* feat(posthog): correlate task events with Go logs via request_id
Auto-injects server request_id into all PostHog server events from
AsyncLocalStorage context. Adds task_request_started client event fired
when SSE traceparent response header arrives, carrying the trace ID used
by Go for log correlation. task_generation_aborted now includes the
in-flight request_id when available.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* improvement(posthog): tighten trace ID parse and verbose comments
* fix(posthog): use traceparent header as canonical request_id source
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): phase 1 — gutter numbering from array index
Delete the PositionGapRows component, the gap-fill loop, and the
GAP_CHECKBOX_CLASS / GAP_ROW_LIMIT / PositionGapRowsProps surface area.
The server's recompactPositions() guarantees positions are 0..N-1
contiguous in the unfiltered view, so the phantom-row machinery has
been defending against a state that essentially never happens.
DataRow now receives an arrayIndex prop and renders {arrayIndex + 1}
in the gutter. Selection coordinates still flow through row.position;
that switches in phase 2.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): phase 2-5 — selection by array index, checks by row id
Decouple Tables UI selection coordinates from DB position:
- rowIndex semantics shift from row.position to array index across
selection state, mouse handlers, keyboard nav, paste, scrollIntoView
- checkedRows: Set<number> (position) → Set<string> (rowId), survives
sort/filter and realtime row inserts
- lastCheckboxRowRef stores rowId; shift-click range resolves to current
array indices for visual-order ranges
- Drop positionMap/maxPosition derived state in favor of direct rowsRef
reads
- ExpandedCellPopover anchors via data-row-id (row-id-stable) instead
of data-row (array index)
- collectRowSnapshots accepts Iterable<TableRowType> directly
- Add bounds-validation effect to clamp anchor/focus when rows.length
shrinks (sort change, pagination, realtime delete)
- Drop redundant arrayIndex prop on DataRow (rowIndex now equals it)
Server-side position math stays at API boundary only: insertRow,
duplicateRow, shift-Enter append, paste create-batch, undo snapshots.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): rowId-stable selection across sort, position math via reduce
- Track anchor/focus by rowId so same-length sort changes remap selection
to the new visual index instead of leaving it on a different row.
- Replace last-row position lookups with Math.max reduce in paste's
create-batch and append-row's undo snapshot — under non-position sorts,
the last visual row's position is not the largest.
- Trim a navigation-noise comment and tighten two over-explanatory ones.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(tables): guard rowId remap effect and document paste batch position
- Skip the validation effect when rows is empty (transient state during
initial load of a new sort/filter before keepPreviousData populates) so
selection survives uncached query changes.
- Skip when isColumnSelection is true; the column-selection pinning effect
owns focus.rowIndex for those, and remapping would shrink a full-column
range to wherever the captured endpoints happened to land after reorder.
- Comment lastRowPosition's hoist invariant so a future refactor doesn't
move it inside the loop and produce colliding positions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(tables): suppress phantom rows on sort, center gutter numbers, stop select-all viewport jump
* fix(tables): suppress scroll on Ctrl+A select-all
Cmd/Ctrl+A duplicates the select-all logic but missed the
suppressFocusScrollRef flag, so the keyboard path still triggered
the viewport jump.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(logs): add Logs block for querying execution logs from workflows
* fix(logs): guard transformResponse on non-2xx and correct executionMetadata description
- Add response.ok check in all three logs tools' transformResponse so a
4xx/5xx body cannot be silently treated as a success payload (defense
in depth; the executor already throws on non-2xx before transform runs).
- Drop totalTokens from executionMetadata description in block and tool
outputs since the snapshot route does not emit it.
* fix(logs): split summary/detail contracts to make trace tab gate type-safe
The Trace tab was silently missing from the Log Details sidepanel because
list and detail rows shared one WorkflowLog type with executionData:
z.unknown(). The UI couldn't distinguish a summary row (no spans) from a
detail row (with spans), so the tab gate read undefined and hid itself.
Splits into WorkflowLogSummary (list) and WorkflowLogDetail (typed
executionData with optional traceSpans). Detail and by-execution routes
both write through to the same logKeys.detail(id) cache, eliminating the
two-key fragmentation that caused the merge memo workaround. List route
moves to cursor pagination on (sortValue, id) with proper NULLS LAST
handling and SQL-side sort across workflow + job execution tables.
