RockChinQ
b6c4e2c395
feat(cloud): enforce signed workspace subscription resource limits
2026-10-15 05:30:36 +00:00
Hyu
6515ba3b94
fix(api): serve the passkey and password routes for the authenticated Account
...
Passkeys and passwords belong to the Account, but those routes required a Workspace -- which the WebUI never sends for them -- and then resolved the caller by looking the login name up as an email address. Every Account whose login name is not its email answered 404, so the passkey panel could neither add nor list a key.
The routes now authenticate with the account token and address the Account the caller authenticated as, matching the self-service second-factor routes in the same file. /space/bind-authorize-url carried the same Workspace requirement.
The login page also surfaced a TypeError instead of the passkey login failure message when an assertion was rejected.
2026-09-28 23:53:14 +08:00
Hyu
e14e277424
fix(api): scope TOTP oversight to the caller's workspace
...
The second-factor listing was instance-wide and the three mutating endpoints never checked that the target Account belongs to the caller's Workspace, so an owner or admin could see and reset another tenant's account. The listing now resolves the Workspace members and the mutations answer 404 for a foreign account, which does not disclose that it exists.
Also fixes the TOTP write path on Postgres: six write points passed timezone-aware datetimes into timestamp-without-time-zone columns, which asyncpg rejects, so every enroll, confirm, revoke and recovery-code consumption raised a 500 there. SQLite tolerated the same values.
The panel derives its oversight view from the API authorization instead of the length of the account list, which would have hidden it in a single-member Workspace.
2026-09-28 22:38:30 +08:00
huanghuoguoguo
4f95016998
test(api): align CLI diagnostics with integration gates
2026-09-27 17:46:19 +08:00
RockChinQ
27871e4363
merge: integrate master certification and document identity fixes into 4.11
2026-09-21 10:55:40 +00:00
RockChinQ
20a04a77bf
feat(plugin): enforce certified archive admission ( #2553 )
...
* feat(plugin): add certified admission policy
* feat(plugin): enforce certified archive admission
* chore(plugin): pin certified SDK beta
* fix(plugin): consume SDK beta 5
* style(plugin): format certification admission
2026-09-20 18:54:45 +08:00
RockChinQ
bece2aa554
fix(wizard): restore message pipeline setup and page bot preview
2026-09-18 16:01:55 +08:00
RockChinQ
273b1ea3cf
Merge master into dev/4.11.x and preserve plugin runner architecture
...
Reconcile migration branches without rewriting published revisions; retain additive Codex, monitoring, provider and platform fixes. Keep dynamic runner schemas and Host ownership, restore compatibility regressions, and preserve safe model-test error handling.
2026-09-16 08:13:07 +00:00
BiFangKNT
19526e1400
test(api): define explicit fixtures for passkey integration tests
2026-09-12 15:51:56 +08:00
BiFangKNT
dfde9578c1
fix(ci): fix ruff lint errors and postgres legacy migration table exclusion
2026-09-12 15:35:47 +08:00
BiFangKNT
b594cf23e4
feat(auth): add webauthn authentication support
2026-09-12 12:17:26 +08:00
Hyu and dadachann
ff6ad6adc2
fix(monitoring): restore Cloud messages and bot-scoped sessions ( #2526 )
...
* fix(monitoring): restore Cloud message persistence and bot-scoped sessions
* fix(migrations): support partial monitoring schemas and align regression fixtures
* test(migrations): complete raw bot session fixture values
---------
Co-authored-by: dadachann <[email protected]
2026-09-11 14:34:37 +08:00
Tynwink
1ba3c1ec72
Merge pull request #2520 from langbot-app/feat/api-key-system-context
...
为 lbctl 增加 API Key 发现与管理能力
当前为 lbctl 提供的能力通过 system.py -> SYSTEM_CAPABILITY_OPERATIONS 维护，后续可通过统一的接口暴露能力，避免频繁维护常量。
2026-09-09 14:47:00 +08:00
Tynwink2000
d90253cc77
feat(api): advertise provider and model management
2026-09-09 11:18:01 +08:00
Tynwink2000
8281eb18c9
feat(api): advertise plugin and skill management
2026-09-09 00:12:40 +08:00
Tynwink2000
4eea3419e8
feat(api): advertise knowledge and MCP management
2026-09-08 23:07:43 +08:00
Tynwink2000
814740ea68
feat(api): advertise managed read operations
2026-09-08 18:53:55 +08:00
Tynwink2000
e6e8258545
feat(api): advertise extension operation capabilities
2026-09-08 17:43:11 +08:00
Tynwink2000
1a69747a06
feat(api): expose task status to api keys
2026-09-08 14:06:13 +08:00
Tynwink2000
1fa5e2f755
feat(api): add system capabilities endpoint
2026-09-08 13:03:02 +08:00
267232c24f
fix(security): harden password recovery with usable eight-character codes ( #2477 )
...
