Matthew Meszaros
6049d91698
feat: integrate refreshed main documentation and dependency security updates while preserving bounded Kafka codec fixes in administrator operations
2026-10-10 06:57:13 +00:00
Matthew Meszaros
7bb0ff289d
feat: integrate exact cross-assignment mailbox UUID navigation with native administrator device consent schemas and focused identity lookup regressions
2026-10-10 06:41:21 +00:00
Matthew Meszaros
a4b42d8ea1
Merge pull request #911 from warmbly/devin/1791603700-main-security
...
feat: resolve actionable security findings in parsing, Kafka events and dependency trees
2026-10-10 06:22:28 +00:00
Matthew Meszaros
9081b1bce0
feat: add proof-preserving one-use admin device sessions and bounded enrollment-authenticated worker evidence with scoped Kafka partition diagnostics
2026-10-10 06:14:52 +00:00
Matthew Meszaros and Devin AI
44bb752482
feat: keep campaign mailboxes sending around durable recovery holds and reconcile uncertain outcomes
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-10 04:20:12 +00:00
Matthew Meszaros
7cddfc869b
feat: patch security dependencies and bound Kafka Avro decoding while rejecting realtime response header injection
2026-10-10 03:54:07 +00:00
Matthew Meszaros
1c325b7a87
Merge pull request #903 from warmbly/devin/1791559441-admin-monitoring-final
...
feat: show evidence-based admin monitoring and truthful mailbox refresh states
2026-10-09 16:38:53 +00:00
Matthew Meszaros
9a09740c84
feat: add permission-shaped operational monitoring snapshots with aggregate recovery evidence and read-only broker diagnostics
2026-10-09 15:12:54 +00:00
Matthew Meszaros
bb4156cc6a
feat: add resource-scoped member access that restricts a member to selected campaign folders, campaigns and mailboxes read-only, enforced in the API route gate, SQL filters, permission trigger, realtime channels and dashboard
2026-10-09 13:34:05 +02:00
Devin AI
6af3ba910c
feat: preserve cookieless first-touch signup attribution through marketing and app redirects and expose admin referrer hosts
2026-10-09 07:19:23 +00:00
Matthew Meszaros and Devin AI
d7a9563e3f
feat: expire stale warmup failure warnings and alert persistent fleet stalls while safely retrying blocked dispatches
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-09 05:37:56 +00:00
Matthew Meszaros
676445a6ee
Merge pull request #888 from warmbly/devin/1791517488-campaign-mailbox-admission
...
feat: enforce per-mailbox campaign caps and configurable variable sending defaults
2026-10-09 04:56:33 +00:00
Matthew Meszaros
b95655c358
Merge remote-tracking branch 'origin/main' into fix888
2026-10-09 06:40:54 +02:00
Matthew Meszaros
1386dac607
Merge pull request #892 from warmbly/feature/campaign-positive-reply-analytics
...
feat: positive replies, positive reply rate and interested leads in campaign analytics
2026-10-09 04:28:22 +00:00
Matthew Meszaros
1ce4a75545
Merge pull request #890 from warmbly/feature/unibox-forwarded-email-threading
...
