huanghuoguoguo
98cc2ec2d6
Merge pull request #2680 from langbot-app/fix/auth-invalid-json-contract-20261017
...
fix(auth): reject malformed credential payloads before authentication
2026-10-17 20:11:01 +08:00
huanghuoguoguo
0b0201a3f5
Merge pull request #2679 from langbot-app/test/quality-api-observability-20261017
...
test(api): verify monitoring payloads and embed side effects
2026-10-17 20:10:55 +08:00
huanghuoguoguo
ecea4c3d41
Merge pull request #2675 from langbot-app/test/quality-self-duplicates-20261017
...
test: remove redundant backend checks and migration aliases
2026-10-17 20:10:30 +08:00
huanghuoguoguo
567ce3a841
Merge pull request #2674 from langbot-app/test/quality-api-response-contracts-20261017
...
test(api): verify resource payloads and scoped service arguments
2026-10-17 20:10:20 +08:00
huanghuoguoguo
569dd07024
fix(auth): reject malformed credential payloads before authentication
2026-10-17 15:25:16 +08:00
huanghuoguoguo
d25c1e0f0c
test(api): verify monitoring payloads and embed side effects
2026-10-17 15:16:26 +08:00
huanghuoguoguo
4afd86c1f6
test: consolidate duplicate backend contracts and strengthen stage checks
2026-10-17 15:03:50 +08:00
huanghuoguoguo
8bad1a14fe
test(api): verify resource payloads and scoped service arguments
2026-10-17 15:02:41 +08:00
huanghuoguoguo
24300adc72
test(runtime): assert filter and message delivery semantics
2026-10-17 15:01:09 +08:00
huanghuoguoguo
d54e533985
fix(skill): pin revisions per run and preserve shared Box state
2026-10-17 09:32:41 +08:00
RockChinQ and Claude Opus 5.5
16cfb6f8bd
feat(cloud): show purchased plan revision alongside the latest revision
...
- Expose the workspace's purchased plan revision from the entitlement
snapshot.
- Stack the purchased revision card in front of the latest revision in
the plan comparison dialog; both cards share the same layout, and the
purchased card's copy and prices come from the Space revision endpoint
while benefits stay on the entitlement snapshot.
- Add a cancel-first tooltip for subscribing to the newer revision.
Co-Authored-By: Claude Opus 5.5 <[email protected]
2026-10-17 00:25:41 +08:00
RockChinQ
625ee67113
fix(ci): align workspace fixtures and constrain mobile tours
2026-10-15 05:31:04 +00:00
Hyu
e29fd27f02
feat(i18n): localize backend messages by workspace language
2026-10-15 05:31:04 +00:00
RockChinQ
b6c4e2c395
feat(cloud): enforce signed workspace subscription resource limits
2026-10-15 05:30:36 +00:00
Hyu
6515ba3b94
fix(api): serve the passkey and password routes for the authenticated Account
...
Passkeys and passwords belong to the Account, but those routes required a Workspace -- which the WebUI never sends for them -- and then resolved the caller by looking the login name up as an email address. Every Account whose login name is not its email answered 404, so the passkey panel could neither add nor list a key.
The routes now authenticate with the account token and address the Account the caller authenticated as, matching the self-service second-factor routes in the same file. /space/bind-authorize-url carried the same Workspace requirement.
The login page also surfaced a TypeError instead of the passkey login failure message when an assertion was rejected.
2026-09-28 23:53:14 +08:00
Hyu
e14e277424
fix(api): scope TOTP oversight to the caller's workspace
...
The second-factor listing was instance-wide and the three mutating endpoints never checked that the target Account belongs to the caller's Workspace, so an owner or admin could see and reset another tenant's account. The listing now resolves the Workspace members and the mutations answer 404 for a foreign account, which does not disclose that it exists.
Also fixes the TOTP write path on Postgres: six write points passed timezone-aware datetimes into timestamp-without-time-zone columns, which asyncpg rejects, so every enroll, confirm, revoke and recovery-code consumption raised a 500 there. SQLite tolerated the same values.
The panel derives its oversight view from the API authorization instead of the length of the account list, which would have hidden it in a single-member Workspace.