Use eight securely random recovery-code characters with concurrency-safe online throttling. Preserve existing keys and verify recovery through browser and real SQLite integration tests.
Co-authored-by: [email protected] [email protected] [email protected]
2026-09-07 15:31:54 +00:00
Tynwink2000
bc32eb3ca0
feat(api): add system context endpoint for lbctl
2026-09-07 14:22:27 +08:00
Hyu and dadachann
b44b8f474d
fix(cloud): provision login workspace just in time ( #2505 )
...
* fix(cloud): provision login workspace just in time
* fix(oauth): send callback URI during code exchange
* fix(oauth): preserve callback URI through browser exchange
* fix(oauth): negotiate redirect-bound codes
---------
Co-authored-by: dadachann <[email protected]
2026-09-03 23:14:44 +08:00
Hyu
7c64756203
fix(ui): improve agent debug and model test feedback
2026-09-03 14:51:01 +08:00
Hyu and dadachann
ab52684a01
Revert "fix(cloud): request automatic Space launch ( #2501 )" ( #2503 )
...
This reverts commit d50957fc4f[email protected]
2026-09-03 12:16:21 +08:00
Hyu and dadachann
d50957fc4f
fix(cloud): request automatic Space launch ( #2501 )
...
Co-authored-by: dadachann <[email protected]
2026-09-03 11:44:32 +08:00
Hyu and dadachann
c8d8b1aac4
fix(cloud): serialize directory catch-up ( #2500 )
...
Co-authored-by: dadachann <[email protected]
2026-09-02 21:57:53 +08:00
Hyu and dadachann
018dd7a363
fix(cloud): launch newly registered accounts through Space ( #2499 )
...
* fix(cloud): launch new accounts through Space
* style: format Cloud entry URL
* fix(cloud): wait for launch workspace projection
---------
Co-authored-by: dadachann <[email protected]
2026-09-02 21:41:35 +08:00
Hyu and dadachann
bf8d418ad4
feat(monitoring): paginate sessions and messages ( #2489 )
...
* feat(monitoring): paginate sessions and messages
* fix(monitoring): align detail pages with local dates
---------
Co-authored-by: dadachann <[email protected]
2026-09-01 15:14:29 +08:00
Hyu
91e09af76a
fix(web): complete pluginized agent onboarding flows
2026-09-01 10:41:29 +08:00
Hyu
fde04e64f6
Merge remote-tracking branch 'origin/master' into dev/4.11.x
...
# Conflicts:
# src/langbot/pkg/api/http/controller/groups/pipelines/pipelines.py
# src/langbot/pkg/api/http/service/bot.py
# src/langbot/pkg/provider/runners/localagent.py
# src/langbot/templates/metadata/pipeline/ai.yaml
# tests/unit_tests/api/service/test_bot_service.py
# tests/unit_tests/provider/runners/test_difysvapi_runner.py
# tests/unit_tests/utils/test_safe_regex.py
# web/src/app/infra/entities/adapter-categories.ts
# web/src/app/wizard/page.tsx
# web/src/i18n/locales/en-US.ts
# web/src/i18n/locales/ja-JP.ts
# web/src/i18n/locales/zh-Hans.ts
# web/tests/e2e/plugin-page-auth.spec.ts
2026-08-31 17:17:47 +08:00
be3734ffda
feat(wizard): rework agent onboarding flow ( #2471 )
...
* feat(wizard): rework agent onboarding flow
* fix(web): support LAN development access
* fix(wizard): parse ranked model selection entries
* feat(wizard): add inbound bot verification
* feat(wizard): add floating page bot verification
* fix(wizard): repair HTTP bot inbound test setup
* feat(wizard): streamline custom model onboarding
* feat(wizard): label page bot test preview
* style(space): apply ruff formatting
* fix(wizard): polish AI engine onboarding
* fix(wizard): clarify local account message test
* feat(wizard): animate AI engine transitions
* fix(wizard): align AI engine setup headers
---------
Co-authored-by: langbot-dev <[email protected] [email protected]
2026-08-28 01:30:30 +08:00
RockChinQ
600a173918
refactor(bots): remove route execution test
2026-08-26 14:28:30 +08:00
dadachann
0559d9d441
Merge master into dev/4.11.x
...
