Matthew Meszaros
1c325b7a87
Merge pull request #903 from warmbly/devin/1791559441-admin-monitoring-final
...
feat: show evidence-based admin monitoring and truthful mailbox refresh states
2026-10-09 16:38:53 +00:00
Matthew Meszaros
cdb102ca56
feat: keep mailbox health and usage unknown until Cloud and account status checks finish with refresh and incomplete-data regressions
2026-10-09 16:27:20 +00:00
Matthew Meszaros
1f928de78f
feat: record member access proof with a per-flow account option in the qa harness, and hide inbox compose and out-of-scope mailbox tags from restricted members
2026-10-09 13:42:09 +02:00
Matthew Meszaros
bb4156cc6a
feat: add resource-scoped member access that restricts a member to selected campaign folders, campaigns and mailboxes read-only, enforced in the API route gate, SQL filters, permission trigger, realtime channels and dashboard
2026-10-09 13:34:05 +02:00
Matthew Meszaros and Devin AI
e6bd3491b2
feat: document dashboard browsing preferences, consolidate scoped search debouncing, and prevent signed-out pages from restoring saved filters after logout or token expiry
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 07:48:58 +00:00
Matthew Meszaros and Devin AI
acc3d62ba3
feat: add validated browser-tab browsing preferences scoped to the signed-in user and workspace, restore destination filters before rendering, preserve explicit navigation intent, and clear saved browsing state on logout or session expiry
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 07:17:34 +00:00
Matthew Meszaros and Devin AI
c7144c1502
feat: restore the destination workspace mailbox tag filter before saving route state when switching organizations, preserve other query parameters, and cover the mounted Accounts transition without clearing either workspace selection
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 07:06:25 +00:00
Matthew Meszaros and Devin AI
b4ef37fe82
feat: restore existing self-host realtime connections through normalized legacy gateway URLs and an authenticated API-origin WebSocket proxy, preserve ticket-bound client IP limits and direct retry fallback, and remember workspace mailbox tag filters across navigation with deterministic default account grouping
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 06:57:48 +00:00
Matthew Meszaros and Devin AI
fda0743eae
feat: clean application header with route-aware breadcrumbs and responsive workspace navigation
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 18:07:18 +00:00
Matthew Meszaros
8b72f1f6e0
Merge pull request #872 from warmbly/devin/1791388041-mailbox-filter-template-subject
...
feat: retain mailbox filters and template subjects in new campaigns
2026-10-07 16:06:17 +00:00
Matthew Meszaros and Devin AI
72b3620ea0
feat: retain mailbox tag filters on refresh and compose campaign wizard template subject and body updates against the latest draft
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 15:55:51 +00:00
Matthew Meszaros and Devin AI
2926f888c2
feat: allow unlimited self-hosted workspaces and bind Cloud billing access to individual workspace links while preserving legacy enrollments
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 13:49:42 +00:00
Matthew Meszaros and Devin AI
925e0edc31
feat: proxy dashboard and editor image previews with SSRF-safe bounded fetching while preserving original customer email URLs
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 07:28:25 +00:00
Matthew Meszaros and Devin AI
0f12b3b250
feat: preserve static CSP preview and runtime configuration cache rules with current main
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 06:05:17 +00:00
Matthew Meszaros and Devin AI
589bc823ed
feat: generate static dashboard CSP hashes and isolate email preview styling across Vite nginx and Pages
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 05:46:52 +00:00
Matthew Meszaros and Devin AI
9d0f43780b
feat: provision onboarding-complete reviewer workspaces with expiring Test access, bounded credits and Test header labels
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 16:15:56 +00:00
Matthew Meszaros and Devin AI
f58a6c1ff9
feat: control Gmail mailbox OAuth per frontend deployment and bind callbacks to allowlisted dashboard origins
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 12:16:34 +00:00
Matthew Meszaros and Devin AI
3ee98f1881
feat: expire unfinished mailbox and admin-grant OAuth states after the ten-minute blocked-popup wait and fall back to reopening the sign-in window by name when navigating the reserved one throws
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:51:05 +00:00
Matthew Meszaros and Devin AI
8347d4f94a
fix: open OAuth sign-in windows inside the click so Safari stops blocking them, and keep listening when one is blocked
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 04:18:49 +00:00
Matthew Meszaros and Devin AI
b54b840bd1
Merge origin/main into refactor/dashboard-tanstack-start-spa
...