2026-09-28 22:38:30 +08:00
huanghuoguoguo
7bf20490f4
feat(skill): use SDK store without box execution
2026-09-28 10:18:16 +08:00
huanghuoguoguo
4f95016998
test(api): align CLI diagnostics with integration gates
2026-09-27 17:46:19 +08:00
RockChinQ
27871e4363
merge: integrate master certification and document identity fixes into 4.11
2026-09-21 10:55:40 +00:00
RockChinQ
20a04a77bf
feat(plugin): enforce certified archive admission ( #2553 )
...
* feat(plugin): add certified admission policy
* feat(plugin): enforce certified archive admission
* chore(plugin): pin certified SDK beta
* fix(plugin): consume SDK beta 5
* style(plugin): format certification admission
2026-09-20 18:54:45 +08:00
RockChinQ
bece2aa554
fix(wizard): restore message pipeline setup and page bot preview
2026-09-18 16:01:55 +08:00
RockChinQ
273b1ea3cf
Merge master into dev/4.11.x and preserve plugin runner architecture
...
Reconcile migration branches without rewriting published revisions; retain additive Codex, monitoring, provider and platform fixes. Keep dynamic runner schemas and Host ownership, restore compatibility regressions, and preserve safe model-test error handling.
2026-09-16 08:13:07 +00:00
BiFangKNT
19526e1400
test(api): define explicit fixtures for passkey integration tests
2026-09-12 15:51:56 +08:00
BiFangKNT
dfde9578c1
fix(ci): fix ruff lint errors and postgres legacy migration table exclusion
2026-09-12 15:35:47 +08:00
BiFangKNT
b594cf23e4
feat(auth): add webauthn authentication support
2026-09-12 12:17:26 +08:00
Hyu and dadachann
ff6ad6adc2
fix(monitoring): restore Cloud messages and bot-scoped sessions ( #2526 )
...
* fix(monitoring): restore Cloud message persistence and bot-scoped sessions
* fix(migrations): support partial monitoring schemas and align regression fixtures
* test(migrations): complete raw bot session fixture values
---------
Co-authored-by: dadachann <[email protected]
2026-09-11 14:34:37 +08:00
Tynwink
1ba3c1ec72
Merge pull request #2520 from langbot-app/feat/api-key-system-context
...
为 lbctl 增加 API Key 发现与管理能力
当前为 lbctl 提供的能力通过 system.py -> SYSTEM_CAPABILITY_OPERATIONS 维护，后续可通过统一的接口暴露能力，避免频繁维护常量。
2026-09-09 14:47:00 +08:00
Tynwink2000
d90253cc77
feat(api): advertise provider and model management
2026-09-09 11:18:01 +08:00
Tynwink2000
8281eb18c9
feat(api): advertise plugin and skill management
2026-09-09 00:12:40 +08:00
Tynwink2000
4eea3419e8
feat(api): advertise knowledge and MCP management
2026-09-08 23:07:43 +08:00
Tynwink2000
814740ea68
feat(api): advertise managed read operations
2026-09-08 18:53:55 +08:00
Tynwink2000
e6e8258545
feat(api): advertise extension operation capabilities
2026-09-08 17:43:11 +08:00
Tynwink2000
1a69747a06
feat(api): expose task status to api keys
2026-09-08 14:06:13 +08:00
Tynwink2000
1fa5e2f755
feat(api): add system capabilities endpoint
2026-09-08 13:03:02 +08:00
267232c24f
fix(security): harden password recovery with usable eight-character codes ( #2477 )
...
Use eight securely random recovery-code characters with concurrency-safe online throttling. Preserve existing keys and verify recovery through browser and real SQLite integration tests.
Co-authored-by: [email protected] [email protected] [email protected]
2026-09-07 15:31:54 +00:00
Tynwink2000
bc32eb3ca0
feat(api): add system context endpoint for lbctl
2026-09-07 14:22:27 +08:00
Hyu and dadachann
b44b8f474d
fix(cloud): provision login workspace just in time ( #2505 )
...