Detail route now requires and asserts workspaceId. Deep-link path uses
useLogByExecutionId instead of auto-paginating the entire workspace.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): audit follow-ups — render side-effect, stats invalidation, enhanced spread order
- Move onActiveTabChange call from render into useEffect to avoid
side-effects during render (StrictMode safety).
- Re-add logKeys.stats() invalidation to cancel/retry mutations so
the dashboard reflects status flips immediately.
- Reorder enhanced: true after ...execData spread in detail and
by-execution routes so the literal discriminator is never
overwritten by stale execData.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): mirror SQL NULLS LAST in JS merge for cursor consistency
The in-memory merge of workflow + job pages negated the comparator
for DESC, which placed null sort values at the start. SQL orders
both ASC and DESC with NULLS LAST, so DESC pages emitted a cursor
{v: <last non-null>, id: ...} while null rows still satisfied the
cursor predicate (OR sort_expr IS NULL) on the next page —
producing duplicate null rows across pages on cost/duration sorts.
Handle nulls explicitly in the JS comparator so they always sort
last regardless of direction, matching the SQL ordering.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): final-audit follow-ups — stable tab callback, byExecution invalidation, optimistic detail patch, trace loading state
- Wrap LogDetails -> LogDetailsContent onActiveTabChange in useCallback
so the child useEffect doesn't refire on every parent render.
- Add logKeys.byExecutionAll() to cancel + retry invalidation so the
table-embedded sidebar picks up status changes immediately.
- Optimistic write-through to logKeys.detail in useCancelExecution so
the open sidebar reflects 'cancelling' instantly; rolls back on error.
- Distinguish trace loading from trace-empty: when log.executionData is
not yet fetched, render "Loading trace…" instead of the empty state.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): migrate stores/components to contract types
Replace the legacy `WorkflowLog` / `LogsResponse` / `WorkflowData` /
`CostMetadata` / `ToolCallMetadata` shapes in
`stores/logs/filters/types.ts` with direct use of the contract types
`WorkflowLogSummary`, `WorkflowLogDetail`, and a new `WorkflowLogRow`
alias for surfaces that render either form. Removes the
`summaryToWorkflowLog` / `detailToWorkflowLog` bridge in the React
Query layer along with their double-cast annotations.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): address PR review feedback
- Whitelist sort columns against logSortBy enum to prevent client crash
when non-sortable headers (workflow, trigger) reach the contract parser.
- Extract fetchLogDetail helper shared by /api/logs/[id] and
/api/logs/by-execution/[executionId] — collapses ~360 duplicated lines
to a single source of truth keyed on lookup column.
* fix(logs): exclude job logs when level filter is workflow-only
When level=running or level=pending (workflow-only states involving
endedAt/pausedExecutions semantics), jobLevelConditions stayed empty
so no level constraint reached jobConditions — every job log in the
workspace leaked into the result. Skip the job side entirely when the
level filter has no job-applicable values (error/info).
* chore(logs): drop dead utils — mapToExecutionLog and friends
Remove ExecutionLog/RawLogResponse/ExecutionCost/LogWithExecutionData/
TraceSpan/BlockExecution interfaces and the mapToExecutionLog,
mapToExecutionLogAlt, extractOutput functions — all unreferenced after
the contract split. -212 lines.
* chore(logs): drop unused LOG_COLUMN_ORDER and LogColumnKey
* fix(logs): hydrate filters from URL synchronously on mount
The previous useEffect-based initializeFromURL caused useLogsList and
useDashboardStats to fire once with default store filters, then refetch
after the effect updated filters from the URL. Move the initial hydrate
into a useState lazy initializer so the first render already reads
URL-derived filters; the popstate handler keeps the existing effect for
back/forward navigation.