feat: show forwarded emails inside the original Unibox thread
2026-10-09 04:27:52 +00:00
Matthew Meszaros
b9cc87db1a
feat: enable configurable 28–32 daily mailbox sending plans with admission rechecks, clear limit controls and consistent UTC placement budgets
2026-10-09 04:18:52 +00:00
Matthew Meszaros
fd1c333402
feat: add positive replies, positive reply rate, interested leads and a reply-class breakdown to campaign analytics (summary, per-step, daily series, AI tool, OpenAPI, Zapier/Make samples), show them on the campaign overview with a reply quality card, positive chart series and step column, mirror them in the iOS models, document them, and seed classified replies plus a proof flow
2026-10-09 06:08:28 +02:00
Matthew Meszaros
6d88588350
feat: filter the Analytics dashboard by campaigns and campaign folders (campaign_ids/folder_ids on GET /analytics/dashboard, resolved server-side to one deduplicated org-scoped set), with a picker on web, a filter sheet on iOS, CLI flags, an AI tool argument, and API, OpenAPI and guide docs
2026-10-09 06:04:31 +02:00
Matthew Meszaros
11b56b7031
feat: file Unibox forwards into the conversation they were forwarded from via email_tasks.forward_thread_id and unibox_emails.filed_forward, sent with no provider thread or In-Reply-To and skipped by reply threading
2026-10-09 06:03:21 +02:00
Matthew Meszaros and Devin AI
691280cdef
feat: give premium warmup senders all qualified recipients and balance host coverage without paid-receiver bias
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 11:31:05 +00:00
Matthew Meszaros
706beca2f7
feat: integrate workspace-scoped Cloud ownership with durable consent restrictive standing and send safety while preserving legacy enrollments and renumbering unreleased upgrade migrations
2026-10-07 16:32:30 +00:00
Devin AI
d090b8e021
feat: complete native and Cloud diagnostic consent immutable shared provider attempt accounting authorized bounded IMAP timing retries conservative feedback pacing and released-schema correction fixtures
2026-10-07 15:12:45 +00:00
Devin AI
8a45508e79
feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates
2026-10-07 14:02:11 +00:00
Matthew Meszaros and Devin AI
2926f888c2
feat: allow unlimited self-hosted workspaces and bind Cloud billing access to individual workspace links while preserving legacy enrollments
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 13:49:42 +00:00
Devin AI
8e53fc7027
feat: integrate warmup observation evidence canonical diagnostics send-result recovery cloud trust exact-parent lineage durable dispatch portability and legacy compatibility
2026-10-07 12:38:58 +00:00
Matthew Meszaros
bbd0d9f785
Merge pull request #863 from warmbly/devin/1791356256-posthog-root-causes
...
feat: fix PostHog root causes in API validation, Gmail recovery and frontend asset delivery
2026-10-07 07:35:04 +00:00
Matthew Meszaros and Devin AI
dfed1e1593
feat: validate API UUIDs, recover expired Gmail history and guard consumer startup and stale frontend assets
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 07:19:15 +00:00
Matthew Meszaros
a92e40b4d1
feat: show Cloud warmup analytics and placement alongside local history on linked self-hosted instances with scoped report APIs
2026-10-07 06:12:04 +00:00
Matthew Meszaros
e6b0b4dbd3
Merge pull request #854 from warmbly/feat/flow-builder-redesign
...
feat: rebuild the automation and campaign step builders as a self-laying, animated design-tool canvas with + insertion, branch columns, a step picker and side-panel editing
2026-10-06 13:04:46 +00:00
Matthew Meszaros
705651e01a
Merge remote-tracking branch 'origin/main' into feat/flow-builder-redesign
...
# Conflicts:
# web/src/app/app/campaigns/[id]/steps/page.tsx
2026-10-06 05:24:33 -07:00
Matthew Meszaros and Devin AI
5fe22b3b6a
feat: preserve warmup identity across mailbox reconnects and retry provider filing with pre-disconnect cleanup
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 12:03:17 +00:00
Matthew Meszaros and Devin AI
f52ef240b4
feat: add audited repeat-safe sample data provisioning for active dedicated Test workspaces in Admin Testers
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 09:23:31 +00:00
Matthew Meszaros
8d8135c30c
feat: document the self-laying campaign and automation canvases in the sequences, campaigns, collaboration and realtime guides, correct the step position and empty-branch model comments, and add a campaign steps proof flow
2026-10-05 22:13:44 -07:00
Matthew Meszaros and Devin AI
9d0f43780b
feat: provision onboarding-complete reviewer workspaces with expiring Test access, bounded credits and Test header labels
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 16:15:56 +00:00
Matthew Meszaros
fc18d8c186
Merge pull request #842 from warmbly/devin/1791201936-google-oauth-frontend-flag
...
