Matthew Meszaros
69f2fef943
feat: move the flow canvas zoom controls to the bottom left, clear of the assistant launcher, in the app and the site mocks
2026-10-06 05:29:09 -07:00
Matthew Meszaros
705651e01a
Merge remote-tracking branch 'origin/main' into feat/flow-builder-redesign
...
# Conflicts:
# web/src/app/app/campaigns/[id]/steps/page.tsx
2026-10-06 05:24:33 -07:00
Matthew Meszaros
62674fdcc9
feat: animate flow edits so cards glide to their new places, new steps fade and grow in, removed ones fade out, lines morph between straight and branched, and pills, waits and add buttons travel with their lines, skipping animation on first paint
2026-10-06 03:32:47 -07:00
Matthew Meszaros
1bbc88b250
feat: make the flow builders a full-height design-tool canvas with two-finger and drag panning with momentum, pinch and Ctrl or Cmd wheel zoom toward the pointer, a moving dot grid, no scrollbars, fenced bounds, zoom shortcuts, and a campaign canvas that fills the window
2026-10-06 03:24:49 -07:00
Matthew Meszaros
26b0333d87
feat: draw the flow builders as a plain scrolling page instead of a pan and zoom canvas, scroll a step into view only when needed, fade the panel and picker in, keep the campaign flow growing with the page beside a sticky panel, move stop on reply into a toolbar row, and drop React Flow and dagre
2026-10-06 02:07:47 -07:00
Matthew Meszaros
2d76c535c8
feat: quiet the flow canvas with two-line cards, a + that shows on hover, waits as plain text beside the line, pill-wide columns, an amber dot for steps needing setup and faded unconnected steps
2026-10-06 01:47:29 -07:00
Matthew Meszaros and Devin AI
925e0edc31
feat: proxy dashboard and editor image previews with SSRF-safe bounded fetching while preserving original customer email URLs
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 07:28:25 +00:00
Matthew Meszaros and Devin AI
0f12b3b250
feat: preserve static CSP preview and runtime configuration cache rules with current main
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 06:05:17 +00:00
Matthew Meszaros and Devin AI
34fbbc3c54
feat: apply per-response development nonces after Vite finishes rendering HTML
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 05:57:08 +00:00
Matthew Meszaros and Devin AI
589bc823ed
feat: generate static dashboard CSP hashes and isolate email preview styling across Vite nginx and Pages
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 05:46:52 +00:00
Matthew Meszaros
91e031a41c
feat: confirm discarding unsaved step edits outside the selection state updater, and mint campaign branch ids with the plain-HTTP-safe fallback
2026-10-05 22:20:56 -07:00
Matthew Meszaros
aa63ed9a4f
feat: redraw the site's campaign builder mock, campaigns page builder and hero fragments as the self-laying tree canvas with wait chips, column pills and End terminals, and drop dot and drag wording from the switch step editor
2026-10-05 22:19:23 -07:00
Matthew Meszaros
8d8135c30c
feat: document the self-laying campaign and automation canvases in the sequences, campaigns, collaboration and realtime guides, correct the step position and empty-branch model comments, and add a campaign steps proof flow
2026-10-05 22:13:44 -07:00
Matthew Meszaros
d25055c122
feat: rebuild the campaign step builder on the shared tree canvas with conditions as columns, waits on the lines, a step picker, path and step side panels with unsaved-change guards, reconnect-on-delete, and switch cases that keep their paths through a rename
2026-10-05 22:10:23 -07:00
Matthew Meszaros
b553c61db1
feat: drop the automation canvas layout hook and client now that the builder derives positions from the flow's structure
2026-10-05 21:57:32 -07:00
Matthew Meszaros
63ae572345
feat: keep the connector + button under the pointer on hover, open the step picker beside the cards, top-anchor the first view, and update the automation docs, the site's builder demo and branching copy, and a proof flow for the tree builder
2026-10-05 21:56:30 -07:00
Matthew Meszaros and Devin AI
bb0b822cb0
feat: reject unsupported request text and secure local dashboard responses
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 04:45:36 +00:00
Matthew Meszaros
42205a6ade
feat: rebuild the automation builder as an auto-laid-out tree with + insertion, branch columns, a step picker, undo/redo, inline issues and a side panel on a shared flow canvas
2026-10-05 21:41:40 -07:00
Matthew Meszaros
c1606851d8
Merge pull request #845 from warmbly/devin/1791212676-structured-sender-variables
...