* chore(logs): trim verbose comments added during PR
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): guard navigation arrows when selected log is off-page
Deep-linked logs resolved via useLogByExecutionId may not be in the
current page list, leaving selectedLogIndex at -1. The hasNext prop
was evaluating -1 < logs.length - 1 (true for any non-empty list),
which enabled the next arrow and jumped to the first item on click.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): sync active-tab callback before paint to keep keyboard guards aligned
Run the resolvedTab → onActiveTabChange propagation in useLayoutEffect
so the parent's activeTabRef updates synchronously before the next
paint. This closes the brief window where window keydown handlers
in the logs page would still see activeTabRef.current === 'trace'
and short-circuit arrow-key navigation immediately after switching
to a log without a Trace tab.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(copilot): redact sim_key API keys from persisted Mothership chat messages
* improvement(emcn): promote ApiKeyReveal to SecretReveal in emcn
* fix(copilot): thread cursor across content blocks when restoring sim_key tags
* fix(mothership): stop persisting log resources from get_workflow_logs and self-heal stale log panel entries
* fix(mothership): skip retries on 404 in useLogDetail for instant self-heal
* fix(mothership): simplify onNotFoundRef sync to inline assignment
* fix(mothership): catch draft restore errors instead of crashing /home
Wrap the mount-time draft restore in try/catch with clearDraft on
throw, and coerce text to a string in the useState initializer.
A corrupt entry in mothership-drafts:v1 localStorage previously took
down the entire workspace via the error boundary.
* fix(mothership): defer state writes and log restore failures
Build the restored state in locals first and only apply on success
so a partial throw can't leave stale contexts in the UI with the
draft already cleared. Switch the empty catch to logger.error so
corrupt-draft incidents surface in production logs.
* feat(knowledge): expose Cohere reranker controls on knowledge block
Add a self-hosted Cohere API key field (mirroring the agent block's hosted-key
pattern), a configurable reranker input pool size (1-100), and surface
meta.warnings from Cohere rerank responses via logger.warn. All new contract
fields are optional and nullable for full backwards compatibility.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): address PR feedback on Cohere reranker controls
- Drop required:true on apiKey field — server has BYOK→env→rotation fallback
chain, so self-hosted users with COHERE_API_KEY env should not be blocked
- Drop .min(1) on rerankerApiKey contract field so empty strings coerce to
undefined via the transform (matches the existing query field pattern)
- Log a warning when rerankerInputCount is clamped up to topK so users notice
their setting was overridden
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(knowledge): mirror agent block API key visibility for Cohere reranker
Restore required:true on the Cohere API Key field and hide it server-side via
a new NEXT_PUBLIC_COHERE_CONFIGURED public env flag — same pattern the Agent
block uses for Azure (NEXT_PUBLIC_AZURE_CONFIGURED). Self-hosters who set
COHERE_API_KEY in their environment also set NEXT_PUBLIC_COHERE_CONFIGURED=true,
which removes the field from the UI; everyone else sees a required field.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): treat empty rerankerInputCount as unset
An empty string from the Documents Sent to Reranker input passed the
undefined/null guard, so Number('') = 0 → clamped to 1, sending only 1
document to the reranker instead of falling back to the 4× topK auto
default. Add the empty-string check to the guard.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): align upload route image extensions with picker
* fix(files): widen image mime mapping for chat/profile/logo uploads
* fix(files): fall back to extension when MIME is generic for image-only uploads
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): add new image extensions to EXTENSION_TO_MIME map
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): skip non-Claude image MIMEs in createFileContent
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): resolve content type for image-only contexts when MIME is generic
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): cover image/jpg in Claude gate, reverse MIME map, audit metadata
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(files): allow image uploads in workspace files
* fix(files): include images in workspace type filter
* fix(files): match all image mime types in image filter
* feat(files): export markdown as zip with embedded images in assets/ folder
* fix(files): sanitize zip filenames, fix storage context cast, cap embedded image count
* fix(files): fix race condition in asset filename deduplication
* chore(files): remove extraneous comments from export route
* fix(files): sanitize markdown zip entry name, full uuid fallback for filename dedup
* fix(files): extract userId const to satisfy TypeScript narrowing in async callback
* fix(files): use replacer function to prevent $ special-char corruption in markdown URL rewrite
* fix(files): wrap zip buffer in Uint8Array for NextResponse BodyInit compatibility
* lock behavior
* fix(workflow): track resolved isAdmin in prevIsAdminRef to prevent stale lock notification
When workspacePermissions loads asynchronously, prevCanAdminRef (which only
tracked effectivePermissions.canAdmin) would not detect the change, causing
the early-return guard to skip rebuilding the notification with the correct
unlock-button visibility. Track the same resolved value (workspacePermissions
?.viewer?.isAdmin ?? effectivePermissions.canAdmin) that is actually used to
build the notification.