feat: configure Google mailbox OAuth and trusted multi-dashboard returns
2026-10-05 13:31:17 +00:00
Matthew Meszaros and Devin AI
f58a6c1ff9
feat: control Gmail mailbox OAuth per frontend deployment and bind callbacks to allowlisted dashboard origins
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 12:16:34 +00:00
Matthew Meszaros and Devin AI
5ae09e0e15
feat: separate fleet mailbox targets from measured CPU and RAM, report node public egress IPv4 and add workload share analytics
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 11:24:32 +00:00
Matthew Meszaros and Devin AI
e77e2dd98b
feat: light, input-width Turnstile on the auth screens, one captcha per sign-in instead of a second one on the code step, and an opt-in 30-day remembered device that skips the emailed login code with a random server-hashed account-bound token, revoked on password reset or change and on signing out everywhere or other sessions
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 04:32:15 +00:00
Matthew Meszaros
36149cdebd
feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer
2026-10-04 19:20:48 +02:00
Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
bf47984cd5
feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations
2026-10-04 02:59:10 -07:00
Matthew Meszaros
8bb60e9449
feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers
2026-10-04 02:58:43 -07:00
Matthew Meszaros
5bd8dbfab9
feat: bind Warmbly Cloud brokered mailbox sign-ins to PKCE, a single-use state and a cloud consent page naming the requesting instance and workspace that sets the browser cookie the callback requires, return only to the instance's registered address, add PKCE and an OIDC nonce to Workspace and Microsoft 365 admin-proof sign-ins, post OAuth callback codes only to a configured dashboard origin, cap CLI-approved keys to the approver's role behind a fresh sign-in, and accept only same-origin login next paths
2026-10-04 02:53:16 -07:00
Matthew Meszaros
9f7d45a1fb
feat: charge every password, emailed-code and TOTP attempt atomically before comparing it (Redis INCR+expire script) with a per-account TOTP budget across challenges, put the signed-in password change on the reauth budget, set the per-account login limit to 50 per hour, give tester passwords an expiry (users.password_expires_at, migration 000257) and clear them plus every session on revoke, mint warmblyctl reset links with the password-reset purpose, expire fleet join tokens (7 days default, 30 max, reusable inside the window), derive captcha from the resolved Turnstile secret, refuse weak bootstrap argon2id hashes, make registration codes single-use, rate-limit the v1 invitation lookup, and draw RIDs and user codes without modulo bias
2026-10-04 02:52:22 -07:00
Matthew Meszaros
f0ec39febd
feat: scope automation and sequence unsubscribes to the caller's organization, require manage_settings to create, edit, enable or delete automations, run each integration action only on its own provider's connection (400 action_provider_mismatch), refuse org-permission gates when no organization service is wired, read /integrations/bookings like contacts, scope lead claims, research runs and CRM list cursors to the organization, and bind contact note edits to the contact in the path
2026-10-04 02:47:10 -07:00
Matthew Meszaros
e1c4a91ad1
feat: confirm a Slack link only for the Warmbly member whose email matches the Slack account's confirmed profile email (read via users.info with the new users:read and users:read.email scopes, refused as slack_link_email_mismatch), show the Slack account's name and avatar on the link page and after linking, return the Slack connection in GET /integrations/slack/status only to manage_settings or use_integrations, scope agent-thread lookups by organization, and check a Draft a reply card's conversation belongs to the clicker's workspace before starting the assistant
2026-10-04 02:45:04 -07:00
Matthew Meszaros
d505508997
feat: audit OAuth app moderation and developer blocks under their own entity types, refuse logo removal on suspended apps, delete a replaced workspace-uploaded app logo once no other app shows it, confirm before revoking every token in the admin panel, open store cards on Space, retry a new logo URL after a failed one, toast only after the clipboard write succeeds, and freeze the listing form baseline while it is open
2026-10-04 01:20:28 -07:00
Matthew Meszaros
1a483cb27f
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# internal/app/integration/service.go
# web/src/app/app/integrations/page.tsx
# web/src/hooks/useDocumentTitle.ts
2026-10-04 00:45:48 -07:00
Matthew Meszaros
4bc2417618
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# docs/content/docs/api/error-codes.mdx
# docs/content/docs/guides/integrations.mdx
# web/src/app/app/integrations/page.tsx
2026-10-04 00:32:54 -07:00
Matthew Meszaros
7555f641a5
feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps
2026-10-04 00:31:52 -07:00
Matthew Meszaros
Matthew Meszaros
