Persist the v4 plugin runtime state so recreating the runtime container no
longer discards installed plugins' artifacts, dependency environments and
installation-private data, and stop a transient Runner registry miss during
steering from dropping the message.
- docker-compose: bind-mount ./data/plugin-runtime for the plugin runtime
alongside ./data/plugins.
- kubernetes: add the langbot-plugin-runtime-state claim (5Gi) mounted at
/app/data/plugin-runtime, kept separate from the plugin data claim so
runtime state does not land inside the plugin directory.
- chat handler: treat RunnerNotFoundError while claiming steering as
"steering unavailable" and continue with a normal run; every other error
keeps propagating. The runner error imports move to module scope, which
the new early reference requires.
- tests: cover the steering fallback, the claimed-steering interrupt, and
the lasting-gap path that still reports runner-not-found.
The steering fallback buys one extra uncached registry lookup while a
runtime reconnects; it does not recover a gap that outlasts the message.
Context7 only re-indexes on its own popularity schedule, which is why the
existing /langbot-app/langbot-docs entry had already drifted before this
migration. Add the refresh call documented in Context7's GitHub Actions
integration so a docs change reaches the index on the same push.
The job is inert until a CONTEXT7_API_KEY secret exists, so it cannot fail
the build while the library registration is pending.
Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>
The migrated workflows required LANGBOT_WIKI_PUSH_TOKEN, which only exists in
the langbot-docs repository. The existing RELEASE_UPLOAD_GITHUB_TOKEN was
verified to authenticate as the owner with repo scope plus push/admin on
LangBot, langbot-docs, langbot-landing-page and the production fork, and it can
push the Wiki, so publication now falls back to it when the dedicated secret is
absent. Also retarget the cutover notes at the master branch.
Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>
LangBot's default branch is master, so the landing-submodule, wiki and blog
sync workflows would never have triggered and would have pushed to a
non-existent main. Also restore the wiki clone URL that was truncated in the
mirror copy of sync-github-wiki.yml.
Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Imported langbot-app/langbot-docs main (51dddcb3f) under docs/ with
`git subtree add`, keeping every original commit SHA and signature so the
mirror and landing-page submodule can fast-forward from a `git subtree
split` later. Retarget the docs workflows to docs/, point blog sync at the
main repository, and update the remaining internal references.
Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Move the 27 internal design docs (87 tracked files) from docs/ to dev-docs/
to make room for the public documentation site, adjust Docker/fnOS ignores,
refresh the README/AGENTS/ARCHITECTURE references, and land the docs
workflows ahead of the subtree import so they cannot diverge from mirror.
Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>
The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32.
0.0.27 falls inside four published advisories, so any resolve that honours the
floor rather than the lock can land on a vulnerable release:
- GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time
querystring DoS, semicolon field-separator and Content-Disposition parameter
smuggling), fixed in 0.0.30
- GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in
0.0.31
The locked 0.0.32 has no known advisories. Raising the floor to match the lock
costs nothing and keeps the two from drifting apart.
Reachability, for the record: multipart parsing happens on the skills and plugin
local-upload routes, both of which require USER_TOKEN_OR_API_KEY with
RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous
one.
The resolved version is unchanged; only the requirement metadata moves.
Co-authored-by: multica-agent <[email protected]>
Classify event cleanup queries by selected columns instead of CORRELATED
plan text, preserving covering-index, primary-key, and no-sort checks.
Validated all 15 tests on ARM64 with SQLite 3.53.4 and 3.46.1.
- Switch Python base images to python:3.12-slim-trixie
- Replace libprotobuf32 with libprotobuf32t64
- Pin SQLite to 3.53.4-2 from forky for the WAL-reset fix
- Restrict forky packages to libsqlite3-0 with APT pinning
- Replace per-session mocks with lightweight shutdown counters
- Preserve the one-second timeout and 100-workspace coverage
- Assert that every session shuts down exactly once
- Add migration 0042 to enable incremental vacuum with verified backup and restore
- Enable incremental vacuum before creating tables in new SQLite databases
- Adapt reclamation batches to elapsed time and lock contention
- Cover migration recovery, WAL mode, and concurrent writes with regression tests
Emit and persist a Host cancellation event before closing the runner stream.
Preserve existing terminal events and record cancelled runs consistently.
Serialize Host event sequence allocation to prevent conflicts with admin
cancellation audits, and notify observers with the persisted sequence.
Add deterministic cancellation and concurrent event allocation regressions.
The Chinese copy used 套餐 (package) for the subscription plan in the cloud
banner, the model errors and the multi-tenant docs. Name the same concept 计划
everywhere; Traditional Chinese keeps 計劃.
- Deduplicate message and history resource URLs using stable catalog references
- Persist renewed URLs with concurrent refresh protection
- Refresh OneBot images via get_msg intervals or NapCat rkey TTL
- Migrate historical payloads and cover SQLite and PostgreSQL behavior
* fix(web): keep the dedicated-environment link on a custom Cloud banner
The Cloud banner can carry per-language copy, but the custom-copy branch
rendered that text alone: everything else in the banner swaps the built-in
message for an override so the operator can say what is actually happening,
and doing so silently dropped the link to the dedicated environment -- the only
destination that turns a warning into an upgrade.
Render the dedicated link after the override when show_links is on, using new
cta_dedicated copy in every locale so the second half of the sentence reads as
a call to action rather than repeating the environment name.
* test(web): expect the new banner CTA copy in every locale
- Refresh images in inputs, outputs, deliveries, and conversation history
- Reuse OneBot refresh logic without rewriting persisted records
- Cover existing image URLs across agent and pipeline execution views
Martin