* refactor(uploads): rename server fn to fetchWorkspaceFileBuffer, move client download to uploads/client/download.ts as triggerFileDownload
* more lock updates
* fix(tests): update mocks for fetchWorkspaceFileBuffer rename
* improvement(sidebar): overlay lock indicator on leading icon
* fix(sidebar): correct lock indicator HTML nesting and a11y
* improvement(sidebar): swap lock indicator with more button on hover
* fix(sidebar): gate pointer-events on lock and more button visibility
* fix(sidebar): add role=img so lock indicator is announced by AT
* fix(uploads): direct-to-S3 workspace files + shared transport
* chore(testing): centralize posthog and storage-service mocks
* fix(uploads): address PR review — abort propagation, orphan cleanup, error handling
- Throw immediately on AbortError in KB retry loop (no useless 14s backoff)
- Cleanup S3/Blob object on quota or size-cap rejection in registerUploadedWorkspaceFile
- Enforce MAX_WORKSPACE_FILE_SIZE at registration (defense vs presigned PUT lying about size)
- Handle non-OK / non-JSON responses in workspace-files upload paths
* fix(uploads): add Zod contracts for workspace presigned/register routes
* fix(uploads): correct BlobServiceClient type name in headBlobObject
* fix(uploads): address PR review — typo, complete-failure cleanup, double-increment
* fix(uploads): preserve fallback size and reuse existing display name on re-register
* fix(uploads): surface server error message and bypass quota for local-storage fallback
* fix(uploads): align register response schema with UserFile; skip presigned for KB large files
- registerWorkspaceFileResponseSchema now matches the UserFile shape the route actually returns; previous schema required workspace DB-row fields that were never populated, causing requestJson validation to reject successful uploads.
- KB batch presigned fetch now skips files >= LARGE_FILE_THRESHOLD since multipart bypasses the per-file presigned URL anyway.
* fix(uploads): idempotent register skips duplicate audit/posthog; add edge-case tests
- registerUploadedWorkspaceFile now returns { file, created } so the route can skip captureServerEvent and recordAudit on idempotent re-register (existing metadata reused). Previously a re-register fired duplicate analytics + audit log entries.
- Add tests covering: idempotent re-register skips audit/analytics, isNetworkError matches econnreset/timeout/etc keywords, multipart complete failure fires action=abort cleanup.
* fix(uploads): include 50MiB boundary in batch presigned fetch
* fix(uploads): trust HEAD size to prevent quota inflation
The head.size > 0 fallback let a client PUT 0 bytes and register
with an inflated size, debiting quota without storing data. HEAD
on an existing object always returns the true byte count, so trust
it directly — a genuine 0-byte file correctly contributes 0.
* fix(uploads): audit verified file size, not client-supplied
* fix(uploads): handle register retries and name-collision races
Two bugs in registerUploadedWorkspaceFile:
1. Register retry could orphan storage. When a successful response
was lost on the wire and the client retried, the quota check saw
the bytes already counted, failed, and cleanupOrphan deleted the
already-registered storage object — leaving the DB row pointing
to nothing. Fix: check getFileMetadataByKey before quota guard
and short-circuit on existing record.
2. Concurrent same-named uploads could lose data. allocateUniqueWorkspaceFileName
is best-effort; two racing uploads can pass it and both attempt
the same display name. The loser's insert hits 23505, the catch
block called cleanupOrphan, and successfully-uploaded bytes
were deleted. Fix: retry on 23505 with a fresh allocateUniqueWorkspaceFileName,
matching the pattern in uploadWorkspaceFile. Throw FileConflictError
after exhaustion.