feat: add native Sender mailbox personalization to campaign emails
2026-10-05 16:37:09 +00:00
Matthew Meszaros and Devin AI
9d0f43780b
feat: provision onboarding-complete reviewer workspaces with expiring Test access, bounded credits and Test header labels
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 16:15:56 +00:00
Matthew Meszaros and Devin AI
d807aa2852
feat: expose typed sender mailbox details in campaign templates, previews and email editor variables
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 15:15:12 +00:00
Matthew Meszaros
e19c55ebd6
feat: match the text/html media type case-insensitively in the dashboard client's web-page guard and cover a mixed-case Content-Type in Client.test.ts
2026-10-05 17:14:41 +02:00
Matthew Meszaros
0731a8c788
feat: refuse an HTML page as an API response in the dashboard client (api_url_not_api) so a missing or wrong API_URL falls back to the unreachable login state instead of crashing, and serve config.js with Cache-Control no-store from the dashboard and admin Pages _headers to match the nginx images
2026-10-05 17:04:05 +02:00
Matthew Meszaros and Devin AI
f58a6c1ff9
feat: control Gmail mailbox OAuth per frontend deployment and bind callbacks to allowlisted dashboard origins
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 12:16:34 +00:00
Matthew Meszaros
549a0f7293
Merge pull request #833 from warmbly/devin/1791173929-safari-oauth-popups
...
fix: open OAuth sign-in windows inside the click so Safari stops blocking them, and keep listening when one is blocked
2026-10-05 10:00:02 +00:00
Matthew Meszaros
01aae25483
Merge pull request #834 from warmbly/devin/1791174213-turnstile-trusted-device
...
feat: light, input-width Turnstile, one captcha per sign-in, and opt-in remembered devices
2026-10-05 08:37:40 +00:00
Matthew Meszaros and Devin AI
ea9b80af1f
feat: make integration OAuth popups ignore callbacks whose state does not match the state in the authorization URL they opened, so a stray /oauth-return relay cannot end a pending connect
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 06:36:22 +00:00
Matthew Meszaros
76ae0fcef2
Merge remote-tracking branch 'origin/main' into devin/1791173929-safari-oauth-popups
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
# Conflicts:
# web/src/router.tsx
2026-10-05 06:10:59 +00:00
Matthew Meszaros and Devin AI
1617ced006
fix(auth): offer remember-device only under new_device; AGENTS.md: code confirmation rides the start step's captcha
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:58:51 +00:00
Matthew Meszaros and Devin AI
8d034059f3
fix(auth): fail revocation when remembered devices can't be forgotten; resend never sends the device token
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:51:31 +00:00
Matthew Meszaros and Devin AI
3ee98f1881
feat: expire unfinished mailbox and admin-grant OAuth states after the ten-minute blocked-popup wait and fall back to reopening the sign-in window by name when navigating the reserved one throws
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:51:05 +00:00
Matthew Meszaros and Devin AI
9eb109559f
feat: send OAuth sign-in windows that lost their opener (allowed from a blocked-popup prompt) back to the waiting dashboard tab via a new /oauth-return page and same-origin BroadcastChannel, marking dashboard-started mailbox states so the native app keeps its warmbly:// callback
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:40:23 +00:00
Matthew Meszaros and Devin AI
1d06475e44
feat: add qa/flows/slack-link.flow.ts proof flow for the standalone /slack/link page and raise contrast of its expiry, account labels and footer links, hiding the decorative Slack glyph from the Continue with Slack button name
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:38:51 +00:00
Matthew Meszaros and Devin AI
55d1b9a634
feat: link Slack members to Warmbly automatically by matching email, add Continue with Slack (Sign in with Slack) for mismatched emails, and move the Slack link page to a standalone /slack/link screen
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 05:00:22 +00:00
Matthew Meszaros and Devin AI
e77e2dd98b
feat: light, input-width Turnstile on the auth screens, one captcha per sign-in instead of a second one on the code step, and an opt-in 30-day remembered device that skips the emailed login code with a random server-hashed account-bound token, revoked on password reset or change and on signing out everywhere or other sessions
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 04:32:15 +00:00
Matthew Meszaros and Devin AI
8347d4f94a
fix: open OAuth sign-in windows inside the click so Safari stops blocking them, and keep listening when one is blocked
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 04:18:49 +00:00
Matthew Meszaros and Devin AI
b54b840bd1
Merge origin/main into refactor/dashboard-tanstack-start-spa
...
