6f67347e00
ci: restore npm token auth for dist-tag promotion
2026-04-02 20:37:49 +01:00
04cf29f613
refactor: speed up whatsapp inbound dispatch tests
2026-04-03 04:34:58 +09:00
694d12a90b
refactor: apply context visibility across channels
2026-04-03 04:34:57 +09:00
35e1605147
feat: add configurable context visibility
2026-04-03 04:34:57 +09:00
d4d2d9e479
ci: move npm promotion into trusted workflow
2026-04-02 20:29:57 +01:00
658f0c5d2d
ci: use oidc token for npm promotion
2026-04-02 20:23:56 +01:00
dbfb13b93a
build: update appcast for 2026.4.2
2026-04-02 20:08:40 +01:00
883df8c6a8
fix(plugins): reuse runtime registries for web provider snapshots ( #59865 )
...
* fix(plugins): reuse runtime registries for web providers
* test(plugins): clarify runtime reuse intent
* chore(changelog): note web provider runtime reuse
2026-04-03 04:07:43 +09:00
193fdd6e3b
fix(policy): preserve restrictive tool allowlists ( #58476 )
...
* fix(policy): preserve restrictive tool allowlists
Co-authored-by: David Silva <david.silva@gendigital.com >
* fix(policy): address review follow-ups
* fix(policy): restore additive alsoAllow semantics
* fix(policy): preserve optional tool opt-ins for allow-all configs
* fix(policy): narrow plugin-only allowlist warnings
* fix(policy): add changelog entry
* Revert "fix(policy): add changelog entry"
This reverts commit 4a996bf4caedfe8c9ff3a7f190816e657ead5d10.
* chore: add changelog for restrictive tool allowlists
---------
Co-authored-by: David Silva <david.silva@gendigital.com >
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-02 12:55:36 -06:00
9f85595d80
fix: pin anthropic sdk to patched version
2026-04-02 19:50:05 +01:00
d34bca3ce6
fix(plugins): reuse runtime registry for provider resolution ( #59856 )
...
* fix(plugins): reuse runtime registry for provider resolution
* test(plugins): align provider runtime helper names
2026-04-03 03:40:24 +09:00
be4be5e783
fix: improve parallels smoke progress
2026-04-02 19:39:23 +01:00
d631326c5e
fix(tailscale): gate test binary override ( #58468 )
...
* fix(tailscale): gate test binary override
* fix(changelog): note tailscale override hardening
* fix(changelog): drop tailscale note from pr
* chore: add changelog for tailscale test binary gating
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-02 12:39:10 -06:00
f32a5b30db
chore(skills): align taskflow skill with runtime
2026-04-03 03:38:02 +09:00
d74a12264a
fix: mirror bedrock runtime dep in root package
Docker Release / validate_manual_backfill (push) Has been cancelled
Docker Release / approve_manual_backfill (push) Has been cancelled
Docker Release / build-amd64 (push) Has been cancelled
Docker Release / build-arm64 (push) Has been cancelled
Docker Release / create-manifest (push) Has been cancelled
2026-04-02 19:26:56 +01:00
f911bbc353
refactor(plugins): separate activation from enablement ( #59844 )
...
* refactor(plugins): separate activation from enablement
* fix(cli): sanitize verbose plugin activation reasons
2026-04-03 03:22:37 +09:00
4aeb0255f3
docs: rename TaskFlow to Task Flow in prose
2026-04-03 03:22:01 +09:00
d9c662dc69
docs: restructure automation section as Automation & Tasks
2026-04-03 03:16:51 +09:00
3bd2bbea34
docs: clarify npm release workflow inputs
2026-04-02 19:11:01 +01:00
0ebb69b882
build: set release version to 2026.4.2
2026-04-02 19:09:58 +01:00
38bd525888
test: align strict inline-eval awk denial expectation
2026-04-02 19:09:39 +01:00
209535b7c7
build: make npm release tag configurable
2026-04-02 19:06:37 +01:00
bcd61e54e1
docs: fix TaskFlow CLI command path and CLI task notify policy
2026-04-03 03:03:00 +09:00
9f3a26caa6
fix(discord): quiet Carbon reconcile log
2026-04-02 18:55:34 +01:00
49d08382a9
iOS: restrict A2UI action dispatch to trusted canvas URLs ( #58471 )
...
* fix(ios): restrict a2ui bridge trust
* test(ios): cover fragment-strip trust and document raw-string equality
* fix(ios): normalize capability URL before trust comparison in canvas commands
* fix(ios): trim canvas.navigate url before trust comparison
* chore: add changelog for iOS A2UI trust boundary
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-02 11:51:09 -06:00
00aa31a30c
docs(changelog): remove duplicate entries
2026-04-02 18:48:27 +01:00
7aa22959e4
refactor(tasks): rename registry hooks to observers ( #59829 )
2026-04-03 02:42:59 +09:00
676b748056
Limit connect snapshot metadata to admin-scoped clients ( #58469 )
...
