* LANG-145: bind WebAuthn to server config and make passkeys OSS-only
Two problems in the passkey implementation:
1. The RP ID and expected origin came from the request: a JSON 'origin' field,
then the Origin/Referer headers, then the request URL. WebAuthn's
anti-phishing guarantee depends on values the server chose; trusting the
request lets a sibling host under the same registrable domain obtain a valid
assertion for a victim's credential. Resolution now follows the same rule the
OAuth and invitation links already use: api.webui_url, then
api.webhook_prefix, then the configured port on loopback.
2. Passkeys are now an OSS-only feature. Cloud deployments authenticate through
their own account service, so every passkey route (register options/verify,
auth options/verify, list, rename, delete) refuses with
edition_unsupported, and /account-info advertises neither passkey_login_enabled
nor passkey_supported. Both cloud flavours are covered: system.edition ==
'cloud' and deployment.mode == 'cloud'.
Tests:
- New unit suite for the edition matrix and for origin resolution (including
that client-supplied origin/Origin/Referer are ignored).
- The three 'reverse proxy scenario' tests asserted the old, unsafe behaviour
(server trusting the request). They now assert the server-config contract.
- test_smoke cloud capabilities expectation updated to passkey_* = false.
Co-authored-by: multica-agent <[email protected]>
* style(api): drop the typing import left unused by the WebAuthn origin change
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: multica-agent <[email protected]>
Apply group response rules before busy-session steering. Initialize usable private-message and group-mention routes for new bots, including Wizard-created pipelines, and preserve member-configured rules across saves and retries.
Fix empty pipeline configuration, refresh the processor sidebar after automatic creation, and show creation feedback. Align routing regressions and use Node 24 for the browser CI job.
Correct the task's erroneous agent attribution while preserving every code tree and the original human contribution.
Co-authored-by: multica-agent <[email protected]>
- Add covering indexes through migration 0040
- Preserve PostgreSQL FORCE RLS state when marking historical summaries
- Add query-plan and migration regression tests to CI
Count and paginate lightweight records, then load payloads only for the
selected page to avoid materializing large historical messages.
Add regression coverage for oversized history, ingress deduplication,
stable pagination, and PostgreSQL tenant isolation.
- Maintain counts and display snapshots in source transactions with replay-safe deduplication.
- Read session lists exclusively from summaries and remove execution-only filters.
- Automatically initialize historical summaries in bounded, resumable batches during OSS startup.
- Add behavioral contracts covering accounting, retention, query cost and PostgreSQL concurrency.
Verified with the required session_summary suite and real container upgrade startup.
- Apply media retention to inline images while preserving text and URLs
- Persist per-workspace cursors atomically with payload updates
- Bound candidate scans and verify event ownership before loading payloads
- Add cleanup indexes and regression tests, and fix Windows path assertions
- Load overview first and fetch secondary sections when expanded
- Add a covering index and select conversation IDs before loading page payloads
- Preserve full-detail API compatibility and add pagination and lazy-loading tests
Exclude message_content and variables from the message source used by
conversation session summaries. These fields were carried through window
sorting even though the resulting summaries did not use them.
Preserve complete payloads for message detail queries. Add regression
coverage for summary counts, session metadata, and full message retrieval.
Require a valid owner and unexpired lease for pending Pipeline messages
to appear as active tasks. Exclude historical ingress records without
rewriting their stored status.
Project only the fields needed by snapshots, skip linkage queries for empty
results, and resolve linked runs from selected message IDs instead of a
cross-table OR join that scans historical messages.
Cover lease filtering, terminal transitions, Workspace isolation, payload
exclusion, and indexed lookup plans with regression tests.
- Coerce/default/drop invalid or unknown legacy fields with warnings instead of blocking
- Never block on LocalAgent model; prune dangling KB/tool/MCP references
- Mark custom (non-builtin) 4.10 runners as unsupported_runner instead of failing
- Pin runner plugins to current marketplace versions (0.2.x); fall back to latest when a pin is withdrawn
- Raise plugin install/upgrade timeout to 600s for slow dependency installs
- Assistant configure_pipeline writes the 4.11 runner shape
Co-Authored-By: Claude Opus 5.5 <[email protected]>