# Conflicts:
# pyproject.toml
# uv.lock
2026-08-24 02:34:14 +00:00
Hyu and dadachann
1336f47cb4
fix(auth): enable local registration for OSS invitations ( #2460 )
...
Co-authored-by: dadachann <[email protected]
2026-08-24 10:28:45 +08:00
Junyan Qin
f94243c725
chore: merge master into dev/4.11.x
2026-08-14 16:04:52 +08:00
Hyu and dadachann
79773b669a
fix(auth): allow callbacks from literally any origin ( #2430 )
...
* fix(auth): allow callbacks from any origin
* chore: retrigger repository checks
---------
Co-authored-by: dadachann <[email protected]
2026-08-13 23:58:23 +08:00
Hyu and dadachann
5084f2391d
fix(auth): support dynamic OSS callbacks and LangBot Account copy ( #2428 )
...
* fix(auth): support dynamic OSS callbacks and LangBot Account copy
* style(web): format LangBot Account copy
---------
Co-authored-by: dadachann <[email protected]
2026-08-13 23:18:01 +08:00
RockChinQ
bbc912d0ef
fix(runtime): restore standalone runtime compatibility
2026-08-11 21:35:03 +08:00
Hyu and dadachann
d78546967c
feat: expose Workspace-scoped rotating plugin debug keys ( #2395 )
...
* feat: add Workspace-scoped rotating plugin debug tokens
* chore: pin formatted Workspace debug runtime
* chore: pin merged Workspace debug runtime
* chore: pin tenant-safe debug runtime
---------
Co-authored-by: dadachann <[email protected]
2026-08-04 19:20:06 +08:00
Hyu and dadachann
c08bfc8ced
feat: report independent instance and workspace identities ( #2394 )
...
* feat: report independent instance and workspace identities
* test: include workspace in OAuth callback fixture
* ci: pin production cloud adapter to Space release
* fix: preserve authenticated Workspace telemetry attribution
* ci: pin production cloud adapter to final Space release
---------
Co-authored-by: dadachann <[email protected]
2026-08-04 17:27:23 +08:00
huanghuoguoguo
5c5ed940a9
Merge remote-tracking branch 'origin/master' into dev/4.11.x
2026-08-04 13:55:25 +08:00
huanghuoguoguo
679b8346cb
Merge remote-tracking branch 'origin/master' into dev/4.11.x
...
# Conflicts:
# pyproject.toml
# src/langbot/pkg/pipeline/controller.py
# uv.lock
# web/src/app/home/bots/components/bot-form/BotForm.tsx
# web/src/app/home/components/home-sidebar/HomeSidebar.tsx
# web/src/app/home/components/home-sidebar/SidebarDataContext.tsx
# web/src/app/home/plugin-pages/page.tsx
# web/src/app/infra/entities/api/index.ts
2026-08-04 12:16:27 +08:00
Hyu and dadachann
7820949d3a
fix(workspace): show member emails ( #2393 )
...
Co-authored-by: dadachann <[email protected]
2026-08-04 11:48:43 +08:00
Hyu and dadachann
1e6e4c0ca7
fix(cloud): show owner model balance and enforce single owner ( #2384 ) ( #2385 )
...
* fix(cloud): show owner model balance and enforce single owner
* fix(migrations): create owner index idempotently
---------
Co-authored-by: dadachann <[email protected]
2026-08-03 02:14:43 +08:00
dadachann
a7a7218afe
fix(cloud): accept invitations with current account
2026-08-02 09:08:49 +00:00
Hyu and dadachann
c5aada494d
fix(cloud): treat workspace owners as Space-bound ( #2378 )
...
Co-authored-by: dadachann <[email protected]
2026-08-02 00:33:46 +08:00
huanghuoguoguo
e589683b98
Merge remote-tracking branch 'origin/master' into dev/4.11.x
...
# Conflicts:
# src/langbot/pkg/pipeline/process/handlers/chat.py
# tests/integration/persistence/test_workspace_migration.py
2026-08-01 09:31:23 +08:00
huanghuoguoguo
55f42a4ebc
chore(merge): sync master into dev/4.11.x
2026-07-31 19:29:38 +08:00
Hyu and dadachann
404e3466d9
feat(cloud): add scoped support admin sessions ( #2369 )
...
* feat(cloud): add scoped support admin sessions
* style(web): format support admin session changes
* fix(cloud): isolate support adapter sessions
* fix(cloud): authenticate plugin assets and report workspace resources
---------
Co-authored-by: dadachann <[email protected]
2026-07-31 17:41:55 +08:00
RockChinQ