82f5988d56
fix(objects): load creator profiles on demand
...
Keep object list responses limited to recorded creator identities and resolve full profiles through the creator subresource. Normalize list avatar sizing and avoid retrying terminal creator lookup errors.
2026-08-16 21:06:09 -04:00
daaeb56bd6
fix(ci): repair Docker and mobile regression checks
2026-08-15 16:48:31 -04:00
bbf4a8e6c0
feat(agent-skills): publish Realmroot ZPan skill
2026-08-15 12:46:37 -04:00
10e16d14a2
fix(store): complete agent capacity purchase workflow ( #561 )
...
* fix(oauth): make token revocation idempotent
* fix(store): complete agent capacity purchase workflow
* fix(build): refresh patched dependency lock hash
* fix(oauth): hide inactive token state on revoke
---------
Co-authored-by: saltbo <saltbo@foxmail.com >
2026-08-12 02:26:35 +00:00
d7d1435e56
fix(workers): recover canceled cache initialization
2026-08-11 01:26:24 -04:00
d289e93fee
test(e2e): make archive fixtures deterministic
2026-08-08 13:21:11 -04:00
20eae12dda
fix(ui): truncate actor metadata in profile cards
2026-08-08 13:20:06 -04:00
6f4182bb28
fix(agents): follow public profile discovery contract
...
Discover Realmroot Agent profiles from OAuth authorization-server metadata, validate the public profile response, and link resolved audit actors to their public profile pages.
2026-08-08 12:59:47 -04:00
600486b8ab
fix(files): unify actions and constrain metadata layout ( #560 )
2026-08-08 12:04:33 -04:00
5806919d5a
build(deps): bump hono in the npm_and_yarn group across 1 directory ( #558 )
...
Bumps the npm_and_yarn group with 1 update in the / directory: [hono](https://github.com/honojs/hono ).
Updates `hono` from 4.12.27 to 4.12.34
- [Release notes](https://github.com/honojs/hono/releases )
- [Commits](https://github.com/honojs/hono/compare/v4.12.27...v4.12.34 )
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.34
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jasper Van <saltbo@foxmail.com >
2026-08-08 11:14:01 -04:00
fa19323eda
feat: attribute files and downloads to actors ( #559 )
...
* feat: attribute files and downloads to actors
* chore: refresh preview after staging migration
* fix: use a dash for missing actor identity
* fix: complete actor attribution and file creator UI
* fix: refine file creator identity UI
2026-08-08 11:04:16 -04:00
1b7d8d55f5
fix(audit): resolve agent api key and device actors ( #557 )
...
* fix(audit): resolve agent api key and device actors
* fix(deps): address high severity advisories
* test(audit): cover actor identity boundaries
* fix(audit): support Cloudflare agent info fetches
* docs: add audit actor preview evidence
* docs: add api key audit preview evidence
2026-08-07 23:55:22 -04:00
a0b3d9cad6
fix(openapi): declare DPoP requirement for OAuth
2026-08-07 19:57:32 -04:00
095daf8b30
fix(openapi): align OAuth security metadata
2026-08-07 13:33:57 -04:00
b92df828ab
ci: parallelize and isolate test suites ( #556 )
...
* ci: parallelize and isolate test suites
* ci: avoid unavailable Playwright video runtime
* ci: shard coverage and cache docker smoke
* ci: balance Playwright shards by test
* ci: smoke test the CLI container
* ci: enforce merged coverage thresholds
* ci: ratchet canonical coverage baseline
* ci: make coverage ratchet lossless
* ci: organize parallel gates by responsibility
* perf(ci): reduce total runner time
* perf(ci): balance runner cost and latency
* perf(ci): suppress passing test logs
* fix(test): make coverage sorting proof deterministic
* perf(docker): exclude test-only build inputs
* perf(ci): scope Docker smokes to packaging changes
* refactor(test): enforce fast test boundaries
* test: isolate coverage ownership
* perf(test): run backend projects concurrently
* perf(ci): separate test layers by runtime
* perf(test): separate integration boundaries
* perf(ci): prioritize test runners
* docs(ci): clarify package scheduling
* test: restore shared Cloudflare mocks
* fix(preview): isolate Cloudflare E2E build config
* fix(auth): bind preview sessions to request origin
* revert: remove ineffective preview auth workaround
* fix(auth): stop signing JWTs on session reads
2026-08-05 15:01:12 -04:00
3064403c92
fix(ids): make normalization optional
...
Keep historical identifiers readable and addressable while generating all new entity IDs with Base62. Reject unsafe external ID references and preserve API keys and device codes during optional normalization.
2026-08-05 13:06:41 -04:00
3a4e739c9f
Refactor downloader bootstrap query execution ( #555 )
2026-08-05 02:24:07 -04:00
17db813d1c
feat(ids)!: normalize persistent identifiers to Base62 ( #554 )
...
* feat(ids)!: normalize persistent identifiers to Base62
BREAKING CHANGE: historical ZPan-owned IDs and public tokens require the one-time normalization migration; old public links and stored credentials are invalidated without runtime fallback.
* fix(ids): namespace public redirect tokens
Generate share tokens as s plus 11 Base62 characters and image tokens as i plus 11 Base62 characters. Dispatch /r by namespace prefix, reuse the single resolved record, and update migration validation, contracts, documentation, and tests.
