starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-11-02 16:15:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,793 Commits 48 Branches 122 Tags
ae9eca5c7e5bdb8a1ba63d331c845dde2f1e793b
Commit Graph
285 Commits
Author SHA1 Message Date
Matthew Meszaros ae9eca5c7e feat: cut database load from issue 993 with placement, sweep and unibox indexes, redundant index drops, identical-result rewrites of contact facets, dashboard stats, campaign progress, advisor bounces and routing pre-filter, bounded delivery evidence, cold-ramp skip, held advisor sections, ANALYZE after restore and hidden-tab realtime deferral 2026-10-17 05:18:45 +02:00
Matthew Meszaros de4328b4cf feat: let Unibox forwards reach suppressed recipients by exempting forward tasks from the send-admission suppression check, refuse suppressed replies and direct sends before queueing with a recipient_suppressed 400 naming the address and matching entry, report admission refusals as RECIPIENT_SUPPRESSED with the address, show the server reason in the reply composer, and document it 2026-10-16 06:56:52 +02:00
Matthew Meszaros dbfc5b06f8 feat: keep unibox sends out of campaign, warmup and shared send caps with their own 500-recipient daily ceiling and report refused sends to the mailbox owner, skip IMAP history below the held UIDNEXT on a folder-wide MODSEQ bump, and stop treating mail received before its sender became a contact as a reply in reply processing, the repair sweep and the opt-out recheck 2026-10-14 06:38:34 +02:00
Matthew Meszaros 8b667c2d29 feat: merge main into the mobile app redesign branch, keep both the apollo and appattest handler imports, and renumber the app_attest_keys migration to 000291 now that main holds 000290 2026-10-12 10:40:02 +02:00
Matthew Meszaros 8c06efc6e4 feat: ship the iOS app to TestFlight from GitHub Actions on merges touching ios/ (ios-release workflow with cloud-managed signing, shared Warmbly scheme, ExportOptions, iPhone-only 1.0.0, privacy manifest), add in-app account deletion and a read-only billing page, let admins exempt an existing account from the emailed login code for App Review, read Apple .p8 keys as PEM or base64 through one applekey parser for Sign in with Apple and APNs, and document the release flow and Apple web sign-in setup 2026-10-12 10:38:14 +02:00
Matthew Meszaros ec46f57d22 feat: redesign the iOS app (inbox with inbox agent drafted replies edited in the full composer, Remie, home, analytics, CRM, contacts, settings hubs, mailbox connect flow covering every dashboard source) and replace Turnstile in the app with Apple App Attest (attested keys in app_attest_keys, challenge and key endpoints, verifyHuman gate on login, registration and password reset, auth config flag, docs and OpenAPI) 2026-10-11 19:00:50 +02:00
Matthew Meszaros 19d8d24fac feat: add Apollo integration (API key connect, list imports with hourly sync, contact enrichment) and two-way Clay integration (inbound row URL creating contacts, outbound event rows, automation action) with dashboard pages, brand logos, Discover ranking, org transfer registration and docs 2026-10-11 12:41:56 +02:00
Matthew MeszarosandDevin AI ba1c6e3f3e feat: bound local task dispatch across polling rounds using effective database pool capacity without stamping queued work 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-10 13:23:12 +00:00
Matthew Meszaros 74d4c1eb02 feat: enforce current workspace membership on owner-addressed realtime events and notification ingress, stored feeds, deferred email and push delivery 2026-10-10 10:54:59 +00:00
Matthew Meszaros 9081b1bce0 feat: add proof-preserving one-use admin device sessions and bounded enrollment-authenticated worker evidence with scoped Kafka partition diagnostics 2026-10-10 06:14:52 +00:00
Devin AI 24b0130c45 feat: reconcile mailbox sync recovery with merged worker Kafka retry and broker-confirmed delivery safeguards 2026-10-09 18:18:26 +00:00
Devin AI 1ca77a431b feat: integrate merged monitoring updates with ordered worker command recovery 2026-10-09 16:57:57 +00:00
Devin AI 4758216dbf feat: integrate current monitoring and member access changes with durable mailbox synchronization 2026-10-09 16:56:53 +00:00
Matthew Meszaros 5ab4b5e544 feat: drain Kafka worker commands through bounded ordered mailbox lanes and accelerate safe startup recovery while backing off duplicate filing retries 2026-10-09 16:35:26 +00:00
Matthew Meszaros 9a09740c84 feat: add permission-shaped operational monitoring snapshots with aggregate recovery evidence and read-only broker diagnostics 2026-10-09 15:12:54 +00:00
Devin AI 445e014b5e feat: recover mailbox synchronization across Gmail Outlook and IMAP with encrypted arrival replay and safe worker lifecycle 2026-10-09 14:24:10 +00:00