* fix(cloud): provision login workspace just in time
* fix(oauth): send callback URI during code exchange
* fix(oauth): preserve callback URI through browser exchange
* fix(oauth): negotiate redirect-bound codes
---------
Co-authored-by: dadachann <[email protected]
2026-09-03 23:14:44 +08:00
Hyu
7c64756203
fix(ui): improve agent debug and model test feedback
2026-09-03 14:51:01 +08:00
Hyu and dadachann
ab52684a01
Revert "fix(cloud): request automatic Space launch ( #2501 )" ( #2503 )
...
This reverts commit d50957fc4f[email protected]
2026-09-03 12:16:21 +08:00
Hyu and dadachann
d50957fc4f
fix(cloud): request automatic Space launch ( #2501 )
...
Co-authored-by: dadachann <[email protected]
2026-09-03 11:44:32 +08:00
Hyu and dadachann
c8d8b1aac4
fix(cloud): serialize directory catch-up ( #2500 )
...
Co-authored-by: dadachann <[email protected]
2026-09-02 21:57:53 +08:00
Hyu and dadachann
018dd7a363
fix(cloud): launch newly registered accounts through Space ( #2499 )
...
* fix(cloud): launch new accounts through Space
* style: format Cloud entry URL
* fix(cloud): wait for launch workspace projection
---------
Co-authored-by: dadachann <[email protected]
2026-09-02 21:41:35 +08:00
Hyu and dadachann
bf8d418ad4
feat(monitoring): paginate sessions and messages ( #2489 )
...
* feat(monitoring): paginate sessions and messages
* fix(monitoring): align detail pages with local dates
---------
Co-authored-by: dadachann <[email protected]
2026-09-01 15:14:29 +08:00
Hyu
91e09af76a
fix(web): complete pluginized agent onboarding flows
2026-09-01 10:41:29 +08:00
Hyu
fde04e64f6
Merge remote-tracking branch 'origin/master' into dev/4.11.x
...
# Conflicts:
# src/langbot/pkg/api/http/controller/groups/pipelines/pipelines.py
# src/langbot/pkg/api/http/service/bot.py
# src/langbot/pkg/provider/runners/localagent.py
# src/langbot/templates/metadata/pipeline/ai.yaml
# tests/unit_tests/api/service/test_bot_service.py
# tests/unit_tests/provider/runners/test_difysvapi_runner.py
# tests/unit_tests/utils/test_safe_regex.py
# web/src/app/infra/entities/adapter-categories.ts
# web/src/app/wizard/page.tsx
# web/src/i18n/locales/en-US.ts
# web/src/i18n/locales/ja-JP.ts
# web/src/i18n/locales/zh-Hans.ts
# web/tests/e2e/plugin-page-auth.spec.ts
2026-08-31 17:17:47 +08:00
be3734ffda
feat(wizard): rework agent onboarding flow ( #2471 )
...
* feat(wizard): rework agent onboarding flow
* fix(web): support LAN development access
* fix(wizard): parse ranked model selection entries
* feat(wizard): add inbound bot verification
* feat(wizard): add floating page bot verification
* fix(wizard): repair HTTP bot inbound test setup
* feat(wizard): streamline custom model onboarding
* feat(wizard): label page bot test preview
* style(space): apply ruff formatting
* fix(wizard): polish AI engine onboarding
* fix(wizard): clarify local account message test
* feat(wizard): animate AI engine transitions
* fix(wizard): align AI engine setup headers
---------
Co-authored-by: langbot-dev <[email protected] [email protected]
2026-08-28 01:30:30 +08:00
RockChinQ
600a173918
refactor(bots): remove route execution test
2026-08-26 14:28:30 +08:00
dadachann
0559d9d441
Merge master into dev/4.11.x
...
# Conflicts:
# pyproject.toml
# uv.lock
2026-08-24 02:34:14 +00:00
Hyu and dadachann
1336f47cb4
fix(auth): enable local registration for OSS invitations ( #2460 )
...
Co-authored-by: dadachann <[email protected]
2026-08-24 10:28:45 +08:00
Junyan Qin
f94243c725
chore: merge master into dev/4.11.x
2026-08-14 16:04:52 +08:00
huanghuoguoguo