* fix(gateway): gate connect snapshot metadata by scope
* fix(gateway): clarify connect snapshot trust boundary
* fix(gateway): note connect snapshot change in changelog
* fix(gateway): remove changelog changes from PR
* chore: add changelog for scoped gateway snapshot metadata
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-02 11:41:47 -06:00
a4a372825e
docs(changelog): reorder unreleased fixes
2026-04-02 18:39:31 +01:00
45c8207ef2
fix(exec): clarify auto routing semantics ( #58897 ) (thanks @vincentkoc)
2026-04-03 02:37:12 +09:00
938541999e
Delete docs/internal/codex/2026-03-29-exec-target-override-fix.md
2026-04-03 02:37:12 +09:00
5dca81271c
fix(exec): clarify and cover auto host override guard
2026-04-03 02:37:12 +09:00
dae6632da1
Security: block exec host overrides under auto target
2026-04-03 02:37:12 +09:00
5874a387ae
fix(windows): reject unresolved cmd wrappers ( #58436 )
...
* fix(windows): reject unresolved cmd wrappers
* fix(windows): add wrapper policy coverage
* fix(windows): document wrapper fallback migration
* fix(windows): drop changelog entry from pr
* chore: add changelog for Windows wrapper fail-closed behavior
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
Co-authored-by: Devin Robison <drobison00@users.noreply.github.com >
2026-04-02 11:35:50 -06:00
3e452f2671
fix: preserve strict inline-eval approval boundaries ( #59780 ) (thanks @luoyanglang)
2026-04-02 18:30:29 +01:00
f03d7c5a4c
refactor: centralize Windows exec invocation
2026-04-02 18:27:53 +01:00
d56415e353
fix(openai): support reference-image edits
2026-04-03 02:26:33 +09:00
f0a4bbba33
test(tasks): close flow registry before temp-dir cleanup
2026-04-03 02:25:48 +09:00
68d8e15a2e
fix(exec): satisfy allowlist predicate type checks
2026-04-03 02:25:48 +09:00
7c83cae425
fix(exec): keep strict inline-eval interpreter approvals reusable
2026-04-03 02:25:48 +09:00
a941a4fef9
fix(android): require TLS for remote gateway endpoints ( #58475 )
...
* fix(android): require tls for remote gateway endpoints
* fix(android): expand loopback gateway coverage
* fix(android): validate scanned gateway endpoints
* fix(android): handle mapped loopback literals
* fix(android): allow emulator bridge host
* fix(changelog): note android gateway tls hardening
* fix(android): preserve first-time tls trust prompts
* fix(changelog): drop android gateway entry from pr
* fix(android): scope emulator bridge tls bypass
* fix(android): normalize ipv6 gateway hosts
* fix(android): preserve ipv6 gateway url brackets
* fix(android): preserve auth across tls trust prompt
* fix(android): normalize bracketed ipv6 gateway hosts
* chore: add changelog for Android remote gateway TLS
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
Co-authored-by: Devin Robison <drobison00@users.noreply.github.com >
2026-04-02 11:23:51 -06:00
2ea0ca08f6
test: add cross-provider approval availability coverage ( #59776 ) (thanks @joelnishanth)
2026-04-03 02:21:17 +09:00
d5865bbcc2
fix: decouple approval availability from native delivery enablement ( #59620 )
...
getActionAvailabilityState in createApproverRestrictedNativeApprovalAdapter
was gating on both hasApprovers AND isNativeDeliveryEnabled, causing
Telegram exec approvals to report "not allowed" when
channels.telegram.execApprovals.target was configured but
execApprovals.enabled was not explicitly true. The availability check
should only depend on whether approvers exist; native delivery mode is
a routing concern handled downstream.
2026-04-03 02:21:17 +09:00
9b48a4d90a
docs: fix changelog conflict markers ( #59466 )
2026-04-03 02:19:32 +09:00
bacc938c2a
docs: note windows exec landing ( #59466 ) (thanks @lawrence3699)
2026-04-03 02:19:32 +09:00
2fd7f7ca52
fix(exec): hide windows console windows
2026-04-03 02:19:32 +09:00
7eb094a00d
fix(infra): align env key normalization in approval binding path ( #59182 )
...
* fix: address issue
* fix: address PR review feedback
* fix: address review feedback
* fix: address review feedback
* chore: add changelog for Windows env approval binding
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-02 11:14:33 -06:00
774beb8e5c
refactor(plugin-sdk): add task domain runtime surfaces ( #59805 )
...
* refactor(plugin-sdk): add task domain runtime views
* chore(plugin-sdk): refresh api baseline
* fix(plugin-sdk): preserve task runtime owner isolation
2026-04-03 02:11:21 +09:00
f30b4bc717
fix: remove leaked changelog conflict marker
2026-04-02 18:07:39 +01:00
fc76f667c2
test: isolate task flow link validation stores
2026-04-03 02:04:26 +09:00
Peter Steinberger