Matthew MeszarosandDevin AI d7a9563e3f feat: expire stale warmup failure warnings and alert persistent fleet stalls while safely retrying blocked dispatches 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-09 05:37:56 +00:00
Matthew MeszarosandDevin AI b16dadd264 feat: refresh self-hosted Cloud pool standing from validated mailbox listings and separate availability holds from reputation bans 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-08 17:19:02 +00:00
Matthew MeszarosandDevin AI e02655fd89 feat: coordinate TypeSafe billing recovery across backend and consumer, attribute token usage and reuse copy judgments during cache outages 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-08 04:28:37 +00:00
Devin AI 8a45508e79 feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates 2026-10-07 14:02:11 +00:00
Devin AI 8e53fc7027 feat: integrate warmup observation evidence canonical diagnostics send-result recovery cloud trust exact-parent lineage durable dispatch portability and legacy compatibility 2026-10-07 12:38:58 +00:00
Matthew MeszarosandDevin AI b8303060dc feat: integrate current main with a single consumer schema and relation visibility guard while preserving migration cancellation diagnostics and regression coverage 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 07:49:50 +00:00
Matthew MeszarosandDevin AI 3acfe64109 feat: preserve self-host upgrades with exact realtime CSP discovery, consumer migration readiness and backend-compatible fleet targets 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 06:53:14 +00:00
Matthew Meszaros a92e40b4d1 feat: show Cloud warmup analytics and placement alongside local history on linked self-hosted instances with scoped report APIs 2026-10-07 06:12:04 +00:00
Matthew Meszaros 1de33d9f41 feat: guard configuration tab links against losing unsaved edits, keep the login captcha mounted for resend, confirm warmup appeal decisions by mailbox, show header tabs only on section pages, show the update pill in the mobile drawer, make admin sign-in alerts opt-in per channel, check the admin bit before loading the account, and alert on admin access only when it changes 2026-10-05 03:21:44 -07:00
Matthew Meszaros e506544119 Merge origin/main into feature/admin-redesign 2026-10-05 03:01:22 -07:00
Matthew Meszaros 8910b02198 feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link 2026-10-05 03:01:22 -07:00
Matthew MeszarosandDevin AI 0ea856537e fix(security): drop jwt-go via first-party Apple auth, bump yoke-derive, grant checks:write to rust audit 
Refs WAR-10

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 18:36:28 +00:00
Matthew Meszaros 36149cdebd feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer 2026-10-04 19:20:48 +02:00
Matthew Meszaros f23c04ddd8 Merge remote-tracking branch 'origin/main' into feature/slack-app-agent 
# Conflicts:
#	deploy/slack/manifest.json
#	docs/content/docs/development/slack-app.mdx
#	docs/content/docs/guides/slack.mdx
#	internal/app/integration/slack.go
#	internal/app/slackapp/agent.go
#	internal/app/slackapp/client.go
#	internal/app/slackapp/slackapp_test.go
#	web/src/lib/integrations/oauthPopup.ts
 2026-10-04 06:54:19 -07:00
Matthew Meszaros 801c87ffe1 feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup 2026-10-04 05:15:07 -07:00
Matthew Meszaros bf47984cd5 feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations 2026-10-04 02:59:10 -07:00
Matthew Meszaros 8bb60e9449 feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers 2026-10-04 02:58:43 -07:00
Matthew Meszaros 33f99b97e5 feat: end every session on sign-out-everywhere through RevokeOtherSessions with cache eviction after commit, refuse refresh on a revoked session, close a user's realtime sockets on any session revocation via a SESSIONS_REVOKED event, and verify tokens without a purpose claim for no flow 2026-10-04 02:56:18 -07:00
Matthew Meszaros 585c7ff85a feat: end every credential a login-banned user holds by refusing their API keys, OAuth grants and Slack links at resolution, and run the Slack assistant only for members whose role includes use_ai, matching the dashboard gate 2026-10-04 02:34:01 -07:00
Matthew Meszaros 1a483cb27f Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign 
# Conflicts:
#	internal/app/integration/service.go
#	web/src/app/app/integrations/page.tsx
#	web/src/hooks/useDocumentTitle.ts
 2026-10-04 00:45:48 -07:00
Matthew Meszaros 4bc2417618 Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign 
# Conflicts:
#	docs/content/docs/api/error-codes.mdx
#	docs/content/docs/guides/integrations.mdx
#	web/src/app/app/integrations/page.tsx
 2026-10-04 00:32:54 -07:00
Matthew Meszaros 7555f641a5 feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps 2026-10-04 00:31:52 -07:00