* fix(uploads): retry transient DirectUploadErrors at outer KB level
The KB outer retry only triggered on isNetworkError, missing
transient 5xx from S3/Azure (DirectUploadError code
DIRECT_UPLOAD_ERROR or MULTIPART_ERROR). Adds isTransientUploadError
and retries on it, restoring resilience for small-file presigned
PUTs against flaky cloud storage.
* fix(uploads): only retry transient 5xx, not deterministic 4xx
DirectUploadError now carries the HTTP status. isTransientUploadError
gates on 5xx so callers don't loop on 400/403/404 (e.g., malformed
request, expired signature). Multipart per-part retry also short-circuits
on 4xx — same reasoning.
* refactor(uploads): collapse getFileContentType into resolveFileType
The two helpers differed only in whether application/octet-stream
falls back to the extension map. Add an option flag to resolveFileType
and keep getFileContentType as a thin wrapper for direct-PUT callers
that need to preserve the exact browser-reported content-type.
* chore(uploads): trim verbose comments
Drop inline comments that restate code ("Use the full storageKey as fileName"),
collapse a multi-line block comment into a tighter TSDoc on the existence
check, and prune verbose vitest file headers — describe blocks already
document what's tested.
* fix(uploads): regenerate fileId per insert retry; require cloud storage for register
* fix(uploads): cap formdata fallback at 100MB; drop unused size param
* fix(uploads): abort multipart on get-part-urls failure; retry register on transient errors
* fix(uploads): drop vestigial size field from register contract
* fix(uploads): abort multipart on complete-fetch throw
* fix(uploads): set kb presignedEndpoint fallback; race-safe blob HEAD
* fix(uploads): include ?type=knowledge-base on kb presigned fallback
* fix(uploads): remove abort listener on xhr timeout
* fix(uploads): add timeout/abort to kb api fallback upload
* fix(connectors): harden 10 KB connectors after audit
Validated each issue against provider docs before fixing.
- jira: migrate from deprecated /rest/api/3/search (Atlassian sunset
May 2025) to /rest/api/3/search/jql with nextPageToken pagination
- confluence: unify stub hash across v1 CQL (`when`) and v2
(`createdAt`) paths via shared pageToStub helper using version.number
- salesforce: replace hardcoded login.salesforce.com userinfo with
host fallback so sandbox-issued tokens (test.salesforce.com) work
- servicenow: validate sys_id against /^[a-f0-9]{32}$/ and switch
getDocument to path-based /api/now/table/{table}/{sys_id} to close
encoded-query injection; reject `^` in kbCategory filter
- zendesk: URL-encode Search API query via URLSearchParams; whitelist
ticket statuses; encode locale path segment
- github: add 10MB cap and /git/blobs/{sha} fallback for files >1MB
that /contents/ returns with encoding:"none"
- slack: replace SHA-256 over formatted-message window with metadata
hash slack:{channelId}:{latestTs}:{count} so list and getDocument
agree; cache auth.test team_id on syncContext
- obsidian: drop syncRunId from stub hash (Local REST API has no
HEAD/Last-Modified per OpenAPI spec); fall back to path-only stub
so engine two-stage check short-circuits unchanged notes
- evernote: title fallback for attachments-only notes — breaks
infinite hydration loop where empty plaintext returned null
- google-docs: drop residual `error instanceof Error` pattern
Confluence and Slack hash format changes self-heal with a one-time
re-sync; no data loss.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors/slack): include oldestTs in hash to catch window-shift edits
Audit caught that the metadata hash slack:{channel}:{latestTs}:{count}
misses edits to the oldest message in the rolling window — count and
latestTs both stay constant. Adding oldestTs catches window-shift
when a new message arrives and pushes the oldest out without changing
the newest.