Port the Pipedrive CRM work onto TanStack Router: add the
integrations/pipedrive route, move ConnectionDetail, CrmSettings and
crmMode off react-router-dom, and drop hubspotCrm.tsx (replaced by
crmMode.tsx on main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-04 18:17:21 +00:00
Matthew Meszaros
b828723889
feat: keep the dashboard unibox loader to a cold cache so opening a thread never reloads the list, retry a dashboard boot that failed, undo optimistic edits only where the cache still holds them, hold blocked navigations during the unsaved-changes confirm, keep shell scroll offsets apart from list offsets, share the label count query, and trim new comments
2026-10-04 10:59:19 -07:00
Matthew Meszaros
7980079f3e
feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent mailbox, campaign, CRM, label and template actions
2026-10-04 10:38:14 -07:00
Matthew Meszaros
36149cdebd
feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer
2026-10-04 19:20:48 +02:00
Matthew Meszaros
a6e72f1a92
feat: keep linking and unlinking Warmbly Cloud and adopting the cloud workspace's mailboxes with the instance administrator, and let members with manage_emails read the link and put their own workspace's mailboxes on it
2026-10-04 05:17:20 -07:00
Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
bf47984cd5
feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations
2026-10-04 02:59:10 -07:00
Matthew Meszaros
8bb60e9449
feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers
2026-10-04 02:58:43 -07:00
Matthew Meszaros
23c57f35c2
Merge pull request #822 from warmbly/feature/integrations-page-redesign
...
feat: turn Integrations into an app store with search, filters and app pages, add a link-only community directory, a new OAuth app registration dialog, per-app re-encoded logos and admin moderation for OAuth apps
2026-10-04 08:27:13 +00:00
Matthew Meszaros
2983d3ca1e
Merge pull request #823 from warmbly/feat/remie-assistant
...
feat: Remie, the dashboard AI assistant: animated blob mark, floating panel, live run UI, and Advisor-driven suggestions and tips
2026-10-04 07:59:05 +00:00
Matthew Meszaros
1a483cb27f
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# internal/app/integration/service.go
# web/src/app/app/integrations/page.tsx
# web/src/hooks/useDocumentTitle.ts
2026-10-04 00:45:48 -07:00
Matthew Meszaros
7672924a72
feat: rename the dashboard assistant to Remie with an animated blue blob mark, open it as a floating window by default, show live runs with a shimmering status, elapsed timer, collapsible tool-step trace, streamed text with a blurred tail and a redesigned approval card, and add Remie suggestions and rate-limited tips built from open Advisor findings that Remie fixes through its own approvals
2026-10-04 00:36:27 -07:00
Matthew Meszaros
4bc2417618
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# docs/content/docs/api/error-codes.mdx
# docs/content/docs/guides/integrations.mdx
# web/src/app/app/integrations/page.tsx
2026-10-04 00:32:54 -07:00
Matthew Meszaros
7555f641a5
feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps
2026-10-04 00:31:52 -07:00
Matthew Meszaros
6b7e254e56
feat: add native Salesforce sync with Lead and Contact matching and links, a leased activity outbox that logs sends, replies, bounces, opt-outs and meetings as Tasks, Lead Status and Email Opt Out writeback, a pull loop with CRM pause rules, list view and Campaign imports, sandbox and My Domain OAuth that refreshes expired sessions, a Salesforce settings page with contact and inbox cards in web, and docs
2026-10-04 08:54:27 +02:00
Matthew Meszaros
37e91fc89f
feat: add HubSpot CRM mode where HubSpot deals, pipelines, tasks, notes and owners are mirrored and written through, sends and replies log as HubSpot emails, exit rules hold campaigns, list import, sync health, setup wizard in web, HubSpot app project with record card and workflow action, and docs
2026-10-04 07:47:51 +02:00
Matthew Meszaros
75840247c8
feat: replace the stored Outlook admin approval link on every Outlook sign-in start in useMailboxOAuth, clearing it when the start response carries none
2026-10-03 20:33:53 +02:00
Matthew Meszaros
8883a1df6b
feat: connect Microsoft 365 organizations through Microsoft's v2.0 admin consent page followed by a sign-in on the same state, read the approving admin's directory role from the Graph token as well as the ID token, return an organization-wide approval link for single-mailbox Outlook sign-in (admin_consent_url) and show it in the connect panel, and document publisher verification and the admin approval path
2026-10-03 20:17:38 +02:00
Matthew Meszaros
4957214431
feat: redesign the Integrations page with search, category chips, recommended and popularity-ranked integrations, add a community app directory where OAuth apps are published unverified by link and verified in a new admin review queue, with docs and OpenAPI
2026-10-03 09:24:34 -07:00
Matthew Meszaros
61d16dfe9a
feat: add Warmbly for Slack with the AI assistant in DMs, mentions and the assistant pane, unified inbox threads with reply, AI draft and lead actions, per-category notification routing and DMs, account linking, dashboard Slack settings, manifest and docs
2026-10-03 15:35:11 +02:00
Matthew Meszaros
c3da0d684b
Merge pull request #805 from Skylinerffm97/feat/unibox-long-press-menu
...