Matthew Meszaros 6b7e254e56 feat: add native Salesforce sync with Lead and Contact matching and links, a leased activity outbox that logs sends, replies, bounces, opt-outs and meetings as Tasks, Lead Status and Email Opt Out writeback, a pull loop with CRM pause rules, list view and Campaign imports, sandbox and My Domain OAuth that refreshes expired sessions, a Salesforce settings page with contact and inbox cards in web, and docs 2026-10-04 08:54:27 +02:00
Matthew Meszaros 37e91fc89f feat: add HubSpot CRM mode where HubSpot deals, pipelines, tasks, notes and owners are mirrored and written through, sends and replies log as HubSpot emails, exit rules hold campaigns, list import, sync health, setup wizard in web, HubSpot app project with record card and workflow action, and docs 2026-10-04 07:47:51 +02:00
Matthew Meszaros 4957214431 feat: redesign the Integrations page with search, category chips, recommended and popularity-ranked integrations, add a community app directory where OAuth apps are published unverified by link and verified in a new admin review queue, with docs and OpenAPI 2026-10-03 09:24:34 -07:00
Matthew Meszaros 61d16dfe9a feat: add Warmbly for Slack with the AI assistant in DMs, mentions and the assistant pane, unified inbox threads with reply, AI draft and lead actions, per-category notification routing and DMs, account linking, dashboard Slack settings, manifest and docs 2026-10-03 15:35:11 +02:00
Claude bb580164e6 feat: compute each active campaign's send plan in a background snapshotter (internal/app/campaign) stored in campaign_send_plan_snapshots so GET /campaigns/:id/send-plan serves a stored snapshot instead of walking the planner on the request 2026-10-03 11:04:22 +00:00
Matthew Meszaros a844c506a0 feat: make Warmbly Cloud warmup start and explain itself for linked mailboxes: apply the instance's warmup settings, start warmup on adopted mailboxes, read the warmup day mask Monday-first, report the last refused warmup send and the partner cap to the instance and dashboard, hand changed SMTP credentials to the cloud, refuse cleartext mailboxes at enrollment, and show cloud warmup with the warming animation and a clear Cloud marker 2026-10-01 03:01:36 -07:00
Matthew Meszaros f41b377f0c feat: offer the Advisor's campaign hold only while a mailbox is still sending cold, reseed warmup when an AI tool switches a mailbox on or starts warmup, and fix the mailbox switch's bulk selection, double clicks and revoked-mailbox hints 2026-09-30 21:02:00 -07:00
Matthew Meszaros d64adcc191 Merge remote-tracking branch 'origin/main' into feat/cloud-domain-redirects 2026-09-30 07:18:51 -07:00
Matthew Meszaros 75f764dc67 feat: require a verified Cloud Tasks token with a pinned audience on task webhooks, manage_settings on integration OAuth and a fresh membership check at every mailbox and integration OAuth finish, user verification for passkey sign-in, ended sessions before a password reset or ban reports success, and a revoked session when a rotated refresh token is replayed; remove the internal DEK delete route, log credential path parameters by name, hold remote images in received mail until the reader loads them, add Calendly and Cal.com signing keys with inbound URL rotation, keep automation signing secrets out of connection responses, and apply the password rules to the bootstrap password 2026-09-30 06:46:24 -07:00
Matthew Meszaros 41d43f64be feat: check that a verified root redirect actually reaches visitors by opening the domain over http and https and naming what answered instead (Traefik, nginx, Caddy, a rewritten Host header, a missing certificate, a closed port) with per-proxy fix steps in the sending domain drawer, and let a self-hosted instance linked to Warmbly Cloud have Cloud serve and certify its redirects (connect in place from the redirect tab, the bulk dialog or a page banner), with Cloud-side linked-instance redirect endpoints under a per-instance limit, migration 000237, labelled tracking answers and a 503 when the redirect lookup is unavailable, and the sending domains, Warmbly Cloud, data control, install, OpenAPI, API and error code docs updated 2026-09-30 06:04:00 -07:00
Matthew Meszaros e76cdc6f3a Merge remote-tracking branch 'origin/main' into fix/recent-posthog-errors-2 2026-09-29 20:13:29 +02:00
Matthew Meszaros ca66b25d8d feat: register the release's bus schemas from the booting backend and hold the fleet on its current release until the backend runs the new one and the schema registry accepts them, check every published schema against a recorded snapshot in CI (make schemas) so a change the registry would refuse fails before merge, pin a FORWARD or FULL registry subject to BACKWARD on refusal, bound advisor narration so the run still lands, store unlabelled 8-bit mail with its invalid UTF-8 replaced, treat a pending or credential-less passkey ceremony as a cancellation, and drop link-scanner rejections from site error tracking 2026-09-29 19:20:07 +02:00