Also drop residual error instanceof Error pattern in validateConfig.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address remaining audit findings
- jira: thread VALIDATE_RETRY_OPTIONS through getJiraCloudId so the
validate path uses the tighter retry budget
- confluence: thread VALIDATE_RETRY_OPTIONS through getConfluenceCloudId;
drop residual error instanceof Error pattern
- zendesk: log a warning when statusFilter is set and limit exceeds
the Search API 1000-result cap; add priority to tagDefinitions and
mapTags so the metadata isn't orphaned
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address PR review comments
- github: skip blob fetch for empty 0-byte files
- salesforce: add fallback message for empty error
- zendesk: warn on invalid statusFilter instead of silent fallthrough
- evernote: remove dead content.trim() guard
* fix(zendesk): add fallback message for empty validateConfig error
* docs(obsidian): clarify hash strategy and re-hydration behavior
* fix(connectors): address parallel audit findings
- servicenow: case-insensitive sys_id pattern; validate workflowState/incidentState/incidentPriority as numeric, kbCategory via allowlist
- salesforce: include 400 in userinfo host fallthrough for sandbox tokens
- zendesk: add missing 'new' and 'hold' options to ticketStatus dropdown
* fix(servicenow): allow string workflowState values (published/draft/review/retired)
* fix(obsidian): validateConfig must check authenticated field, not just status
GET / is the only public endpoint per the Local REST API spec — it returns
200 regardless of auth and exposes the real signal via response.authenticated.
The prior status-based check let invalid API keys pass validation.
* fix(jira): encode collected count in cursor so maxIssues cap works without syncContext
* fix(connectors): address remaining audit findings
- slack: detect message edits and new threaded replies via edited.ts/latest_reply in contentHash
- github: skip binary files via NUL-byte sniff and filter oversized files at tree-list time
- servicenow: add 'outdated' workflow state to allowlist and dropdown; add Canceled (8) to incident state dropdown
- salesforce: drop 400 from userinfo host fallthrough (Salesforce returns 401/403 for cross-env tokens)
* fix(github): apply binary check to blob fallback path
fetchBlobContent now runs isBinaryBuffer on base64-decoded data and
returns null for binaries; getDocument propagates the null so 1-10MB
binary files are skipped instead of being decoded into garbled UTF-8.
* fix(confluence): reuse pageToStub in getDocument to keep hashes in sync
Replace duplicated versionKey/contentHash logic with a single call to
pageToStub so listDocuments and getDocument can never drift.
* fix(connectors): address audit findings across 7 connectors
- github: branch with slashes encoded per-segment in sourceUrl; treat 403
Contents API responses (>100MB or restricted) as null instead of
throwing; fetchBlobContent throws on unexpected encoding rather than
returning empty content
- jira: ADF extractor handles hardBreak, mention, and emoji nodes
- google-docs: paragraph join uses newline so heading/body boundaries
are preserved
- servicenow: drop legacy 'wiki' field from kb_knowledge requests; only
the 'text' field is reliably present on modern instances
- salesforce: KnowledgeArticleVersion query adds IsLatestVersion=true to
avoid duplicate historical versions; encode externalId in sObject GET
- slack: subtype filter switches to a denylist (SLACK_NOISE_SUBTYPES) so
thread_broadcast / me_message / reminder_add are kept; reply_count
folded into contentHash to detect threaded reply deletes
- confluence: drop bare-string cursor fallback; unparseable cursors now
restart the listing instead of silently re-listing blogposts from 0
* fix(servicenow): allow non-ASCII KB category names
Switch from a \w-based allowlist (ASCII only) to a denylist that
rejects only encoded-query-meaningful characters (^, control chars,
quotes). International category names like 'Général' or 'Ação' are
now accepted.
* fix(servicenow): restore wiki field fallback for kb_knowledge
Wiki-template KB articles populate the wiki field and leave text empty;
HTML-template articles do the opposite. Removing wiki caused wiki-format
articles to resolve to empty content and be silently skipped.
* fix(connectors): jira pagination signal and google-docs paragraph join
- jira: rely solely on absence of nextPageToken for end-of-results;
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the OR-with-isLast logic could truncate pagination early
- google-docs: strip trailing newline from each paragraph before
joining so heading->body produces a single newline, not two
* fix(jira): rely solely on nextPageToken for end-of-results
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the previous OR-with-isLast logic could truncate pagination early
if Jira ever returned isLast=true alongside a valid nextPageToken.
* fix(slack): exclude DM channel IDs from direct lookup
DM (D...) channel IDs require im:*/mpim:* OAuth scopes, which the
connector does not request. The regex now matches only public (C) and
private (G) channel IDs to fail fast with a clearer error instead of
hitting missing_scope from Slack.