* fix(ids): guard future object storage keys
* fix(ids): normalize historical references safely
2026-08-05 00:36:18 -04:00
4ab0b0922a
fix(openapi): whitelist Better Auth downloader Device Flow ( #552 )
...
Publish only explicitly registered Better Auth operations in the ZPan product OpenAPI contract while preserving runtime auth routes and discovery.
2026-08-04 16:39:54 -04:00
50a9895fcf
fix(auth): add request diagnostics and correlation
2026-08-04 12:18:52 -04:00
07a4278c3f
build(deps): update vulnerable transitive dependencies
2026-08-04 01:56:45 -04:00
0be5c1b7e9
feat(agent): support workspace-scoped resource access
2026-08-03 19:13:50 -04:00
b93db898a4
docs(agent): finalize cleanroom acceptance report
2026-08-03 05:37:52 -04:00
84dcc71b4c
docs(agent): record final file workflow acceptance
2026-08-03 05:33:57 -04:00
0b997e52bf
fix(quota): resume duplicate cloud webhooks
2026-08-03 05:33:03 -04:00
06dc7c2479
docs(agent): record staging workflow regression
2026-08-03 04:26:37 -04:00
3ef1561ba2
docs(agent): record file workflow regressions
2026-08-03 04:05:01 -04:00
c82279f164
Merge commit from fork
2026-08-03 01:05:33 -04:00
1268d902dd
Merge commit from fork
2026-08-03 01:05:11 -04:00
b031739533
build(deps): resolve security advisories
2026-08-03 00:41:07 -04:00
9b95117595
feat(oauth): manage dynamic client registrations
2026-08-02 22:04:43 -04:00
8513b18a8e
feat(oauth): expose workspace authorization catalog ( #551 )
...
* feat(oauth): expose workspace authorization catalog
* fix(oauth): verify catalog tokens against canonical audience
* fix(auth): normalize Workers preview requests
* Revert "fix(auth): normalize Workers preview requests"
This reverts commit 02009f098f
2026-08-02 21:00:20 -04:00
58b88b427b
fix(oauth): accept multi-workspace consent
2026-08-02 17:19:26 -04:00
461becc3d3
fix(oauth): synchronize Realmroot client scopes
2026-08-02 17:15:17 -04:00
b818facdab
fix(x402): report missing receiver as unavailable
2026-08-02 16:22:43 -04:00
24eb5a0e2f
fix(deploy): configure production cloud service
2026-08-02 16:04:41 -04:00
fa158cb11e
fix(oauth): log agent assertion verification failures
2026-08-02 15:43:01 -04:00
bc4a71f691
fix(api-keys): restore legacy Better Auth keys
2026-08-02 15:08:51 -04:00
2657f82ef1
feat(auth): add contextual OAuth workspace grants ( #550 )
...
* feat(auth): add contextual OAuth workspace grants
* fix(auth): register RFC 9396 detail types
* fix(openapi): restore delegated CLI auth profile
* fix(store): recover paid capacity fulfillment
* fix(auth): close OAuth contract gaps
* fix(store): resume verified x402 settlements
* chore(deps): update zpan cloud sdk to 2.5.2
* test(store): cover verified settlement recovery
* fix(auth): localize standard consent scopes
* fix(docker): include dependency patches before install
* fix(store): harden x402 purchase responses
* test(auth): cover OAuth authorization boundaries
* docs: add PR 550 verification screenshots
* chore: remove temporary verification screenshots
* docs(openapi): document exhausted capacity response
2026-08-02 13:33:15 -04:00
1caa4e580c
refactor(oauth): replace agent access naming ( #549 )
2026-08-01 00:32:31 -04:00
d15ca86226
fix(store): recover interrupted capacity purchases ( #548 )
...
* fix(store): recover interrupted capacity purchases
* test(store): cover inactive x402 receiver
2026-07-31 16:25:05 -04:00
d0a8af8dd9
Merge pull request #547 from saltbo/fix/dpop-verification-challenge
...
fix(auth): challenge invalid DPoP tokens
2026-07-31 12:34:05 -04:00
bbb1a48073
fix(ci): serialize shared Cloud staging fixture
2026-07-31 12:14:17 -04:00
f200c3880c
Merge remote-tracking branch 'origin/main' into fix/dpop-verification-challenge
2026-07-31 11:54:32 -04:00
0033b6df4b
Merge pull request #546 from saltbo/fix/quick-tunnel-command-error
...
fix(ci): initialize cloud e2e command errors
2026-07-31 11:54:20 -04:00
bde1bb4bc9
fix(auth): challenge invalid DPoP tokens
2026-07-31 11:34:20 -04:00
21305cc660
fix(ci): isolate quick tunnel callback traffic
2026-07-31 11:27:19 -04:00
4a9588e551
fix(ci): initialize cloud e2e command errors
2026-07-31 11:03:29 -04:00
1f3e9b4bf5
Merge pull request #545 from saltbo/feat/x402-paid-agent-uploads
...
feat(store): add agent x402 capacity purchases
2026-07-31 10:53:45 -04:00
920d5ee143
fix(ci): retry transient quick tunnel failures
2026-07-31 10:46:43 -04:00
jarvis