Port the Pipedrive CRM work onto TanStack Router: add the
integrations/pipedrive route, move ConnectionDetail, CrmSettings and
crmMode off react-router-dom, and drop hubspotCrm.tsx (replaced by
crmMode.tsx on main).
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-04 18:17:21 +00:00
Matthew Meszaros
b828723889
feat: keep the dashboard unibox loader to a cold cache so opening a thread never reloads the list, retry a dashboard boot that failed, undo optimistic edits only where the cache still holds them, hold blocked navigations during the unsaved-changes confirm, keep shell scroll offsets apart from list offsets, share the label count query, and trim new comments
2026-10-04 10:59:19 -07:00
Matthew Meszaros
7980079f3e
feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent mailbox, campaign, CRM, label and template actions
2026-10-04 10:38:14 -07:00
Matthew Meszaros
36149cdebd
feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer
2026-10-04 19:20:48 +02:00
Matthew Meszaros
a993c0f97a
feat: keep the integration OAuth start request's failure handled when the connect window was closed before it answered
2026-10-04 07:15:08 -07:00
Matthew Meszaros
06c2bdb6e1
feat: link the Slack installer in the background so the OAuth callback never waits on Slack, and fail the integration connect popup as soon as its window is closed while the authorization URL is still loading
2026-10-04 07:10:33 -07:00
Matthew Meszaros
f23c04ddd8
Merge remote-tracking branch 'origin/main' into feature/slack-app-agent
...
# Conflicts:
# deploy/slack/manifest.json
# docs/content/docs/development/slack-app.mdx
# docs/content/docs/guides/slack.mdx
# internal/app/integration/slack.go
# internal/app/slackapp/agent.go
# internal/app/slackapp/client.go
# internal/app/slackapp/slackapp_test.go
# web/src/lib/integrations/oauthPopup.ts
2026-10-04 06:54:19 -07:00
Matthew Meszaros
4bd5c1283c
feat: refuse assistant connect links for integrations this instance has no credentials for, give a second OAuth account the first free label so it never replaces another account's connection, open the integration OAuth window inside the click so browsers do not block it, and stub the Slack test repository so link prompts run with APP_URL set
2026-10-04 05:32:44 -07:00
Matthew Meszaros
f092b71a30
feat: answer a spent confirmation budget with reauth_limited and say so in the dashboard and admin dialogs, keep an open confirmation dialog from timing out under the person, and stop the OAuth app webhook secret reveal from re-prompting after a cancel
2026-10-04 05:25:32 -07:00
Matthew Meszaros
c5ff613c5d
feat: start the invite-link clipboard write inside the click so Safari keeps the gesture, say that earlier copied links stop working, and show the new link when the copy fails
2026-10-04 05:23:16 -07:00
Matthew Meszaros
df0949a019
feat: mask invite and next URL parameters in dashboard and admin analytics, clear a copied invite link when the invitation is sent again, and read hex.info's newest stable release without consuming the gate's package list
2026-10-04 05:22:40 -07:00
Matthew Meszaros
a6e72f1a92
feat: keep linking and unlinking Warmbly Cloud and adopting the cloud workspace's mailboxes with the instance administrator, and let members with manage_emails read the link and put their own workspace's mailboxes on it
2026-10-04 05:17:20 -07:00
Matthew Meszaros
801c87ffe1
feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup
2026-10-04 05:15:07 -07:00
Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
Matthew MeszarosandDevin AI