* fix(slack): align validateConfig channel ID regex with resolveChannel
The previous fix narrowed the regex in resolveChannel to [CG] but missed
the duplicate in validateConfig, which still admitted DM IDs and would
fall through to a name-based search returning 'Channel not found.'
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(table): make plan table limits configurable via env vars
* fix(table): coerce env table limits to number for skipValidation env
* improvement(env): extract envNumber helper for numeric env coercion
* improvement(knowledge): use envNumber helper for KB_CONFIG_* env reads
* fix(testing): add envNumber to env mock factory
* fix(env): allow zero in envNumber for max-throughput configs
* fix(env): add min option to envNumber for strict-positive configs
* fix(chat): close SSO auth bypass via checkSSOAccess body flag
- Remove checkSSOAccess short-circuit; SSO branch always validates via getSession()
- Skip chat_auth cookie issuance/validation for SSO deployments to prevent replay
- Split eligibility pre-flight into dedicated POST /api/chat/[identifier]/sso route
- Drop .passthrough() and checkSSOAccess from deployed chat contracts
- Add SSO branch test coverage in chat utils
* fix(chat): cast allowedEmails to string[] for SSO eligibility check
* fix(chat): close SSO GET cookie replay and add eligibility rate limit
- Skip chat_auth cookie validation for SSO in GET handler (replay vector for pre-fix cookies)
- Route SSO GET through getSession() instead of always returning auth_required_sso so post-IdP config fetch works
- Add per-IP rate limiting to /api/chat/[identifier]/sso to prevent allowlist enumeration
* feat(files): resolve workspace file page URLs to raw content in markdown preview
* refactor(files): replace regex URL matching with URL constructor in resolveSimFileUrl
* fix(files): render mermaid diagrams in markdown preview using design tokens
Streamdown intercepts fenced code blocks before components.code is called,
so the previous mermaid branch in the code renderer was dead code. Add a
remarkMermaid plugin that transforms mermaid code nodes at the MDAST stage
via data.hName/hProperties so remark-rehype emits a <mermaid-diagram>
element that our MermaidDiagram component handles. This avoids Streamdown's
built-in mermaid renderer which uses mismatched Tailwind semantic classes.
* fix(trace): reduce default tree pane width from 360 to 280
* fix(files): guard resolveSimFileUrl against cross-origin URL hijacking
* refactor(files): use getBrowserOrigin() instead of window.location.origin
* fix(trace): reduce default tree pane width to 240
* fix(files): narrow img src type before passing to resolveSimFileUrl
* fix(files): use narrow props type for img renderer instead of runtime narrowing
* fix(files): accept full ImgHTMLAttributes for img renderer to satisfy Streamdown Components type
* fix(files): treat null getBrowserOrigin as same-origin to prevent SSR hydration mismatch
* improvement(files): use centered aspect-ratio skeleton for mmd file preview
* improvement(files): diagram-shaped skeleton card for mmd file preview
* fix(files): only rewrite relative workspace file URLs to avoid hydration mismatch
* fix(files): pass context not resolved params to parseRequest in view route
* fix(files): simplify mmd file skeleton to match pptx card pattern
* fix(files): match mmd skeleton to actual rendered layout — full-height zoomable area
* fix(sidebar): left-align folder lock icon next to name
* fix(file): zero byte codegen file format
* address comments
* distinguish streaming from actual empty pdf
* fix mermaid diagram state mgmt
* mermaid linter errors sent back to llm
* address comments
* fix autozoom
* Revert "improvement(executor): correctness-by-construction for workflow logs (#4382)"
This reverts commit add55b4ffa.
* fix(terminal): re-read entries inside reconcileFinalBlockLogs loop
For workflows with loop or parallel iterations, finalBlockLogs can
contain multiple terminal logs sharing the same blockId. The prior
code captured entries once before the loop, so entries.find always
matched the same first running entry — later iterations stayed
isRunning: true and got swept to "cancelled" instead of showing
their actual terminal state. Re-read the snapshot per iteration so
each updateConsole's isRunning: false flush narrows the next match.