feat(unibox): open the row menu on a long press on touch screens
2026-10-03 07:57:35 +00:00
Matthew Meszaros
c84368f2c4
feat: ignore Android's native contextmenu in useAnchoredMenu once a touch press has moved past the 10 px drift, so a scroll that stalls on a unibox row never opens its menu, with a hook test for the moved press
2026-10-03 08:59:01 +02:00
Skylinerffm97 and Claude Opus 5.5
3f6617000a
feat(unibox): open the row menu on a long press on touch screens
...
iOS Safari fires no contextmenu on a long press, so the conversation rows and the scope rail had no way to reach the right-click menu on a phone. useAnchoredMenu now opens the same menu after a 500 ms touch hold at the finger, cancels on a move over 10 px, swallows the click and touchend that follow the hold (so the row does not open and no menu item under the finger fires), and ignores Android's native contextmenu after a fired hold. Mouse and pen are unchanged.
Herkunft: [Claude]
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-02 16:14:35 +02:00
Skylinerffm97 and Claude Opus 5.5
a9945e2e7e
[Claude] fix(web): close dropdowns on a tap inside the email body on iOS Safari
...
WebKit does not run parent-registered listeners in a frame sandboxed without allow-scripts, and a tap does not focus the frame, so neither iframe path from #792 fires on an iPhone. While a layer is open, same-page iframes outside it now get pointer-events: none (shared counter per frame, previous inline value restored), so the tap lands on the page and reaches the existing capture-phase pointerdown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-02 14:37:37 +02:00
Matthew Meszaros
b8a8ec4743
Merge remote-tracking branch 'origin/main' into feat/unibox-rail-layout-per-member
2026-10-01 22:58:31 -07:00
Matthew Meszaros
1e1acef6f4
Merge pull request #791 from warmbly/fix/unibox-refresh-load
...
feat: coalesce and dedupe unibox realtime refreshes in useRealtimeEvents, forward TanStack Query abort signals through every unibox client and the shared Request helper with cancellations kept out of error handling, share one organization-scoped unibox overview computation per second with in-flight dedup and write-time invalidation, bound interactive unibox reads at 30s including pool wait, and log slow pgxpool connection acquisitions
2026-10-02 05:46:17 +00:00
Matthew Meszaros
8f89c36756
feat: refresh the open conversation for inbox events that name only a message id, give unibox refresh keys added just before a max-wait flush a trailing flush, cancel a shared unibox overview computation once its last caller leaves and bound it and GET /unibox/overview at 30s, include scheduled sends in the coalesced inbox refresh, and word the slow pgxpool acquire log as acquire time rather than saturation
2026-10-01 22:41:00 -07:00
Matthew Meszaros
596c395cd0
Merge pull request #792 from warmbly/fix/menus-close-on-email-body-tap
...
feat: close every dashboard dropdown on a tap inside a same-origin iframe such as the unibox email body
2026-10-02 05:37:50 +00:00
Matthew Meszaros
478d3ecc7b
Merge remote-tracking branch 'origin/main' into fix/unibox-refresh-load
2026-10-01 22:37:48 -07:00
Matthew Meszaros
54a05027cc
feat: save the unibox scope rail's favorites, row and section order and hidden rows to the member's account per workspace through a unibox_rail view with a validated layout on /me/views, synced from the dashboard store so every device shows the same rail while folds and widths stay per browser
2026-10-01 22:37:23 -07:00
Matthew Meszaros
f01016c64f
feat: close every dashboard dropdown on a tap inside a same-origin iframe such as the unibox email body by listening on the frame's own document in useClickOutside, re-attaching when the frame reloads, since a tap on a phone never moves focus into the frame
2026-10-01 22:27:45 -07:00
Matthew Meszaros
Matthew Meszaros
Skylinerffm97andClaude Opus 5.5