s ( #9513 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:54 -03:00
nguyenha935
20a4ab6f55
fix(api): stop rejecting long chat histories by default ( #9494 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:51 -03:00
Bob.Hou
765fd71aea
feat(lib): make MODELS_DEV_SYNC_ENABLED actually control the sync ( #9483 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:47 -03:00
Bob.Hou
29d97ac328
fix(sse): take the Antigravity output ceiling from the model, not a constant ( #9482 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:44 -03:00
dependabot[bot]
1f77f75b69
deps: bump undici from 8.9.0 to 8.10.0 ( #9472 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:41 -03:00
Poid-ZA
d22839626b
chore(db): raise sqlite cache_size/mmap_size defaults ( #9467 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:38 -03:00
dependabot[bot]
cd97ce5c2c
chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 ( #9462 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:35 -03:00
dependabot[bot]
656526bc8d
chore(deps): bump github/codeql-action/init from 4.37.3 to 4.37.4 ( #9461 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:33 -03:00
dependabot[bot]
9f9ff3911a
chore(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.4 ( #9459 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:30 -03:00
dependabot[bot]
7b7b22cec4
chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4 ( #9458 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:27 -03:00
小妍儿 ✨
6aa9d90067
fix(ui): preserve request log position ( #9452 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:24 -03:00
Bob.Hou
217ac4c829
feat(warmup): proactive Claude warmup scheduler ( #8848 ) ( #9449 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:21 -03:00
Diego Rodrigues de Sa e Souza
2f5df569b5
feat(api): add plugins marketplace install API ( #6752 ) ( #9445 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:18 -03:00
Diego Rodrigues de Sa e Souza
348102a114
feat(api): add response content encoding verification ( #6736 ) ( #9444 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:15 -03:00
Wahyu Hidayatulloh Pamungkas
e6bf92ad65
fix(usage): stop double-counting cache-read tokens in Command Code executor ( #9438 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:12 -03:00
Pixma
99be4474b6
fix(providers): correct Codex GPT-5.6 context limits ( #9432 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:08 -03:00
dependabot[bot]
6287caa5b3
deps: bump the npm_and_yarn group across 1 directory with 2 updates ( #9427 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:05 -03:00
Diego Rodrigues de Sa e Souza
babc75f058
feat(chatgpt-web): harden prompt-emulated tool contract for thinking models ( #7679 ) ( #9422 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:02 -03:00
Chewji
062d48b1ad
fix(combo): keep operator-defined model order for deterministic strategies ( #9420 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:53:00 -03:00
Diego Rodrigues de Sa e Souza
74cf860ccc
feat(providers): make video_url passthrough configurable per provider/model ( #9248 ) ( #9419 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:57 -03:00
Diego Rodrigues de Sa e Souza
915b383a71
fix(qoder): surface qodercli stderr in error message instead of generic 502 ( #9319 ) ( #9412 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:54 -03:00
Bob.Hou
7857e0ac6d
refactor(sse): move the thinking-budget helpers out of base.ts ( #9381 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:51 -03:00
Bob.Hou
f22b81c2d2
fix(sse): drop the localDb barrel imports from chat and auth ( #9380 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:48 -03:00
Bob.Hou
c32818e738
test(quota): wait for the hot-path consumption instead of sleeping ( #9365 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:45 -03:00
Milan Soni
696435efa8
fix(routing): normalize time remaining in reset-window strategy ( #9330 ) ( #9353 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:42 -03:00
Bob.Hou
a57e4ab873
fix(auth): let an agy request find the connection it authorized ( #9340 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:38 -03:00
Diego Rodrigues de Sa e Souza
9dd6251361
feat(dashboard): render provider API key registration links ( #9270 ) ( #9336 )
...
Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679 ).
2026-08-07 20:52:35 -03:00