* chore(terminal): remove dead consoleMode 'add' branch and helpers
Every callsite passes consoleMode: 'update'. Deletes the field, the
unreachable 'add' branches in onBlockCompleted/onBlockError, and the
addConsoleEntry/addConsoleErrorEntry helpers that only the dead
branch invoked.
* fix(executor): reconcile finalBlockLogs on execution:completed
block:completed callbacks fire-and-forget; the last block's event can
arrive after execution:completed, leaving its console entry stuck
isRunning. Mirror the error/cancelled paths: emit finalBlockLogs on
execution:completed and reconcile + sweep on the client.
* fix(executor): emit finalBlockLogs on queued/HITL error and cancel paths
queued-workflow-execution and human-in-the-loop-manager only attached
finalBlockLogs to execution:completed. Without it on cancel/error,
reconcileFinalBlockLogs is a no-op and the client sweep flips
already-completed blocks to canceled. Mirror the route.ts pattern.
* fix(serializer): apply tools.config.params before validating required tool params
* fix(serializer): guard array results and drop redundant fallback in tool param validation
* fix(blocks): align canonicalParamId with tool param name for file inputs
Renames the canonical id from `document` to `file` on firecrawl, reducto v2,
pulse v2, and extend v2 so pre-execution validation resolves the value
under the same key the tool expects, eliminating false "missing required
fields: file" errors at submit time.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore(blocks): drop extraneous comments from canonical file-input renames
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(serializer): drop tools.config.params invocation; enforce canonical-id contract via audit
The serializer's pre-execution validator no longer runs the block's
`tools.config.params` mapper to discover renamed tool param ids. Instead
it relies on the contract that every required+user-only tool param is
backed by a subBlock whose `id` or `canonicalParamId` equals the tool
param id, and a new audit (`bun run check:block-canonical`) enforces
this. Migrates posthog (`personalApiKey` → canonical `apiKey`) so the
audit passes cleanly.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(scripts): consolidate block registry CI checks into one script
Folds the canonical-id contract audit into the existing subblock ID
stability script and renames it to `check-block-registry.ts`. Both
checks share the same `getAllBlocks()` import and registry-invariant
purpose, so a single CI gate now catches both regression classes.
The early-exit path on the stability check no longer short-circuits
the canonical-id check.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore(scripts): unify check-block-registry result reporting
Each check returns a discriminated `CheckResult` (pass | skip | fail)
so the runner prints one definitive line per check instead of mixing a
"skipping" message with a redundant "passed" line. Failure messages
include a per-check header explaining the runtime impact.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* improvement(home): anchor @-mention popup at caret and right-size dropdown widths
* fix(home): align caret-anchor marker to text-top so mention popup clears glyph
* fix(home): enable collision avoidance for @-mention popup so it fits in narrow chats
* improvement(mothership): reuse logs detail panel in resource view
* improvement(logs): drop unnecessary memo and export tab type
* fix(logs): notify embedder on every resolved-tab change
* fix(oauth): trim Atlassian OAuth scopes to fix CloudFront 414
* fix(oauth): restore Confluence scopes whose tools are still active
* fix(oauth): add JSM Forms scopes for form tools
* fix(oauth): restore read:issue.vote:jira scope
Jira issue retrieve tool reads fields.votes.votes and fields.votes.hasVoted
from the GET /rest/api/3/issue payload, which requires the
read:issue.vote:jira granular scope. Restoring to prevent vote data from
being omitted in retrieve responses.
* fix(oauth): drop redundant Jira granular scopes covered by classic
Atlassian recommends <50 scopes per OAuth app to keep authorize URLs
under URL-length limits. Drops 20 granular Jira read/write scopes that
are subsumed by the classic read:jira-work / write:jira-work scopes
already in the list. Existing user tokens are unaffected — Atlassian
refresh keeps originally-granted scopes; the trimmed list only applies
to new authorizations.
Kept granular scopes: delete:* (no classic equivalent) and JSM
granular scopes (separate scope family).
* fix(oauth): re-add read:issue.vote:jira to match PR description
Bugbot flagged that the previous classic-scope collapse dropped this
granular scope while the PR description still claimed it was restored.
Classic read:jira-work covers vote reads, but adding the granular
explicitly keeps the description, code, and intent aligned.
